Register your own token issuer
Registers the token issuer your own system mints identity tokens with, switching your organization to external auth. Endstate verifies those tokens against the JWKS URL and audience you provide. Send all three fields; they replace any previously registered issuer.
Authorizations
Use Authorization: Bearer end_sk_* for partner API keys (e.g. end_sk_AbCd_example_api_key).
Body
The iss your identity tokens carry. Matched exactly, so it must be stable across key rotation.
1 - 2048"https://auth.brand.example"
A public, cacheable JWKS URL Endstate fetches to verify your tokens. HTTPS only.
2048"https://auth.brand.example/.well-known/jwks.json"
The aud your identity tokens carry. Use a value dedicated to Endstate so your other tokens cannot be presented here.
1 - 2048"https://wallet.brand.example"
Response
The registered configuration.
external when your own token issuer is registered; endstate when identity is managed by Endstate.
endstate, external "external"
The registered token issuer (iss), or null when unset.
"https://auth.brand.example"
The registered JWKS URL, or null when unset.
"https://auth.brand.example/.well-known/jwks.json"
The audience (aud) your identity tokens carry, or null when unset.
"https://wallet.brand.example"

