> ## Documentation Index
> Fetch the complete documentation index at: https://docs.endstate.io/llms.txt
> Use this file to discover all available pages before exploring further.

# endstate.settings.auth.update

> Register your own token issuer, switching to external auth.

```ts theme={null}
    update(body: UpdateAuthSettingsRequest, options?: RequestOptions): Promise<AuthSettingsResponse>
```

|             |                                                                                   |
| ----------- | --------------------------------------------------------------------------------- |
| Endpoint    | [`PUT /v1/settings/auth`](/api-reference/settings/register-your-own-token-issuer) |
| Credential  | Secret key (`end_sk_...`)                                                         |
| Retry class | `write`                                                                           |

Never repeated. The API accepts no idempotency key here, so a second send is a second write. Only `429 rate_limit.exceeded` is retried.

## Example

```ts theme={null}
const result = await endstate.settings.auth.update({
  issuer: "https://auth.brand.example",
  jwks_url: "https://auth.brand.example/.well-known/jwks.json",
  audience: "https://wallet.brand.example",
});
```

## Parameters

<ParamField body="issuer" type="string" required>
  The `iss` your identity tokens carry. Matched exactly, so it must be stable across key rotation.
</ParamField>

<ParamField body="jwks_url" type="string" required>
  A public, cacheable JWKS URL Endstate fetches to verify your tokens. HTTPS only.
</ParamField>

<ParamField body="audience" type="string" required>
  The `aud` your identity tokens carry. Use a value dedicated to Endstate so your other tokens cannot be presented here.
</ParamField>

## Returns

`200` - `AuthSettingsResponse`.

<ResponseField name="auth_type" type="'endstate' | 'external'" required>
  `external` when your own token issuer is registered; `endstate` when identity is managed by Endstate.
</ResponseField>

<ResponseField name="issuer" type="string | null" required>
  The registered token issuer (`iss`), or null when unset.
</ResponseField>

<ResponseField name="jwks_url" type="string | null" required>
  The registered JWKS URL, or null when unset.
</ResponseField>

<ResponseField name="audience" type="string | null" required>
  The audience (`aud`) your identity tokens carry, or null when unset.
</ResponseField>

## Errors

Branch on `error.code`, never on the HTTP status - several codes share one.

| Code                | HTTP | Retry         |
| ------------------- | ---- | ------------- |
| `auth.unauthorized` | 401  | Do not retry  |
| `internal.error`    | 500  | Safe to retry |
| `validation.failed` | 400  | Do not retry  |

See [Errors and retries](/sdks/core/errors-and-retries) for the error types and how to narrow them.