---
title: "Add JWKS URL"
method: POST
path: "/projects/{project_id}/jwks"
tags: ["Project"]
---

# Add JWKS URL

`POST /projects/{project_id}/jwks`

Adds a JWKS URL to the specified project for verifying JWTs used as the authentication mechanism.

The URL must be a valid HTTPS URL that returns a JSON Web Key Set.

The `provider_name` field allows you to specify which authentication provider you're using (e.g., Clerk, Auth0, AWS Cognito).

The `branch_id` scopes the JWKS URL to specific branches; if not specified, it applies to all branches.

The `role_names` scopes the URL to specific roles; if not specified, default roles are used (`authenticator`, `authenticated`, `anonymous`).

The `jwt_audience` specifies which `aud` values are accepted in JWTs.

## Request body

- AddProjectJWKSRequest — Add a new JWKS to a specific endpoint of a project
  - `jwks_url` string, required — The URL that lists the JWKS
  - `provider_name` string, required — The name of the authentication provider (e.g., Clerk, Stytch, Auth0)
  - `branch_id` string — Branch ID
  - `jwt_audience` string — The name of the required JWT Audience to be used
  - `role_names` string[] — DEPRECATED. This field should only be used when using Neon RLS. The roles the JWKS should be mapped to. By default, the JWKS is mapped to the `authenticator`, `authenticated` and `anonymous` roles.
  - `skip_role_creation` boolean — DEPRECATED. This field should only be used when using Neon RLS. If true, the role creation will be skipped.

## Response `201`

The JWKS URL was added to the project's authentication connections

- JWKSCreationOperation
  - `jwks` JWKS, required
    - `id` string, required — JWKS ID
    - `project_id` string, required — Project ID
    - `branch_id` string — Branch ID
    - `jwks_url` string, required — The URL that lists the JWKS
    - `provider_name` string, required — The name of the authentication provider (e.g., Clerk, Stytch, Auth0)
    - `created_at` string, date-time, required — The date and time when the JWKS was created
    - `updated_at` string, date-time, required — The date and time when the JWKS was last modified
    - `jwt_audience` string — The name of the required JWT Audience to be used
    - `role_names` string[]
  - `operations` Operation[], required
    - `id` string, uuid, required — The operation ID
    - `project_id` string, required — The Neon project ID
    - `branch_id` string — The branch ID
    - `endpoint_id` string — The endpoint ID
    - `action` 'create_compute' | 'create_timeline' | 'start_compute' | 'suspend_compute' | 'apply_config' | 'check_availability' | 'delete_timeline' | 'create_branch' | 'import_data' | 'tenant_ignore' | 'tenant_attach' | 'tenant_detach' | 'tenant_detach_safekeepers' | 'tenant_attach_safekeepers' | 'tenant_reattach' | 'replace_safekeeper' | 'disable_maintenance' | 'apply_storage_config' | 'prepare_secondary_pageserver' | 'switch_pageserver' | 'detach_parent_branch' | 'timeline_archive' | 'timeline_unarchive' | 'start_reserved_compute' | 'sync_dbs_and_roles_from_compute' | 'apply_schema_from_branch' | 'timeline_mark_invisible' | 'timeline_update_protected_config' | 'prewarm_replica' | 'promote_replica' | 'set_storage_non_dirty' | 'swap_binding_id' | 'finalize_migration' | 'mark_migration_prepared' | 'update_catalog' | 'epc_sync', required — The action performed by the operation
    - `status` 'scheduling' | 'running' | 'finished' | 'failed' | 'error' | 'cancelling' | 'cancelled' | 'skipped', required — The status of the operation
    - `error` string — The error that occurred
    - `failures_count` integer, required — The number of times the operation failed
    - `retry_at` string, date-time — A timestamp indicating when the operation was last retried
    - `created_at` string, date-time, required — A timestamp indicating when the operation was created
    - `updated_at` string, date-time, required — A timestamp indicating when the operation status was last updated
    - `total_duration_ms` integer, required — The total duration of the operation in milliseconds

## Other responses

- `default` — General Error. The request may or may not be safe to retry, depending on the HTTP method, response status code, and whether a response was received. - If no response is returned from the API, a network error or timeout likely occurred. - In some cases, the request may have reached the server and been successfully processed, but the response failed to reach the client. As a result, retrying non-idempotent requests can lead to unintended results. The following HTTP methods are considered non-idempotent: `POST`, `PATCH`, `DELETE`, and `PUT`. Retrying these methods is generally **not safe**. The following methods are considered idempotent: `GET`, `HEAD`, and `OPTIONS`. Retrying these methods is **safe** in the event of a network error or timeout. Any request that returns a `503 Service Unavailable` response is always safe to retry. Any request that returns a `423 Locked` response is safe to retry. `423 Locked` indicates that the resource is temporarily locked, for example, due to another operation in progress.

---

[API](https://skmtc.net/neon/apis/neon-api.md) · [All operations](https://skmtc.net/neon/apis/neon-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/neon/neon-api/revisions/cfde79a5c713/schema)