Skip to main content
POST
Create service JWT provider
Beta This endpoint is in beta. API contract is stable, and no breaking changes are expected in the future.

Adds a JWT authentication provider to the service. Users can then connect to the service with a JWT issued by the provider; they are signed in as the default user and receive the roles listed in the roles claim. The JWKS URL is fetched and validated before the provider is saved. If the service already has a provider with this name and the same configuration, the request succeeds without changing it, so it is safe to retry.
Errors:
  • 400: invalid field values, the JWKS URL is unreachable or does not return a valid RS256 key set, or the service already has 5 providers.
  • 401: missing, invalid, or disabled API key.
  • 403: caller lacks control-plane:service:manage on the service, or the organization does not have the JWT authentication providers feature (Enterprise tier).
  • 404: service does not exist or is not visible to the caller.
  • 409: the service already has a provider with this name and a different configuration.

Permission

The API key must have the control-plane:service:manage permission.

Authorizations

Authorization
string
header
required

Use key ID and key secret obtained in ClickHouse Cloud console: https://clickhouse.com/docs/cloud/manage/openapi

Path Parameters

organizationId
string<uuid>
required

ID of the organization that owns the service.

serviceId
string<uuid>
required

ID of the service.

Body

application/json
name
string
required

Name of the JWT provider, unique within the service. Lowercase letters, digits and hyphens, at most 59 characters. Cannot be one of, or start with one of followed by a hyphen: cloud, clickhouse, ch, internal, system, default.

Maximum string length: 59
Pattern: ^[a-z0-9-]{1,59}$
Example:

"my-oidc-provider"

issuer
string
required

Expected iss claim of the tokens. Printable ASCII without whitespace, at most 256 characters.

Maximum string length: 256
Example:

"https://auth.example.com"

audience
string
required

Expected aud claim of the tokens. Printable ASCII without whitespace, at most 256 characters.

Maximum string length: 256
Example:

"my-clickhouse-service"

jwksUrl
string
required

Public https:// URL of the JSON Web Key Set used to verify token signatures, at most 256 characters. The key set must contain at least one RS256 (RSA) key; it is fetched and validated when the provider is created or updated.

Maximum string length: 256
Example:

"https://auth.example.com/.well-known/jwks.json"

rolesClaim
string

Name of the token claim that lists the ClickHouse roles to grant the user. Printable ASCII without whitespace, at most 256 characters, and not a registered JWT claim (iss, sub, aud, exp, nbf, iat, jti). Omit to configure no roles claim.

Example:

"clickhouse:roles"

Response

Successful response

status
number

HTTP status code.

Example:

200

requestId
string<uuid>

Unique id assigned to every request. UUIDv4

result
object