Create service JWT provider
This endpoint is in beta. API contract is stable, and no breaking changes are expected in the future.
Adds a JWT authentication provider to the service. Users can then connect to the service with a JWT issued by the provider; they are signed in as the default user and receive the roles listed in the roles claim. The JWKS URL is fetched and validated before the provider is saved. If the service already has a provider with this name and the same configuration, the request succeeds without changing it, so it is safe to retry.
Errors:
- 400: invalid field values, the JWKS URL is unreachable or does not return a valid RS256 key set, or the service already has 5 providers.
- 401: missing, invalid, or disabled API key.
- 403: caller lacks
control-plane:service:manageon the service, or the organization does not have the JWT authentication providers feature (Enterprise tier). - 404: service does not exist or is not visible to the caller.
- 409: the service already has a provider with this name and a different configuration.
Adds a JWT authentication provider to the service. Users can then connect to the service with a JWT issued by the provider; they are signed in as the
default user and receive the roles listed in the roles claim. The JWKS URL is fetched and validated before the provider is saved. If the service already has a provider with this name and the same configuration, the request succeeds without changing it, so it is safe to retry.
Errors:
- 400: invalid field values, the JWKS URL is unreachable or does not return a valid RS256 key set, or the service already has 5 providers.
- 401: missing, invalid, or disabled API key.
- 403: caller lacks
control-plane:service:manageon the service, or the organization does not have the JWT authentication providers feature (Enterprise tier). - 404: service does not exist or is not visible to the caller.
- 409: the service already has a provider with this name and a different configuration.
Permission
control-plane:service:manage permission.Authorizations
Use key ID and key secret obtained in ClickHouse Cloud console: https://clickhouse.com/docs/cloud/manage/openapi
Path Parameters
ID of the organization that owns the service.
ID of the service.
Body
Name of the JWT provider, unique within the service. Lowercase letters, digits and hyphens, at most 59 characters. Cannot be one of, or start with one of followed by a hyphen: cloud, clickhouse, ch, internal, system, default.
59^[a-z0-9-]{1,59}$"my-oidc-provider"
Expected iss claim of the tokens. Printable ASCII without whitespace, at most 256 characters.
256"https://auth.example.com"
Expected aud claim of the tokens. Printable ASCII without whitespace, at most 256 characters.
256"my-clickhouse-service"
Public https:// URL of the JSON Web Key Set used to verify token signatures, at most 256 characters. The key set must contain at least one RS256 (RSA) key; it is fetched and validated when the provider is created or updated.
256"https://auth.example.com/.well-known/jwks.json"
Name of the token claim that lists the ClickHouse roles to grant the user. Printable ASCII without whitespace, at most 256 characters, and not a registered JWT claim (iss, sub, aud, exp, nbf, iat, jti). Omit to configure no roles claim.
"clickhouse:roles"