Create a client credential

Create a client credential associated to your application. Credentials can be used to configure Private Key JWT and mTLS authentication methods, as well as for JWT-secured Authorization requests.

Public Key

Public Key credentials can be used to set up Private Key JWT client authentication and JWT-secured Authorization requests.

Sample:

{
  "credential_type": "public_key",
  "name": "string",
  "pem": "string",
  "alg": "RS256",
  "parse_expiry_from_cert": false,
  "expires_at": "2022-12-31T23:59:59Z"
}

Certificate (CA-signed & self-signed)

Certificate credentials can be used to set up mTLS client authentication. CA-signed certificates can be configured either with a signed certificate or with just the certificate Subject DN.

CA-signed Certificate Sample (pem):

{
  "credential_type": "x509_cert",
  "name": "string",
  "pem": "string"
}

CA-signed Certificate Sample (subject_dn):

{
  "credential_type": "cert_subject_dn",
  "name": "string",
  "subject_dn": "string"
}

Self-signed Certificate Sample:

{
  "credential_type": "cert_subject_dn",
  "name": "string",
  "pem": "string"
}

The credential will be created but not yet enabled for use until you set the corresponding properties in the client:

• To enable the credential for Private Key JWT or mTLS authentication methods, set the client_authentication_methods property on the client. For more information, read Configure Private Key JWT Authentication and Configure mTLS Authentication
• To enable the credential for JWT-secured Authorization requests, set the signed_request_objectproperty on the client. For more information, read Configure JWT-secured Authorization Requests (JAR)

POST https://{tenantDomain}/api/v2/clients/{client_id}/credentials

Go

Go

package example

import (
    context "context"

    management "github.com/auth0/go-auth0/management/management"
    client "github.com/auth0/go-auth0/management/management/client"
    clients "github.com/auth0/go-auth0/management/management/clients"
    option "github.com/auth0/go-auth0/management/management/option"
)

func do() {
    client := client.NewClient(
        option.WithToken(
            "<token>",
        ),
    )
    request := &clients.PostClientCredentialRequestContent{
        CredentialType: management.ClientCredentialTypeEnumPublicKey,
    }
    client.Clients.Credentials.Create(
        context.TODO(),
        "client_id",
        request,
    )
}

201

{
  "id": "cred_1m7sfABoNTTKYwTQ8qt6tX",
  "name": "",
  "kid": "IZSSTECp...",
  "alg": "RS256",
  "subject_dn": "<string>",
  "thumbprint_sha256": "<string>",
  "created_at": "2023-11-07T05:31:56Z",
  "updated_at": "2023-11-07T05:31:56Z",
  "expires_at": "2023-11-07T05:31:56Z"
}

Authorizations

bearerAuthoAuth2ClientCredentials

Authorization · string · header · required

Bearer authentication header of the form Bearer <token>, where <token> is your auth token.

Path Parameters

client_id · string · required

ID of the client.

Body

application/jsonapplication/x-www-form-urlencoded

credential_type · enum<string> · required

The type of credential.

Available options: public_key, cert_subject_dn, x509_cert

name · string · default: ""

Friendly name for a credential.

Maximum string length: 128

subject_dn · string

Subject Distinguished Name. Mutually exclusive with pem property. Applies to cert_subject_dn credential type.

Required string length: 1 - 256

pem · string · default: -----BEGIN PUBLIC KEY----- MIIBIjANBg... -----END PUBLIC KEY-----

PEM-formatted public key (SPKI and PKCS1) or X509 certificate. Must be JSON escaped.

alg · enum<string> · default: RS256

Algorithm which will be used with the credential. Can be one of RS256, RS384, PS256. If not specified, RS256 will be used. Applies to public_key credential type.

Available options: RS256, RS384, PS256

parse_expiry_from_cert · boolean · default: false

Parse expiry from x509 certificate. If true, attempts to parse the expiry date from the provided PEM. Applies to public_key credential type.

expires_at · string<date-time> · default: 2023-02-07T12:40:17.807Z

The ISO 8601 formatted date representing the expiration of the credential. If not specified (not recommended), the credential never expires. Applies to public_key credential type.

kid · string

Optional kid (Key ID), used to uniquely identify the credential. If not specified, a kid value will be auto-generated. The kid header parameter in JWTs sent by your client should match this value. Valid format is [0-9a-zA-Z-_]{10,64}

Required string length: 10 - 64

Pattern: ^([0-9a-zA-Z-_]{10,64})$

Response

201

application/json

Credential successfully created.

id · string · default: cred_1m7sfABoNTTKYwTQ8qt6tX

ID of the credential. Generated on creation.

name · string · default: ""

The name given to the credential by the user.

kid · string · default: IZSSTECp...

The key identifier of the credential, generated on creation.

alg · enum<string> · default: RS256

Algorithm which will be used with the credential. Supported algorithms: RS256,RS384,PS256

Available options: RS256, RS384, PS256

credential_type · enum<string>

The type of credential.

Available options: public_key, cert_subject_dn, x509_cert

subject_dn · string

The X509 certificate's Subject Distinguished Name

thumbprint_sha256 · string

The X509 certificate's SHA256 thumbprint

created_at · string<date-time>

The ISO 8601 formatted date the credential was created.

updated_at · string<date-time>

The ISO 8601 formatted date the credential was updated.

expires_at · string<date-time>

The ISO 8601 formatted date representing the expiration of the credential.