Crossmint projects auth-provider

View and configure the auth provider of a project

The projects auth-provider commands show and change the auth provider of the currently selected project: which provider issues the JWTs that identify your users, also known as JWT authentication or bring your own auth. They do the same as the JWT Authentication section of the Developer Console.

crossmint projects auth-provider get
crossmint projects auth-provider set

View the Current Configuration

crossmint projects auth-provider get

🔐 Auth provider (JWT authentication):
Provider: auth0
Provider ID: your-tenant.us.auth0.com
JWKS URI: https://your-tenant.us.auth0.com/.well-known/jwks.json
Issuer: https://your-tenant.us.auth0.com/
User ID claim: sub
Audience: (not checked)
Keys requiring JWT auth: none

Change the Configuration

Run crossmint projects auth-provider set and the CLI asks for the provider and what it needs. Pass --provider and its flags to run it without prompts, for example in a script:

# Crossmint Auth, the default; also how to undo a change
crossmint projects auth-provider set --provider crossmint

# A third-party provider
crossmint projects auth-provider set --provider auth0 --provider-id your-tenant.us.auth0.com

# Your own JWKS endpoint
crossmint projects auth-provider set --provider custom --jwks-uri https://auth.example.com/.well-known/jwks.json --issuer https://auth.example.com

Flag	Description
--provider <provider>	crossmint, auth0, stytch, firebase, supabase, kinde or custom
--provider-id <id>	Third-party providers: Auth0 domain, Stytch project ID, Firebase project ID, Supabase project reference or Kinde subdomain
--jwks-uri <url>	custom: the https URL of your JWKS endpoint
--issuer <iss>	custom: the expected iss claim. Left out, any issuer is accepted
--user-id-claim <claim>	The claim that holds the user ID. Defaults to sub
--audience <aud>	The aud claim tokens must carry. Kept while the issuer stays, removed when you switch provider or issuer; "" removes it
-y, --yes	Change it even when client keys require JWT auth. Without a terminal, the command fails instead of asking

If client keys of the project require JWT auth, they only accept JWTs from the new provider once you change it, so your users’ requests may start failing. The CLI lists those keys and asks you to confirm.