> ## Documentation Index
> Fetch the complete documentation index at: https://docs.crossmint.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Crossmint projects auth-provider

> View and configure the auth provider of a project

The projects auth-provider commands show and change the auth provider of the currently selected project: which provider issues the JWTs that identify your users, also known as [JWT authentication](/introduction/platform/api-keys/jwt-authentication) or bring your own auth. They do the same as the JWT Authentication section of the Developer Console.

```bash theme={null}
crossmint projects auth-provider get
crossmint projects auth-provider set
```

## View the Current Configuration

```bash theme={null}
crossmint projects auth-provider get
```

```text theme={null}
🔐 Auth provider (JWT authentication):
Provider: auth0
Provider ID: your-tenant.us.auth0.com
JWKS URI: https://your-tenant.us.auth0.com/.well-known/jwks.json
Issuer: https://your-tenant.us.auth0.com/
User ID claim: sub
Audience: (not checked)
Keys requiring JWT auth: none
```

## Change the Configuration

Run `crossmint projects auth-provider set` and the CLI asks for the provider and what it needs. Pass `--provider` and its flags to run it without prompts, for example in a script:

```bash theme={null}
# Crossmint Auth, the default; also how to undo a change
crossmint projects auth-provider set --provider crossmint

# A third-party provider
crossmint projects auth-provider set --provider auth0 --provider-id your-tenant.us.auth0.com

# Your own JWKS endpoint
crossmint projects auth-provider set --provider custom --jwks-uri https://auth.example.com/.well-known/jwks.json --issuer https://auth.example.com
```

| Flag | Description |
| - | - |
| `--provider <provider>` | `crossmint`, `auth0`, `stytch`, `firebase`, `supabase`, `kinde` or `custom` |
| `--provider-id <id>` | Third-party providers: Auth0 domain, Stytch project ID, Firebase project ID, Supabase project reference or Kinde subdomain |
| `--jwks-uri <url>` | `custom`: the `https` URL of your JWKS endpoint |
| `--issuer <iss>` | `custom`: the expected `iss` claim. Left out, any issuer is accepted |
| `--user-id-claim <claim>` | The claim that holds the user ID. Defaults to `sub` |
| `--audience <aud>` | The `aud` claim tokens must carry. Kept while the issuer stays, removed when you switch provider or issuer; `""` removes it |
| `-y, --yes` | Change it even when client keys require JWT auth. Without a terminal, the command fails instead of asking |

<Warning>
  If client keys of the project [require JWT auth](/cli/keys/create), they only accept JWTs from the new provider once
  you change it, so your users' requests may start failing. The CLI lists those keys and asks you to confirm.
</Warning>