---
title: Managing token processors
description: The PingFederate Security Token Service (STS) uses token processors to validate incoming tokens and token requests.
component: pingfederate
version: 13.0
page_id: pingfederate:administrators_reference_guide:pf_managing_token_processors
canonical_url: https://docs.pingidentity.com/pingfederate/13.0/administrators_reference_guide/pf_managing_token_processors.html
revdate: May 6, 2026
page_aliases: ["help_tokenprocessortasklet_tokenpluginmgmtstate.adoc"]
section_ids:
  about-this-task: About this task
  steps: Steps
---

# Managing token processors

The PingFederate Security Token Service (STS) *(tooltip: \<div class="paragraph">
\<p>An entity responsible for responding to WS-Trust requests for validation and issuance of security tokens used for SSO authentication to web services.\</p>
\</div>)* uses token processors to validate incoming tokens and token requests.

## About this task

You must configure at least one processor in order to set up an STS connection or a token-to-token mapping.

For more information about WS-Trust, see [Web services standards](../introduction_to_pingfederate/pf_web_service_standard.html).

PingFederate comes bundled with the following token processors:

* JWT Token Processor 1.2

* JWT Token Processor 2.0

* Kerberos Token Processor

* OAuth Bearer Token Processor

* SAML 1.1 Token Processor

* SAML 2.0 Token Processor

* Username Token Processor

You can deploy additional token translators from [Ping Identity website](https://www.pingidentity.com/en/resources/downloads.html).

## Steps

1. Go to **Authentication > Token Exchange > Token Processors**.

2. In the **Token Processors** window, choose from the following options.

   | Option                      | Description                                                     |
   | --------------------------- | --------------------------------------------------------------- |
   | Configure a new instance    | Click **Create New Instance**                                   |
   | Modify an existing instance | Click the name of instance in the **Instance Name** column      |
   | Remove an existing instance | Click **Delete** in the **Action** column on the instance's row |

   |   |                                                                                                                                                                                                                                                                                                                                                               |
   | - | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
   |   | By default, PingFederate automatically checks multi-connection errors whenever you access this window. This verifies that configured connections are not adversely affected by changes made here.If you experience noticeable delays in accessing this window, you can disable automatic connection validation. Go to **System > Server > General Settings**. |