---
title: Adding a trusted issuer
description: Add external authorization servers as trusted issuers in PingOne to support third-party token exchange.
component: pingone
page_id: pingone:integrations:p1_adding_trusted_issuers
canonical_url: https://docs.pingidentity.com/pingone/integrations/p1_adding_trusted_issuers.html
llms_txt: https://docs.pingidentity.com/pingone/llms.txt
docs_for_agents: https://developer.pingidentity.com/build-with-ai/docs-for-agents.md
revdate: 2026-11-05T18:42:02Z
section_ids:
  before-you-begin: Before you begin
  steps: Steps
  next-steps: Next steps
---

# Adding a trusted issuer

Define external authorization servers as **Trusted Issuers** in PingOne whose signed JSON Web Tokens (JWTs) you want to accept during OAuth 2.0 token exchange. Trusted issuers can include another PingOne environment, another Ping Identity product, or a third-party solution.

## Before you begin

To add a trusted issuer, you must have:

* The Environment Admin role or a custom role with equivalent permissions (such as **trustedIssuers:create:trustedIssuer**). Learn more in [Administrator Roles](../directory/p1_roles.html).

* The issuer URL for your external authorization server. You'll enter the URL in PingOne.

* The JSON Web Key Set (JWKS) URL or JWKS for the external issuer. You'll enter the URL or the JWKS itself in PingOne.

## Steps

1. In the PingOne admin console, go to **Integrations > Trusted Issuers** and click the **[icon: plus, set=fa]**icon.

2. Enter the following:

   1. **Name**: A unique name for the issuer.

   2. **Description** (optional): A brief description of the issuer.

   3. **Issuer**: Enter the URL that identifies the external token issuer.

   4. **JSON Web Key Set Method**: Enter either the URL where PingOne can retrieve the JWKS or the web key set itself. You can paste the JSON in one line or multiple lines.

   5. **Audiences** (optional): Enter accepted audience values for incoming tokens from this issuer. When defined, at least one value in the incoming token's `aud` array must match a configured audience.

      If left blank, PingOne accepts any `aud` value for tokens from this issuer.

      Click **[icon: plus, set=fa]Add** to add additional audiences.

   6. **Advanced Settings**: Enter or edit the following optional settings:

      1. **Require Expiration Claim**: Select the checkbox for PingOne to reject tokens missing the `exp` claim. The `exp` claim sets a timestamp when the token is no longer valid.

      2. **Require Issued-at Claim**: Select the checkbox for PingOne to reject tokens missing the `iat` claim. The `iat` claim sets the timestamp when the token was created.

      3. **Require Not-before Claim**: Select the checkbox for PingOne to reject tokens missing the `nbf` claim. The `nbf` claim sets the timestamp before which the token isn't accepted for processing.

      4. **Clock Skew Tolerance**: Set the allowed clock discrepancies (0 - 60 seconds) between the external issuer and PingOne when validating token expiration and time-based claims.

      5. **Max Future Validity**: Set the maximum time a token's expiration can be set in the future (maximum 30 days). PingOne rejects tokens exceeding this maximum. Values can be in seconds, minutes, hours, or days. If set to 0, any future date is valid.

3. Click **Save**.

## Next steps

* Follow the steps in [Configuring third-party trusted issuers for token exchange](../use_cases/p1_oauth_2_token_exchange_third_party_trusted_issuers.html) to assign the trusted issuer to an application and define attribute mappings in the custom resources that are the intended audiences of the access tokens during token exchange.

* Run a PingOne Audit report or create a webhook to view events related to trusted issuers. Learn more in [Running an audit report](../monitoring/p1_running_audit_report.html). You can find a complete list of events logged in PingOne in [Audit Reporting Events](https://developer.pingidentity.com/pingone-api/platform/reference/audit-reporting-events.html) in the PingOne API documentation.