---
title: Trusted Issuers
description: Configure authorization servers as trusted issuers in PingOne to support third-party token exchange.
component: pingone
page_id: pingone:integrations:p1_trusted_issuers
canonical_url: https://docs.pingidentity.com/pingone/integrations/p1_trusted_issuers.html
llms_txt: https://docs.pingidentity.com/pingone/llms.txt
docs_for_agents: https://developer.pingidentity.com/build-with-ai/docs-for-agents.md
revdate: 2026-11-10T16:16:59Z
---

# Trusted Issuers

A trusted issuer in PingOne represents an external authorization server whose signed JSON Web Tokens (JWTs) you want to accept during OAuth 2.0 token exchange. Trusted issuers can include another PingOne environment, another Ping Identity product, or a third-party solution.

Define configuration and token validation settings for each trusted issuer you add in PingOne. PingOne uses these settings to validate incoming tokens from the external issuer.

After adding trusted issuers, assign each issuer to the OpenID Connect (OIDC)-based applications that you want to use JSON Web Tokens (JWTs) signed by that issuer in token exchange requests. Worker applications aren't supported.

Define attribute mappings in the custom resources that are the intended audiences of the resulting access tokens. These mappings determine the claims in the access tokens.

Learn more in:

* [Adding a trusted issuer](p1_adding_trusted_issuers.html)

* [Managing trusted issuers](p1_managing_trusted_issuers.html)

* [Configuring third-party trusted issuers for token exchange](../use_cases/p1_oauth_2_token_exchange_third_party_trusted_issuers.html)