/projects/{project_id}/jwksAdd JWKS URL
Adds a JWKS URL to the specified project for verifying JWTs used as the authentication mechanism.
The URL must be a valid HTTPS URL that returns a JSON Web Key Set.
The provider_name field allows you to specify which authentication provider you're using (e.g., Clerk, Auth0, AWS Cognito).
The branch_id scopes the JWKS URL to specific branches; if not specified, it applies to all branches.
The role_names scopes the URL to specific roles; if not specified, default roles are used (authenticator, authenticated, anonymous).
The jwt_audience specifies which aud values are accepted in JWTs.
Quick start
curl "https://console.neon.tech/api/v2/projects/$PROJECT_ID/jwks" \
-X POST \
-H "Authorization: Bearer $NEON_API_KEY"import { createApiClient } from '@neondatabase/api-client';
const api = createApiClient({ apiKey: process.env.NEON_API_KEY });
const { data } = await api.addProjectJwks(process.env.PROJECT_ID);Parameters
project_idThe Neon project ID
Request body
2 required Required: jwks_url, provider_name.
jwks_urlThe URL that lists the JWKS
provider_nameThe name of the authentication provider (e.g., Clerk, Stytch, Auth0)
branch_idBranch ID
jwt_audienceThe name of the required JWT Audience to be used
role_namesDEPRECATED. This field should only be used when using Neon RLS. The roles the JWKS should be mapped to. By default, the JWKS is mapped to the authenticator, authenticated and anonymous roles.
skip_role_creationDEPRECATED. This field should only be used when using Neon RLS. If true, the role creation will be skipped.
Response
201The JWKS URL was added to the project's authentication connections
Errors
General error
This endpoint can return the standard Neon API error response.
Response fields
messageRequired. Human-readable error message.codeRequired. Machine-readable error code.request_idOptional. Request identifier for debugging. You can provide one with theX-Request-IDheader.
Retry guidance
If no response is returned, the request may still have reached the server. This is why retry safety depends on the method and status code.
Idempotent methods (GET, HEAD, OPTIONS) are generally safe to retry after a network error or timeout. Non-idempotent methods (POST, PATCH, DELETE, PUT) can change state, so avoid automatic retries unless your workflow can tolerate duplicate effects.
Responses with 423 Locked or 503 Service Unavailable are safe to retry. 423 Locked means the resource is temporarily locked, usually because another operation is in progress.