Register end-user authentication (hosted tier)
PUT /config/end-user-auth
For hosted-tier vaults, register the identity provider whose tokens authorize an end user’s signatures: the JWKS XKOVA verifies end-user tokens against, and the audience it expects. Hosted vaults created afterward require a valid end-user token on each transaction. Scoped to your org.
Authorizations
Section titled “Authorizations ”Request Body required
Section titled “Request Body required ”object
The JWK Set XKOVA verifies your end users’ tokens against
object
The expected aud claim on end-user tokens
Responses
Section titled “ Responses ”Registered.
object
Example
{ "status": "registered"}The request body or parameters failed validation.
Failures return a single human-readable error message; the HTTP status
carries the category (400 validation, 401 auth, 403 refused, 404 missing,
409 conflict, 429 rate limit). When a signing request is refused for a
specific reason, the message names it — for example the amount exceeds a
spend limit, the policy denied the recipient, or the intent signature did
not verify.
object
Stable machine slug (invalid_request, unauthorized, forbidden, not_found, conflict, rate_limited); a refused sign names the reason in the message
Example
{ "error": "amount must be a base-10 integer", "code": "invalid_request"}Missing, malformed, or invalid request signature.
Failures return a single human-readable error message; the HTTP status
carries the category (400 validation, 401 auth, 403 refused, 404 missing,
409 conflict, 429 rate limit). When a signing request is refused for a
specific reason, the message names it — for example the amount exceeds a
spend limit, the policy denied the recipient, or the intent signature did
not verify.
object
Stable machine slug (invalid_request, unauthorized, forbidden, not_found, conflict, rate_limited); a refused sign names the reason in the message
Example
{ "error": "request signature did not verify", "code": "unauthorized"}