--- title: Create a token validation configuration --- [Skip to content](#_top) [API Reference](https://developers.cloudflare.com/api) [Token Validation](https://developers.cloudflare.com/api/resources/token_validation) [Configuration](https://developers.cloudflare.com/api/resources/token_validation/subresources/configuration) Copy Markdown Open in **Claude**Open in **ChatGPT**Open in **Cursor** --- **Copy Markdown****View as Markdown** # Create a token validation configuration POST/zones/{zone\_id}/token\_validation/config Creates a JWT validation configuration for the zone. ##### Security

API Token

The preferred authorization scheme for interacting with the Cloudflare API. Create a token. **Example:**Authorization: Bearer Sn3lZJTBX6kkg7OdcBUAxOO963GEIyGQqnFTOFYY

API Email + API Key

The previous authorization scheme for interacting with the Cloudflare API, used in conjunction with a Global API key. **Example:**X-Auth-Email: user@example.com The previous authorization scheme for interacting with the Cloudflare API. When possible, use API tokens instead of Global API keys. **Example:**X-Auth-Key: 144c9defac04969c7bfad8efaa8ea194

##### Accepted Permissions (at least one required) `Account API Gateway``Domain API Gateway` ##### P ath ParametersExpand Collapse zone\_id: string Identifier. maxLength32 [Link to this property](<#(resource)%20token_validation.configuration%20%3E%20(method)%20create%20%3E%20(params)%20default%20%3E%20(param)%20zone_id%20%3E%20(schema)>) ##### Body ParametersJSONExpand Collapse

credentials: object {keys } Request payload for create and PUT credentials operations. Provided keys define the complete stored key set. Key identities ({alg,kid}) must be unique.

keys: array of object {alg, e, kid, 2 more } or object {alg, crv, kid, 3 more } or object {alg, crv, kid, 3 more } or object {alg, k, kid, kty }

One of the following:

APIShieldCredentialsJWTKeyRSA object {alg, e, kid, 2 more } JSON representation of an RSA key.

alg: "RS256"or "RS384"or "RS512"or 3 more Algorithm

One of the following: "RS256" Link to this property "RS384" Link to this property "RS512" Link to this property "PS256" Link to this property "PS384" Link to this property "PS512" Link to this property

Link to this property e: string RSA exponent Link to this property kid: string Key ID Link to this property kty: "RSA" Key Type Link to this property n: string RSA modulus Link to this property

Link to this property

APIShieldCredentialsJWTKeyEcEs256 object {alg, crv, kid, 3 more } JSON representation of an ES256 key

alg: "ES256" Algorithm Link to this property crv: "P-256" Curve Link to this property kid: string Key ID Link to this property kty: "EC" Key Type Link to this property x: string X EC coordinate Link to this property y: string Y EC coordinate Link to this property

Link to this property

APIShieldCredentialsJWTKeyEcEs384 object {alg, crv, kid, 3 more } JSON representation of an ES384 key

alg: "ES384" Algorithm Link to this property crv: "P-384" Curve Link to this property kid: string Key ID Link to this property kty: "EC" Key Type Link to this property x: string X EC coordinate Link to this property y: string Y EC coordinate Link to this property

Link to this property

APIShieldCredentialsJWTKeyOctRequest object {alg, k, kid, kty } JSON representation of a symmetric key for create/PUT requests.

alg: "HS256"or "HS384"or "HS512" Algorithm

One of the following: "HS256" Link to this property "HS384" Link to this property "HS512" Link to this property

Link to this property k: string Symmetric key material. Required for create and PUT update requests. Link to this property kid: string Key ID Link to this property kty: "oct" Key Type Link to this property

Link to this property

[Link to this property](<#(resource)%20token_validation.configuration%20%3E%20(method)%20create%20%3E%20(params)%200%20%3E%20(param)%20credentials%20%3E%20(schema)>) description: string maxLength500 [Link to this property](<#(resource)%20token_validation.configuration%20%3E%20(method)%20create%20%3E%20(params)%200%20%3E%20(param)%20description%20%3E%20(schema)>) title: string maxLength50 [Link to this property](<#(resource)%20token_validation.configuration%20%3E%20(method)%20create%20%3E%20(params)%200%20%3E%20(param)%20title%20%3E%20(schema)>) token\_sources: array of string [Link to this property](<#(resource)%20token_validation.configuration%20%3E%20(method)%20create%20%3E%20(params)%200%20%3E%20(param)%20token_sources%20%3E%20(schema)>) token\_type: "JWT" [Link to this property](<#(resource)%20token_validation.configuration%20%3E%20(method)%20create%20%3E%20(params)%200%20%3E%20(param)%20token_type%20%3E%20(schema)>) ##### ReturnsExpand Collapse

errors: Message { code, message, documentation\_url, source }

code: number minimum1000 Link to this property message: string Link to this property documentation\_url: optional string Link to this property

source: optional object {pointer }

pointer: optional string Link to this property

Link to this property

[Link to this property](<#(resource)%20token_validation.configuration%20%3E%20(method)%20create%20%3E%20(network%20schema)%20%3E%20(property)%20errors>)

messages: Message { code, message, documentation\_url, source }

code: number minimum1000 Link to this property message: string Link to this property documentation\_url: optional string Link to this property

source: optional object {pointer }

pointer: optional string Link to this property

Link to this property

[Link to this property](<#(resource)%20token_validation.configuration%20%3E%20(method)%20create%20%3E%20(network%20schema)%20%3E%20(property)%20messages>)

result: TokenConfig { id, created\_at, credentials, 5 more }

id: string UUID. maxLength36 minLength36 Link to this property created\_at: string formatdate-time Link to this property

credentials: object {keys }

keys: array of object {alg, e, kid, 2 more } or object {alg, crv, kid, 3 more } or object {alg, crv, kid, 3 more } or object {alg, kid, kty }

One of the following:

APIShieldCredentialsJWTKeyRSA object {alg, e, kid, 2 more } JSON representation of an RSA key.

alg: "RS256"or "RS384"or "RS512"or 3 more Algorithm

Link to this property e: string RSA exponent Link to this property kid: string Key ID Link to this property kty: "RSA" Key Type Link to this property n: string RSA modulus Link to this property

Link to this property

APIShieldCredentialsJWTKeyEcEs256 object {alg, crv, kid, 3 more } JSON representation of an ES256 key

Link to this property

APIShieldCredentialsJWTKeyEcEs384 object {alg, crv, kid, 3 more } JSON representation of an ES384 key

Link to this property

APIShieldCredentialsJWTKeyOctResponse object {alg, kid, kty } JSON representation of a symmetric verification key in API responses (secret material is redacted).

alg: "HS256"or "HS384"or "HS512" Algorithm

One of the following: "HS256" Link to this property "HS384" Link to this property "HS512" Link to this property

Link to this property kid: string Key ID Link to this property kty: "oct" Key Type Link to this property

Link to this property

Link to this property description: string maxLength500 Link to this property last\_updated: string formatdate-time Link to this property title: string maxLength50 Link to this property token\_sources: array of string Link to this property token\_type: "JWT" Link to this property

[Link to this property](<#(resource)%20token_validation.configuration%20%3E%20(method)%20create%20%3E%20(network%20schema)%20%3E%20(property)%20result>) success: true Whether the API call was successful. [Link to this property](<#(resource)%20token_validation.configuration%20%3E%20(method)%20create%20%3E%20(network%20schema)%20%3E%20(property)%20success>) ### Create a token validation configuration HTTP HTTPTypeScriptPythonGoTerraform ``` curl https://api.cloudflare.com/client/v4/zones/$ZONE_ID/token_validation/config \ -H 'Content-Type: application/json' \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \ -d '{ "credentials": { "keys": [ { "alg": "RS256", "e": "e", "kid": "kid", "kty": "RSA", "n": "n" } ] }, "description": "Long description for Token Validation Configuration", "title": "Example Token Validation Configuration", "token_sources": [ "http.request.headers[\\"x-auth\\"][0]", "http.request.cookies[\\"Authorization\\"][0]" ], "token_type": "JWT" }' ``` 200 example ``` { "errors": [ { "code": 1000, "message": "message", "documentation_url": "documentation_url", "source": { "pointer": "pointer" } } ], "messages": [ { "code": 1000, "message": "message", "documentation_url": "documentation_url", "source": { "pointer": "pointer" } } ], "result": { "id": "f174e90a-fafe-4643-bbbc-4a0ed4fc8415", "created_at": "2014-01-01T05:20:00.12345Z", "credentials": { "keys": [ { "alg": "ES256", "crv": "P-256", "kid": "38013f13-c266-4eec-a72a-92ec92779f21", "kty": "EC", "x": "KN53JRwN3wCjm2o39bvZUX2VdrsHzS8pxOAGjm8m7EQ", "y": "lnkkzIxaveggz-HFhcMWW15nxvOj0Z_uQsXbpK0GFcY" } ] }, "description": "Long description for Token Validation Configuration", "last_updated": "2014-01-01T05:20:00.12345Z", "title": "Example Token Validation Configuration", "token_sources": [ "http.request.headers[\"x-auth\"][0]", "http.request.cookies[\"Authorization\"][0]" ], "token_type": "JWT" }, "success": true } ``` ##### Returns Examples 200 example ``` { "errors": [ { "code": 1000, "message": "message", "documentation_url": "documentation_url", "source": { "pointer": "pointer" } } ], "messages": [ { "code": 1000, "message": "message", "documentation_url": "documentation_url", "source": { "pointer": "pointer" } } ], "result": { "id": "f174e90a-fafe-4643-bbbc-4a0ed4fc8415", "created_at": "2014-01-01T05:20:00.12345Z", "credentials": { "keys": [ { "alg": "ES256", "crv": "P-256", "kid": "38013f13-c266-4eec-a72a-92ec92779f21", "kty": "EC", "x": "KN53JRwN3wCjm2o39bvZUX2VdrsHzS8pxOAGjm8m7EQ", "y": "lnkkzIxaveggz-HFhcMWW15nxvOj0Z_uQsXbpK0GFcY" } ] }, "description": "Long description for Token Validation Configuration", "last_updated": "2014-01-01T05:20:00.12345Z", "title": "Example Token Validation Configuration", "token_sources": [ "http.request.headers[\"x-auth\"][0]", "http.request.cookies[\"Authorization\"][0]" ], "token_type": "JWT" }, "success": true } ```