privy config custom-jwt configure

Replace custom-JWT trust configuration; stdin-only, no automatic account activation. --enable-auth explicitly permits initial app enablement.

Usage

privy config custom-jwt configure [options]

Options

Option	Description
--dry-run	Validate and print the API request without network access or credentials.
--allow-access-change	Acknowledge cross-app access or customer authentication impact.
--confirm-name <name>	Exact selected app name, verified against fresh state.
--enable-auth	Explicitly allow initial app enablement before verifier configuration; two non-atomic writes.
--allow-unrestricted-jwt	Acknowledge disabling the audience/additional-claim requirement; Firebase still requires audience.
--yes	Confirm this mutation or export.
--body <json>	JSON body, or - to read stdin.
--file <path>	JSON body file, or - to read stdin.
--jwt-cookie-name <string>	Must be null, matching the observed dashboard contract. Custom cookie names are not exposed here.
--jwt-claim-user-id <string>	JWT claim identifying the customer user or organization; typically sub.
--jwt-claim-sub-user-id <string>	Explicit sub-user claim or null.
--jwt-allowed-auds <json>	Complete distinct allowed audiences. Firebase securetoken JWKS requires at least one.
--require-jwt-claims <boolean>	Require at least one audience/additional claim before saving. False requires --allow-unrestricted-jwt. Does not erase supplied checks.
--environment <string>	Explicit accepted request environment, separate from Privy dev/prod.
--jwks-caching-enabled <boolean>	Optional, only with JWKS and server-reported cache eligibility. Revoked keys can remain accepted until the cached copy expires.
--diff	Read live state and show changes WITHOUT writing (requires login).
--allow-production	Explicitly allow this production mutation; also requires --yes.

Global options such as --app, --account and --profile also apply. See the command reference overview.

Examples

privy config custom-jwt configure --body - --diff

Behavior

• Changes data: yes. Preview with --dry-run, then run with --yes and any required confirmations.
• Scope: app

Related guides

• Custom JWT auth
• Failure recovery

Inspect the full contract locally with privy schema config custom-jwt configure.