<a id="manage-oauth-identity-provider-configs"></a>

# Manage OAuth-OIDC identity provider configurations on Confluent Cloud

Update your OAuth identity provider configurations, refresh the JWKS URI, and
delete an identity provider following the steps below.

To add an OAuth identity provider to your Confluent Cloud organization, see
[Add an OAuth/OIDC Identity Provider on Confluent Cloud](identity-providers.md#add-oauth-identity-providers).

To add an identity pool, see [Use OAuth Identity Pools with Your OAuth/OIDC Identity Provider on Confluent Cloud](identity-pools.md#add-oauth-identity-pools).

<a id="update-oauth-identity-provider-config"></a>

## Update an OAuth identity provider configuration

You can update the following OAuth identity provider configurations:

- Name
- Description
- JWKS URI (To refresh an existing JWKS URI, see [Refresh the JWKS URI](#refresh-jwks-uri) below.)
- Issuer URI
- Identity claim (used to identify the external identity in audit logs when no
  identity pool ID is specified, or multiple identity pool IDs are matched;
  see [Use auto pool mapping with OAuth identity pools](identity-pools.md#oauth-auto-pool-mapping))

To update your OAuth identity provider configurations, follow the steps for the
Confluent Cloud Console or the Confluent Cloud REST API.

### Cloud Console

1. Sign in to the Cloud Console and go to the **Workload identities** tab
   on the **Accounts & access** page at [https://confluent.cloud/settings/org/workload_identities](https://confluent.cloud/settings/org/workload_identities).
2. Click the identity provider you want to update. The identity provider
   details page appears.
3. To the right of **Identity provider**, click the **Edit** icon. The editable
   fields appear.
4. Update the identity provider details, as needed.
5. Click **Save**.

The identity provider details page reappears with the updated identity
provider details.

### REST API

To use the Confluent Cloud REST API to make a request to update the identity provider,
see [Update an identity provider](https://docs.confluent.io/cloud/current/ccloud/update-iam-v-2-identity-provider/).

<a id="refresh-jwks-uri"></a>

## Refresh the JWKS URI

You can manually refresh the JWKS URI of your OAuth identity provider using
either the Confluent Cloud Console or the Confluent Cloud REST API to:

- Force immediate application of rotated public keys.
- Recover from automatic refresh failures.

**Refresh Frequency Settings**

The `max-age` directive in the `Cache-Control` header of the JWKS URI response
determines how often keys are refreshed:

- Minimum: 5 minutes (300 seconds)
- Maximum: 7 days (604800 seconds)
- Default: 24 hours (86400 seconds) when `max-age` is not specified.

**Note**: Values below the minimum are automatically set to 5 minutes, while
values above the maximum are capped at 7 days. To increase refresh frequency,
set a lower `max-age` value in your `Cache-Control` header.

**Example**: To set a 1-hour (3600 seconds) refresh frequency, the `Cache-Control`
header should be:

```text
Cache-Control: max-age=3600
```

If the JWKS URI is temporarily unavailable, the system continues using the
cached keys until the next successful refresh. In prolonged outages, you might
need to manually refresh the JWKS URI using the procedure below once connectivity
is restored.

### Cloud Console

Use the Cloud Console to manually refresh the JWKS URI

To manually refresh the JWKS URI of your OAuth identity provider:,

1. Sign in to the Cloud Console and go to the **Workload identities** tab
   on the **Accounts & access** page at [http://confluent.cloud/settings/org/identity_providers](http://confluent.cloud/settings/org/identity_providers).
2. Click the identity provider you want to refresh. The details page appears.
3. Click **Edit** (icon) and then click **Refresh JWKS keys**.

The refresh operation proceeds and the identity provider details page appears.

### REST API

Use the Confluent Cloud REST API to manually refresh the JWKS URI

To use the Confluent Cloud REST API to make a request to refresh the JWKS URI,
see [Refresh a provider’s JWKS](https://docs.confluent.io/cloud/current/ccloud/refresh-iam-v-2-json-web-key-set/).

<a id="delete-oauth-identity-provider"></a>

## Delete an OAuth identity provider

To delete an OAuth identity provider, you can use the Cloud Console or the
Confluent Cloud REST API.

### Cloud Console

1. Sign in to the Cloud Console and go to the **Workload identities** tab
   on the **Accounts & access** page at [http://confluent.cloud/settings/org/identity_providers](http://confluent.cloud/settings/org/identity_providers).
2. Click the identity provider you want to update. The identity provider
   details page appears.
3. To the right of **Identity provider**, click the **Edit** icon. The editable
   fields appear.
4. Click the **Delete** icon (to the right of **Refresh JWKS keys**).
5. Click **Save**.

The identity provider is deleted.

### REST API

To use the Confluent Cloud REST API to make a request to delete the identity provider, see
[Delete an identity provider](https://docs.confluent.io/cloud/current/ccloud/delete-iam-v-2-identity-provider/).