An AccessProvider is a document within a Fauna database that configures one half of the relationship required to access authentication information from an external identity provider. The other half of the relationship is configured in the identity provider.


An AccessProvider document has this structure:

  ref: AccessProvider("Auth0-myapp"),
  ts: 1604524688650000,
  name: 'Auth0-myapp',
  issuer: '',
  jwks_uri: '',
  audience: ''
Field Name Field Type Definition and Requirements


A unique name for the AccessProvider.

Cannot be events, sets, self, documents, or _. Cannot contain the % character.


An HTTPS URL for the IdP that you are using to grant access to Fauna. This is typically an account-/app-specific URL that your IdP provides.

Use an exact copy of your IdP’s issuer URL, including a trailing slash (if there is one). URL differences could prevent Fauna acceptance of your IdP’s JWT tokens.


A valid HTTPS URI, which should serve the JSON Web Key that signs the JWT tokens from your IdP.


Array of Role References or Role-predicate objects.

Optional - Defines the roles that should be evaluated to determine access for a provided JWT token.

When roles is not specified, no privileges are defined — queries with JWT tokens from the specified issuer cannot be processed.

The usual use of roles is to specify a list of one or more Role references:

roles: [ Role('developers'), Role('managers') ]

Per overlapping roles, any role that grants access means that the query involving a JWT token is processed, even if another Role might deny access.

A Role-predicate object specifies a Role to potentially evaluate, whose evaluation is determined by the specified predicate function:

  role: Role('executives'),
  predicate: Query(Lambda("accessToken", ... )),

The predicate function is passed an object representing the payload field from the JWT token. The payload field contains claims, which are statements about the user represented by the JWT token. How these claims are specified/interpreted can vary depending on the IdP. See for background information, and your IdP’s documentation, for more details.

The predicate function must return a boolean value, and if the result is true, the specified Role is evaluated to determine whether the access required to execute the query (in the request accompanying the JWT token) has been granted.


Optional - Contains user-defined metadata for the AccessProvider. It is provided for the developer to store AccessProvider-relevant information.


Read only - A unique URL for your database that should be used in the audience configuration for an identity provider. Fauna creates this field automatically when you create a database (see the CreateDatabase function).


Optional - A timestamp indicating the document’s time-to-live, which is when the document should be removed. When a document is removed, the document’s existence ceases (as if it never existed); temporal queries cannot recover the document.

Removal is handled by a background task, so once a document (including collections, databases, indexes, keys, roles, and tokens) "expires" due to the setting in the ttl field, it could be some time (hours or days) before the removal occurs. There is no guarantee that removal occurs.

As of version 3.0.0, the ttl field is honored on read — an expired but not yet removed document behaves as if removal is complete. But, until removal is completed by background task processing, you can continue to access the history of the document, provided you have its reference, using the Events function.

Is this article helpful? 

Tell Fauna how the article can be improved:
Visit Fauna's forums or email

Thank you for your feedback!