> ## Documentation Index
> Fetch the complete documentation index at: https://docs.withsutro.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Builders

> Configuring the system for Builders

**Builders** are end users or clients who build and run apps that integrate with Sutro. They are managed by your organization (via [Members](/docs/getting-started/auth/members)), not Sutro directly.

To support your own user base, you'll need to configure certificates for both **JWT verification** and **mTLS security**. Learn more about [JSON Web Tokens (JWTs)](/docs/getting-started/auth/jwts) and [Mutual TLS (mTLS)](/docs/getting-started/auth/mutual-tls).

## JWT verification

The Sutro API verifies JWTs that your system generates and includes in requests from your Builders.

### Required claims

Every JWT must include the following claims:

| Claim | Description                                                   |
| ----- | ------------------------------------------------------------- |
| `sub` | The security ID (SID) associated with the user in your system |
| `iss` | The issuer SID previously registered with the UAPI            |
| `aud` | Must include `https://sapi.withsutro.com`                     |

JWTs must be signed using the **RS256** algorithm.

The public key used to verify signatures must be preregistered with the **User Management API (UAPI)**.

### Configuration

Two elements are needed for JWT verification:

1. **Register an Issuer SID**
2. **Register a Verification Certificate**

#### 1. Register an issuer SID

Issuer SIDs identify and verify the source of JWTs.

* Each SID must be globally unique and comply with [RFC 7519](https://www.rfc-editor.org/rfc/rfc7519#page-9).
* In practice, use a **UUID** or a **URI** containing a domain you own.
* Multiple issuer SIDs can be registered if needed.

#### 2. Register a verification certificate

JWTs signed with RS256 require a matching **public certificate** to be registered with the UAPI.

Once registered, that certificate can be linked to one or more issuer SIDs.

<Note>
  You hold the private key; Sutro never stores it. Register only the public certificate.
</Note>

## mTLS security

**Mutual TLS (mTLS)** adds another layer of authentication, requiring clients to present a certificate for every request.

This uses public-private key pairs: the client signs each request with its private key, and Sutro verifies it using the corresponding public certificate registered via the UAPI.

### Configuration

Sutro can generate mTLS certificates for you.

* Certificates are signed by Sutro's private Certificate Authority.
* The **public certificate** is stored by Sutro; the **private key** is available only once at generation.
* Certificates expire after **90 days**.

<Note>
  Automatic renewal of mTLS certificates will be available in an upcoming release.
</Note>

## Summary

| Security Layer      | What You Do                                      | Managed In |
| ------------------- | ------------------------------------------------ | ---------- |
| JWT Verification    | Register issuer SID and verification certificate | UAPI       |
| mTLS Security       | Upload or generate client certificate            | UAPI       |
| Certificate Renewal | Manual (auto-renew coming soon)                  | UAPI       |