The error means the patch value after = is parsed as raw JSON, not as a string literal. For JSON, the valid value must be a JSON string (quoted) or another JSON type. In your command you already have quotes, but the CLI strips the outer shell quotes and expects the inner value to still be valid JSON. Use escaped quotes so the JSON string "external_id" reaches the server: - With bash:

ory patch identity-config \   --project "$dev_project_id" \   --workspace "$workspace_id" \   --replace '/session/whoami/tokenizer/templates/jwt_template/subject_source="external_id"'

If your shell still strips the quotes, escape them:

ory patch identity-config \   --project "$dev_project_id" \   --workspace "$workspace_id" \   --replace '/session/whoami/tokenizer/templates/jwt_template/subject_source=\"external_id\"'

Alternatively, use the add flag with a JSON object:

ory patch identity-config \   --project "$dev_project_id" \   --workspace "$workspace_id" \   --add '/session/whoami/tokenizer/templates/jwt_template={"subject_source":"external_id"}'

Notes: - subject_source is a supported key on tokenizer templates and can be set to external_id to use the identity’s external_id as the JWT sub. [[External ID](https://www.ory.sh/docs/kratos/manage-identities/external-id); [JWT templates](https://www.ory.sh/docs/identities/session-to-jwt-cors#json-web-token-templates)] - The patch command interprets the part after = as raw JSON, so strings must be quoted. [[Config with CLI](https://www.ory.sh/docs/guides/cli/config-with-cli); [patch identity-config](https://www.ory.sh/docs/cli/ory-patch-identity-config#ory-patch-identity-config)] If you continue to see the same error, print what your shell passes by echoing the arg:

printf "%s\n" '/session/whoami/tokenizer/templates/jwt_template/subject_source="external_id"'

You should see the inner quotes around external_id. If not, add escaping as shown above.