External authentication with a custom login system
Use your own login system to authenticate users for Zuora Experiences by issuing a signed JWT in a browser cookie that Zuora validates with your public key.
External login supports authentication through your own login system for Zuora Experiences.
Zuora Experiences does not provide a login screen for this model. After your login system authenticates a user, it sets a browser cookie that contains a signed JSON Web Token (JWT). Zuora uses the cookie to determine whether the user is signed in.
Your system signs the JWT with a private key. It publishes the matching public key at a JSON Web Key Set (JWKS) URL. A JWKS URL commonly ends with /.well-known/jwks.json.
When an Experience loads, Zuora verifies the token signature with the public key and checks whether the token has expired. Zuora does not currently enforce the issuer (iss) or audience (aud) claims. Including sensible issuer and expiry values remains recommended.
You can use external login with the following destinations:
- A full Experience page hosted by Zuora.
- A page that you host with embedded Experience components.
Both destinations use the same login cookie.