Skip to navigation
ExtensibilityExperience BuilderExternal authentication with a custom login system

Common errors

View as Markdown

The user appears to be logged out

Check that:

  • The cookie name matches the tenant setting.
  • The cookie is sent to the Experience destination.
  • The cookie domain and path are correct.
  • The JWKS URL is publicly reachable.
  • The JWT has not expired.
  • The JWT kid matches a key published in the JWKS.
  • The server clock is accurate.

The user receives the default role

Check that:

  • The role claim path matches the JWT structure.
  • The role value is a string or array in the supported format.
  • Every role value has a tenant role mapping.
  • The mapped role is valid for the Experience.

Check that:

  • The response uses HTTPS.
  • Secure is set when required.
  • SameSite matches the actual navigation or embedding model.
  • The domain is compatible with both the authentication service and the Experience destination.
  • Browser cookie policies do not block the configured attributes.

Authentication fails after key rotation

Check that:

  • The new public key was published before tokens using it were issued.
  • The JWT kid exactly matches the new JWKS key.
  • The previous key remains published until tokens signed with it have expired and relevant caches have refreshed.