> This page is for Docs.

> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://zuora.ferndocs.com/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://zuora.ferndocs.com/_mcp/server.

# Common errors

## The user appears to be logged out

Check that:

* The cookie name matches the tenant setting.
* The cookie is sent to the Experience destination.
* The cookie domain and path are correct.
* The JWKS URL is publicly reachable.
* The JWT has not expired.
* The JWT kid matches a key published in the JWKS.
* The server clock is accurate.

## The user receives the default role

Check that:

* The role claim path matches the JWT structure.
* The role value is a string or array in the supported format.
* Every role value has a tenant role mapping.
* The mapped role is valid for the Experience.

## The browser does not store or send the cookie

Check that:

* The response uses HTTPS.
* Secure is set when required.
* SameSite matches the actual navigation or embedding model.
* The domain is compatible with both the authentication service and the Experience destination.
* Browser cookie policies do not block the configured attributes.

## Authentication fails after key rotation

Check that:

* The new public key was published before tokens using it were issued.
* The JWT kid exactly matches the new JWKS key.
* The previous key remains published until tokens signed with it have expired and relevant caches have refreshed.