Skip to navigation
ExtensibilityExperience BuilderExternal authentication with a custom login system

Create signing keys and publish JWKS

View as Markdown

Learn how to prepare a new signing key pair and public JWKS endpoint for external login.

  • Your login system does not already publish a JWKS URL.
  • You can expose a public HTTPS endpoint that Zuora can reach.
1

Create an RSA key pair.

2

Keep the private key in your login system and do not publish it.

3

Publish the public key at a URL that ends with /.well-known/jwks.json.

4

Assign a key ID (kid) to the public key.

5

Configure the login endpoint to validate users, create a JWT, and set the login cookie.

6

Configure the cookie domain as a dot-prefixed parent domain, such as .example.com.

7

Provide the JWKS URL, cookie name, role claim path, and role mappings in the tenant settings.

Your login system can issue JWTs that Zuora can verify through the published JWKS URL.