> This page is for Docs.

> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://zuora.ferndocs.com/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://zuora.ferndocs.com/_mcp/server.

# Create signing keys and publish JWKS

> Learn how to prepare a new signing key pair and public JWKS endpoint for external login.

Learn how to prepare a new signing key pair and public JWKS endpoint for external login.

* Your login system does not already publish a JWKS URL.
* You can expose a public HTTPS endpoint that Zuora can reach.

Create an RSA key pair.

Keep the private key in your login system and do not publish it.

Publish the public key at a URL that ends with /.well-known/jwks.json.

Assign a key ID (kid) to the public key.

Configure the login endpoint to validate users, create a JWT, and set the login cookie.

Configure the cookie domain as a dot-prefixed parent domain, such as .example.com.

Provide the JWKS URL, cookie name, role claim path, and role mappings in the tenant settings.

Your login system can issue JWTs that Zuora can verify through the published JWKS URL.

## Related links

* [Configure external login settings](/docs/platform/extensibility/experience-builder/external-authentication-with-a-custom-login-system/configure-external-login-settings)
* [Set the external login cookie](/docs/platform/extensibility/experience-builder/external-authentication-with-a-custom-login-system/set-the-external-login-cookie)