External login cookie attributes

Use this reference to set the cookie that carries the signed JWT.

Attribute	Required value	Purpose
Name	Configured tenant cookie name	Identifies the cookie that Zuora reads.
Value	Signed JWT	Provides the token that Zuora verifies.
Path	/	Makes the cookie available on every path.
HttpOnly	yes	Prevents page scripts from reading the cookie.
SameSite	None	Allows the cookie to work across different subdomains.
Secure	yes	Sends the cookie only over HTTPS.
Domain	Dot-prefixed parent domain, such as .example.com	Shares the cookie across applicable subdomains.
Max-Age	Duration in seconds	Controls how long the browser keeps the cookie.

Use the following format as a model for the Set-Cookie header:

Set-Cookie: idp_session=<signed-JWT>; Path=/; HttpOnly; SameSite=None; Domain=.example.com; Secure; Max-Age=7200