External login JWT claims

Use this reference to create or validate the claims in the JWT.

Claim	Required	Description	Example
sub	Yes	Unique user ID in your system.	user@example.com
email	Optional	User email address.	user@example.com
name	Optional	User display name.	Support administrator
given_name	Optional	User first name.	Support
family_name	Optional	User last name.	Administrator
Configured role claim	Optional	One or more roles. The value can be a string or an array.	[“billing-admin”]
exp	Recommended	Time when the JWT expires. Zuora rejects expired JWTs.	Unix timestamp
iat	Recommended	Time when the JWT was issued.	Unix timestamp

The sub claim is the only required claim. A token that contains only sub can authenticate a user with the tenant default role and no profile fields.

The email, name, given_name, and family_name claims populate the user profile when present. Other claims are preserved for use by Experience pages and components.

Sign the JWT with the RS256 algorithm. Zuora verifies the signature with the public key from the configured JWKS URL.