> This page is for Docs.

> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://zuora.ferndocs.com/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://zuora.ferndocs.com/_mcp/server.

# External login JWT claims

> Use this reference to create or validate the claims in the JWT.

Use this reference to create or validate the claims in the JWT.

| Claim                 | Required    | Description                                               | Example                                     |
| --------------------- | ----------- | --------------------------------------------------------- | ------------------------------------------- |
| sub                   | Yes         | Unique user ID in your system.                            | [user@example.com](mailto:user@example.com) |
| email                 | Optional    | User email address.                                       | [user@example.com](mailto:user@example.com) |
| name                  | Optional    | User display name.                                        | Support administrator                       |
| given_name            | Optional    | User first name.                                          | Support                                     |
| family_name           | Optional    | User last name.                                           | Administrator                               |
| Configured role claim | Optional    | One or more roles. The value can be a string or an array. | \["billing-admin"]                          |
| exp                   | Recommended | Time when the JWT expires. Zuora rejects expired JWTs.    | Unix timestamp                              |
| iat                   | Recommended | Time when the JWT was issued.                             | Unix timestamp                              |

The sub claim is the only required claim. A token that contains only sub can authenticate a user with the tenant default role and no profile fields.

The email, name, given_name, and family_name claims populate the user profile when present. Other claims are preserved for use by Experience pages and components.

Sign the JWT with the RS256 algorithm. Zuora verifies the signature with the public key from the configured JWKS URL.