> This page is for Docs.

> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://zuora.ferndocs.com/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://zuora.ferndocs.com/_mcp/server.

# External login tenant settings

> Use this reference to configure the tenant values required for external login.

Use this reference to configure the tenant values required for external login.

| Setting                | Required | Description                                                    | Example or range                                                                                   |
| ---------------------- | -------- | -------------------------------------------------------------- | -------------------------------------------------------------------------------------------------- |
| JWKS URL               | Yes      | Public URL that contains the key used to verify signed JWTs.   | [https://login.example.com/.well-known/jwks.json](https://login.example.com/.well-known/jwks.json) |
| Cookie name            | Yes      | Exact name of the cookie that your login system sets.          | idp_session                                                                                        |
| Role claim path        | Optional | Location of user roles in the JWT. Use dots for nested claims. | roles or realm_access.roles                                                                        |
| Role mappings          | Optional | Maps identity provider role names to Zuora Experience roles.   | billing-admin to admin                                                                             |
| Access token lifetime  | Optional | Length of the Zuora session after token exchange, in seconds.  | 60 through 86,400 seconds                                                                          |
| Refresh token lifetime | Optional | Length of the refresh window, in seconds.                      | 60 through 604,800 seconds                                                                         |

If a role has no mapping, the user receives the tenant default role.