| Cookie domain | Uses a dot-prefixed parent domain, such as .example.com. |
| Cookie name | Matches the name configured in the tenant settings. |
| Cookie security | Uses Secure, HttpOnly, and SameSite=None. |
| JWKS URL | Is reachable by Zuora over HTTPS. |
| JWT subject | Contains the required sub claim. |
| JWT signature | Uses RS256 and matches a public key in the JWKS response. |
| JWT expiry | Contains a valid exp value and uses a synchronized server clock. |
| Role path | Points to the claim that contains the user roles. |
| Role mappings | Include each role that the identity provider issues. |
| Destination | Works for full Experience pages and embedded Experience components. |
