Integration responsibilities

This topic describes the components involved in the Zuora Experience authentication integration and outlines their responsibilities in the end-to-end login flow.

The integration involves several components. Each component has a distinct responsibility.

Component	Responsibility
User’s browser	Stores the authentication cookie and sends it with requests to the applicable destinations.
Login form	Collects the user’s credentials and calls your authentication service.
Login system	Validates the user, creates or obtains a compatible JWT, sets the authentication cookie, and redirects the user.
JWKS endpoint	Publishes the public key that Zuora uses to verify the JWT signature.
Zuora Experience	Reads the authentication cookie, retrieves or uses the cached public key, verifies the JWT, reads the user and role claims, and applies the configured role mappings.
Destination	Displays either a full Zuora Experience page or your page with embedded Experience components.

The authentication flow is:

The user signs in through your login form.
Your login system validates the user and creates or obtains the JWT.
Your login system sets the authentication cookie and redirects the user.
The destination loads the full Experience page or the embedded Experience components.
Zuora verifies the JWT and applies the user’s mapped role.

integration_responsibility