> This page is for Docs.

> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://zuora.ferndocs.com/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://zuora.ferndocs.com/_mcp/server.

# Integration responsibilities

> This topic describes the components involved in the Zuora Experience authentication integration and outlines their responsibilities in the end-to-end login flow.

This topic describes the components involved in the Zuora Experience authentication integration and outlines their responsibilities in the end-to-end login flow.

The integration involves several components. Each component has a distinct responsibility.

<table>
  <tr>
    <th>
      Component
    </th>

    <th>
      Responsibility
    </th>
  </tr>

  <tr>
    User's browser

    Stores the authentication cookie and sends it with requests to the applicable destinations.
  </tr>

  <tr>
    Login form

    Collects the user's credentials and calls your authentication service.
  </tr>

  <tr>
    Login system

    Validates the user, creates or obtains a compatible JWT, sets the authentication cookie, and redirects the user.
  </tr>

  <tr>
    JWKS endpoint

    Publishes the public key that Zuora uses to verify the JWT signature.
  </tr>

  <tr>
    Zuora Experience

    Reads the authentication cookie, retrieves or uses the cached public key, verifies the JWT, reads the user and role claims, and applies the configured role mappings.
  </tr>

  <tr>
    Destination

    Displays either a full Zuora Experience page or your page with embedded Experience components.
  </tr>
</table>

The authentication flow is:

1. The user signs in through your login form.
2. Your login system validates the user and creates or obtains the JWT.
3. Your login system sets the authentication cookie and redirects the user.
4. The destination loads the full Experience page or the embedded Experience components.
5. Zuora verifies the JWT and applies the user's mapped role.

![integration\_responsibility](/_fern-img/9bf2bac991e0ab1137ae5881533e115c97ecb074ce2c1cf6bb55cb19bb9176b0.webp)