> For clean Markdown of any page, append .md to the page URL. > For a complete documentation index, see https://zuora.ferndocs.com/docs/platform/extensibility/experience-builder/external-authentication-with-a-custom-login-system/llms.txt. > For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://zuora.ferndocs.com/_mcp/server. # External authentication with a custom login system > Use your own login system to authenticate users for Zuora Experiences by issuing a signed JWT in a browser cookie that Zuora validates with your public key. Use your own login system to authenticate users for Zuora Experiences by issuing a signed JWT in a browser cookie that Zuora validates with your public key. External login supports authentication through your own login system for Zuora Experiences. Zuora Experiences does not provide a login screen for this model. After your login system authenticates a user, it sets a browser cookie that contains a signed JSON Web Token (JWT). Zuora uses the cookie to determine whether the user is signed in. Your system signs the JWT with a private key. It publishes the matching public key at a JSON Web Key Set (JWKS) URL. A JWKS URL commonly ends with /.well-known/jwks.json. When an Experience loads, Zuora verifies the token signature with the public key and checks whether the token has expired. Zuora does not currently enforce the issuer (iss) or audience (aud) claims. Including sensible issuer and expiry values remains recommended. You can use external login with the following destinations: * A full Experience page hosted by Zuora. * A page that you host with embedded Experience components. Both destinations use the same login cookie. ## Authentication models | Model | Use this model when | Key actions | | -------------------------- | ------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | New JWKS setup | Your login system does not sign JWTs or publish a public key. | [Create an RSA key pair, publish a JWKS URL, and configure your login endpoint](/docs/platform/extensibility/experience-builder/external-authentication-with-a-custom-login-system/create-signing-keys-and-publish-jwks). | | Existing identity provider | Your identity provider already signs JWTs and publishes a JWKS URL. | [Reuse the existing keys and add the agreed login cookie](/docs/platform/extensibility/experience-builder/external-authentication-with-a-custom-login-system/use-an-existing-identity-provider). | > Use your own login system to authenticate users for Zuora Experiences by issuing a signed JWT in a browser cookie that Zuora validates with your public key. ## Docs - [Choose an external login setup](https://zuora.ferndocs.com/docs/platform/extensibility/experience-builder/external-authentication-with-a-custom-login-system/choose-an-external-login-setup.md): Learn how to select the external login setup that matches your authentication system. - [Configure external login settings](https://zuora.ferndocs.com/docs/platform/extensibility/experience-builder/external-authentication-with-a-custom-login-system/configure-external-login-settings.md): Learn how to provide the tenant settings that Zuora uses to verify users and map their roles. - [Set the external login cookie](https://zuora.ferndocs.com/docs/platform/extensibility/experience-builder/external-authentication-with-a-custom-login-system/set-the-external-login-cookie.md): Learn how to place a signed JWT in the browser so Zuora Experiences can recognize authenticated users. - [Create signing keys and publish JWKS](https://zuora.ferndocs.com/docs/platform/extensibility/experience-builder/external-authentication-with-a-custom-login-system/create-signing-keys-and-publish-jwks.md): Learn how to prepare a new signing key pair and public JWKS endpoint for external login. - [Use an existing identity provider](https://zuora.ferndocs.com/docs/platform/extensibility/experience-builder/external-authentication-with-a-custom-login-system/use-an-existing-identity-provider.md): Learn how to reuse an identity provider that already signs JWTs and publishes a JWKS URL. - [Validate external login](https://zuora.ferndocs.com/docs/platform/extensibility/experience-builder/external-authentication-with-a-custom-login-system/validate-external-login.md): Learn how to verify the complete sign-in flow for full Experience pages and embedded Experience components. - [External login tenant settings](https://zuora.ferndocs.com/docs/platform/extensibility/experience-builder/external-authentication-with-a-custom-login-system/external-login-tenant-settings.md): Use this reference to configure the tenant values required for external login. - [External login cookie attributes](https://zuora.ferndocs.com/docs/platform/extensibility/experience-builder/external-authentication-with-a-custom-login-system/external-login-cookie-attributes.md): Use this reference to set the cookie that carries the signed JWT. - [External login JWT claims](https://zuora.ferndocs.com/docs/platform/extensibility/experience-builder/external-authentication-with-a-custom-login-system/external-login-jwt-claims.md): Use this reference to create or validate the claims in the JWT. - [External login responsibilities](https://zuora.ferndocs.com/docs/platform/extensibility/experience-builder/external-authentication-with-a-custom-login-system/external-login-responsibilities.md): Use this reference to identify which part of the authentication flow performs each action. - [External login validation checklist](https://zuora.ferndocs.com/docs/platform/extensibility/experience-builder/external-authentication-with-a-custom-login-system/external-login-validation-checklist.md): Use this reference to verify common configuration conditions before publishing external login. - [Use case example](https://zuora.ferndocs.com/docs/platform/extensibility/experience-builder/external-authentication-with-a-custom-login-system/use-case-example.md): This example shows how Jane signs in to your site, receives a JWT in a login cookie, and accesses Zuora Experiences based on her mapped role. - [Integration responsibilities](https://zuora.ferndocs.com/docs/platform/extensibility/experience-builder/external-authentication-with-a-custom-login-system/integration-responsibilities.md): This topic describes the components involved in the Zuora Experience authentication integration and outlines their responsibilities in the end-to-end login flow. - [Quick checklist to go live](https://zuora.ferndocs.com/docs/platform/extensibility/experience-builder/external-authentication-with-a-custom-login-system/quick-checklist-to-go-live.md): Use this checklist to configure JWT-based single sign-on for Zuora Experience, whether you are creating new keys and a JWKS or using an existing identity provider. - [Common errors](https://zuora.ferndocs.com/docs/platform/extensibility/experience-builder/external-authentication-with-a-custom-login-system/common-errors.md)