# Add an External JWT IdP Complete a FusionAuth login with an external JWT from a third party Identity Provider. > For the index of this section of the site, see [llms.txt](https://fusionauth.io/docs/llms.txt) The External JWT Identity Provider is not intended to provide a login button in FusionAuth. Instead, this configuration is intended for use with the JWT Reconcile API. * [External JWT API](https://fusionauth.io/docs/apis/identity-providers/external-jwt.md) * [Reconcile a JWT API](https://fusionauth.io/docs/apis/jwt/reconcile-a-jwt-using-the-external-jwt-provider.md) Using this identity provider allows you to authenticate with a third party that can provide you a JSON Web Token (JWT). Then you may take this JWT and send it to FusionAuth to reconcile the user. The reconcile process is essentially logging that user into a particular FusionAuth application. The configuration for this identity provider allows you to configure some claim mapping from the third party JWT to the FusionAuth user, and it will require one or more keys that will allow FusionAuth to verify the signature of the third party JWT. These keys will be added to the `Verification Keys` section documented below. Caution This external JWT Identity Provider flow is not compatible with the hosted login pages. This integration is accessible through our API only. Additionally, if you are integrating with any of the identity providers for which there is a provided Identity Provider integration (whether specific like Facebook or generic like OIDC), prefer those options over this provider. In general, you should use the `/api/identity-provider/login` endpoint of another Identity Provider rather than the External JWT provider if one is available. If you are looking to add a login button to FusionAuth for users to authenticate against a third party identity provider, this is not the configuration you're looking for, move along. ## Add an External JWT Identity Provider To enable External JWT for an Application: 1. Navigate to Settings -> Identity Providers . 2. Click the Add provider dropdown and select External JWT . This will take you to the Add External JWT screen. 3. Fill out the required fields; your identity provider can provide most of these values. For a detailed description of each field, see the [documentation for External JWT](https://fusionauth.io/docs/lifecycle/authenticate-users/identity-providers/external-jwt.md#form-fields). 4. In the Applications configuration section at the bottom of this panel, find your application name. 5. To dynamically create FusionAuth user accounts (with default roles) for all users who successfully authenticate using this provider, select Create registration . If you disable this option, only an administrator with registration permissions can create new users for this application with access via Sign in with External JWT. 6. You should now see the Sign in with External JWT button on the login page for the Pied Piper application. ![Add External JWT](https://fusionauth.io/img/docs/lifecycle/authenticate-users/identity-providers/external-jwt/identity-provider-external-jwt-add.png) ### Form Fields `Id` * optional An optional UUID. When this value is omitted a unique Id will be generated automatically. `Tenant` * optional * Available since 1.62.0 The tenant to which this identity provider belongs. This field only displays when the user selects a specific tenant on the previous page. When `Global identity provider` is selected on the previous page, this field does not display. `Name` * required A unique name to identify the identity provider. This name is for display purposes only and it can be modified later if desired. `Reconcile lambda` * optional * Available since 1.17.0 A lambda may be utilized to map custom claims from the JWT. This may be used in addition to, or in place of the claim mapping on the JWT tab. To configure a lambda, navigate to Customizations -> Lambdas . `Linking strategy` * optional * Available since 1.28.0 The linking strategy for this identity provider. [See Linking Strategies for more](https://fusionauth.io/docs/lifecycle/authenticate-users/identity-providers.md#linking-strategies). Available since `1.65.0` You can **only** change this value when the identity provider is **disabled**. To change the linking strategy for an identity provider that is already enabled, disable the provider, change the value, and then re-enable the provider. When the **Linking strategy** is equal to `Link on email. Create the user if they do not exist.` or `Link on email. Do not create the user if they do not exist.` and the **email\_verified** claim is present on the response from the External JWT Identity Provider and the value is `false` a link will not be established and an error will be returned indicating a link cannot be established using an unverified email address. `Enable debug logging` * optional * Defaults to false Creates event log entries to help debug integration errors. Check System -> Event Log . ## Applications To enable this identity provider for an application, find your application name in the table. You will always see the `FusionAuth` application, this application represents the FusionAuth user interface. If you wish to be able to log into FusionAuth with this provider you may enable this application. In the above screenshot, you will see that we have enabled this login provider for the `Pied Piper` application and enabled `Create registration`. Enabling create registration means that a user does not need to be manually registered for the application before using this login provider. For example, when a new user attempts to log into `Pied Piper` using this identity provider, if their user does not exist in FusionAuth it will be created dynamically, and if the `Create registration` toggle has been enabled, the user will also be registered for `Pied Piper` and assigned any default roles assigned by the application. If you do not wish to automatically provision a user for this Application when logging in with PiedPiper, leave `Create registration` off and you will need to manually register a user for this application before they may complete login with this provider. ## JWT This configuration is necessary to allow FusionAuth to properly inspect the third-party JWT once the signature has been verified. ![Add External JWT](https://fusionauth.io/img/docs/lifecycle/authenticate-users/identity-providers/external-jwt/identity-provider-external-jwt-jwt-add.png) ### Form Fields `Unique Id claim` * optional * Defaults to sub The name of the claim that will contain the user's unique Id. `Email claim` * optional * Defaults to email The name of the claim that will contain an email address. `Email verified claim` * optional * Defaults to email\_verified * Available since 1.48.0 The name of the claim that will contain the email verified claim. When the linking strategy is configured to `Link on email. Create the user if they do not exist.` or `Link on email. Do not create the user if they do not exist.`, a link will be rejected if this claim is returned by the identity provider and the value is `false`. `Username claim` * optional * Defaults to preferred\_username The name of the claim that will contain the user's username. `Header key identifier` * optional * Defaults to kid This value is the name of the claim in the third-party JWT header FusionAuth can find the identifier used to indicate which key pair was used to generate the JWT signature. This allows FusionAuth to use the correct key if more than one key is provided in the `Verification Keys` configuration. This field defaults to `kid`, this is a common identifier used in the JWT header to identify the key used to generate the signature. `Verification keys` * required * Available since 1.69.0 The keys stored in Key Master that are used to verify the third-party JWT sent back to FusionAuth from the identity provider. `Unique claim` * optional * Deprecated This value is the name of the claim in the third-party JWT where FusionAuth can find the user's email address. The email address will be used in FusionAuth to uniquely identify a user. This field defaults to `email`, this is likely the correct claim name. ## Managed domains To successfully reconcile a JWT to FusionAuth using this identity provider, you can *optionally* specify one more managed domains. A managed domain will indicate to FusionAuth this identity provider can reconcile a user based upon their email address. For example, if a user's email address is `jared@piedpiper.com`, in order for a JWT owned by Jared to be reconciled to FusionAuth using this identity provider, `piedpiper.com` could be configured as a managed domain. You may leave this blank. If you do so, then any email can be used with this identity provider. This is helpful if you are not certain which email domains your users will have. A domain may only be managed by a single identity provider in the context of a given tenant. More than one domain may be added per identity provider. Learn more about [managed domains](https://fusionauth.io/docs/lifecycle/authenticate-users/identity-providers.md#managed-domains). ![Add External JWT](https://fusionauth.io/img/docs/lifecycle/authenticate-users/identity-providers/external-jwt/identity-provider-external-jwt-domains-add.png) ### Form Fields `Managed domains` * optional This identity provider may only be used to reconcile a user that has an email address that matches a configured domain. If you do not know which domains you would like to manage, you may leave this empty for now and return and add them later. If you would like to add more than one domain, use a separate line per domain. These configured domains will be used by the [Lookup API](https://fusionauth.io/docs/apis/identity-providers.md#lookup-an-identity-provider) and the [Reconcile API](https://fusionauth.io/docs/apis/jwt/reconcile-a-jwt-using-the-external-jwt-provider.md). ## Claim mapping All configured claim mappings will be visible here. Use the Add Claim button to add additional claim mappings. You may optionally perform all of the claim mapping using a Reconcile lambda function. ## Add Claim Mapping Dialog If you click on the Add Claim button on this page you will be presented with the following dialog. ![Add Claim Mapping](https://fusionauth.io/img/docs/lifecycle/authenticate-users/identity-providers/external-jwt/identity-provider-external-jwt-add-claim-dialog.png) ### Form Fields `Incoming claim` * required The name of the claim in the third-party JWT that you would like to map to a FusionAuth user claim `FusionAuth claim` * required The FusionAuth user claim to receive the value of the specified claim in the third-party JWT. If you select the special values `UserData` or `RegistrationData` the value will be stored in either the user or registration data with the key being the claim name. For example, if you select `company` as the incoming claim, and specify **RegistrationData**, the claim will be stored in the registration data for the corresponding application. ```json { "registration": { "data": { "company": "Acme. Corp" } } } ``` ## OAuth The OAuth configuration is not a functional part of this identity provider. Instead, it is provided for convenience only. If you review the API response of the [Lookup API](https://fusionauth.io/docs/apis/identity-providers.md#lookup-an-identity-provider) you will notice it returns these two values. You may use these values then at runtime to identify where to redirect the user to complete authentication. ![Add External JWT](https://fusionauth.io/img/docs/lifecycle/authenticate-users/identity-providers/external-jwt/identity-provider-external-jwt-oauth-add.png) ### Form Fields `Authorization endpoint` * optional The URL of the OAuth 2.0 Authorization endpoint in use by the third-party identity provider that will be providing the third-party JWT. `Token endpoint` * optional The URL of the OAuth 2.0 Token endpoint in use by the third-party identity provider that will be providing the third-party JWT. Related [Lifecycle External JWT IdP Example Usage Learn how to federate identity using the External JWT Identity Provider. external jwtjwt identity provider](https://fusionauth.io/docs/lifecycle/authenticate-users/identity-providers/external-jwt/example.md) [APIs Authenticate with our APIs Learn how the FusionAuth APIs authenticate requests. jwt authentication](https://fusionauth.io/docs/apis/authentication.md) [APIs External JWT API Learn about the APIs for creating, retrieving, updating and deleting external JWT identity providers. external jwt](https://fusionauth.io/docs/apis/identity-providers/external-jwt.md) [APIs Reconcile a JWT Using the External JWT Provider API API documentation for the FusionAuth Reconcile a JWT Using the External JWT Provider API. reconcile jwt](https://fusionauth.io/docs/apis/jwt/reconcile-a-jwt-using-the-external-jwt-provider.md) --- ## Other pages in Identity Providers > For the full index of this section, see [Lifecycle](https://fusionauth.io/docs/llms-lifecycle.txt). - [Add a SAML v2 with ADFS IdP](https://fusionauth.io/docs/lifecycle/authenticate-users/identity-providers/enterprise/adfs.md): Configure SAML v2 for Active Directory Federation Services (ADFS). - [Add an OpenID Connect with Azure AD IdP](https://fusionauth.io/docs/lifecycle/authenticate-users/identity-providers/enterprise/azure-ad-oidc.md): Set up user login using Azure AD/Microsoft Entra ID as an OpenID Connect Identity Provider. - [Add a SAML v2 with Azure AD IdP](https://fusionauth.io/docs/lifecycle/authenticate-users/identity-providers/enterprise/azure-ad-saml.md): Configure SAML v2 for Azure Active Directory (Azure AD)/Microsoft Entra ID. - [Add a OpenID Connect with Cognito IdP](https://fusionauth.io/docs/lifecycle/authenticate-users/identity-providers/enterprise/cognito.md): Set up user login using Cognito as an OpenID Connect Identity Provider. - [Add a HYPR IdP](https://fusionauth.io/docs/lifecycle/authenticate-users/identity-providers/enterprise/hypr.md): Set up user login with HYPR using the HYPR Identity Provider. - [Add an OpenID Connect with Okta IdP](https://fusionauth.io/docs/lifecycle/authenticate-users/identity-providers/enterprise/okta-oidc.md): Learn how to set up user login using Okta as an OpenID Connect Identity Provider. - [Add a SAML v2 IdP-Initiated with Okta IdP](https://fusionauth.io/docs/lifecycle/authenticate-users/identity-providers/enterprise/okta-samlv2-idp-initiated.md): Configure SAML v2 IdP-Initiated SSO With Okta. - [Add a SAML v2 with Okta IdP](https://fusionauth.io/docs/lifecycle/authenticate-users/identity-providers/enterprise/okta-samlv2.md): Configure SAML v2 for Okta. - [Add a SAML v2 IdP-Initiated IdP](https://fusionauth.io/docs/lifecycle/authenticate-users/identity-providers/enterprise/samlv2-idp-initiated.md): Set up user login using a SAML v2 IdP-Initiated Identity Provider. - [External JWT IdP Example Usage](https://fusionauth.io/docs/lifecycle/authenticate-users/identity-providers/external-jwt/example.md): Learn how to federate identity using the External JWT Identity Provider. - [Add an OpenID Connect with Discord IdP](https://fusionauth.io/docs/lifecycle/authenticate-users/identity-providers/gaming/discord.md): Learn how to set up user log in using Discord as an OpenID Connect Identity Provider. - [Add an Epic Games IdP](https://fusionauth.io/docs/lifecycle/authenticate-users/identity-providers/gaming/epic-games.md): Learn more about user login with Epic Games using the Epic Games Identity Provider. - [Add a Nintendo IdP](https://fusionauth.io/docs/lifecycle/authenticate-users/identity-providers/gaming/nintendo.md): Learn more about user login with Nintendo using the Nintendo Identity Provider. - [Add a Sony PlayStation Network IdP](https://fusionauth.io/docs/lifecycle/authenticate-users/identity-providers/gaming/sony.md): Learn more about user login with Sony PlayStation using the Sony PlayStation Identity Provider. - [Add a Steam IdP](https://fusionauth.io/docs/lifecycle/authenticate-users/identity-providers/gaming/steam.md): Learn more about user login with Steam using the Steam Identity Provider. - [Add a Twitch IdP](https://fusionauth.io/docs/lifecycle/authenticate-users/identity-providers/gaming/twitch.md): Learn more about user login with Twitch using the Twitch Identity Provider. - [Add an Xbox IdP](https://fusionauth.io/docs/lifecycle/authenticate-users/identity-providers/gaming/xbox.md): Learn more about user login with Xbox using the Xbox Identity Provider. - [Add an Identity Provider (IdP)](https://fusionauth.io/docs/lifecycle/authenticate-users/identity-providers.md): An overview of all FusionAuth Identity Providers, which allow authentication delegation. - [Add an OpenID Connect IdP](https://fusionauth.io/docs/lifecycle/authenticate-users/identity-providers/overview-oidc.md): Learn more about user login using an OpenID Connect Identity Provider. - [Add an External SAML v2 IdP](https://fusionauth.io/docs/lifecycle/authenticate-users/identity-providers/overview-samlv2.md): Learn how to set up user log in using the SAML v2 Identity Provider. - [Add an Apple IdP](https://fusionauth.io/docs/lifecycle/authenticate-users/identity-providers/social/apple.md): Learn how to add a login with Apple button to your application. - [Add a Facebook IdP](https://fusionauth.io/docs/lifecycle/authenticate-users/identity-providers/social/facebook.md): Learn how to add a login with Facebook button to your application. - [Add a Github IdP](https://fusionauth.io/docs/lifecycle/authenticate-users/identity-providers/social/github.md): Set up user login using Github as an OpenID Connect Identity Provider. - [Add a Google IdP](https://fusionauth.io/docs/lifecycle/authenticate-users/identity-providers/social/google.md): Learn how to add a login with Google button to your application. - [Add a LinkedIn IdP](https://fusionauth.io/docs/lifecycle/authenticate-users/identity-providers/social/linkedin.md): Learn how to add a login with LinkedIn button to your application. - [Add a Twitter/X IdP](https://fusionauth.io/docs/lifecycle/authenticate-users/identity-providers/social/twitter.md): Learn how to add a login with Twitter/X button to your application.