JWT SSO (Zendesk)
Settings > Brand Settings > JWT SSO (Zendesk) lets a customer who is already signed in to your portal open your Zendesk help center without logging in again.
This is a purpose-built Zendesk integration, separate from the general-purpose SSO Identity and SSO Consumer sections.
When you would use this
You run support on Zendesk and you want customers to reach it from inside the portal without a second account. Everything Zendesk knows about who they are comes from the signed handoff your portal sends.
If you use the in-portal Support Desk Manager instead, you do not need this.
The three fields
| Field | Direction | What it is |
|---|---|---|
| Client redirect URI | Read-only | The login URL that receives the Zendesk JWT handoff for your workspace. Copy this into Zendesk |
| Return URL | You enter it | The Zendesk URL users land on once the handshake completes |
| JWT Secret | You enter it | The shared signing secret used to generate the Zendesk-compatible token |
Setting it up
- In Zendesk, enable JWT single sign-on and generate a shared secret.
- Paste that secret into JWT Secret here.
- Copy the Client redirect URI from this page into your Zendesk SSO configuration as the remote login URL.
- Enter the Return URL that Zendesk should land users on.
- Save, then test the handoff with a real customer account.
Leave the JWT Secret field empty when re-saving to keep the stored secret unchanged.
Anyone holding this secret can mint a token that Zendesk will accept as any user. Store it in a secret manager, never paste it into a ticket or a screenshot, and rotate it in both systems at the same time if it is ever exposed.
Testing the handoff
- Sign in to your portal as a test customer.
- Open the help center link from inside the portal.
- Confirm Zendesk shows the correct name and email, not a new empty profile.
- Sign out of the portal and confirm a fresh handoff is required.
If the handoff fails
| Symptom | Usual cause |
|---|---|
| Zendesk rejects the token | The secret differs between the two systems, or was rotated in only one |
| The user arrives as a new blank profile | Zendesk is matching on a field the handoff does not provide |
| Users land on the wrong page | The Return URL points somewhere other than the intended help center entry point |
| Nothing happens | The remote login URL in Zendesk does not match the Client redirect URI shown here |
Common questions
Does this work with help desks other than Zendesk? This section is built for Zendesk's JWT SSO scheme. For a general OAuth 2 integration, use SSO Identity Settings.
Does this replace my support email? No. Keep Support Settings filled in either way.
Why is this section greyed out? SSO sections are locked until the 30-day free trial is started with an authorized card. See Getting Started.
Was this page helpful?
SSO Consumer Settings
Let your users sign in to your SpaceMedia portal with an external OAuth 2 identity provider by supplying the client credentials and the authorize, token, and user info endpoints.
Terms of Service
Publish the terms of service for your branded SpaceMedia portal, covering catalog obligations, payments, revenue splits, and when to update them.