SpaceMediaSpaceMedia
Brand Settings

JWT SSO (Zendesk)

Settings > Brand Settings > JWT SSO (Zendesk) lets a customer who is already signed in to your portal open your Zendesk help center without logging in again.

This is a purpose-built Zendesk integration, separate from the general-purpose SSO Identity and SSO Consumer sections.

When you would use this

You run support on Zendesk and you want customers to reach it from inside the portal without a second account. Everything Zendesk knows about who they are comes from the signed handoff your portal sends.

If you use the in-portal Support Desk Manager instead, you do not need this.

The three fields

FieldDirectionWhat it is
Client redirect URIRead-onlyThe login URL that receives the Zendesk JWT handoff for your workspace. Copy this into Zendesk
Return URLYou enter itThe Zendesk URL users land on once the handshake completes
JWT SecretYou enter itThe shared signing secret used to generate the Zendesk-compatible token

Setting it up

  1. In Zendesk, enable JWT single sign-on and generate a shared secret.
  2. Paste that secret into JWT Secret here.
  3. Copy the Client redirect URI from this page into your Zendesk SSO configuration as the remote login URL.
  4. Enter the Return URL that Zendesk should land users on.
  5. Save, then test the handoff with a real customer account.

Leave the JWT Secret field empty when re-saving to keep the stored secret unchanged.

The secret is the whole security model

Anyone holding this secret can mint a token that Zendesk will accept as any user. Store it in a secret manager, never paste it into a ticket or a screenshot, and rotate it in both systems at the same time if it is ever exposed.

Testing the handoff

  1. Sign in to your portal as a test customer.
  2. Open the help center link from inside the portal.
  3. Confirm Zendesk shows the correct name and email, not a new empty profile.
  4. Sign out of the portal and confirm a fresh handoff is required.

If the handoff fails

SymptomUsual cause
Zendesk rejects the tokenThe secret differs between the two systems, or was rotated in only one
The user arrives as a new blank profileZendesk is matching on a field the handoff does not provide
Users land on the wrong pageThe Return URL points somewhere other than the intended help center entry point
Nothing happensThe remote login URL in Zendesk does not match the Client redirect URI shown here

Common questions

Does this work with help desks other than Zendesk? This section is built for Zendesk's JWT SSO scheme. For a general OAuth 2 integration, use SSO Identity Settings.

Does this replace my support email? No. Keep Support Settings filled in either way.

Why is this section greyed out? SSO sections are locked until the 30-day free trial is started with an authorized card. See Getting Started.

Was this page helpful?

On this page