> ## Documentation Index
> Fetch the complete documentation index at: https://docs.dynamic.xyz/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Authenticate with an external JWT

> Sign users into Dynamic with a JWT issued by your own authentication provider.

> [!NOTE]
>
> Bring Your Own Auth (BYOA) is an enterprise feature. Contact us [in Slack](https://dynamic.xyz/slack) or at [dynamic@fireblocks.com](mailto:dynamic@fireblocks.com) to enable it.

If you already issue your own JWTs (e.g. from Auth0, Firebase Auth, Supabase, or your own backend), you can exchange that JWT for a Dynamic session. After sign-in, the user behaves like any other Dynamic user, with access to wallets, user management, and the rest of the SDK.

For concepts and configuration, see [Bring Your Own Auth](https://docs.dynamic.xyz/docs/auth/bring-your-own-auth.md).

> [!NOTE]
>
> Issue a Dynamic-specific JWT from your auth provider, separate from your application's normal access token, so the token Dynamic receives cannot be used to access resources on your own servers. See [Bring Your Own Auth](https://docs.dynamic.xyz/docs/auth/bring-your-own-auth.md) for the full recommendation.

## Prerequisites

* [BYOA configured](https://docs.dynamic.xyz/docs/auth/bring-your-own-auth.md) in your Dynamic Console (issuer, JWKS URL).
* Before this: create and initialize a Dynamic client (see [Creating a Dynamic Client](https://docs.dynamic.xyz/docs/javascript/reference/client/create-dynamic-client.md), [Initializing the Dynamic Client](https://docs.dynamic.xyz/docs/javascript/reference/client/initialize-dynamic-client.md)).
* Your backend issues a JWT with at least `iss`, `sub`, and `exp` claims.

## Usage

Call `signInWithExternalJwt` with the JWT issued by your auth provider. Dynamic verifies the signature against your configured JWKS URL, validates the claims, and establishes a session.

```javascript theme={"system"}
import { signInWithExternalJwt } from '@dynamic-labs-sdk/client';

const signIn = async (externalJwt) => {
  try {
    await signInWithExternalJwt({
      externalJwt,
    });

  } catch (e) {
    console.error('Dynamic sign-in failed:', e);
  }
};
```

## Parameters

| Parameter | Type | Required | Description |
| - | - | - | - |
| `externalJwt` | `string` | No | The raw encoded JWT issued by your authentication provider. Not required when using cookie based auth. |
| `sessionPublicKey` | `string` | No | Public key for session based auth. |

Dynamic derives the external user ID from the `sub` claim in the JWT, so you do not pass it in.

## Related

* [Bring Your Own Auth](https://docs.dynamic.xyz/docs/auth/bring-your-own-auth.md): concepts, configuration, and JWT requirements.
* [External auth step-up](https://docs.dynamic.xyz/docs/javascript/authentication-methods/step-up-auth/external-auth.md): issue elevated access tokens from your backend for sensitive actions.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.