Authenticate with an external JWT

Sign users into Dynamic with a JWT issued by your own authentication provider.

Bring Your Own Auth (BYOA) is an enterprise feature. Contact us in Slack or at [e-mail] to enable it.

If you already issue your own JWTs (e.g. from Auth0, Firebase Auth, Supabase, or your own backend), you can exchange that JWT for a Dynamic session. After sign-in, the user behaves like any other Dynamic user, with access to wallets, user management, and the rest of the SDK.

For concepts and configuration, see Bring Your Own Auth.

Issue a Dynamic-specific JWT from your auth provider, separate from your application’s normal access token, so the token Dynamic receives cannot be used to access resources on your own servers. See Bring Your Own Auth for the full recommendation.

Prerequisites

• BYOA configured in your Dynamic developer console (issuer, JWKS URL).
• Before this: create and initialize a Dynamic client (see Creating a Dynamic Client, Initializing the Dynamic Client).
• Your backend issues a JWT with at least iss, sub, and exp claims.

Usage

Call signInWithExternalJwt with the JWT issued by your auth provider. Dynamic verifies the signature against your configured JWKS URL, validates the claims, and establishes a session.

import { signInWithExternalJwt } from '@dynamic-labs-sdk/client';

const signIn = async (externalJwt) => {
  try {
    await signInWithExternalJwt({
      externalJwt,
    });

  } catch (e) {
    console.error('Dynamic sign-in failed:', e);
  }
};

Parameters

Parameter	Type	Required	Description
externalJwt	string	No	The raw encoded JWT issued by your authentication provider. Not required when using cookie based auth.
sessionPublicKey	string	No	Public key for session based auth.

Dynamic derives the external user ID from the sub claim in the JWT, so you do not pass it in.

Related

• Bring Your Own Auth: concepts, configuration, and JWT requirements.
• External auth step-up: issue elevated access tokens from your backend for sensitive actions.