Authenticate with an external JWT

Bring Your Own Auth (BYOA) is an enterprise feature. Contact us in Slack or at hello@dynamic.xyz to enable it.

If you already issue your own JWTs (e.g. from Auth0, Firebase Auth, Supabase, or your own backend), you can exchange that JWT for a Dynamic session. After sign-in, the user behaves like any other Dynamic user — with access to wallets, user management, and the rest of the SDK. For concepts and configuration, see Bring Your Own Auth.

Issue a Dynamic-specific JWT from your auth provider — separate from your application’s normal access token — so the token Dynamic receives cannot be used to access resources on your own servers. See Bring Your Own Auth for the full recommendation.

Prerequisites

BYOA configured in your Dynamic dashboard (issuer, JWKS URL).
Before this: create and initialize a Dynamic client (see Creating a Dynamic Client, Initializing the Dynamic Client).
Your backend issues a JWT with at least iss, sub, and exp claims.

Usage

Call signInWithExternalJwt with the JWT issued by your auth provider. Dynamic verifies the signature against your configured JWKS URL, validates the claims, and establishes a session.

import { signInWithExternalJwt } from '@dynamic-labs-sdk/client';

const signIn = async (externalJwt, externalUserId) => {
  try {
    await signInWithExternalJwt({
      externalJwt,
      externalUserId,
    });

  } catch (e) {
    console.error('Dynamic sign-in failed:', e);
  }
};

Parameters

Parameter	Type	Required	Description
`externalJwt`	`string`	Yes	The raw encoded JWT issued by your authentication provider.
`externalUserId`	`string`	Yes	The user ID in your authentication system. Must match the `sub` claim in the JWT — Dynamic derives the stored external user ID from the JWT server-side.

Bring Your Own Auth — Concepts, configuration, and JWT requirements.
External auth step-up — Issue elevated access tokens from your backend for sensitive actions.

Last modified on June 24, 2026

Cookie-based authenticationConfigure the JavaScript SDK to use cookie-based authentication with a custom API base URL.

⌘I

Installation & Configuration

Chains & Networks

Authenticate

User & Session Management

Wallets

Flow

Swaps

Funding & Onramp

Events

Building UI

Migrating from React

Authenticate with an external JWT

Prerequisites

Usage

Parameters

​Prerequisites

​Usage

​Parameters

​Related

Prerequisites

Usage

Parameters

Related