Configure JWT in Document360

Create a JSON Web Token (JWT) configuration in Document360 so readers who sign in to your application can open your private knowledge base site without a separate Document360 account. You set the project login options, create the configuration, and copy the Client ID, URLs and secret tokens your developers need to connect your application. Readers then sign in with tokens from your application or identity provider.

When to use JWT

Your readers already have accounts in your own application, and you want them to reach the knowledge base site from there.
You want to control reader sign-in and reader access from your application instead of creating reader accounts in Document360.
You need separate sign-in flows for different domains or audiences. A project can have up to 5 JWT configurations.

If your organization signs in through an identity provider such as Okta or Microsoft Entra ID, use SAML or OpenID Connect instead. To compare the options, see JWT.

Before you begin

You need the Owner or Admin project role to configure JWT in Document360.
You need a developer who can add the sign-in route to your application's backend.
Know the sign-in page URL of your application (for example, https://app.example.com/login). You enter it as the Login URL.
Have a secure place, such as a secrets manager, ready to store the secret tokens. Document360 shows them only once.

You create and manage JWT configurations at Settings () > Users & Permissions > Enterprise SSO.

Enterprise SSO page in Document360 settings, listing SSO and JWT configurations with the Create SSO button.

If you already have a JWT configuration

If you set up JWT before October 2026, your configuration now appears in the Enterprise SSO list alongside any SAML or OpenID Connect configurations. It stays active, and readers keep signing in without interruption. From the list, you can:

Keep using the configuration. No changes are needed.
Click the Edit icon to update its settings.
Click the Delete icon to remove it. See Limits and limitations before you delete the last active configuration.

To add another JWT configuration, follow Step 2. Your existing configuration is not changed.

How to configure JWT in Document360

Complete these steps in order. Steps 1 and 2 happen in Document360. Step 3 happens in your application.

Step 1: Configure JWT login

The login settings apply to the whole project and to every sign-in option, not to a single JWT configuration. You set them once.

Go to Settings () > Users & Permissions > Enterprise SSO.
Click Settings at the top right of the page.

The Login settings dialog opens.

Login settings dialog with the Direct JWT login and Disable default login page toggles.

Choose whether to turn on Direct JWT login (default: ON).
- Turn it on to send readers straight to JWT sign-in without a login selection screen. Use it when JWT is the only sign-in method, or when you want readers to sign in only through JWT even though SSO is also configured.
- Turn it off when several sign-in methods are active and readers need to choose one. Readers then see a login selection screen with all configured sign-in options (JWT, SSO and the default Document360 login). You confirm the change before it applies.
Choose whether to turn on Disable default login page (default: OFF). When it is on, the Document360 email and password login is hidden, and readers can sign in only through your JWT or SSO configurations. Teams that control all reader access through a central identity system use this setting.

CAUTION

Turn on Disable default login page only after you have fully configured and tested JWT or SSO sign-in. If the external authentication is misconfigured, readers can't access the knowledge base.

Click Close.

Your changes apply immediately.

NOTE

To change where the JWT login button appears among other sign-in options on your knowledge base site, drag the configuration to a new position in the Enterprise SSO list, or use keyboard reordering. For details, see Managing JWT configurations.

Step 2: Create a JWT configuration

On the Enterprise SSO page, click Create SSO.
Select JWT (Authenticate users with JWTs from your application).

The Create SSO - JWT modal opens on the Authentication tab.

Create SSO - JWT modal, Authentication tab, showing the Name field, the Callback URL, Code generation URL and Client ID, and the JWT keys.

In Name, enter a name that identifies this configuration, for example "Customer Portal SSO". The name appears in the Enterprise SSO list. If you show a login button for this configuration, readers also see this name on the login page, so choose one they will recognize.

Copy the Authentication values with the Copy icon next to each one. These are read-only values that Document360 generates.

Field	Description
Callback URL	The redirect URL where the identity provider sends readers after successful authentication. Register this in your IdP to complete the sign-in process.
Code generation URL	The endpoint Document360 calls to retrieve the token used to sign in readers.
Client ID	The unique identifier for this JWT configuration. Add it to your application.

Under JWT keys, copy the Primary secret token and the Secondary secret token, and store them securely.

Token	Purpose
Primary secret token	Signs and verifies JWT authentication requests between your application and Document360. This is the Client Secret your application uses with the Client ID. Keep it confidential. If it is exposed, regenerate it immediately and update your application.
Secondary secret token	A backup signing key for credential rotation. While you update the primary token, the secondary token lets authentication continue without interruption.

IMPORTANT

Secret tokens appear in plain text only while this modal is open. After you close it, they are masked and can't be retrieved. If you lose them, you must regenerate them, which immediately invalidates the previous tokens.

Click Next.

The Server settings tab opens.

Enter the server settings.

Field	Required	Description
Login URL	Yes	The sign-in page in your application where readers are sent to authenticate (for example, `https://app.example.com/login`).
Logout URL	No	The page readers are sent to after they sign out (for example, `https://app.example.com/logout`). If you leave it empty, readers go to Document360's default JWT logout page.
Domain name	Automatic	Filled in automatically from the Login URL. When a reader enters this domain on the login page, Document360 sends them to this configuration's Login URL.

The domain name follows these rules:

Subdomains are separate entries. portal.example.com and example.com are different domains and can belong to different configurations.
Wildcard domains such as *.example.com aren't supported. Each domain must be an exact value.
Each domain must be unique across the JWT configurations in the project. If another configuration already uses it, an inline error appears when you save.

(Optional) Expand Advanced settings and set these options:
- Enable JWT authentication (default: ON): keep it on so readers can sign in with this configuration. Turn it off to suspend the configuration without deleting its settings.
- Show login button (default: OFF): turn it on to show a login button for this configuration on the knowledge base login page, so readers don't have to enter a domain name. When it is on, enter the Login button text that tells readers where they are signing in, and optionally upload a Login button logo (JPG, PNG or SVG, up to 512 KB).
Click Create. The button stays inactive until every required field has a valid value.

The modal closes, and the new configuration appears in the Enterprise SSO list.

Step 3: Set up your application

Give your developers these values. They add them to your application's backend.

Value	Where to find it
Client ID	Authentication tab of the configuration
Callback URL	Authentication tab of the configuration
Code generation URL	Authentication tab of the configuration
Client Secret (Primary secret token)	JWT keys, copied when you created the configuration
Secondary secret token	JWT keys, copied when you created the configuration. Used during token rotation.

Your developers then build the backend route that sends signed-in readers to the knowledge base site. See Implement JWT in your application.

Readers don't need a Document360 account. An account in your application is enough to access the knowledge base.

Limits and limitations

Limit	Details
JWT configurations per project	Up to 5.
JWT login buttons on the login page	Up to 3 at a time. When the limit is reached, the Show login button toggle is disabled for other configurations. Readers of those configurations sign in by entering their domain name in the Domain name field on the login page.
Wildcard domains	Not supported.
Secret tokens	Shown only once, when you create the configuration. Regenerating a token invalidates the previous one.
Last active configuration	If this is the only active SSO or JWT configuration and the default login page is disabled, you can't turn it off or delete it. Document360 shows this message: "This is the only active SSO or JWT configuration and the default login page is disabled, so turning it off or deleting it would lock everyone out. Enable another configuration, or turn the default login page back on, first."
Sign-in scope	JWT signs readers in to the knowledge base site. It doesn't sign users in to the knowledge base portal.

Best practices

Store the secret tokens in a secrets manager as soon as you copy them, and never put them in client-side code.
Give each configuration a name readers recognize, especially if you show its login button.
Test the setup with Test your JWT configuration before you turn on Disable default login page.
Turn on Direct JWT login only when JWT is the sign-in method you want readers to use.
Turn a configuration off instead of deleting it when you only need to pause it. Its settings are kept.

FAQ

Do readers need a Document360 account to sign in with JWT?

No. Readers sign in to your application, and an account there is enough to access the knowledge base site.

Can I use JWT together with SAML or OpenID Connect?

Yes. To add SSO alongside JWT, click Create SSO on the Enterprise SSO page and select SAML or OpenID Connect. Your JWT configuration isn't affected. Both stay active, and readers see both options on the login page. See Managing JWT configurations for how the login page looks.

What if I lose my secret tokens?

You can't view them again. Edit the configuration and click Regenerate next to the token. The old token stops working immediately, so update your application with the new one right away. See Managing JWT configurations.

Why can't I turn off or delete my JWT configuration?

Document360 blocks the action when it is the only active SSO or JWT configuration and the default login page is disabled, because it would lock everyone out. Turn on another configuration, or turn the default login page back on, and try again.