title: How Custom Authentication Works in MongoDB Stitch
body: <p>Following <a href="https://docs.mongodb.com/stitch/authentication/custom/" rel="nofollow noreferrer">MongoDB Custom Authentication</a>, it is given that any <code>JWT Token</code> with the minimal below fields works with the MongoDB Stitch Authentication. Also, token needs to be issued by <code>External Authentication System</code></p>
  
  <pre><code>{
    "aud": "&lt;stitch app id&gt;"
    "sub": "&lt;unique user id&gt;",
    "exp": &lt;NumericDate&gt;,
  }
  </code></pre>
  
  <p>I've tested this and it works as well</p>
  
  <ol>
  <li>Created Stitch App and enabled Users with <code>Custom Authentication Provider</code></li>
  <li>Generated Sample Token through <a href="https://jwt.io/#debugger-io?token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhdWQiOiI8c3RpdGNoLWFwcC1pZD4iLCJzdWIiOiI8dW5pcXVlLWlkPiIsImlhdCI6MTUxNjIzOTAyMn0.XkluqPcBbCOl6fejWJVN1eV5InCP_Y3w8FpysKQWh-Y" rel="nofollow noreferrer">Jwt.io</a> with the below inputs. (Use same algorithm and key as configured when enabling Custom Authentication Provider, Here it is, HS256 and the )</li>
  </ol>
  
  <p><a href="https://i.stack.imgur.com/IF9Nt.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/IF9Nt.png" alt="enter image description here"></a></p>
  
  <p>It works in the way,</p>
  
  <ul>
  <li>It is validating the users in MongoDB Stich Users Collection with the unique <code>value</code> provided in <code>sub</code>: <code>"sub": "&lt;unique user id&gt;"</code> and if the user is present then it returning the Object Id for that User.</li>
  <li>If the user is not present then it is creating one against the input and returning the Object Id.</li>
  </ul>
  
  <p>Queries are,</p>
  
  <ol>
  <li>Why it is creating a new user instead of returning login failure, which in turn works like any user can log in with any credentials on demand?</li>
  <li>If <code>MongoDB Stitch Custom Authentication</code> involves <code>External Authentication System</code> to issue <code>JWT</code>, where the user data will be actually stored when user registration? - <code>MongoDB Stitch App Collection</code> or <code>External Authentication API System</code>?</li>
  </ol>