Identity provider token endpoint down

Your SaaS app uses a third-party identity provider (Auth0-style) for all social and SSO login. At 09:05 support reports a flood of 'can't log in' tickets. Dashboards: your login success rate dropped from 99% to 12%; the IdP's token endpoint is returning 500s and its JWKS endpoint is timing out. Existing logged-in sessions are unaffected. You shipped a config change to your IdP tenant 40 minutes ago that rotated a signing key. The IdP's public status page says 'all systems operational.' How do you triage and mitigate?