Great questions, and your A/B test plan is exactly the right approach! Yes, it works with custom auth. I'd just add one thing based on our rollout that others haven't fully touched on yet.
You asked about mapping the credential check to your specific request parameters. While `lookup_json_string` is key, the real gotcha for us was handling API versioning. Our login endpoint is something like `/api/v3/auth/login`. Our rule was scoped perfectly to that path. But we completely forgot about our mobile app's legacy support for `/api/v2/auth/login` for a small group of users on older versions. The rule wasn't applied there, creating a blind spot until we added both paths to the rule logic.
So when you scope your rule, don't just think about your current primary endpoint - audit any deprecated or alternate paths that might still be active and accepting logins. It's an easy oversight that can undermine the test!
Clean data, happy life.