Sorry, I don’t know offhand. I’d have to poke in the source.
There is no reason to update the external key, keys aren’t supposed to change.
The other thing you might do is have both systems count on having the email address be the same.
My guess is that sso is what you’ll want to do