Auth0 Session & Token Management

Authorization Code Flow with server-side session cookie. Back-Channel Logout propagates revocation to all apps when a session ends. Shows active sessions via the Auth0 Session Management API.

Public browser client, no server-side session at all. DPoP binds the access token to an ephemeral ES256 key pair generated in IndexedDB — a stolen token is useless without the private key. A Post-Login Action stamps Refresh Token Metadata (device, browser, IP) on the refresh token at issuance.

Online Refresh Tokens are validated server-side on every exchange — Auth0 checks the token store rather than just verifying the signature. Revoke a session and the next getTokenSilently() call fails immediately, with no access-token grace period. No DPoP (intentional — isolates ORT from sender constraining).

Confidential OAuth client — tokens are stored server-side behind an HttpOnly session cookie and never reach the browser. The browser holds a session cookie; it never sees a bearer token. Multi-Resource Refresh Token (MRRT) exchanges one refresh token for access tokens scoped to multiple API audiences, entirely server-side.

SSO isolation via sso:false on the Auth0 client. Logging into any other app on this tenant does not carry over — the Authorization Server always forces fresh credentials. Demonstrates per-application session isolation for high-sensitivity surfaces.

Session transfer token bridges a native app session into a web browser session — no password re-entry. Single-use, 60-second expiry, IP-bound. Shows the exact exchange request, raw STT with countdown timer, and both sessions' tokens compared claim-by-claim.

Two genuinely separate web origins, same Auth0 tenant, default SSO settings — the mirror image of the High Trust App demo. Log into Brand A, then hit Brand B's prompt=none check: Auth0's own AS session cookie silently authenticates the second app with no login screen.

Auth0's new paved path for impersonation-style access: a support agent (actor) mints a Session Transfer Token via Custom Token Exchange, naming a different (subject) user and their own ID token as actor_token. Redeeming it establishes an ephemeral, 2-hour, IP-bound session as that user with an act claim recording the delegating agent — no refresh token, ever. Live tenant log panel shows the real sdel/sdeleacft/sdelsa audit codes.

Auth0's "Manage Sessions with Actions" post-login APIs, applied unconditionally by a dedicated always-ephemeral client rather than a client-asserted "shared device" flag. A Post-Login Action calls api.session.setCookieMode('non-persistent') plus tightened setExpiresAt/setIdleExpiresAt on every login; no offline_access scope means no refresh token is ever minted; this app's own session cookie is independently shortened to match. Session Management API panel shows the real cookie.mode and expiry as ground truth. Compare with Traditional Web App for the persistent-session contrast.

RFC 8693 token exchange: a middle-tier service presents the user's access token and receives a new token for a downstream API. The user's sub is preserved end-to-end; the act claim records the delegation chain. Demonstrates the canonical pattern for AI agent and microservice architectures.

Exchange any external token — JWT, SAML, or arbitrary format — for full Auth0 AT + ID Token + RT. An Auth0 Action validates the incoming token and maps it to an Auth0 user identity with no browser redirect and no Universal Login. Covers external IdP federation, migration, and device attestation.

Auth0 Connected Accounts + getAccessTokenForConnection() link Google Calendar and GitHub as secondary connections, independent of the primary login. Two columns compare live results side by side — real-first-fallback means a tester with only one of the two accounts still sees a full comparison, the other column clearly labeled simulated.

Auth0's Early Access Identity Assertion Authorization Grant for AI-agent-to-app access. An enterprise IdP issues a short-lived ID-JAG gated by admin policy; Agent0 (Requesting App) redeems it for a Todo0 (Resource App) access token via a real Auth0 jwt-bearer grant — no consent screen, no shared credential. The Enterprise IdP is simulated locally with jose-generated RS256 keys; Todo0 (Resource App) is real Auth0. Requesting App redemption is Auth0-side not-yet-shipped, so that one call attempts real Auth0 first and falls back to a clearly-labeled mock, switching over automatically once Auth0 ships it.

Client-Initiated Backchannel Authentication — a requesting device sends a real Auth0 Guardian push notification to a separate device for approval, with no redirect and no browser round-trip on the approver's side at all. Requires an Enterprise plan and genuine Guardian enrollment, not a simulated inbox.

RFC 8628 Device Code flow for input-constrained clients — a CLI tool or smart TV displays a code, and the user redeems it via real Universal Login on a second screen. No prior session, no MFA dependency, works on any Auth0 plan. Requires a native/public client — no client secret anywhere in the flow.

Capture a PostHog anonymous distinct_id before Auth0 login, then call posthog.identify() after callback to merge the pre-auth browsing journey into the authenticated user profile. In-app reporting panel queries the PostHog Events API to show the stitched timeline.

A first-party client issues a real OAuth access token (sub: anon@xxx) for an unidentified visitor via POST /anonymous/token, called directly from the browser so Auth0 can set its own session cookie. Contrasts a genuinely public catalog endpoint against a JWKS-verified cart endpoint, then hands off to a known user with zero extra code on the redirect.

A real, separately-deployed confidential Auth0 client running on Cloudflare Workers via @auth0/auth0-hono, compared against this suite's Traditional and BFF demos. Same OIDC flow, but a stateless encrypted-cookie session by default (no database) and an edge runtime instead of Node.js serverless — both genuinely different tradeoffs, not just a different host.