This demo suite already uses Firebase Firestore under the hood for session storage. This post surfaces that same identifier as its own pattern: the Auth0 sub claim used as a stable foreign key into Firestore, deciding who can access an account and logging who did what once they're in.
Toby Allen
Solutions Engineer at Okta. I write about identity, access management, and security. This site archives my published articles, talks, and presentations.
Series - Indepth Explainers
Latest
FGA as an API Gateway Enforcement Point, Part 2: Apigee, AWS, and Zuplo
· Auth0, Auth0 FGA, Customer Identity Products
The same Auth0 FGA policy decision point, three different policy enforcement points. One ships a dedicated FGA policy out of the box, one hands you a function and lets you build it yourself, and one has no FGA story at all beyond two generic primitives chained together.
Four layers deep and a 404: finding the real Auth0 My Account API
· Auth0, My Account API, MFA
I asked Claude Code to build a demo of Auth0's real My Account API, not the Management API with a user token wearing its name. Four separate pieces of tenant configuration and one Early Access MFA policy stood between a correctly-written client and a working token - and the profile endpoint simply isn't there yet.
FGA as an API Gateway Enforcement Point: OpenFGA Behind a Cloudflare Worker
· Auth0, Auth0 FGA, Customer Identity Products
A real Cloudflare Worker in front of a real OpenFGA store, deciding every request's fate before a line of application code runs. The access token carries no permissions claim at all; the allow, deny, or unavailable verdict happens entirely at the gateway.
Embedded Passkey Step-Up, and Forcing User Verification Auth0 Won't Let You Configure
· Auth0, passkey, MFA
Re-verifying identity in-page with a passkey sounds like a small feature until you realise Auth0's own passkey verification route has no concept of who was already logged in. Plus a WebAuthn setting I couldn't find a dashboard control for anywhere, and the one place you can still override it.
What this site's traffic actually shows since the move to Next.js
· Security Industry, Careers and other Domains
The stats page on this site only ever showed the last 14 days, which meant every time I looked at it I was looking at noise. I rebuilt it to track lifetime totals properly, and the all-time numbers - covering the time since this site moved off WordPress - turned up a few things I didn't expect.