Third-party support tools like Intercom are usually bolted onto an application with a shared API key and a loosely-typed user ID. Auth0's On-Behalf-Of token exchange lets you do better: every message a customer sends carries a real, auditable delegation chain back to the login that started it, and a CIBA push puts a human back in the loop for the requests that need one.
Toby Allen
Solutions Engineer at Okta. I write about identity, access management, and security. This site archives my published articles, talks, and presentations.
Series - Indepth Explainers
Latest
Auth0 Token Vault with Organizations: Per-Org Isolation and Three Setup Gotchas
· Auth0, Customer Identity Products, Identity Security
Auth0's Token Vault partitions a user's Connected Accounts by Organization, so the same Google or GitHub connection in one org is invisible from another. The isolation itself just works. Getting a demo application to the point where it worked took three separately-gated setup steps, each with a misleading error.
The feature was built and the model never heard about it
· Auth0 FGA, AI Agents, MCP
Two new capabilities shipped in the same session, wired into the backend correctly and invisible to the chat model anyway - because registering a tool and telling the model it exists turned out to be two separate, separately-forgettable steps.
From Service Accounts to Agents: The Identity Progression Behind an AI Chatbot
· Auth0, AI Agents, API
Most AI chatbots reach a backend API the same way any other service does: a client credentials grant and a static scope. That model breaks down fast once the chatbot is acting on behalf of a specific user, and breaks down again once you want to know which agent did what.
Four more bugs: applying last week's lesson in the wrong place
· Auth0, MCP, AI Agents
A live user hit a broken appeal submission on an error from the exact family the previous post had just spent two sessions solving. It wasn't the same bug - the earlier fix's own assumption didn't hold for a second hop, and two more unrelated bugs were stacked underneath it.
Three bugs Claude Code and I only caught by checking the wrong layer
· Auth0, Next.js, AI Agents
Building out an Auth0 Organizations demo suite with Claude Code, three separate bugs all had the same shape: the verification looked complete, and was still checking a different layer to the one where the failure actually lived.