Auth0's Manage Sessions with Actions APIs let a Post-Login Action set a non-persistent cookie mode and short expiry on the Authorization Server's own session. Getting a genuinely ephemeral login end-to-end took matching that on the app's own session too, and an access token that turned out not to be a JWT.
Toby Allen
Solutions Engineer at Okta. I write about identity, access management, and security. This site archives my published articles, talks, and presentations.
Series - Indepth Explainers
Latest
Auth0 Token Vault: Connecting Google Calendar and GitHub on a User's Behalf
· Auth0, Customer Identity Products, Identity Security
Auth0's Token Vault lets your app call Google or GitHub APIs with a user's own consent, without the user's password ever touching your app. Getting it working end to end took five separately-gated prerequisites, each with its own unrelated-looking error message.
Adversarial review, real bugs, and dead ends: building an OpenFGA model with Claude Code
· Auth0, Customer Identity Products, Auth0 FGA
An adversarial review across two different AI models caught a real OpenFGA semantics bug in the model behind this series, and also produced confident, specific-sounding nonsense that didn't survive being checked. Both outcomes are worth writing up.
AI agents, approval gaps, and the edges of a persona model
· Auth0, Customer Identity Products, Auth0 FGA
The model from this series has humans and businesses as principals, but not agents, and no way to represent a delegation that's been requested but not yet approved. Both turned out to need real additions, not workarounds.
Delegation you can put a number on
· Auth0, Customer Identity Products, Auth0 FGA
Every delegation in this series so far has been bounded by time. This post covers the other kind: bounded by a dollar figure, or a dollar figure and a category together, checked fresh against every attempted spend rather than a stored running total.
Verified directors and public registries: identity proofing meets FGA
· Auth0, Customer Identity Products, Auth0 FGA
A company registry needs three things a subscription service doesn't: a public entry anyone can search, a governance role distinct from day-to-day admin, and proof that whoever holds that role is who they say they are.