Toby Allen

Solutions Engineer at Okta. I write about identity, access management, and security. This site archives my published articles, talks, and presentations.

All articles →About me →

Series - Indepth Explainers

Auth0 Session and Token Management17 parts →Building the apidays 2026 Workshop Demo8 parts →AI Agent Identity1 part →Separating People from Accounts: The Persona Model7 parts →Delegated Access with Auth0 and Auth0 FGA4 parts →Home Tenant Discovery2 parts →

Latest

Four layers deep and a 404: finding the real Auth0 My Account API

Auth0, My Account API, MFA

I asked Claude Code to build a demo of Auth0's real My Account API, not the Management API with a user token wearing its name. Four separate pieces of tenant configuration and one Early Access MFA policy stood between a correctly-written client and a working token - and the profile endpoint simply isn't there yet.

FGA as an API Gateway Enforcement Point: OpenFGA Behind a Cloudflare Worker

October 9, 2026 · Auth0, Auth0 FGA, Customer Identity Products

A real Cloudflare Worker in front of a real OpenFGA store, deciding every request's fate before a line of application code runs. The access token carries no permissions claim at all; the allow, deny, or unavailable verdict happens entirely at the gateway.

Embedded Passkey Step-Up, and Forcing User Verification Auth0 Won't Let You Configure

October 8, 2026 · Auth0, passkey, MFA

Re-verifying identity in-page with a passkey sounds like a small feature until you realise Auth0's own passkey verification route has no concept of who was already logged in. Plus a WebAuthn setting I couldn't find a dashboard control for anywhere, and the one place you can still override it.

What this site's traffic actually shows since the move to Next.js

September 28, 2026 · Security Industry, Careers and other Domains

The stats page on this site only ever showed the last 14 days, which meant every time I looked at it I was looking at noise. I rebuilt it to track lifetime totals properly, and the all-time numbers - covering the time since this site moved off WordPress - turned up a few things I didn't expect.

Six reviews caught the architecture and missed the data

September 28, 2026 · Auth0, Vercel, AI-Assisted Development

A live-event monitoring dashboard went through six rounds of adversarial review before a line of code shipped - and every one of them was reviewing an argument, not the actual files, for four rounds running.

Auth0 Anonymous Sessions: The Cookieless Transfer Ticket Handoff

September 28, 2026 · Auth0, Customer Identity Products, Identity Security

Auth0 has documented a second way to carry an anonymous session into login: a transfer ticket, exchanged for a short-lived anon_transfer_token and passed straight to /authorize as a query parameter, with no cookie involved at all.