Building out an Auth0 Organizations demo suite with Claude Code, three separate bugs all had the same shape: the verification looked complete, and was still checking a different layer to the one where the failure actually lived.
Toby Allen
Solutions Engineer at Okta. I write about identity, access management, and security. This site archives my published articles, talks, and presentations.
Series - Indepth Explainers
Latest
Six checks later: the on-behalf-of bug that took two sessions to find
· Auth0, MCP, AI Agents
On-behalf-of token exchange for the apidays demo's MCP server failed with the same generic error no matter what I tried. Six separate, individually correct verification passes across two sessions all checked the wrong property of the one field that mattered.
Five bugs in one afternoon: what a real click found that Claude's own checks never did
· Auth0 FGA, AI Agents, MCP
Claude Code built the caseworker admin console for my apidays workshop demo and every check it ran passed - type check, lint, build, direct FGA queries. The first time I actually clicked the button, we found five separate bugs, one in each layer of the stack.
What's New in the Auth0 Session and Token Guide: Token Vault and Session Delegation
· Auth0, Customer Identity Products, Identity Security
Four separate follow-up posts are now folded into the main guide instead of sitting as bolted-on updates at the bottom - two new grant types for devices with no browser of their own, and two new use cases worth building around: Token Vault and Session Delegation.
Auth0 Session Delegation: Two Silent Failures and One Bug of My Own
· Auth0, Customer Identity Products, Identity Security
Every SaaS company with a support team eventually needs a 'log in as this customer' button, and most build it badly. Auth0's new Session Delegation feature is a paved path for it - an audited, time-boxed session with an act claim naming the agent. Wiring up a genuine one meant fixing two failures Auth0 never surfaces as an OAuth error, then a bug entirely of my own making.
I told myself three times that checking requirements was a good idea
· Auth0 FGA, AI Agents, MCP
Part three of building the apidays workshop demo with Claude Code. Three separate times in one session I went back to the original brief and found real drift - and each time I described it to myself as though it were a fresh insight, rather than noticing I'd said the same thing before.