86 posts, newest first.
This demo suite already uses Firebase Firestore under the hood for session storage. This post surfaces that same identifier as its own pattern: the Auth0 sub claim used as a stable foreign key into Firestore, deciding who can access an account and logging who did what once they're in.
The same Auth0 FGA policy decision point, three different policy enforcement points. One ships a dedicated FGA policy out of the box, one hands you a function and lets you build it yourself, and one has no FGA story at all beyond two generic primitives chained together.
I asked Claude Code to build a demo of Auth0's real My Account API, not the Management API with a user token wearing its name. Four separate pieces of tenant configuration and one Early Access MFA policy stood between a correctly-written client and a working token - and the profile endpoint simply isn't there yet.
A real Cloudflare Worker in front of a real OpenFGA store, deciding every request's fate before a line of application code runs. The access token carries no permissions claim at all; the allow, deny, or unavailable verdict happens entirely at the gateway.
Re-verifying identity in-page with a passkey sounds like a small feature until you realise Auth0's own passkey verification route has no concept of who was already logged in. Plus a WebAuthn setting I couldn't find a dashboard control for anywhere, and the one place you can still override it.
The stats page on this site only ever showed the last 14 days, which meant every time I looked at it I was looking at noise. I rebuilt it to track lifetime totals properly, and the all-time numbers - covering the time since this site moved off WordPress - turned up a few things I didn't expect.
A live-event monitoring dashboard went through six rounds of adversarial review before a line of code shipped - and every one of them was reviewing an argument, not the actual files, for four rounds running.
Auth0 has documented a second way to carry an anonymous session into login: a transfer ticket, exchanged for a short-lived anon_transfer_token and passed straight to /authorize as a query parameter, with no cookie involved at all.
I asked Claude Code to generate a technical architecture diagram with gpt-image-1 for a blog post. Getting one five-box diagram fully correct took ten regenerations, and the version that shipped first was itself wrong - it got a clean render by quietly dropping the exact claim the whole post was about.
Third-party support tools like Intercom are usually bolted onto an application with a shared API key and a loosely-typed user ID. Auth0's On-Behalf-Of token exchange lets you do better: every message a customer sends carries a real, auditable delegation chain back to the login that started it, and a CIBA push puts a human back in the loop for the requests that need one.
@auth0/auth0-hono ships an idpLogout option that defaults to false, so calling /auth/logout only clears the local session cookie and never touches Auth0's own session at the identity provider. I found this deploying a third runtime for the same SDK, and it turned out to already be sitting unfixed in a demo I'd built weeks earlier.
Auth0's Token Vault partitions a user's Connected Accounts by Organization, so the same Google or GitHub connection in one org is invisible from another. The isolation itself just works. Getting a demo application to the point where it worked took three separately-gated setup steps, each with a misleading error.
Two new capabilities shipped in the same session, wired into the backend correctly and invisible to the chat model anyway - because registering a tool and telling the model it exists turned out to be two separate, separately-forgettable steps.
Most AI chatbots reach a backend API the same way any other service does: a client credentials grant and a static scope. That model breaks down fast once the chatbot is acting on behalf of a specific user, and breaks down again once you want to know which agent did what.
A live user hit a broken appeal submission on an error from the exact family the previous post had just spent two sessions solving. It wasn't the same bug - the earlier fix's own assumption didn't hold for a second hop, and two more unrelated bugs were stacked underneath it.
Building out an Auth0 Organizations demo suite with Claude Code, three separate bugs all had the same shape: the verification looked complete, and was still checking a different layer to the one where the failure actually lived.
On-behalf-of token exchange for the apidays demo's MCP server failed with the same generic error no matter what I tried. Six separate, individually correct verification passes across two sessions all checked the wrong property of the one field that mattered.
Claude Code built the caseworker admin console for my apidays workshop demo and every check it ran passed - type check, lint, build, direct FGA queries. The first time I actually clicked the button, we found five separate bugs, one in each layer of the stack.
Four separate follow-up posts are now folded into the main guide instead of sitting as bolted-on updates at the bottom - two new grant types for devices with no browser of their own, and two new use cases worth building around: Token Vault and Session Delegation.
Every SaaS company with a support team eventually needs a 'log in as this customer' button, and most build it badly. Auth0's new Session Delegation feature is a paved path for it - an audited, time-boxed session with an act claim naming the agent. Wiring up a genuine one meant fixing two failures Auth0 never surfaces as an OAuth error, then a bug entirely of my own making.
Part three of building the apidays workshop demo with Claude Code. Three separate times in one session I went back to the original brief and found real drift - and each time I described it to myself as though it were a fresh insight, rather than noticing I'd said the same thing before.
Verification level answers who a persona provably is, established once and true forever. Session assurance answers something else entirely - how strongly the current login just proved it - and it has no business being stored as a fact at all.
Part two of the apidays workshop series moves from planning to building. Claude reversed a hosting decision that turned out to be solving a problem that never existed, then quietly let a fourth infrastructure provider into a build I'd explicitly ruled out - twice.
An adversarial review of a conference workshop's build plan found a genuine structural flaw in its Auth0 FGA model, not a polish problem. The check it ran on a citizen's own record was trivially always true, which meant the demo's actual premise - authorising an AI agent acting on someone's behalf - was never being tested at all.
Auth0's Manage Sessions with Actions APIs let a Post-Login Action set a non-persistent cookie mode and short expiry on the Authorization Server's own session. Getting a genuinely ephemeral login end-to-end took matching that on the app's own session too, and an access token that turned out not to be a JWT.
Auth0's Token Vault lets your app call Google or GitHub APIs with a user's own consent, without the user's password ever touching your app. Getting it working end to end took five separately-gated prerequisites, each with its own unrelated-looking error message.
An adversarial review across two different AI models caught a real OpenFGA semantics bug in the model behind this series, and also produced confident, specific-sounding nonsense that didn't survive being checked. Both outcomes are worth writing up.
The model from this series has humans and businesses as principals, but not agents, and no way to represent a delegation that's been requested but not yet approved. Both turned out to need real additions, not workarounds.
Every delegation in this series so far has been bounded by time. This post covers the other kind: bounded by a dollar figure, or a dollar figure and a category together, checked fresh against every attempted spend rather than a stored running total.
A company registry needs three things a subscription service doesn't: a public entry anyone can search, a governance role distinct from day-to-day admin, and proof that whoever holds that role is who they say they are.
Auth0's Passkey APIs let you build passkey sign-in directly into your own UI instead of redirecting to Universal Login. Here's how that fits alongside Universal Login, what self-service passkey management looks like hand-rolled versus with Auth0's official pre-built components, and one Allowed Origins (CORS) setting worth checking before you go looking for a WebAuthn bug that isn't there.
It's easy to claim an authorisation model is generic. It's more convincing to run the exact same model, unmodified, across media, healthcare, financial services, telco, retail and legal case management, and show the tests passing every time.
An anonymous session's cookie and its metadata are both set once, at the moment the session is created, and neither one changes again for the rest of that session's life. That single fact reshapes how you have to track state across the handoff into a known identity.
The delegated-access series treated the authenticated login as the whole security principal. It isn't quite. The same real person routinely holds more than one login, and an authorisation model that can't tell them apart ends up merging blast radii it shouldn't.
This blog's cross-posting to Bluesky, Mastodon, and LinkedIn used to only fire as a side effect of a successful Vercel deploy, which meant a social post could never exist without a brand new article behind it. I pulled the two apart into an independent queue, and found neither LinkedIn nor Bluesky actually auto-fetch a link's image the way the compose box makes you assume.
Auth0 published a guide for running a confidential client on Cloudflare Workers with @auth0/auth0-hono. I built the guide's example for real and hit three things it doesn't mention — a middleware default that locks down every route, an undocumented Node API dependency, and a session model that changes what revoking a session actually means.
Auth0's Device Authorization Grant lets a CLI tool or smart TV authenticate a user without a browser of its own. Getting it working meant hitting an undocumented requirement — the client has to be a native, OIDC-conformant public client, not the confidential regular_web type used everywhere else in Auth0.
Building a genuine Client-Initiated Backchannel Authentication demo against a real Guardian push notification - not a simulated approver inbox - turned up two bugs of my own making, then a Rich Authorization Requests upgrade that changes what the push notification is actually allowed to say.
Auth0's session_transfer_token was built for handing a session from a native app to a web app on the same domain. Point it at two genuinely different Auth0 domains in the same tenant and the audience parameter has an undocumented requirement - get it wrong and Auth0 doesn't error, it silently hands you a plain access token instead.
When a user taps 'Open in browser' inside your mobile app, they get asked to log in again. Auth0's Native-to-Web SSO solves this by exchanging a refresh token for a short-lived session transfer token that the web app can consume without any re-authentication.
When an anonymous visitor signs up or logs in, their pre-authentication browsing history disappears - invisible to both your identity system and your analytics. This post details how to bridge that gap using PostHog's identity model and the Auth0 callback flow.
A reader asked me to add an RSS feed to this blog. With Next.js App Router, the whole thing is about fifty lines of code and zero new dependencies - the framework handles more than you might expect.
Every Auth0 session and token option in one live demo - Traditional Web App, SPA with DPoP, BFF with Multi-Resource Refresh Tokens, SSO isolation, On-Behalf-Of, Custom Token Exchange, and a unified profile view that correlates all of them at the Authorization Server layer.
Auth0 gives you a lot of knobs to turn when it comes to sessions and tokens. This post maps out every option - including RFC 8693 token exchange flows for service delegation, external identity bridging, and customer-support impersonation - and shows how they work together for different application types.
Running Auth0 MFA demos with real SMS requires every presenter to have a personal phone enrolled. Auth0's custom-phone-provider trigger lets you route codes to a shared inbox instead, so any team member can run the demo without any per-device setup.
OpenID's Shared Signals Framework and Continuous Access Evaluation Profile went final in August 2025, but Auth0 supports neither natively. This post details a from-scratch reference implementation, and what building it revealed about the gap between a finalised spec and the tooling around it.
The previous post covered the CIBA approval flow for delegated access. This one covers what happens when the five-minute CIBA window closes before the approver responds - and why the answer reveals an important architectural distinction between the delivery mechanism and the approval itself.
A server-rendered web app is the simplest of Auth0's session patterns to reason about, right up until you try to revoke a session and find out the browser didn't get the memo. Here's how to build one properly.
The previous post covered how a patient proactively grants a carer access to their record. This post covers the inverse: a user requests access they do not yet have, and the account holder approves it in real time using Auth0's Client-Initiated Backchannel Authentication.
The first post in this series covered why separating the authenticated actor from the account they are acting within matters. This post covers how to build it: the data model, the integration points between Auth0, Auth0 FGA and a standard application data store, and the key flows from delegation grant through to acting on someone else's behalf.
Every Vendor Security and Customer Requirement Questionnaire asks the same questions — the SIG words them one way, CAIQ another, HECVAT a third. The standard approach is to re-derive answers from scratch each time. The better approach is to treat this as a retrieval problem: build a canonical corpus of approved answers once, and match new questions to it.
The original analytics implementation stored one tiny file in Vercel Blob for every page view. Vercel Blob charges per operation, not per byte, so this burned through the free tier faster than expected. In this post I will detail the migration to Firestore daily summary documents — one write per page view, one read per day of stats — and the Firestore gotcha that wasted an afternoon.
Most analytics tools require a JavaScript snippet in every page — which means your readers' browsers are doing the tracking work, and adding a dependency you cannot fully control. In this post I will detail how I added page view tracking to this blog using Next.js 16's proxy layer and Vercel Blob, with no client-side JavaScript and no third-party analytics service.
Identity systems are very good at answering one question: who are you? What they are less good at is the follow-up: and who are you acting for? In this post I will look at why separating the authenticated user from the account or person they are acting within is important, what it enables across a range of industries, and how Auth0 and Auth0 FGA address the two complementary sides of the problem.
In part one we built the Auth0 ACUL screens for multi-tenant routing with a hardcoded lookup. In this post I will replace that with a real Cloudflare Worker backed by Workers KV, move to full email-address routing, handle users who exist across multiple tenants, and add Cloudflare Turnstile bot protection to the login screens.
Home Realm Discovery is a well-understood pattern at the network layer, but moving that routing logic inside Auth0's login flow using Advanced Custom Universal Login opens up some interesting possibilities — and a few unexpected challenges.
The Auth0 CLI is a handy tool to help with designing and building your Auth0 experience. It lets you do a number of things including: The Auth0 CLI has a simple interactive logging flow that lets you login as a user and it is powered by the device authorization flow. Unfortunatel
Auth0 supports Twilio out of the box as a phone provider however in many instances Twilio Verify provides a better experience. The out of the box Twilio integration requires the sender to manage all of the phone numbers and Sender IDs that they need. This can be simple if you onl
Auth0 has released Tenant Access Control Lists (ACL). This new capability is designed to give you more granular control over the traffic accessing your Auth0 tenant and services, helping you protect against potential threats and ensure only legitimate requests make it through. Ad
Auth0 Forms is a tool designed to allow identity flows to be extended with customisable forms and logic, allowing use cases like progressive profiling, policy acceptance, payment collection and more within the hosted login flows you've come to know and love from Auth0. For more d
Auth0 Forms is a powerful tool to extend identity flows with customisable forms and business logic. Forms allows for a hosted secure experience with no need to redirect users to external sites and consistent branding with Universal Login. In this blog post I will talk through how
Auth0 has launched native support for Global Token Revocation and Okta's Universal Logout functionality. This means that Auth0 applications now natively support the ability for federated Okta customers to automatically revoke all of the users sessions and tokens when Identity Thr
Nick Connelly, a key member of the Okta Professional services team has combined his knowledge of Okta, Terraform, AWS, GitHub and secure development to write an excellent post on the Okta developer blog. Check it out -> How to Create a Secure CI/CD Pipeline Using Okta Terraform T
When OIE was released it championed assurance levels rather than specific authenticators. This provided a better experience for the majority of users and administrators. This ease of use came at the cost of easily being able to specify specific factors or factor orders which some
Okta recently made its Breached Password Detection Functionality generally available. This functionality is enabled by default. If your user's credentials appear in a list, Okta notifies you by recording the security.breached_credential.detected event in the System Log. By defaul
A while ago Okta announced the integration of Okta Workflows with Auth0. Bringing low-code automation to the Auth0 platform. In this blog post I am going to talk about leveraging Workflows to remove inactive users from a tenant. I am using this in a demo environment where I have
A while ago Okta announced the integration of Okta Workflows with Auth0. Bringing low-code automation to the Auth0 platform. In this blog post I am going to cover the setup steps for the integrations. In another blog post I give an example of deleting inactive users from a one of
Here is a presentation I gave today on passkeys at the Canberra Cyber Conference hosted by AISA.
Okta’s Identity Engine introduced an Inline Hook for Telephony effectively allowing you to replace Okta’s inbuilt SMS solution with your own provider. In this short post I will detail how to leverage Twilio Functions to deliver OTP codes via SMS or Voice call. This is largely an
One of the best security resources a company has is it's users. One feature of Okta that can be leveraged to take advantage of this is Security Notification emails and the Report suspicious activity via email feature. The first of these sends email notifications to end users when
Okta Defensive Cyber Operations have observed that attackers who have obtained Super Admin access are leveraging IdP Federation to impersonate users to gain access to downstream applications. In this post I will discuss how to leverage workflows to alert on any IdP changes. For a
Okta Event hooks and Workflows can be combined to provide powerful detection, alerting and remediation actions. These can be leveraged for a wide range of actions such as those detailed in the Security Blog Post: Cross-Tenant Impersonation: Prevention and Detection including; The
MFA, Passwordless and Phishing Resistance are all terms we are hearing more and more lately. MFA usage has nearly doubled since 2020 according to Okta's recent Secure Sign in trends report discussed here Unfortunately there is a lot of confusion around what these terms and more b
Okta has just made generally available its Workflows Connector Builder and I am writing this post to celebrate. Okta's Workflow Connector Builder delivers the powerful concept of reuse to your Workflows. It allows you build connections and actions once for re-use throughout all o
Okta's Identity Engine introduced an Inline Hook for Telephony effectively allow you to replace Okta's inbuilt SMS solution with your own provider. This empowers customers to manage their own numbers and providers around the world allowing for cost and delivery optimisation. It a
Recently an Okta customer was interested in being able to set a fixed Recovery Question for a subset of its employees. In particular they wanted to use an attribute from their source of truth as a security answer. Having a fixed security question and answer based on an employee a
Twilio Flex, Twilio's contact centre solution, supports SAML 2.0 for Agent and Supervisor provisioning and access. Users are provisioned Just In Time into TaskRouter workers with skills and attributes created or updated when a user logs in. Unfortunately Twilio provides no standa
Note: Okta has released Authentication Method Chains which provide a simpler method of specifying factors. See this blog post for more detail. Okta Identity Engine provides increased flexibility for Authentication with Application Level Policies and easy to configure passwordless
The objective of this blog post is to show how you can leverage Segment to capture and track progress through Studio Flows. In this case we will adapt our standard Appointment Reminder Studio Flow Template to track feedback in Segment using Functions. This will allow us then to
In these unprecedented times of social distancing and a virus pandemic, we are seeing a huge increase in the number of voice calls being made. Our Super Network team is working around the clock to ensure that calls make it through. However, in some areas, we are seeing that
If you find yourself needing to send urgent messages out to customers or staff but don’t have developers on hand or access to your usual tools. Then this tutorial that shows you how to send SMS notifications from Google sheets may be perfect for you. In this blog post we’ll show
The short answer is yes. So how do you go about doing it? Context! Context can remove the need for an IVR. Context can make speaking to a customer service representative easy, quick and painless. Context can have a customer speaking to an agent in under 10 seconds. How? To
There are many approaches to mitigating contact center fraud. Each approach has its pros and cons. Some are easy to implement but also relatively easy to bypass. Some are more effective but create a poor user experience for both agents and customers. Others offer excellent
Over the top applications can deliver great call quality if you engineer them well. I’ve touched on the power of adding real time communications channels like voice and video to mobile applications in the past. The context gained by adding in application calling from something
Interoperability – Does the SBC you’re considering have proven interoperability with all the vendors in your network? How about your SIP trunk providers? Does the SBC have the ability to manipulate and modify any and all messages on the fly to enable your Call Manager to talk to
Communications is now a feature. An expected feature for mobile applications. Forward looking enterprises are embedding communications within their applications. They are also extending their applications out into communications channels such as WhatsApp, Facebook Messenger and