3 posts.
Auth0's Manage Sessions with Actions APIs let a Post-Login Action set a non-persistent cookie mode and short expiry on the Authorization Server's own session. Getting a genuinely ephemeral login end-to-end took matching that on the app's own session too, and an access token that turned out not to be a JWT.
OpenID's Shared Signals Framework and Continuous Access Evaluation Profile went final in August 2025, but Auth0 supports neither natively. This post details a from-scratch reference implementation, and what building it revealed about the gap between a finalised spec and the tooling around it.
Auth0 Forms is a tool designed to allow identity flows to be extended with customisable forms and logic, allowing use cases like progressive profiling, policy acceptance, payment collection and more within the hosted login flows you've come to know and love from Auth0. For more d