Configure Session Delegation

This page covers configuration only. Read Implement Session Delegation for the security model and the request/response detail once both applications below are configured.

Configure your applications

Configure the requesting application

The application that calls Custom Token Exchange to obtain a Session Transfer Token needs Custom Token Exchange enabled and the ability to create a Session Transfer Token:

{
  "token_exchange": {
    "allow_any_profile_of_type": ["custom_authentication"]
  },
  "session_transfer": {
    "can_create_session_transfer_token": true,
    "enforce_cascade_revocation": true
  }
}

Read Create and manage Session Transfer Tokens for more on the can_create_session_transfer_token setting.

The application that calls Custom Token Exchange to request a Session Transfer Token must be a confidential client, authenticating with a Client Secret (or another confidential-client method). Unlike a standard Custom Token Exchange request, the tokenEndpointAuthMethod: none public-client option is not supported when requesting a Session Transfer Token.

Configure the target web application

Your web application must explicitly opt in to accept delegated sessions, and accept the Session Transfer Token as a query parameter on /authorize:

{
    "session_transfer": {
        "allowed_authentication_methods": ["cookie", "query"],
        "enforce_device_binding": "ip", // also "none" or "asn"
        "allow_refresh_token": false,
        "enforce_online_refresh_tokens": true,
        "delegation": {
           "allow_delegated_access": true,
           "enforce_device_binding": "ip" // this is the only allowed value for delegation
        }
    }
}

allowed_authentication_methods must include query because Session Delegation passes the Session Transfer Token as a URL query parameter — the cookie-based transfer used by Native to Web SSO doesn’t apply here. delegation.enforce_device_binding only accepts "ip" — IP-based device binding is enforced automatically for delegated sessions. This configuration is disabled by default and has no equivalent Dashboard UI toggle at this time: configure it through the Management API or your infrastructure-as-code tooling (Terraform, Deploy CLI).If a Session Transfer Token carrying an actor is presented to a client without allow_delegated_access enabled, Auth0 does not return an error — it falls back to showing the login page and emits a warning (w) tenant log. Check for this if a delegated session unexpectedly falls back to a login prompt.

Once both applications are configured, read Implement Session Delegation to make the requests, and Delegated Session Behavior and Monitoring to understand session behavior and audit logging.

Session Delegation

Implement Session Delegation

⌘I

Add Login

Provision Users

Configure Session Delegation

Configure your applications

Configure the requesting application

Configure the target web application

​Configure your applications

​Configure the requesting application

​Configure the target web application

Configure your applications

Configure the requesting application

Configure the target web application