Toby Allen
@tobes11.bsky.social
Solutions Engineer - bringing tech to the world
Built cross-tenant SSO - click a link in one Auth0 tenant, land authenticated in an app behind a second tenant's own IdP, zero extra prompts, new or returning user. Architecture was right first try. Getting it running took finding the same bug in two different clients. https://tobytes.com/a/96
Zero-Prompt SSO into an App Behind Its Own IdP
tobytes.com
Auth0 Account Linking only works if both accounts are actually re-authenticated. My first design used the suspended-transaction redirect primitives and it looked right - adversarial review found it wasn't. https://tobytes.com/a/95
Auth0 Account Linking: Two Paths In, One Hardened Callback
tobytes.com
Auth0 gives native mobile apps a built-in, Action-free token exchange for Google One Tap. Web apps can't use that path, so Custom Token Exchange steps in with a validator you control. Built it, plus the Universal Login FedCM toggle worth knowing about. https://tobytes.com/a/94
Google One Tap with Auth0: Custom Token Exchange, and the Native Path It Replaces
tobytes.com
Vercel said we'd used 75% of the free Active CPU allowance. I assumed traffic. It was three Open Graph image routes missing generateStaticParams, re-rendering a PNG from scratch on every request. https://tobytes.com/a/93
Four fixes and two second opinions: cutting this blog's Vercel bill
tobytes.com
The week before my apidays workshop: a repo that had to go public, a fix that silently wasn't live for six days, a blog post with its own factual error, and a Slack message that found four bugs in fifteen minutes. Then the talk itself, to about fifty people. https://tobytes.com/a/92
The week before the apidays workshop, and the workshop itself
tobytes.com
Every other client in this demo suite keeps a server to hold tokens somewhere. This one doesn't - a public Auth0 client on Firebase Hosting, tokens held in browser memory only. https://tobytes.com/a/90
A Public Client with No Server at All
tobytes.com
sub stays the citizen throughout. act.sub is what actually names the AI agent calling the API on their behalf - not the same claim. Auth0 FGA, on-behalf-of token exchange, and Agent as Principal, explained against a real demo app you can sign up and try yourself: https://tobytes.com/a/91
SmartGov Explained: Auth0 FGA, On-Behalf-Of, and Agent as Principal in One Demo App
tobytes.com
Upgraded a sample HMAC Custom Token Exchange demo to a real Firebase ID token, verified against Google's published JWKS instead of a shared secret. Also: a "critical" adversarial-review finding about Auth0 Actions colliding turned out wrong once I checked the live tenant. https://tobytes.com/a/89
A Real External Identity Provider for Auth0 Custom Token Exchange
tobytes.com
Some followers may not know that my main source of income is a newsletter about computers and the internet called The Sizzle. I read all the tech news and filter out the crap, leaving just the interesting bits for you! Try it out for free thesizzle.com.au
The Sizzle
Australia's favourite daily tech newsletter. No ads. No tracking. Made by a human, not AI.
thesizzle.com.au
A working demo shipped, looked fine, and was still carrying an unbounded Firestore read, a non-atomic join race, a fail-open permission check, and an anonymous-session escalation path underneath. Adversarial review on already-shipped code, not just the plan. https://tobytes.com/a/88
Using the Auth0 sub Claim as a Firestore Authorisation Foreign Key
tobytes.com
Same Auth0 FGA Check call, four gateways. Zuplo denies unauthorised requests by default. AWS and Apigee leave that decision entirely up to whoever writes the integration. https://tobytes.com/a/86
FGA as an API Gateway Enforcement Point, Part 2: Apigee, AWS, and Zuplo
tobytes.com
An adversarial review caught the same OpenFGA modelling bug twice, independently, before I ran a single test. Wrote up the fix and the Cloudflare Worker gateway it ended up in. https://tobytes.com/a/85
FGA as an API Gateway Enforcement Point: OpenFGA Behind a Cloudflare Worker
tobytes.com
Auth0's real My Account API needs four separate pieces of tenant config to work, and each missing one produces a completely different, misleading error. The profile endpoint doesn't exist yet either. https://tobytes.com/a/84
Four layers deep and a 404: finding the real Auth0 My Account API
tobytes.com
Auth0's passkey verification route has no concept of who was already logged in - it'll happily hand your session to whoever's passkey it just verified. Plus: userVerification defaults to "preferred" and there's no dashboard setting to change it. https://tobytes.com/a/83
Embedded Passkey Step-Up, and Forcing User Verification Auth0 Won't Let You Configure
tobytes.com
Auth0 Anonymous Sessions now has a second handoff mechanism alongside the auth0_anon cookie: a transfer ticket, an anon_transfer_token passed straight to /authorize as a query param. Built specifically for cases where cookies can't survive the trip. https://tobytes.com/a/81
Auth0 Anonymous Sessions: The Cookieless Transfer Ticket Handoff
tobytes.com
Nobody.... Seriously what a silly idea. Spend your development effort on something useful. Its an email in box not Duolingo
A monitoring feature went through 6 rounds of adversarial review before shipping. 4 of them found real architecture bugs. Round 5 found something bigger: the code being reviewed had never actually been written. https://tobytes.com/a/82
Six reviews caught the architecture and missed the data
tobytes.com
The blog's stats page only ever showed the last 14 days. Rebuilt it to track all-time totals, and the numbers turned up a WordPress-scanner problem in the old bot filter along with the traffic patterns. https://tobytes.com/a/80
What this site's traffic actually shows since the move to Next.js
tobytes.com
AI coding tools promise fast custom demos, but the promise and the reality don't match. Five bugs a typecheck and direct FGA queries missed. Six checks to find one bug. Ten regenerations for one diagram. New blog section - Human in the Loop. https://tobytes.com/human-in-the-loop
Human in the Loop
tobytes.com
Asked Claude to generate one technical diagram with gpt-image-1. Ten regenerations later: the fix that shipped first got a clean render by quietly dropping the exact claim the diagram existed to show. Caught it after publishing, not before. https://tobytes.com/a/78
Ten attempts, one diagram: what fixing an AI-generated image actually taught me
tobytes.com
Most Intercom integrations share a secret key and hope the user ID stays in sync. Auth0's On-Behalf-Of exchange gives you a signed delegation chain instead - sub stays the customer, act records exactly which service acted for them. https://tobytes.com/a/76
Integrating Intercom with Auth0 On-Behalf-Of Token Exchange for a Full Login Audit Trail
tobytes.com
Auth0 Token Vault with Organizations partitions a user's connected accounts per org - genuinely separate, not admin-provisioned. Getting a demo working surfaced 3 setup gotchas, including a hard OIDC logout constraint. https://tobytes.com/a/75
Auth0 Token Vault with Organizations: Per-Org Isolation and Three Setup Gotchas
tobytes.com
Part seven of my apidays series: two features shipped correctly and were still invisible to the chat model, because registering a tool and telling the model it exists are two separate steps. Also found: a browser tab that had read "Create Next App" since day one. https://tobytes.com/a/74
The feature was built and the model never heard about it
tobytes.com
A chatbot backend calling an API as a static service account can't answer "which citizen was this for". On-behalf-of token exchange fixes that but still can't answer "which agent did it". Agent as Principal closes both gaps, worked through a real 3-hop token chain. https://tobytes.com/a/73
From Service Accounts to Agents: The Identity Progression Behind an AI Chatbot
tobytes.com
Part six of my apidays series: a live click broke appeal submission on an error from the exact family part five spent two sessions solving. Four bugs were stacked underneath it, and one exposed a real gap Auth0's new Agents as Principal (EA) is built to close. https://tobytes.com/a/72
Four more bugs: applying last week's lesson in the wrong place
tobytes.com
Three bugs in one week of building an Auth0 Organizations demo with Claude Code, all with the same shape: the verification looked complete and was still checking the wrong layer to catch the actual failure. https://tobytes.com/a/71
Three bugs Claude Code and I only caught by checking the wrong layer
tobytes.com
Mention Auth0 in your chats to add login into your app and so much more. chatgpt.com/plugins/plug...
ChatGPT Plugins | Browse and add plugins to ChatGPT
Discover and add plugins that extend ChatGPT with new tools, capabilities, and workflows.
chatgpt.com
OBO token exchange for the apidays demo failed with the same generic error for two sessions. Six checks in, the real bug was one field checked for existence, never for equality against the token in hand. https://tobytes.com/a/70
Six checks later: the on-behalf-of bug that took two sessions to find
tobytes.com
Claude Code built the admin console for my apidays workshop demo and every check it ran passed - type check, lint, build, direct FGA queries. My first real click found five bugs, one in each layer of the stack. https://tobytes.com/a/69
Five bugs in one afternoon: what a real click found that Claude's own checks never did
tobytes.com
