Session delegation: authorized actors act as end users

We're excited to announce that Auth0 now supports Session Delegation via Custom Token Exchange. This release is available to all Enterprise, B2B Professional, and B2C Professional customers.

Session Delegation builds on Custom Token Exchange's delegated authorization model to cover a common use case: letting an authorized actor, such as a support agent, establish a web session as another user, so they can navigate your application on that user's behalf rather than only calling APIs for them. As with delegated authorization, both identities are preserved throughout: the sub claim identifies the user the session belongs to, while the standards-based act claim (per RFC 8693) identifies who is actually acting. Every delegated session carries a verifiable, auditable record of who did what on whose behalf.

Key highlights of this release:

• Session Transfer Token: Requesting a Custom Token Exchange token with a special session_transfer audience returns a Session Transfer Token instead of an access token, authorized by the same Action logic you already control for delegation
• Seamless redemption: Redirect the browser to the target application, which redeems the token through the standard /authorize endpoint — no extra login step for the user being acted for
• Built-in guardrails: Delegated sessions are short-lived, issue no refresh tokens, skip MFA/consent prompts by design, and can be bound to the requesting IP address
• Dedicated audit trail: Delegated logins generate distinct tenant log events, separate from regular logins, for compliance and traceability

To learn more, visit the Session Delegation and Custom Token Exchange Use Cases documentation.