Session Metadata is now Generally Available for all Enterprise customers.

What's New

Session Metadata allows you to attach custom key–value data to a user's session using Actions or the Auth0 Management API. This enables you to persist contextual data throughout the session lifecycle, powering richer integrations, stronger audit trails, and personalized session behavior.

Key capabilities:

Set and retrieve metadata in Actions using api.session.setMetadata(key, value) and event.session.metadata
Manage metadata via Management API with GET and PATCH on /api/v2/sessions/{id}
Delete individual keys using api.session.deleteMetadata(key) or evict all metadata with api.session.evictMetadata()
Include session metadata in OIDC Back-Channel Logout tokens for downstream systems to receive context during logout events

Example usage in Actions:

exports.onExecutePostLogin = async (event, api) => {
  api.session.setMetadata("deviceName", event.request.user_agent);
  api.session.setMetadata("loginRegion", event.request.geoip?.countryCode);
  api.session.setMetadata("orgContext", event.organization?.id);
};

Limits:

Maximum of 25 key-value pairs per session
Each key and value must be a string with max 255 characters
Metadata is stored as a flat JSON object (no nesting)

Use Cases

Self-service device management: Store device names or login locations for user-facing session management UIs
Keep Me Signed In: Persist user preferences to customize session behavior
Organization context: Store organization information for multi-tenant applications
Audit and compliance: Include session context in logout tokens for downstream audit systems

Availability

Session Metadata is now Generally Available for all Enterprise tenants.

No API or behavior changes from Early Access.