Skip to content

Commit ef80317

Browse files
docs: add delegation and impersonation example for CTE (#1611)
Adds a delegation and impersonation example to the CTE section in EXAMPLES.md, showing how to use customTokenExchange() with actor_token and actor_token_type.
1 parent 4e3c65a commit ef80317

1 file changed

Lines changed: 20 additions & 1 deletion

File tree

EXAMPLES.md

Lines changed: 20 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -572,7 +572,26 @@ async function safeTokenExchange() {
572572
}
573573
```
574574

575-
[Token Exchange Documentation](https://auth0.com/docs/authenticate/login/token-exchange)
575+
### Delegation and Impersonation
576+
577+
Use `customTokenExchange()` when one principal needs to act on behalf of another — for example, an AI agent acting on behalf of a user. Unlike `loginWithCustomTokenExchange()`, this method has no side effects: it does not update the session or affect `isAuthenticated()` / `getUser()`.
578+
579+
Pass `actor_token` and `actor_token_type` alongside the subject token to identify the acting party per [RFC 8693](https://tools.ietf.org/html/rfc8693):
580+
581+
```js
582+
const tokenResponse = await auth0.customTokenExchange({
583+
subject_token: '<USER_TOKEN>',
584+
subject_token_type: 'urn:acme:user-token',
585+
actor_token: '<AGENT_TOKEN>',
586+
actor_token_type: 'https://idp.example.com/token-type/agent',
587+
audience: 'https://api.example.com'
588+
});
589+
590+
// Use tokenResponse.access_token to call a downstream API
591+
// The current user session is unchanged
592+
```
593+
594+
[Token Exchange Documentation](https://auth0.com/docs/authenticate/login/token-exchange)
576595
[RFC 8693 Spec](https://tools.ietf.org/html/rfc8693)
577596

578597
## Device-bound tokens with DPoP

0 commit comments

Comments
 (0)