Conversation
Fixes several gaps found comparing our anonymous sessions docs against the Anonymous Sessions Architecture & Implementation Guide and the Management API OAS artifact: - anonymous-sessions.mdx: document the transfer-ticket mechanism for cross-domain session transfer (anon_transfer_token), the ROPG transfer scenario, and the lack of server-side session invalidation. Removed an unverified Auth0-Anonymous-Session header example not present in the OAS or the architecture guide. - configure-anonymous-sessions.mdx: add Dashboard instructions alongside the existing Management API steps for tenant, application, API, and client-grant configuration. Fixed the resource-server PATCH example, which included allow_anonymous_access — a field that does not exist in the Management API schema (additionalProperties: false on UpdateResourceServerRequestContent). Added the missing activate_cookie parameter and corrected the example lifetime value to match our own 30-day-or-longer best practice guidance. - configure-custom-claims-for-anonymous-sessions.mdx (new): documents Claims Mapping, which lets an API map anonymous_session.metadata fields directly into access token custom claims, since anonymous sessions have no post-login Action execution to call setCustomClaim(). Registered in manage-users.json navigation.
Contributor
|
Preview deployment for your docs. Learn more about Mintlify Previews.
💡 Tip: Enable Automations to automatically generate PRs for you. |
Contributor
|
Preview deployment for your docs. Learn more about Mintlify Previews.
💡 Tip: Enable Automations to automatically generate PRs for you. |
Contributor
|
Preview deployment for your docs. Learn more about Mintlify Previews.
💡 Tip: Enable Automations to automatically generate PRs for you. |
Contributor
Summary
Errors per inputErrors in main/docs/customize/experiment-center.mdx
Errors in main/docs/customize/experiment-center/integrations/actions-integration-guide.mdx
Errors in main/docs/customize/experiment-center/integrations/page-templates-integration-guide.mdx
Errors in main/docs/manage-users/sessions/anonymous-sessions.mdx
Errors in main/docs/manage-users/sessions/anonymous-sessions/anonymous-sessions-use-cases.mdx
Errors in main/docs/manage-users/sessions/anonymous-sessions/configure-custom-claims-for-anonymous-sessions.mdx
Run on commit ad8961b. |
The #update-the-session-with-metadata anchor never existed in configure-anonymous-sessions.mdx, and no such update flow is documented in the Management API OAS or the architecture guide. Dropped the dangling fragment link rather than invent a heading for behavior that isn't documented.
- Remove all em dashes per house style ("use sparingly") and per
reviewer preference; replaced with periods or restructured
sentences.
- Remove "etc." (banned; use "such as" instead) and a stray trailing
quote mark left over from a prior edit.
- Fix heading nesting: anonymous-sessions.mdx had five levels of
heading (##### ), exceeding the 3-level max. Flattened "Transfer
anonymous session data..." to ###/#### and merged the redirect-flow
intro into prose.
- Fix gerund headings ("Transferring a session...", "Configuring
Claims Mapping") to simple tense ("Transfer a session...",
"Configure Claims Mapping"), and updated the one internal anchor
link affected by the heading rename.
- Replace curly-brace placeholders ({{anon_sessions_clientid}}) and
angle-bracket placeholders (<username>, <password>, etc.) in code
examples with ALL_CAPS YOUR_ prefixed placeholders, per the
placeholder convention.
- Use the baseline cross-reference format ("To learn more, read
[article]") instead of "see [link]".
Matches the pattern used by Social Identity Providers: the overview page becomes the group's root instead of a duplicate first child entry in the sidebar.
…ty-providers pattern Moves experiment-center/overview.mdx to customize/experiment-center.mdx (sibling to the experiment-center/ directory) and uses it as the nav group's root, removing the redundant overview entry in the sidebar. Adds a redirect from the old /overview URL to the new root URL.
Removes the standalone quickstart.mdx and its three references (the Learn more section in experiment-center.mdx, the CardGroup in entities.mdx, and the navigation entry). The entities.mdx Learn more section now shows the ACUL integration guide as a single card rather than a two-up CardGroup.
Adds a public overview of the Identity Conversion Suite, which bundles Anonymous Sessions and Experiment Center. Sourced from an internal sales enablement deck; omits pricing, customer names, and other internal-only content, and links out to the existing Anonymous Sessions and Experiment Center docs rather than duplicating them.
Points to /docs/customize/experiment-center instead of the old /overview path, now that the overview page has moved to root.
Converts the ### Auth0 Dashboard / ### Auth0 Management API pair under 'Configure claims mapping' into a <Tabs> block, matching the pattern used in configure-anonymous-sessions.mdx.
Co-authored-by: Hazel Virdó <hazel.virdo@okta.com>
Co-authored-by: Hazel Virdó <hazel.virdo@okta.com>
Co-authored-by: Hazel Virdó <hazel.virdo@okta.com>
…ustom-claims-for-anonymous-sessions.mdx Co-authored-by: Hazel Virdó <hazel.virdo@okta.com>
… Suite Matches the Next steps pattern used in android-overview.mdx and experiment-center/entities.mdx.
…o Update-anonymous-sessons-EA
'diluted into in the avearge' -> 'diluted into the average', and 'experiment Center' -> 'Experiment Center'.
…rsion Suite docs Removes terms="true" from all 10 ReleaseStageNotice blocks in the Identity Conversion Suite, Experiment Center, and Anonymous Sessions docs, keeping stage, plans, and contact.
The quickstart.mdx page was removed earlier in this PR; redirect its old URL to the Experiment Center overview.
- configure-custom-claims-for-anonymous-sessions.mdx: drop "Learn how to" from the frontmatter description, remove a stray blank line, and remove a comma before "and include" for a smoother read. - anonymous-sessions.mdx: remove the "How it works" H2, which had no content of its own, and promote its children up a level (H3->H2, H4->H3). This also flattens the deepest heading nesting from 4 levels to 3. - Add "directory": "accordion" to the Anonymous Sessions nav group and remove the manual "Learn more" bullet list from anonymous-sessions.mdx, since it's now the group's root and Mintlify auto-renders sibling links via the directory listing, matching the User Search group's convention.
Adds "directory": "accordion" to the Experiment Center nav group, matching the Anonymous Sessions convention, and removes the manual Learn more section from experiment-center.mdx now that Mintlify auto-renders sibling links via the directory listing.
Converts the Next steps / Learn more bullet-link lists in configure-anonymous-sessions.mdx, configure-custom-claims-for-anonymous-sessions.mdx, and anonymous-sessions-use-cases.mdx into Card / CardGroup components, matching the pattern used in android-overview.mdx, identity-conversion-suite.mdx, and experiment-center/entities.mdx.
Matches the Card layout convention used in customize/portals/overview.mdx.
…tion guides
- Replace em dashes with commas in 4 example headings and 1 code
comment, per house style ('use sparingly').
- Standardize the 4 example headings to the same 'Example: <trigger>,
<description>' format; one was missing its colon.
hazel-nut
approved these changes
Sep 17, 2026
hazel-nut
left a comment
hazel-nut
left a comment
Contributor
There was a problem hiding this comment.
some copyediting, lgtm!
|
|
||
| In an [anonymous sessions](/docs/manage-users/sessions/anonymous-sessions) context, there is no login, and therefore no `post-login` Action execution. This removes the opportunity to add custom claims to the access token the usual way, leaving APIs that expect those claims unable to read them. | ||
|
|
||
| To solve this, Auth0 provides **Claims Mapping**: a direct translation between an anonymous session's metadata and the access tokens issued for it. For example, given a session that contains: |
Contributor
There was a problem hiding this comment.
Suggested change
| To solve this, Auth0 provides **Claims Mapping**: a direct translation between an anonymous session's metadata and the access tokens issued for it. For example, given a session that contains: | |
| To solve this, Auth0 provides claims mapping, which is a direct translation between an anonymous session's metadata and the access tokens issued for it. For example, given a session that contains: |
| @@ -0,0 +1,85 @@ | |||
| --- | |||
| title: Configure Custom Claims for Anonymous Sessions | |||
| description: Map anonymous session metadata into access token custom claims using Claims Mapping. | |||
Contributor
There was a problem hiding this comment.
Suggested change
| description: Map anonymous session metadata into access token custom claims using Claims Mapping. | |
| description: Map anonymous session metadata into access token custom claims using claims mapping. |
| </Warning> | ||
|
|
||
| ## How it works | ||
| **How it works** |
Contributor
There was a problem hiding this comment.
Suggested change
| **How it works** |
Comment on lines
+16
to
+18
| Sometimes your resource servers need additional information passed to them, but an [access token](/docs/secure/tokens/access-tokens) is the only thing you are passing along. Auth0 lets you enrich access tokens with [custom claims](/docs/secure/tokens/json-web-tokens/create-custom-claims) whenever your resource server needs more information about the user interacting with it, typically by calling [`api.accessToken.setCustomClaim()`](/docs/actions/reference/credentials-exchange/credentials-exchange-api-object#api-accesstoken-setcustomclaim-key-value) in a [`post-login`](/docs/customize/actions/explore-triggers/post-login) Action. | ||
|
|
||
| In an [anonymous sessions](/docs/manage-users/sessions/anonymous-sessions) context, there is no login, and therefore no `post-login` Action execution. This removes the opportunity to add custom claims to the access token the usual way, leaving APIs that expect those claims unable to read them. |
Contributor
There was a problem hiding this comment.
Suggested change
| Sometimes your resource servers need additional information passed to them, but an [access token](/docs/secure/tokens/access-tokens) is the only thing you are passing along. Auth0 lets you enrich access tokens with [custom claims](/docs/secure/tokens/json-web-tokens/create-custom-claims) whenever your resource server needs more information about the user interacting with it, typically by calling [`api.accessToken.setCustomClaim()`](/docs/actions/reference/credentials-exchange/credentials-exchange-api-object#api-accesstoken-setcustomclaim-key-value) in a [`post-login`](/docs/customize/actions/explore-triggers/post-login) Action. | |
| In an [anonymous sessions](/docs/manage-users/sessions/anonymous-sessions) context, there is no login, and therefore no `post-login` Action execution. This removes the opportunity to add custom claims to the access token the usual way, leaving APIs that expect those claims unable to read them. | |
| When your resource servers need additional information about a user but you are only passing along an [access token](/docs/secure/tokens/access-tokens), you can augment the access token with [custom claims](/docs/secure/tokens/json-web-tokens/create-custom-claims) to store additional data. | |
| A common way to set a custom claim is by calling [`api.accessToken.setCustomClaim()`](/docs/actions/reference/credentials-exchange/credentials-exchange-api-object#api-accesstoken-setcustomclaim-key-value) in a [`post-login`](/docs/customize/actions/explore-triggers/post-login) Action. However, in an [anonymous sessions](/docs/manage-users/sessions/anonymous-sessions) context, there is no login, and therefore no `post-login` Action execution. |
just a suggestion for brevity :)
| To set the anonymous sessions lifetime, make a `PATCH` request to the [`/api/v2/tenants/settings`](/docs/api/management/v2/tenants/patch-settings) endpoint: | ||
|  | ||
|
|
||
| 2. Enter a value for the **Anonymous Session Lifetime**, in minutes. |
Contributor
There was a problem hiding this comment.
Suggested change
| 2. Enter a value for the **Anonymous Session Lifetime**, in minutes. | |
| 2. Enter a value for the **Anonymous Session Lifetime** in minutes. |
|
|
||
| Auth0 does not offer server-side invalidation for anonymous sessions. Logging out a session only cleans up the anonymous session cookie. If the browser or application retains the token after the cookie is cleaned up, that token can still be used normally. | ||
|
|
||
| If you want more control over anonymous sessions, you can configure your tenant to not issue cookies for anonymous sessions at all. To learn more, read [Configure Anonymous Sessions](/docs/manage-users/sessions/anonymous-sessions/configure-anonymous-sessions#configure-anonymous-sessions). |
Contributor
There was a problem hiding this comment.
Suggested change
| If you want more control over anonymous sessions, you can configure your tenant to not issue cookies for anonymous sessions at all. To learn more, read [Configure Anonymous Sessions](/docs/manage-users/sessions/anonymous-sessions/configure-anonymous-sessions#configure-anonymous-sessions). | |
| If you want more control over anonymous sessions, you can [configure your tenant to not issue cookies for anonymous sessions](/docs/manage-users/sessions/anonymous-sessions/configure-anonymous-sessions) at all. |
| <Tabs> | ||
| <Tab title="Auth0 Dashboard"> | ||
| 1. Navigate to [**Dashboard > Applications > APIs**](https://manage.auth0.com/#/apis), and select the API you want to configure. | ||
| 2. Scroll to the **Access token expiration** section and set the **Anonymous Access Token Lifetime**, in seconds. The minimum is one day and the maximum is 30 days. |
Contributor
There was a problem hiding this comment.
Suggested change
| 2. Scroll to the **Access token expiration** section and set the **Anonymous Access Token Lifetime**, in seconds. The minimum is one day and the maximum is 30 days. | |
| 2. In the **Access token expiration** section, set the **Anonymous Access Token Lifetime** in seconds. The minimum is one day and the maximum is 30 days. |
maybe we can say what one day and 30 days are in seconds given the requirement?
|
|
||
|  | ||
|
|
||
| 3. Scroll to **Application Access Policy**, and set the **Anonymous Access** policy to **Per-app authorization** to enable anonymous sessions using this audience for their access tokens. |
Contributor
There was a problem hiding this comment.
Suggested change
| 3. Scroll to **Application Access Policy**, and set the **Anonymous Access** policy to **Per-app authorization** to enable anonymous sessions using this audience for their access tokens. | |
| 3. Under **Application Access Policy**, set the **Anonymous Access** policy to **Per-app authorization** to enable anonymous sessions using this audience for their access tokens. |
i had learned phrasal verbs because are tough for non-native speakers, so removing or replacing them with single word verbs (scroll to -> find, fill in -> enter) is more accessible
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Create new doc for Auth0 Identity Conversion Suite
Update Experiment Center docs to EA
Update Anonymous Sessions docs to EA, add custom claims doc.
Test plan
🤖 Generated with Claude Code