|
13 | 13 | - [Device-bound tokens with DPoP](#device-bound-tokens-with-dpop) |
14 | 14 | - [Standalone Components and a more functional approach](#standalone-components-and-a-more-functional-approach) |
15 | 15 | - [Connect Accounts for using Token Vault](#connect-accounts-for-using-token-vault) |
| 16 | +- [Native to Web SSO](#native-to-web-sso) |
16 | 17 |
|
17 | 18 | ## Add login to your application |
18 | 19 |
|
@@ -948,3 +949,62 @@ You can now call the API with your access token and the API can use [Access Toke |
948 | 949 | > **Important** |
949 | 950 | > |
950 | 951 | > You must enable Offline Access from the Connection Permissions settings to be able to use the connection with Connected Accounts. |
| 952 | +
|
| 953 | +## Native to Web SSO |
| 954 | +
|
| 955 | +[Native to Web SSO](https://auth0.com/docs/authenticate/single-sign-on/native-to-web) enables seamless single sign-on when users transition from a native mobile app to a web app. The SDK can automatically extract a session transfer token from the URL and include it in the authorization request. |
| 956 | +
|
| 957 | +The feature is **disabled by default**. To enable it, set `sessionTransferTokenQueryParamName` in the SDK configuration with the name of the query parameter your native app appends to the web app URL: |
| 958 | +
|
| 959 | +```ts |
| 960 | +AuthModule.forRoot({ |
| 961 | + domain: 'YOUR_AUTH0_DOMAIN', |
| 962 | + clientId: 'YOUR_AUTH0_CLIENT_ID', |
| 963 | + authorizationParams: { |
| 964 | + redirect_uri: window.location.origin, |
| 965 | + }, |
| 966 | + sessionTransferTokenQueryParamName: 'session_transfer_token', |
| 967 | +}), |
| 968 | +``` |
| 969 | +
|
| 970 | +Or using `provideAuth0`: |
| 971 | +
|
| 972 | +```ts |
| 973 | +provideAuth0({ |
| 974 | + domain: 'YOUR_AUTH0_DOMAIN', |
| 975 | + clientId: 'YOUR_AUTH0_CLIENT_ID', |
| 976 | + authorizationParams: { |
| 977 | + redirect_uri: window.location.origin, |
| 978 | + }, |
| 979 | + sessionTransferTokenQueryParamName: 'session_transfer_token', |
| 980 | +}), |
| 981 | +``` |
| 982 | +
|
| 983 | +When the web app is opened with `?session_transfer_token=xyz` in the URL, the SDK extracts the token, includes it in the `/authorize` request, and removes it from the URL via `window.history.replaceState()`. |
| 984 | +
|
| 985 | +### Using a custom parameter name |
| 986 | +
|
| 987 | +If your native app uses a different query parameter name, configure that name instead. The token is always forwarded to Auth0 as `session_transfer_token` regardless: |
| 988 | +
|
| 989 | +```ts |
| 990 | +AuthModule.forRoot({ |
| 991 | + domain: 'YOUR_AUTH0_DOMAIN', |
| 992 | + clientId: 'YOUR_AUTH0_CLIENT_ID', |
| 993 | + authorizationParams: { |
| 994 | + redirect_uri: window.location.origin, |
| 995 | + }, |
| 996 | + sessionTransferTokenQueryParamName: 'stt', |
| 997 | +}), |
| 998 | +``` |
| 999 | +
|
| 1000 | +### Manually providing the session transfer token |
| 1001 | +
|
| 1002 | +You can pass the token directly via `authorizationParams`. This takes precedence over automatic URL detection: |
| 1003 | +
|
| 1004 | +```ts |
| 1005 | +this.auth.loginWithRedirect({ |
| 1006 | + authorizationParams: { |
| 1007 | + session_transfer_token: 'YOUR_SESSION_TRANSFER_TOKEN', |
| 1008 | + }, |
| 1009 | +}); |
| 1010 | +``` |
0 commit comments