docs: Adds documentation for custom token exchange org support - #160
Merged
Merged
Conversation
…edirect wrappers Exposes STT impersonation methods on AuthClient with flat-param signatures matching the existing SDK wrapper convention. Bumps auth0-server-python min version to b14 (first release with SessionTransferTokenResult). Tests cover delegation, actor forwarding, org forwarding, ACTOR_UNAVAILABLE propagation, no-session-write invariant, and invalid-URL error path. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
rmad17
marked this pull request as ready for review
September 8, 2026 05:45
Contributor
|
Let's change the PR title to call out what this PR is doing |
kishore7snehil
requested changes
Sep 10, 2026
| ## 4. Error Handling | ||
| ## 4. Scoping the Exchange to an Organization | ||
|
|
||
| Pass `organization` (an org ID like `org_abc123`, or an org name) to scope the exchange to a specific |
Contributor
There was a problem hiding this comment.
Any reason we are folding the characters in a sentence.
Contributor
Author
There was a problem hiding this comment.
Not intentional. Fixed - joined the two lines into one sentence in e8b7780.
| `INVALID_TOKEN_FORMAT` is raised client-side before any network call for an empty or whitespace-only `subject_token`, or one with a `"Bearer "` prefix. Other malformed-but-nonempty values (including a `subject_token_type` that isn't a valid URI) are not checked client-side and are sent to Auth0, which rejects them. | ||
|
|
||
| ## 5. Token Type URIs | ||
| When `organization` is set and the subject is not a member, Auth0 rejects the exchange as `CustomTokenExchangeError`. |
rmad17
changed the title
rmad17
changed the title
Merged
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
📋 Changes
This PR extends the existing Custom Token Exchange (CTE) and Session Transfer Token (STT)
support in
auth0-fastapiwithorganizationscoping. The underlying implementation livesin
auth0-server-python, this PR surfaces the parameter in documentation, tests, and onedocstring clarification.
Changes
examples/CustomTokenExchange.md- New section "Scoping the Exchange to anOrganization" with a code example showing
organizationonlogin_with_custom_token_exchange. Error handling section updated to note that Auth0rejects the exchange if the subject is not a member of the specified organization.
Sections renumbered accordingly.
src/auth0_fastapi/auth/auth_client.py- AddedInvalidArgumentError: If organization is provided but blankto therequest_session_transfer_tokenRaises docstring, matching the guard in the underlyingauth0-server-pythonclient.src/auth0_fastapi/test/test_auth_client.py- FixedInvalidArgumentErrorimportsource (
auth0_server_python.error, notauth0_fastapi.errors). Added five tests:test_custom_token_exchange_organization_forwarded-organizationis forwardedthrough
custom_token_exchangetest_login_with_custom_token_exchange_organization_forwarded-organizationisforwarded through
login_with_custom_token_exchangetest_request_session_transfer_token_with_organization-organizationis forwardedthrough
request_session_transfer_tokentest_build_session_transfer_redirect_with_organization-organizationis forwardedto the redirect builder
test_request_session_transfer_token_blank_organization_raises- blankorganizationpropagates
InvalidArgumentErrorfrom the underlying clientNo API surface changes
organizationwas already accepted by bothrequest_session_transfer_tokenandbuild_session_transfer_redirect(landed in PR #153). This PR adds test coverage anddocumentation for that parameter.