Configure Anonymous Sessions

To configure anonymous sessions, you can use the Auth0 Dashboard or the Management API.

Prerequisites

To use anonymous sessions:

You must have an Auth0 account.
Register your Auth0 application. If you do not have an Auth0 application, you can get started with the Auth0 React or Next.js Quickstarts.
Register an API (resource server).

Configure anonymous sessions

Auth0 Dashboard
Management API

Navigate to Dashboard > Tenant Settings > Advanced, and scroll down to the session settings.
Enter a value for the Anonymous Session Lifetime in minutes.
Enable or disable the Anonymous Session Cookie switch to control whether anonymous session requests return the auth0_anon cookie.

To configure the anonymous session lifetime and cookie behavior, make a PATCH request to the /api/v2/tenants/settings endpoint:

{
  "sessions": {
    "anonymous": {
      "lifetime_in_minutes": 144000,
      "activate_cookie": true
    }
  }
}

lifetime_in_minutes sets how long a session is valid for.
activate_cookie sets whether to issue the auth0_anon cookie in anonymous flows. Set this to false if you plan to use the cookieless transfer-ticket mechanism instead.

Enable anonymous sessions in your application

Auth0 Dashboard
Management API

Navigate to Dashboard > Applications > Applications, and select the application you want to configure.
Scroll down to the Anonymous Sessions settings.
Enable the switch to Allow Anonymous Sessions.

To enable anonymous sessions in your Auth0 application, make a PATCH request to the /api/v2/clients/{id} endpoint:

{
  "anonymous_sessions": {
    "active": true
  }
}

Enable anonymous access in your API

Auth0 Dashboard
Management API

Navigate to Dashboard > Applications > APIs, and select the API you want to configure.
In the Access token expiration section, set the Anonymous Access Token Lifetime in seconds. The minimum is one day (86400 seconds) and the maximum is 30 days (2592000 seconds).
Under Application Access Policy, set the Anonymous Access policy to Per-app authorization to enable anonymous sessions using this audience for their access tokens.

To enable anonymous sessions in your API, make a PATCH request to the /api/v2/resource-servers/{id} endpoint:

{
  "token_lifetime_for_anonymous_access_tokens": 86400,
  "subject_type_authorization": {
    "user":           { "policy": "allow_all" },
    "client":         { "policy": "deny_all" },
    "anonymous_user": { "policy": "require_client_grant" }
  }
}

token_lifetime_for_anonymous_access_tokens sets the expiration time, in seconds, of access tokens this API issues in an anonymous session context.
subject_type_authorization.anonymous_user sets whether individual applications can use this API in anonymous sessions (based on policies) or whether this API disallows issuing anonymous access tokens at all.

Create an API Access policy for anonymous users

Auth0 Dashboard
Management API

Navigate to Dashboard > Applications > APIs, and select the API you want to configure.
Select the Application Access tab.
For each application you want this API to issue access tokens to in an anonymous context, select Edit.
Select Anonymous Access, and Configure the permissions you want to grant anonymous users when using this application.
Select Save.

Once anonymous sessions are enabled in your API, make a POST request to the /api/v2/client-grants endpoint:

{
  "audience": "YOUR_AUDIENCE",
  "client_id": "YOUR_CLIENT_ID",
  "scope": [ "read", "write", "delete" ],
  "subject_type": "anonymous_user"
}

Create an anonymous session

Once anonymous sessions are configured in your tenant, application, and API, you can create an anonymous session by making a POST request to the /anonymous/token endpoint:

{
  "client_id": "YOUR_CLIENT_ID",
  "audience": "YOUR_AUDIENCE",
  "scope": "anon"
}

The response includes a session_token and an access_token:

{
  "session_token": "eyJhbGciOiJkaXIiLCJlbmMiOiJBMjU2R0NNIn0...",
  "access_token": "eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9...",
  "token_type": "Bearer",
  "expires_in": 86400
}

Configure custom claims

You can configure custom claims to map anonymous session metadata directly into the access tokens issued for a specific audience. This is useful because there is no post-login Action execution with anonymous sessions, so api.accessToken.setCustomClaim() is not available to enrich anonymous access tokens the way it is for authenticated ones. To learn more, read Configure Custom Claims for Anonymous Sessions.

Next steps

Anonymous Sessions Use Cases

Learn about anonymous sessions use cases.

Concepts

How To

Use Cases

Configure Anonymous Sessions

Prerequisites

Configure anonymous sessions

Enable anonymous sessions in your application

Enable anonymous access in your API

Create an API Access policy for anonymous users

Create an anonymous session

Configure custom claims

Next steps

Anonymous Sessions Use Cases

​Prerequisites

​Configure anonymous sessions

​Enable anonymous sessions in your application

​Enable anonymous access in your API

​Create an API Access policy for anonymous users

​Create an anonymous session

​Configure custom claims

​Next steps

Anonymous Sessions Use Cases

Prerequisites

Configure anonymous sessions

Enable anonymous sessions in your application

Enable anonymous access in your API

Create an API Access policy for anonymous users

Create an anonymous session

Configure custom claims

Next steps