This guide demonstrates how to integrate Auth0 Native to Web Single Sign-On (SSO) with existing iOS or Android applications using the Auth0 CLI and supported SDKs.
+ +We recommend that you log in to follow this quickstart with examples configured for your Auth0 tenant.
+ +## Prerequisites + +To continue with this quickstart, we recommend completing the iOS Swift Quickstart or Android Quickstart.
+ +To successfully enable Native to Web SSO, your mobile application must:
+refresh_token as part of the login flow.This quickstart uses the Auth0 CLI to configure your Auth0 tenant. You may also use the Auth0 Management API. For more details, see Configure Native to Web SSO.
+Start by authenticating to your Auth0 tenant using the Auth0 CLI:
+ +auth0 loginWhen prompted:
+ +How would you like to authenticate?
+> As a user
+ As a machine
+Choose As a user and follow the login flow. Select the Auth0 tenant where you want to enable Native to Web SSO.
+ +## Configure Auth0 + +### Enable Session Transfer Token in the Native Application + +Native to Web SSO uses a session_transfer_token to establish SSO from a native app to a web app.
This token allows Auth0 to identify the user, the native origin app, and additional context securely. For more details, refer to the Native to Web SSO documentation.
+ +Use the Auth0 CLI to enable your native application to generate session transfer tokens:
+ +auth0 apps session-transfer set ${account.clientId} \
+ --can-create-token=true \
+ --enforce-device-binding=asnConfigure the web application to accept the session_transfer_token for authentication using either cookie or URL parameter:
auth0 apps session-transfer set ${account.clientId} \
+ --allowed-authentication-methods=cookie,queryThis enables the native application to inject the token into a WebView using a cookie or append it as a URL parameter.
+ +To test Native to Web SSO on mobile, use a WebView that supports cookie injection (e.g., Android WebView or iOS WKWebView) or append the token as a query string to the login URI if your WebView don't support cookie injection.
+Once your native app has obtained a refresh_token, it must exchange it for a session_transfer_token immediately before launching the web session. This token is short-lived (60 seconds), so it should be generated as close as possible to when the WebView or browser is opened.
We recommend placing the session transfer exchange and WebView launch logic inside the same event handler — such as a button’s onClick method. This ensures the token is valid and avoids timing issues.
The code demonstrates how to pass the session_transfer_token to your web application using a cookie. This method requires WebViews or browsers that support cookie injection. If your platform or WebView does not support cookies, you can instead append the token as a query parameter to the login URL.
To support Native to Web SSO, your web application must be prepared to handle a session_transfer_token received via either a cookie or a URL parameter.
If the token is injected into the browser via a cookie—as shown in the native app examples—then no changes to your web application are required. The only requirement is that the browser navigates to your Application Login URI, which should handle redirecting the user to your Auth0 tenant’s /authorize endpoint.
You can configure the Application Login URI in your application's settings within the Auth0 Dashboard. This is the route Auth0 will redirect users to when initiating login from external sources.
+In the sample below, we show how to handle URL-based session transfer tokens. This is not needed for cookie-based flows, but it helps illustrate how URL-based SSO would be handled as well.
+ +```js + +const { auth } = require('express-openid-connect'); + +const config = { + authRequired: false, + auth0Logout: true, + authorizationParams: { + response_type: 'code', + scope: 'openid profile email', + } +}; + +// Middleware that supports session_transfer_token via query parameter +app.use((req, res, next) => { + const { session_transfer_token } = req.query; + + if (session_transfer_token) { + config.authorizationParams.session_transfer_token = session_transfer_token; + } + + auth(config)(req, res, next); +}); + +```