Configure Anonymous Sessions

​

Prerequisites

• You must have an Auth0 account.
• Register your Auth0 application. If you do not have an Auth0 application, you can get started with the Auth0 React or Next.js Quickstarts.
• Register an API (resource server).

​

Configure anonymous sessions in your Auth0 tenant

​

Using the Dashboard

1. Go to Tenant Settings > Advanced, and scroll down to the session settings.
2. Enter a value for the Anonymous Session Lifetime, in minutes.
3. Enable or disable the Anonymous Session Cookie switch to control whether anonymous session requests return the auth0_anon cookie.

​

Using the Management API

{
  "sessions": {
    "anonymous": {
      "lifetime_in_minutes": 144000,
      "activate_cookie": true
    }
  }
}

• lifetime_in_minutes sets how long a session is valid for.
• activate_cookie sets whether to issue the auth0_anon cookie in anonymous flows. Set this to false if you plan to use the cookieless transfer-ticket mechanism instead.

​

Enable anonymous sessions in your application

​

Using the Dashboard

1. Go to Applications > Applications, and select the application you want to configure.
2. Scroll down to the anonymous session settings.
3. Enable the switch to allow this application to issue anonymous sessions.

​

Using the Management API

{
  "anonymous_sessions": {
    "active": true
  }
}

​

Enable anonymous access in your API

​

Using the Dashboard

1. Go to Applications > APIs, and select the API you want to configure.
2. Scroll to the Access token expiration section and set the Anonymous Access Token Lifetime, in seconds. The minimum is 1 day and the maximum is 30 days.
3. Scroll to Application Access Policy, and set the Anonymous Access policy to Per-app authorization to enable anonymous sessions using this audience for their access tokens.

​

Using the Management API

{
  "token_lifetime_for_anonymous_access_tokens": 86400,
  "subject_type_authorization": {
    "user":           { "policy": "allow_all" },
    "client":         { "policy": "deny_all" },
    "anonymous_user": { "policy": "require_client_grant" }
  }
}

• token_lifetime_for_anonymous_access_tokens sets the expiration time, in seconds, of access tokens this API issues in an anonymous session context.
• subject_type_authorization.anonymous_user sets whether individual applications can use this API in anonymous sessions (based on policies) or whether this API disallows issuing anonymous access tokens at all.

​

Create an API Access policy for anonymous users

​

Using the Dashboard

1. Go to Applications > APIs, and select the API you want to configure.
2. Navigate to the Application Access tab.
3. For each application you want this API to issue access tokens to in an anonymous context, select Edit.
4. In the drawer that appears, navigate to the Anonymous Access tab, and select the permissions you want to grant anonymous users requesting this audience when using this application.
5. Select Save.

​

Using the Management API

{
  "audience": "{{anon_sessions_audience_identifier}}",
  "client_id": "{{anon_sessions_clientid}}",
  "scope": [ "read", "write", "delete" ],
  "subject_type": "anonymous_user"
}

​

Configure custom claims

​

Create an anonymous session

{
  "client_id": "YOUR_CLIENT_ID",
  "audience": "YOUR_AUDIENCE",
  "scope": "anon"
}

{
  "session_token": "eyJhbGciOiJkaXIiLCJlbmMiOiJBMjU2R0NNIn0...",
  "access_token": "eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9...",
  "token_type": "Bearer",
  "expires_in": 86400
}

​

Next steps

• Anonymous Sessions Use Cases Learn about anonymous sessions use cases.