Call Third-Party APIs on User's Behalf Without User Migration

const { createRemoteJWKSet, jwtVerify } = require('jose');

/**
 * Custom Token Exchange Handler
 * @param {Event} event - Auth0 Custom Token Exchange Event
 * @param {CustomTokenExchangeAPI} api - Auth0 Action API
 */
exports.onExecuteCustomTokenExchange = async (event, api) => {
  const token = event.transaction.subject_token;
  const issuer = event.secrets.YOUR_IDP_ISSUER; // trailing slash, OIDC issuer form
  const audience = event.secrets.YOUR_IDP_AUDIENCE; // pins token to your login client

  let claims;
  try {
    const jwks = createRemoteJWKSet(new URL(`${issuer}.well-known/jwks.json`));

    // 1. Validate the ID token issued by your User IdP
    ({ payload: claims } = await jwtVerify(token, jwks, { issuer, audience }));
  } catch {
    return api.access.rejectInvalidSubjectToken('Invalid subject token');
  }
  if (!claims.sub) return api.access.rejectInvalidSubjectToken('Missing sub');
  if (!claims.email) return api.access.rejectInvalidSubjectToken('Missing email');

  // 2. Provision or update the JIT shadow profile in Auth0
  api.authentication.setUserByConnection(
    'cte-users',
    {
      user_id: claims.sub, // stable, unique per upstream user
      email: claims.email,
      email_verified: claims.email_verified === true,
      name: claims.name,
    },
    { creationBehavior: 'create_if_not_exists', updateBehavior: 'none' },
  );

  // 3. Optional: Attach Organization context for Token Vault access if needed
  if (event.organization) api.authentication.setOrganization(event.organization.id);
};

{
  "name": "external-idp-exchange",
  "subject_token_type": "urn:acme:external-idp",
  "action_id": "<YOUR_ACTION_ID>",
  "type": "custom_authentication"
}

curl --request POST 'https://{yourDomain}/oauth/token' \
  --header 'content-type: application/x-www-form-urlencoded' \
  --data-urlencode 'grant_type=urn:ietf:params:oauth:grant-type:token-exchange' \
  --data-urlencode 'subject_token=<YOUR_USER_IDP_ID_TOKEN>' \
  --data-urlencode 'subject_token_type=urn:acme:external-idp' \
  --data-urlencode 'audience=https://{yourDomain}/me/' \
  --data-urlencode 'scope=read:me:connected_accounts create:me:connected_accounts' \
  --data-urlencode 'client_id=<YOUR_CLIENT_ID>' \
  --data-urlencode 'client_secret=<YOUR_CLIENT_SECRET>'
  # Add --data-urlencode 'organization=<YOUR_ORGANIZATION_ID>' only if using Organizations.

// 1. Create the connect flow (backend)
async function startConnect(myAccountToken, connection, redirectUri) {
  const res = await fetch(
    'https://{yourDomain}/me/v1/connected-accounts/connect',
    {
      method: 'POST',
      headers: {
        Authorization: `Bearer ${myAccountToken}`,
        'Content-Type': 'application/json',
      },
      body: JSON.stringify({ connection, redirect_uri: redirectUri, state: '<csrf>' }),
    },
  );
  const { connect_uri, connect_params, auth_session } = await res.json();
  // Persist auth_session (server-side, short-lived); send the user to:
  return {
    authorizationUrl: `${connect_uri}?ticket=${encodeURIComponent(connect_params.ticket)}`,
    auth_session,
  };
}

// 2. Callback to complete the link (backend)
async function completeConnect(myAccountToken, auth_session, connect_code, redirectUri) {
  await fetch('https://{yourDomain}/me/v1/connected-accounts/complete', {
    method: 'POST',
    headers: {
      Authorization: `Bearer ${myAccountToken}`,
      'Content-Type': 'application/json',
    },
    body: JSON.stringify({ auth_session, connect_code, redirect_uri: redirectUri }),
  });
  // On success, the account is added to connected_accounts, and tokens land in Token Vault.
}

async function getVaultToken(refreshToken: string, connection: string): Promise<string> {
  const body = new URLSearchParams({
    grant_type: 'urn:auth0:params:oauth:grant-type:token-exchange:federated-connection-access-token',
    subject_token_type: 'urn:ietf:params:oauth:token-type:refresh_token',
    subject_token: refreshToken,
    requested_token_type: 'http://auth0.com/oauth/token-type/federated-connection-access-token',
    connection, // e.g. 'github', 'google-oauth2'
    client_id: process.env.AGENT_CLIENT_ID!,
    client_secret: process.env.AGENT_CLIENT_SECRET!,
    // login_hint: '<optional — disambiguate multiple linked accounts>'
  });
  const res = await fetch('https://{yourDomain}/oauth/token', {
    method: 'POST',
    headers: { 'content-type': 'application/x-www-form-urlencoded' },
    body: body.toString(),
  });
  const data = await res.json();
  return data.access_token; // short-lived downstream provider token
}

import { Octokit } from '@octokit/rest';

async function runGitHubAgentTool(refreshToken) {
  const token = await getVaultToken(refreshToken, 'github');
  const octokit = new Octokit({ auth: token });
  const { data } = await octokit.rest.issues.listForAuthenticatedUser({ state: 'open', per_page: 5 });
  return data.map((i) => ({ title: i.title, url: i.html_url }));
}