SSO across your apps: one tenant, shared session, and logout that actually logs out

SSO across apps

Setup

Register each app (web, SPA, mobile) in the SAME tenant. They share the Auth0 SSO session automatically: user logs in on app A, visits app B, app B's authorize call returns immediately with a code, no password.

Requirements:

• Same tenant. Different tenants = no shared session.
• Each app registered with its own callback URLs; the session is tenant-wide, the app configs are per-app.
• Consistent connection availability: if app B does not enable the connection the user used on app A, the silent login fails and the user sees a confusing error.

Session consistency

Decide the session story up front:

• Independent app sessions: each app keeps its own session lifetime. Logging out of A does not log out of B. Simplest, often fine.
• Central logout: logout from any app hits /v2/logout, killing the SSO session. App B's session survives until its own expiry unless you add backchannel/frontchannel logout handling.

Most teams want the middle: /v2/logout everywhere (SSO dead), app sessions short enough that stragglers do not matter.

Enterprise SSO

For customers with their own IdP: enterprise connection per org (Organizations), IdP-initiated vs SP-initiated flows decided per customer. Test both directions; IdP-initiated has its own callback quirks.

Checklist

• All apps same tenant, connections enabled on each.
• Logout story written down and tested across two apps, not assumed.

Auth0's SSO docs describe the shared SSO session across applications in a tenant and the session layer behavior. Enterprise connections and Organizations SSO are in the respective docs. Verified against live docs 2026-09-26.