Tap 'Open in browser' in a mobile app and get asked to log in again - that's two independent OAuth clients with no shared context. Auth0's session_transfer_token fixes it: single-use, 60s, IP-bound. Exchange your refresh token for the STT and pass it to /authorize. Full web session, no re-auth. https://tobytes.com/articles/auth0-native-to-web-sso-session-transfer-token #Auth0 #identity #oauth