Auth0's session_transfer_token generalises from native-to-web handoffs to bridging two different domains on one tenant - but the audience parameter has an undocumented requirement. Name the wrong domain and you get a 200 response that looks like success and isn't. https://tobytes.com/articles/auth0-cross-domain-sso-session-transfer-token-audience-domain #auth0 #identity #oauth