OptionalactorExplicit actor override. Omit to use the agent session's ID token.
If the session ID token is expired but a refresh token is available the SDK refreshes it first.
Fails with ACTOR_UNAVAILABLE only when no usable token can be resolved. If that refresh
itself requires MFA step-up, an MfaRequiredError is thrown instead.
Precedence: explicit actor → session ID token (refreshed if stale) → throws ACTOR_UNAVAILABLE.
OptionaladditionalAdditional custom parameters forwarded to the token endpoint.
Accessible in your Action via event.request.body.
OptionalorganizationOrganization ID or name. Forwarded to /authorize by buildSessionTransferRedirect.
Required when the STT is issued in an org context.
OptionalreasonReason for impersonation. Forwarded to the token endpoint as a body param
and readable by your Action at event.request.body.reason.
Must be included in setActor(...) by your Action for it to appear as act.reason.
OptionalscopeScopes for the impersonation session tokens.
Merged with SDK default scopes (openid, profile, email).
Note: offline_access is silently suppressed by Auth0 for impersonation sessions.
Your proof of which customer to impersonate.
Opaque to Auth0 — validated only by your CTE Action via setUserById.
The SDK never produces this value.
Your CTE Profile ID that routes the exchange to your Action.
Same validation rules as CustomTokenExchangeOptions.subjectTokenType (10–100 chars, valid URI).
Options for requesting a Session Transfer Token (STT).
The SDK fills in
audience,grant_type,actor_token, andactor_token_typeautomatically. You supplysubjectTokenandsubjectTokenType— your own proof of which customer to impersonate, validated by your Action.