Are Auth0 Id's senstive

Adding some color here - When a user utilizes a Google Connection to perform authentication via the Google upstream IdP - a redirect occurs to Google and upon successful authentication it (Google) creates its own session. Just like CIC (Auth0). google-oauth2|xxxx is the identifier of the user in Auth0, referenced via the Auth0 established session; xxxx is the identifier of the user in Google, referenced via the session that Google establishes.

The OIDC solution for this is PPID (defined below) - I believe Apple is the only provider that implements this.

Pairwise Pseudonymous Identifier (PPID)
Identifier that identifies the Entity to a Relying Party that cannot be correlated with the Entity’s PPID at another Relying Party.

Hope this helps to clarify!