Let’s remove the account linking from the equation for a moment. We have two flows:
- User logs in with Google and checks all the required permissions. We retrieve the Google refresh token via the
GET /v2/users/{id} endpoint immediately following the initial login.
- User logs in with Google and does not check the required permissions. Then, when the user is in the dashboard, we inform them that they need to check the required permissions in order to use all the features of the dashboard.
- That’s the moment we use
prompt=consent,access_type=offline, also, informing the connection=google-oauth2 parameter. This forces the consent flow to be performed again. We receive the refresh token in this case.
Now, what I mentioned above is 100% true, and it works as expected only when a single Google account is used. However, when we link the Google account as a secondary account, the refresh token is not stored in the Auth0 side.
One workaround for this use case is to have Google Social Connection as the primary account. It does not make sense, though. What if I add Facebook support? Apple?
I’m building a SaaS product and planned to subscribe to the Essentials plan. Auth0 says it supports account linking, but the product is incomplete: it says one thing, and does another. The product is impracticable, it does not work, and Auth0 does not have a plan to fix it.
Token Vault with Connected Accounts is an alternative. However, how do I trust this new product if account linking is not working? I feel frustrated.
Hi @tinuvi.solutions
I understand that you are asking why the refresh token from a linked Google account is not exposed as a top-level property in the Auth0 user object when using account linking.
The account linking endpoint is designed to return only the primary user’s credentials. Federated tokens (such as Google refresh tokens) from secondary linked identities are stored in the profile array of the secondary identity, not exposed as top-level properties in the user object. This architectural limitation means the linking flow behaves differently depending on which identity is set as primary.
Root Cause: Auth0’s traditional account linking feature stores federated tokens from secondary identities in nested profile arrays rather than exposing them at the top level. This design prevents symmetric handling of linked accounts—you cannot reliably retrieve federated tokens regardless of which identity is designated as primary.
Solution: Use Token Vault with Connected Accounts, a modern API-based approach that securely stores federated tokens independently of identity relationships.
-
Configure Token Vault on your Auth0 tenant and complete any required dependencies.
-
Verify that your federated connections are supported. Token Vault currently covers most federated connections, and you can create custom social or enterprise connections to extend coverage if needed.
-
Implement token retrieval using the Token Vault API. When you need a federated token (such as a Google access or refresh token), call the Token Vault endpoint to retrieve it securely, rather than relying on the user object structure.
-
Test that tokens are returned consistently regardless of which identity is configured as primary.
Why Token Vault is recommended: Token Vault decouples federated tokens from identity relationships, storing them securely in a centralized vault. This eliminates the architectural limitation of traditional account linking and provides a reliable, single grant-type API approach for token exchanges.
Important note: Token Vault is a relatively recent feature. If you encounter issues during implementation or need guidance on whether Token Vault suits your specific use case, contact Auth0 Support directly for an in-depth discussion. Support is available to Essentials plan subscribers and above.
Please follow up if you need further assistance with Token Vault configuration.
Kind Regards,
Nik
Account linking product has a bug. It’s a serious bug. The product does not appear incomplete. It is incomplete. If that’s the case, account linking has to be removed from the pricing page.
It is understandable your solution regarding Token Vault with Connected Accounts. It’s fine and I think it’s the correct approach of solving the issue about token exchange flow and all of its security issues. Though, that does not justify Auth0 selling point. What I’m asking is not a “feature request” or something. It’s a bug fix that has to be done.