I have a requirement that certain sensitive operations performed by my backend services require recent interactive authentication. The backend services only have access to access tokens, not ID tokens. When the max_age parameter is provided, Auth0 provides the auth_time claim in the ID token, but not the access token. Therefore, the backend services have no way of checking whether the operation should be permitted or not.
Is there a way to get Auth0 to put the auth_time claim in the access token without being on the Enterprise tier? A post-login action cannot copy it from the ID token into the access token because the ID token is not available to the script. The event.session.authenticated_at field is marked Enterprise-only, and I’m not on the Enterprise tier, and the documentation doesn’t explicitly state that it is equivalent to auth_time anyway.
Any help would be very much appreciated.