How it works
The following diagram shows the delegated authorization flow for calling a first-party API:
Authorization Flow
1
User authentication
A user logs into your AI application or agent interface (e.g., via Universal
Login).
2
Access token issuance
After the user authenticates, Auth0 issues an access token to your
application.
3
AI agent makes a tool call
When the AI agent needs to access user-specific data or perform an action,
it makes a tool call to an API endpoint.
4
Token forwarding
The access token obtained in step 2 is included in the API request
(typically in the
Authorization header).5
API validation & response
The API validates the access token. If valid, it processes the request on
the user’s behalf and returns the response to the AI agent.
6
AI agent receives and processes the information
The AI agent uses this response to fulfill the user’s request.