Missing auth_time claim on ID token after update password before continue Action

Last Updated: Sep 10, 2025

Overview

The ID token is not showing the auth_time property that should be after an /authorize call with max_age

Cause

It's possible that the session is closed and then opened again, and that could explain why the ID token comes without auth_time after the password is updated for this user. After continuing the Action, the ID token does not contain auth_time.

Docs:

https://auth0.com/docs/authenticate/login/max-age-reauthentication#use-auth_time-claims
https://auth0.com/docs/customize/actions/flows-and-triggers/login-flow/redirect-with-actions

Solution

A possible workaround is that the user update (password change, etc.) step is made after the whole login flow is completed. If the user is not modified at all, the auth_time comes in the ID token (tested).