Auth0

No entries match these filters. Clear filters

1. Multi-Factor Authentication: Exponential Backoff for Phone MFA SMS Delivery (2026-10-30) Oct 30, 2026 · issue 126

   Auth0 adds SMSSMSShort Message Service, the protocol built into cellular networks for sending text messages between phones; cyber tools use it for alerting, two-factor authentication delivery, or phishing simulation over mobile channels. Fraud Protection with Exponential Backoff for Phone MFAMFAMulti-factor authentication, requiring proof from different categories, such as a password and a hardware key, to sign in. It reduces reliance on a password alone. on Enterprise plans to replace static rate limits with progressive delays⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   ⤢ ⤢ ⤢
   • Auth0 now logs throttled SMS send attempts as limit_phone tenant log events, including remaining cooldown durations, for audit visibility into fraud-throttling activity.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • An initial buffer of immediate retry attempts accommodates typos or delivery delays before progressive wait times take effect.

   2 details in Everything

2. HTTP Message Signatures Added to Tenant Network ACLs (2026-10-29) Oct 29, 2026 · issue 125

   Auth0 adds RFC 9421RFC 9421An IETF standard defining HTTP Message Signatures, a scheme for cryptographically signing HTTP requests and responses so tools can verify message integrity and authenticity end-to-end. HTTP Message Signatures to Tenant Network ACLsACLsAn access control list, a set of rules allowing or denying operations for particular users, services or network addresses. It decides who can use a resource. for cryptographic origin verification via the Management API⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   ⤢ ⤢ ⤢
   • Observe key-rotation activity and verification events via acls_summary Tenant Log events.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Auth0 Tenant Network ACLs now support RFC 9421 HTTP Message Signatures via the Management API, letting enterprise tenants enforce HMAC-SHA256HMAC-SHA256A keyed hash that proves a message came from someone holding a shared secret and was not altered. Webhooks and API request signing commonly use it. request verification at the network boundary to block direct tenant bypass.
   • Validate that incoming requests originate only from authorized reverse proxies or gateways, dropping unverified direct traffic.
   • Rotate signing keys with zero downtime by configuring multiple active signing keys per rule.

   4 details in Everything

3. changelog Oct 28, 2026 · issue 123

   Auth0 adds Agent Mode to CLI, CIMDCIMDA text-based Short Message Service protocol from Nokia for exchanging SMS messages between applications and SMS centers, used to build tools that send, receive, or test carrier messaging flows. dynamic registration, Identity Conversion Suite, Application Profiles, and FGA Permissions Index EA⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   ⤢ ⤢ ⤢
   └──▷ HOW TO FIND IT
   Configure Manual unblock mode so email security scanners cannot accidentally consume recovery links and unblock accounts prematurely.
   📍Auth0 Dashboard › Security › Attack Protection › Brute-Force Protection › Unblock Behavior › select Manual › Save
   • Adds --agent-mode flag (or AUTH0_AGENT_MODE=true env var) for structured JSON output, prompt-free operation, guaranteed non-zero exit on failure, and stable error code/reason fields (auto-detected for recognized agent clients); auth0 commands --flat (with optional --detailed) for full CLI discovery in a single call; --schema to print the exact JSON payload a command expects (sourced live from the OpenAPIOpenAPIA vendor-neutral specification for describing REST APIs in a machine-readable format, maintained by the OpenAPI Initiative. Cyber tools use it to auto-generate clients, documentation, and validation from a single source of truth. spec) and --data to send a whole payload as one JSON object with local validation before it reaches the API; auth0 docs search for searching Auth0 documentation from the terminal without login; and auth0 agent skills install to install the Auth0 skill into Claude Code, Cursor, or all supported assistants.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Introduces CIMD (Client ID Metadata Document) with dynamic registration in Early Access, allowing MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. clients and AI agents to connect to a tenant via just-in-time registration using a metadata URL — no pre-registration required.
   • Introduces Application Profiles in Early Access, enabling centralized governance of security settings (refresh tokenrefresh tokenA credential used to obtain a new access token without signing in again. It is sent to the authorization service rather than used directly to call the protected API. lifetimes, leeway, DPoPDPoPAn IETF standard that binds an OAuth access token to a specific client's cryptographic key pair, so a stolen token cannot be replayed by an attacker who lacks the matching private key., B2B login behavior) across all CIMD-registered applications from a single configuration point in the Auth0 Dashboard under the Applications section.
   • Adds an Unblock Behavior setting to Brute-Force Protection (Auth0 Dashboard > Security > Attack Protection > Brute-Force Protection), with Automatic (default) and Manual modes — Manual mode prevents email security scanners from consuming recovery links before the user opens them.
   • Graduates the FGA Permissions Index from Developer Preview to Early Access, with self-service build/monitor/manage inside the FGA Dashboard; Enterprise subscriptions include one index with up to 10 million expansions, with a paid add-on scaling to 10 indexes and higher expansion limits.
   • Adds --agent-mode flag (or AUTH0_AGENT_MODE=true env var) for structured JSON output, prompt-free operation, guaranteed non-zero exit on failure, and stable error code/reason fields (auto-detected for recognized agent clients); auth0 commands --flat (with optional --detailed) for full CLI discovery in a single call; --schema to print the exact JSON payload a command expects (sourced live from the OpenAPIOpenAPIA vendor-neutral specification for describing REST APIs in a machine-readable format, maintained by the OpenAPI Initiative. Cyber tools use it to auto-generate clients, documentation, and validation from a single source of truth. spec) and --data to send a whole payload as one JSON object with local validation before it reaches the API; auth0 docs search for searching Auth0 documentation from the terminal without login; and auth0 agent skills install to install the Auth0 skill into Claude Code, Cursor, or all supported assistants.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Introduces CIMD (Client ID Metadata Document) with dynamic registration in Early Access, allowing MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. clients and AI agents to connect to a tenant via just-in-time registration using a metadata URL — no pre-registration required.
   • Introduces Application Profiles in Early Access, enabling centralized governance of security settings (refresh tokenrefresh tokenA credential used to obtain a new access token without signing in again. It is sent to the authorization service rather than used directly to call the protected API. lifetimes, leeway, DPoPDPoPAn IETF standard that binds an OAuth access token to a specific client's cryptographic key pair, so a stolen token cannot be replayed by an attacker who lacks the matching private key., B2B login behavior) across all CIMD-registered applications from a single configuration point in the Auth0 Dashboard under the Applications section.
   • Adds an Unblock Behavior setting to Brute-Force Protection (Auth0 Dashboard > Security > Attack Protection > Brute-Force Protection), with Automatic (default) and Manual modes — Manual mode prevents email security scanners from consuming recovery links before the user opens them.

   1 more in Everything

4. Introducing Universal Portals - Developer Preview (2026-10-27) Oct 27, 2026 · issue 124

   Auth0 adds Universal Portals in Developer Preview — hosted self-service portals for end users and organization admins, built from pre-built components and served on your doma⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   ⤢ ⤢ ⤢
   └──▷ HOW TO FIND IT
   Set up a consumer portal so end users can self-serve MFAMFAMulti-factor authentication, requiring proof from different categories, such as a password and a hardware key, to sign in. It reduces reliance on a password alone. enrollment and profile updates without you building any UI.
   📍In the Auth0 dashboard, go to Customize › Portals, create a new portal of type Consumer, add a Universal Component for MFA enrollment, and publish it to your tenant domain.
   Embed an Auth0 Form on a portal page to collect policy acceptance from users on login.
   📍In the Auth0 dashboard, go to Customize › Portals, open a portal page in the visual builder, select Add Component › Auth0 Form, choose your policy-acceptance Form, and save.
   • Auth0 now offers consumer portals where end users can update their profile, enroll MFA factors and passkeyspasskeysPhishing-resistant sign-in credentials built on FIDO2/WebAuthn: the device holds a private key and proves possession instead of the user typing a password. They sync across a user's devices., and review security settings — hosted by Auth0 on your domain with no interface to build or maintain.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Auth0 now offers business portals where organization administrators can edit organization details and verify domains, without custom development.
   • Build portal pages visually using Universal Components, Auth0 Forms, and layout components such as headings, rich text, sections, separators, and images.
   • Add an Auth0 Form to any portal page to collect or update information, including profile updates, policy acceptance, and communication preferences.
   • Portals inherit your tenant's logo, colors, and fonts — or switch to an organization's branding when opened in an organization context.

   +2 more show less

   • Portal servers hold access and refresh tokensrefresh tokensA credential used to obtain a new access token without signing in again. It is sent to the authorization service rather than used directly to call the protected API. server-side; the browser receives only a secure session cookie.
   • Portals automatically trigger an MFA step-up challenge when Auth0 requires MFA for an operation, then retry the operation once the user completes it.

   7 details in Everything

5. Identity Conversion Suite is now in Early Access (2026-10-26) Oct 26, 2026 · issue 122

   Auth0 launches Identity Conversion Suite in Early Access, bundling Anonymous Sessions and Experiment Center for Enterprise plans.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   ⤢ ⤢ ⤢
   • Adds Anonymous Sessions to maintain session context for visitors before they sign up or log in.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds Experiment Center to A/B test login experiences and review results in metrics dashboards.
   • Introduces the Identity Conversion Suite as a paid add-on for Enterprise plans, combining Anonymous Sessions and Experiment Center.

   3 details in Everything

6. announced Oct 22, 2026 · issue 120

   Auth0 adds CIMDCIMDA text-based Short Message Service protocol from Nokia for exchanging SMS messages between applications and SMS centers, used to build tools that send, receive, or test carrier messaging flows. manual pre-registration and dynamic registration (Early Access) plus Application Profiles for AI agent identity at scale.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   • Adds CIMD with manual pre-registration, letting administrators submit a client metadata URL to Auth0, which retrieves and validates the metadata before creating the client after admin approval.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds CIMD with dynamic registration (Early Access), enabling just-in-time client discovery and registration during an OAuth authorization flow using a client ID metadata URL — without requiring admin pre-registration of every client.
   • Adds Application Profiles (Early Access) for centrally managing security and authorization settings — including refresh tokenrefresh tokenA credential used to obtain a new access token without signing in again. It is sent to the authorization service rather than used directly to call the protected API. policies, Demonstrating Proof of Possession (DPoPDPoPAn IETF standard that binds an OAuth access token to a specific client's cryptographic key pair, so a stolen token cannot be replayed by an attacker who lacks the matching private key.), and Organizations — across dynamically registered CIMD clients.

   3 details in Everything

7. announced Oct 22, 2026 · issue 120

   New b2b-saas-starter Terraform module provisions a full B2B identity stack — RBACRBACRole-based access control, where permissions are assigned to roles such as reader or administrator and users receive those roles. It makes access easier to manage than individual permission lists., MFAMFAMulti-factor authentication, requiring proof from different categories, such as a password and a hardware key, to sign in. It reduces reliance on a password alone., attack protection, enterprise SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management., and custom domains — from one module block.

   • Single module block provisions app client, API, RBAC, MFA, attack protection, and branding on Auth0.
   • roles and permissions inputs declare role-permission mappings as plain data with pre-apply validation.
   • organizations input creates per-customer Auth0 Organizations with SAMLSAMLA standard for passing signed identity assertions between a sign-in provider and an application. It lets a user sign in through their organization's identity provider. (samlp) or OIDCOIDCOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user. enterprise SSO connections.
   • custom_domain and enable_custom_domain_verification inputs with dns_verification_record, dns_verification_command, and custom_domain_next_step outputs guide multi-step custom-domain setup.
   • manage_tenant, manage_attack_protection, and manage_mfa flags let multiple module instances share a tenant without ownership conflicts.

   5 details in Everything

   • New integration Terraform Auth0 Modules — b2b-saas-starter
8. Application Profiles are available in Early Access (2026-10-22) Oct 22, 2026 · issue 117

   Auth0 Early Access: Application Profiles centralize security settings for DCIMD apps used by AI agents in one config point.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   ⤢ ⤢ ⤢ ⤢
   └──▷ HOW TO FIND IT
   Configure Application Profiles for DCIMD apps via the Auth0 dashboard to enforce uniform refresh tokenrefresh tokenA credential used to obtain a new access token without signing in again. It is sent to the authorization service rather than used directly to call the protected API. and DPoPDPoPAn IETF standard that binds an OAuth access token to a specific client's cryptographic key pair, so a stolen token cannot be replayed by an attacker who lacks the matching private key. settings across all AI agent-managed applications.
   📍1. In the Auth0 dashboard, navigate to Applications section. 2. Open Application Profiles. 3. Set default values for refresh token lifetimes, leeway, and DPoP. 4. Configure B2B behaviour (individuals / organizations / both) and login experience. 5. Save — settings apply to all DCIMD applications at runtime.
   • Adds Application Profiles (Early Access) to govern security settings — refresh token lifetimes, leeway, and DPoP — across all DCIMD applications from a single configuration point.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds B2B behaviour configuration for DCIMD applications via Application Profiles, controlling whether applications serve individuals, organizations, or both, along with login experience settings.
   • Enables centralized management of third-party applications created and used by AI agents through Application Profiles.

   3 details in Everything

9. CIMD with Dynamic Registration in Early Access (2026-10-22) Oct 22, 2026 · issue 117

   Auth0 adds CIMDCIMDA text-based Short Message Service protocol from Nokia for exchanging SMS messages between applications and SMS centers, used to build tools that send, receive, or test carrier messaging flows. with dynamic registration (Early Access): MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. clients and AI agents self-register via metadata URL at OAuth time.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   ⤢ ⤢ ⤢ ⤢
   • Supports Client ID Metadata Document (CIMD) with dynamic registration (Early Access): MCP clients and AI agents present an HTTPSHTTPSHTTP carried over an encrypted TLS connection. It protects traffic in transit and lets a browser verify the server's certificate. metadata URL during the OAuth authorization flow and are discovered and registered just-in-time — no administrator pre-registration required.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Picks up changes to a client's metadata and public signing keys automatically, without manual syncing.
   • Introduces Application Profiles (Early Access) to centrally manage refresh tokenrefresh tokenA credential used to obtain a new access token without signing in again. It is sent to the authorization service rather than used directly to call the protected API. policies, DPoPDPoPAn IETF standard that binds an OAuth access token to a specific client's cryptographic key pair, so a stolen token cannot be replayed by an attacker who lacks the matching private key., and Organizations for dynamically registered CIMD clients.
   • Supports optional manual pre-registration flow: an administrator submits the client metadata URL, reviews it, and approves the client before creation.

   4 details in Everything

10. Configurable Unblock Mode for Brute Force Protection (2026-10-22) Oct 22, 2026 · issue 117

    Auth0 Brute-Force Protection gains a Manual Unblock Behavior mode to prevent email scanners from auto-consuming recovery links.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    ⤢ ⤢ ⤢ ⤢
    └──▷ HOW TO FIND IT
    Enable Manual unblock mode so Microsoft 365 Defender and similar link-scanning gateways cannot auto-consume brute-force recovery links.
    📍1. Go to Auth0 Dashboard › Security › Attack Protection › Brute-Force Protection. 2. Scroll to Unblock Behavior. 3. Select Manual. 4. Click Save.
11. docs update Oct 21, 2026 · issue 115

    Auth0 CLI gains Agent Mode for unattended AI-driven automation with structured JSON output and reliable exit codes.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    • Agent Mode activates automatically when the CLI detects a non-interactive terminal, requiring no configuration for most coding agents.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    1 detail in Everything

12. Agent Mode for the Auth0 CLI (2026-10-21) Oct 21, 2026 · issue 116

    Auth0 CLI gains Agent Mode: structured JSON output, full CLI discovery, schema-validated payloads, and one-command AI assistant setup.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    ▶ ⤢

    ⤢ ⤢ ⤢
    └──▷ TRY IT
    Discover every available CLI command and its full invocation shape in one call, useful for feeding an agent its action space.
    copy

    $ auth0 commands --flat --detailed

    • Adds --agent-mode flag (or AUTH0_AGENT_MODE=true env var) to enable structured JSON output, disable prompts and color, and guarantee non-zero exit codes on failure — auto-detected for recognized agent clients.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds auth0 commands --flat subcommand for full CLI discovery in one call; append --detailed for complete invocation shapes.
    • Adds --schema flag to print the exact payload a command expects, sourced live from the OpenAPIOpenAPIA vendor-neutral specification for describing REST APIs in a machine-readable format, maintained by the OpenAPI Initiative. Cyber tools use it to auto-generate clients, documentation, and validation from a single source of truth. spec.
    • Adds --data flag to send an entire payload as one JSON object, validated locally before it reaches the API.
    • Adds auth0 docs search subcommand to search Auth0 documentation from the terminal without requiring login.

    +2 more show less

    • Adds auth0 agent skills install subcommand to install the Auth0 skill into Claude Code, Cursor, or all supported AI assistants in one command.
    • Structured errors now carry a stable code, a finer reason, and field-level detail on validation errors instead of a free-text sentence.
    • Adds --agent-mode flag (or AUTH0_AGENT_MODE=true env var) to enable structured JSON output, disable prompts and color, and guarantee non-zero exit codes on failure — auto-detected for recognized agent clients.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds auth0 commands --flat subcommand for full CLI discovery in one call; append --detailed for complete invocation shapes.
    • Adds --schema flag to print the exact payload a command expects, sourced live from the OpenAPIOpenAPIA vendor-neutral specification for describing REST APIs in a machine-readable format, maintained by the OpenAPI Initiative. Cyber tools use it to auto-generate clients, documentation, and validation from a single source of truth. spec.
    • Adds --data flag to send an entire payload as one JSON object, validated locally before it reaches the API.
    • Adds auth0 docs search subcommand to search Auth0 documentation from the terminal without requiring login.

    +1 more show less

    • Adds auth0 agent skills install subcommand to install the Auth0 skill into Claude Code, Cursor, or all supported AI assistants in one command.

    1 more in Everything

13. announced Oct 20, 2026 · issue 116

    Auth0: Adds auth0 commands --flat to list every runnable CLI command one per line, and auth0 commands --detailed for full invocation shapes in one call.

    ⤢

    ▶ ⤢
    └──▷ TRY IT
    Let an agent discover the full CLI surface and create a resource safely in a single session, without guessing field names.
    copy

    $ auth0 apps create --schema
    auth0 apps create --agent-mode --data '{"name":"billing-app","app_type":"spa"}'

    Run the CLI in a keychain-free CI environment using only environment variables — no disk writes, no interactive prompts.
    copy

    $ export AUTH0_CLI_AUTH_MODE=env
    export AUTH0_DOMAIN=<your-auth0-domain>
    export AUTH0_API_TOKEN=<management-api-token>
    auth0 apps list --agent-mode --json-compact

    Filter a log list by query parameters without memorising per-command flags — useful for agents building dynamic queries.
    copy

    $ auth0 logs list --agent-mode --query '{"per_page":5}'

    • Adds structured JSON error responses carrying stable codes (usage, auth, validation, not_found, rate_limit), a reason sub-field (e.g. local_validation), a details array of per-field failures, and an HTTP status field for API-originated errors.
    • Adds auth0 docs search command to query Auth0 public documentation directly from the CLI with no login required (returning raw-markdown URLs in agent mode), and auth0 agent skills install command to pre-load Auth0 CLI conventions into a coding assistant before first use.
    • Adds AUTH0_CLI_AUTH_MODE=env environment variable (combined with AUTH0_DOMAIN and either AUTH0_API_TOKEN or client credentials) to run the CLI without touching the OS keychain or writing to disk, for CI runners and sandboxes.

    3 details in Everything

14. changelog Oct 20, 2026 · issue 114

    Auth0 adds phone-country controls and a guided ACLACLAn access control list, a set of rules allowing or denying operations for particular users, services or network addresses. It decides who can use a resource. rule builder to Universal Login and Tenant Access Control.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    ⤢ ⤢ ⤢ ⤢
    └──▷ HOW TO FIND IT
    Restrict Universal Login phone entry to a specific set of allowed countries at the tenant level.
    📍In the Auth0 dashboard, go to tenant settings, open the phone country rules section, and add the countries you want to the include list.
    Build and sequence a Tenant ACL rule without hand-writing policy syntax, then toggle it live immediately.
    📍In the Auth0 dashboard, navigate to Security › Access Control, use the Guided Rule Builder to set scope, entity, and action, drag the new rule to the correct position in the Visual Rule Sequencing canvas, then use the Instant Status Toggle to enable it.
    • Adds tenant-level include/exclude lists via tenant settings to configure which phone countries are supported in Universal Login.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds theme API controls for identifier presentation (type-specific Continue with buttons vs. unified field) in Universal Login.
    • Adds updated Universal Login phone entry UI with country selection, regional formatting, numeric keyboard, and phone number suggestions on supported devices — available in Early Access on all plans.
    • Adds a Guided Rule Builder under Security > Access Control for constructing complex Tenant ACL policies using step-by-step prompts for scope, entity, and action selection.
    • Adds Visual Rule Sequencing — an interactive canvas to reorder Tenant ACL policy priorities and inspect exact rule execution order.

    +1 more show less

    • Adds Instant Status Toggles to enable or disable individual Tenant ACL rules with a single click from the dashboard.
    • Adds tenant-level include/exclude lists via tenant settings to configure which phone countries are supported in Universal Login.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds a Guided Rule Builder under Security > Access Control for constructing complex Tenant ACL policies using step-by-step prompts for scope, entity, and action selection.
    • Adds Visual Rule Sequencing — an interactive canvas to reorder Tenant ACL policy priorities and inspect exact rule execution order.
    • Adds Instant Status Toggles to enable or disable individual Tenant ACL rules with a single click from the dashboard.

    2 more in Everything

15. Improved Bot Detection: Enhanced IPv6 Signal Analysis (2026-10-20) Oct 20, 2026 · issue 115
    • Updated detection Bot Detection Model Update — expanded IPv6 signal analysis
16. Universal Login identifier and phone country controls in Early Access (2026-10-16) Oct 16, 2026 · issue 111

    Auth0 Universal Login gains type-specific Continue with buttons and tenant-level phone country include/exclude controls in Early Access.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    ⤢ ⤢ ⤢ ⤢
    • Adds tenant-level include/exclude lists for supported phone countries, configurable via the PATCH /api/v2/tenants/settings endpoint.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds identifier presentation controls (type-specific Continue with buttons vs. unified field) configurable via the PATCH /api/v2/branding/theme endpoint.
    • Adds an updated phone entry UI for Universal Login with country selection, regional formatting, numeric keyboard, and phone number suggestions on supported devices.
    • Adds tenant-level include/exclude lists for supported phone countries, configurable via the PATCH /api/v2/tenants/settings endpoint.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds identifier presentation controls (type-specific Continue with buttons vs. unified field) configurable via the PATCH /api/v2/branding/theme endpoint.

    1 more in Everything

17. announced Oct 14, 2026 · issue 109

    Auth0 launches an official Kotlin Multiplatform SDK for Android and iOS, enabling shared authentication logic in commonMain Kotlin code.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ USE IT
    Add the Auth0 KMP SDK to a shared module so authentication logic is written once and runs on both Android and iOS.
    shared/build.gradle.kts copy

    // shared/build.gradle.kts
    kotlin {
      sourceSets {
        commonMain.dependencies {
          implementation("com.auth0.kmp:auth0:1.0.0-beta.1")
        }
      }
    }

    Enable DPoPDPoPAn IETF standard that binds an OAuth access token to a specific client's cryptographic key pair, so a stolen token cannot be replayed by an attacker who lacks the matching private key. sender-constrained tokens so a stolen access tokenaccess tokenA credential that authorizes a client to use a service or API. It usually has limited permissions and a lifetime; anyone holding it may be able to use those permissions. cannot be replayed from another app or device.
    kotlin copy

    import com.auth0.kmp.Auth0
    import com.auth0.kmp.core.Auth0Account
    
    val account = Auth0Account(
      clientId = "<YOUR_CLIENT_ID>",
      domain = "<YOUR_DOMAIN>",
      useDPoP = true
    )
    val auth0 = Auth0(account)

    Silently renew an expired access token and retrieve a fresh credential without prompting the user, using the built-in Credentials Manager.
    kotlin copy

    import com.auth0.kmp.core.result.Result
    
    val manager = auth0.credentials()
    when (val result = manager.getCredentials()) {
      is Result.Success -> {
        val accessToken = result.data.accessToken
        // attach accessToken to downstream API requests
      }
      is Result.Failure -> {
        // result.error is a CredentialsManagerError — prompt re-login
      }
    }

    • Adds the auth0 umbrella module (com.auth0.kmp:auth0:1.0.0-beta.1) to Maven Central, bundling Web Auth, Authentication API, and credential management into a single KMP artifact usable from commonMain shared code, plus auth0-webauth and auth0-credentials as individual feature modules for lighter-weight dependencies instead of the full auth0 module.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds Auth0Account and Auth0 client classes in com.auth0.kmp, initialised once and sharing a single network transport across webAuth, authentication, and credentials() subsystems.
    • Adds auth0.webAuth.login(LoginOptions(...)) and auth0.webAuth.logout() suspend functions that open Universal Login via Custom Tabs (Android) or ASWebAuthenticationSession (iOS) and return a sealed Result type.
    • Adds the auth0.credentials() Credentials Manager backed by Keystore-encrypted DataStore on Android and Keychain on iOS, with saveCredentials, getCredentials, hasValidCredentials, and clearCredentials methods that auto-renew expired access tokensaccess tokensA credential that authorizes a client to use a service or API. It usually has limited permissions and a lifetime; anyone holding it may be able to use those permissions. via refresh tokenrefresh tokenA credential used to obtain a new access token without signing in again. It is sent to the authorization service rather than used directly to call the protected API., plus a Storage interface for supplying a custom credential store in place of the built-in Keystore/Keychain backend.
    • Adds the auth0.authentication client for direct Authentication API access (sign-in with username/password, user creation, and profile fetch without a browser redirect), including WebAuthnWebAuthnA web standard that lets a browser prove possession of a passkey or hardware key to a website. It is the browser-facing part of FIDO2 sign-in. passkeypasskeyPhishing-resistant sign-in credentials built on FIDO2/WebAuthn: the device holds a private key and proves possession instead of the user typing a password. They sync across a user's devices. enrolment and sign-in through the same client.

    +5 more show less

    • Adds getApiCredentials(...) to exchange a refresh token for audience-scoped tokens, enabling a single login session to call multiple APIs.
    • Adds native-to-web SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. via session-transfer tokens so a native session can continue in the browser.
    • Adds DPoP (RFC 9449) sender-constrained token binding by setting useDPoP = true on Auth0Account.
    • Adds configurable retry behaviour via RetryPolicy in RequestOptions, supporting fixed or exponential backoff on API requests.
    • Exposes Swift-friendly async/await and exhaustive switch via SKIE (Swift Kotlin Interface Enhancer) so iOS Swift code consumes the same KMP API idiomatically.

    10 details in Everything

18. announced Oct 13, 2026 · issue 109

    New @auth0/auth0-tanstack-start-react SDK brings native Auth0 authentication to TanStack Start apps.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ TRY IT
    Install the SDK and set required environment variables to get Auth0 auth into a TanStack Start project.
    copy

    $ npm install @auth0/auth0-tanstack-start-react

    Configure Auth0 credentials so the SDK can reach your tenant and sign sessions.
    copy

    $ AUTH0_DOMAIN=YOUR_AUTH0_APP_DOMAIN
    AUTH0_CLIENT_ID=YOUR_AUTH0_APP_CLIENT_ID
    AUTH0_CLIENT_SECRET=YOUR_AUTH0_APP_CLIENT_SECRET
    AUTH0_SECRET=$(openssl rand -hex 32)
    APP_BASE_URL=http://localhost:3000

    Protect a dashboard route so unauthenticated visitors are redirected to login before any loader or component runs.
    src/routes/dashboard.tsx copy

    import { createFileRoute } from '@tanstack/react-router';
    import { requireAuth, useUser } from '@auth0/auth0-tanstack-start-react/client';
    
    export const Route = createFileRoute('/dashboard')({
      beforeLoad: requireAuth({ returnTo: '/dashboard' }),
      component: Dashboard,
    });
    
    function Dashboard() {
      const user = useUser();
      return <h1>Welcome, {user?.name}!</h1>;
    }

    • Adds AUTH0_DOMAIN, AUTH0_CLIENT_ID, AUTH0_CLIENT_SECRET, AUTH0_SECRET, and APP_BASE_URL environment variables to configure Auth0 in a TanStack Start app.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds core setup primitives for wiring Auth0 into a TanStack Start app: auth0Server() from @auth0/auth0-tanstack-start-react/server for a server-side Auth0 instance, auth0Middleware() from @auth0/auth0-tanstack-start-react/server/middleware to register Auth0 and automatically mount /auth/login, /auth/callback, /auth/logout, /auth/profile, and /auth/backchannel-logout routes, and auth0RouterContext with auth0BeforeLoad() from @auth0/auth0-tanstack-start-react/client to wire Auth0 state into the router context.
    • Adds access-control helpers for protecting routes and API handlers: requireAuth and requireOrg route guards for use in a route's beforeLoad, plus server middleware helpers requireAuthMiddleware, withApiAuth, withApiScopes, withApiOrg, and claim-based guard withApiClaimIncludes.
    • Adds server-side session helpers getSession(auth0), getAccessToken(auth0), getTokenSet(auth0), and createFetcher(auth0) for use inside TanStack Start server functions.
    • Adds client-side auth state utilities: React hooks useAuth0, useUser, useOrg, useLogin, useLogout, and useMfa, and declarative components SignedIn, SignedOut, HasOrg, AuthReady, and AuthLoading for conditional rendering based on auth state.

    +1 more show less

    • Ships a new @auth0/auth0-tanstack-start-react SDK purpose-built for TanStack Start, supporting Organizations, MFAMFAMulti-factor authentication, requiring proof from different categories, such as a password and a hardware key, to sign in. It reduces reliance on a password alone., API scope checks, and WebAuthnWebAuthnA web standard that lets a browser prove possession of a passkey or hardware key to a website. It is the browser-facing part of FIDO2 sign-in.-based passwordless (passkeyspasskeysPhishing-resistant sign-in credentials built on FIDO2/WebAuthn: the device holds a private key and proves possession instead of the user typing a password. They sync across a user's devices.) login.

    6 details in Everything

19. Tenant ACL Dashboard UX (2026-10-12) Oct 12, 2026 · issue 106

    Auth0 adds a guided dashboard UI for building, sequencing, and toggling Tenant ACLACLAn access control list, a set of rules allowing or denying operations for particular users, services or network addresses. It decides who can use a resource. rules without manual syntax.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    ⤢ ⤢ ⤢ ⤢
    └──▷ HOW TO FIND IT
    Create and activate a new Tenant ACL rule without writing raw policy syntax — useful for teams who need to restrict tenant access quickly during an incident.
    📍1. Navigate to Security › Access Control in the Auth0 dashboard. 2. Click New Rule to open the Guided Rule Builder. 3. Step through the scope, entity, and action prompts and save. 4. Use the Instant Status Toggle to enable the rule immediately.
    Adjust enforcement order when a newly added deny rule must take precedence over existing allow rules — prevents unintended access due to rule sequencing.
    📍1. Navigate to Security › Access Control in the Auth0 dashboard. 2. Open the Visual Rule Sequencing canvas. 3. Drag the deny rule above the relevant allow rules to set correct execution order. 4. Save the updated sequence.
    • Adds a Guided Rule Builder under Security > Access Control with step-by-step prompts for scope, entity, and action selection to construct Tenant ACL policies without syntax errors.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds a Visual Rule Sequencing canvas to reorder Tenant ACL policy priorities and inspect exact rule execution order.
    • Adds Instant Status Toggles to enable or disable individual Tenant ACL rules in a single click while Auth0 handles the underlying API calls.

    3 details in Everything

20. Actions - Access Token Scope Customization - GA (2026-10-09) Oct 9, 2026 · issue 099

    Auth0 Actions gain GA-level access tokenaccess tokenA credential that authorizes a client to use a service or API. It usually has limited permissions and a lifetime; anyone holding it may be able to use those permissions. scope customization with Post Login support and read/write scope interfaces.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    ⤢ ⤢ ⤢ ⤢
    • Exposes event.transaction.target_scopes in Actions to read the live target scope list, reflecting every change across chained Actions.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds api.accessToken.addScope() restriction for third-party applications, where it is no longer available to prevent consent bypass.
    • Promotes Access Token Scope Customization for Actions — including Add, Remove, Set, and Clear scope interfaces — to General Availability for Credentials Exchange Actions.
    • Extends target scope interfaces (Add, Remove, Set, Clear) to Post Login Actions, in addition to Credentials Exchange Actions.
    • Exposes event.transaction.target_scopes in Actions to read the live target scope list, reflecting every change across chained Actions.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds api.accessToken.addScope() restriction for third-party applications, where it is no longer available to prevent consent bypass.

    2 more in Everything

    └──▷ BREAKING ON UPGRADE

    • !api.accessToken.addScope() is no longer available in Actions executed for third-party applications; any existing Action relying on it for third-party apps will need to be migrated to the target scope interfaces.
21. announced Sep 28, 2026 · issue 089

    Auth0 launches a ChatGPT plugin that provisions tenants, generates real SDK code, and queries tenant state via plain-language prompts.

    • New integrationNew Auth0 plugin for ChatGPT connects to a real Auth0 tenant to create applications, configure connections, and adjust settings by plain-language prompt.
    • Generates tenant-matched SDK integration code instead of generic boilerplate.
    • Enables querying and managing tenant state — applications, users, and connections — from within a ChatGPT session.
    • Surfaces Auth0 documentation answers directly inside the ChatGPT conversation.

    4 details in Everything

22. changelog Sep 26, 2026 · issue 086
    ⤢ ⤢ ⤢ ⤢
    └──▷ USE IT
    Assign a UUIDUUIDA universally unique identifier, usually a 128-bit value used to identify an object across systems. It is designed to make independently generated identifiers unlikely to collide.-based custom user ID at signup so newly created users match IDs in your existing systems — no self-hosted signup page required.
    javascript copy

    exports.onExecutePreUserRegistration = async (event, api) => {
      const crypto = require('crypto');
      api.user.setUserId(crypto.randomUUID());
    };

    Enable the My Organization API so B2B org administrators can manage members and invitations through embeddable UI components without custom backend infrastructure.
    📍In the Auth0 Dashboard, go to Applications › APIs, select My Organization API, and toggle it to active.
23. docs update Sep 25, 2026 · issue 085

    Auth0 launches Identity Conversion Suite bundling Anonymous Sessions and Experiment Center for pre-auth tracking and A/B testing⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    • Introduces the Identity Conversion Suite, a new Auth0 bundle that pairs two complementary features: Anonymous Sessions and Experiment Center.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds Anonymous Sessions, which tracks and manages users from their first pre-authentication interaction and carries that activity forward to their authenticated profile upon sign-up or login.
    • Adds Experiment Center, which enables A/B tests and gradual rollouts on authentication flow changes — such as new sign-up fields, passkeyspasskeysPhishing-resistant sign-in credentials built on FIDO2/WebAuthn: the device holds a private key and proves possession instead of the user typing a password. They sync across a user's devices., or MFAMFAMulti-factor authentication, requiring proof from different categories, such as a password and a hardware key, to sign in. It reduces reliance on a password alone. rules — targeting a slice of traffic before full rollout.

    3 details in Everything

24. changelog Sep 25, 2026 · issue 085

    Auth0: Adds a member access level model (none, readonly, limited, full) that computes each member's permissions automatically from their organization connection access levels.

    ⤢ ⤢ ⤢ ⤢
    └──▷ USE IT
    Assign a UUIDUUIDA universally unique identifier, usually a 128-bit value used to identify an object across systems. It is designed to make independently generated identifiers unlikely to collide.-based custom user ID at signup to keep identity consistent with an existing system, without building a self-hosted signup page.
    javascript copy

    exports.onExecutePreUserRegistration = async (event, api) => {
      const crypto = require('crypto');
      api.user.setUserId(crypto.randomUUID());
    };

    Activate the My Organization API to start using embeddable member management UI components and the bulk invitation endpoint.
    📍In the Auth0 Dashboard, go to Applications › APIs, locate My Organization API, and toggle it to enabled.
    • Activate the My Organization API by navigating to Applications > APIs in the Auth0 Dashboard.

    1 detail in Everything

25. changelog Sep 24, 2026 · issue 084

    Auth0 adds Action Modules, B2B Member Management API, custom user IDs at signup, and real-time enterprise connection events⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    ⤢ ⤢ ⤢ ⤢
    └──▷ USE IT
    Assign a UUIDUUIDA universally unique identifier, usually a 128-bit value used to identify an object across systems. It is designed to make independently generated identifiers unlikely to collide.-based custom user ID at signup to keep identity consistent with your existing systems, instead of accepting Auth0's auto-generated auth0|<id> format.
    javascript copy

    exports.onExecutePreUserRegistration = async (event, api) => {
      const crypto = require('crypto');
      api.user.setUserId(crypto.randomUUID());
    };

    Activate the My Organization API to enable self-service B2B member management for organization administrators.
    📍In the Auth0 Dashboard, go to Applications › APIs, locate the My Organization API, and activate it for your tenant.
    • Adds api.user.setUserId() method in onExecutePreUserRegistration Actions to assign custom user IDs (UUIDsUUIDsA universally unique identifier, usually a 128-bit value used to identify an object across systems. It is designed to make independently generated identifiers unlikely to collide., domain-specific, or legacy-compatible formats) to new database-connection users at signup, replacing the need for self-hosted signup pages or bulk import.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds connection.created, connection.updated, and connection.deleted events for enterprise connections (Azure AD, ADFS, Google Workspace, Active DirectoryActive DirectoryMicrosoft's directory service for Windows networks that centralises authentication and authorisation; cyber tools target or integrate with it because it controls identity and access across most enterprise environments., LDAPLDAPA protocol for querying and modifying directory services, standardized under RFC 4511, commonly used to look up users, groups, and attributes in corporate identity stores like Active Directory., Ping), deliverable to a webhook or Amazon EventBridgeEventBridgeAWS's managed event bus service that routes events between cloud services, SaaS apps, and custom code using rules and targets, letting tools react to state changes without polling or managing message infrastructure. as CloudEvents-formatted JSON.
    • Adds Action Modules, enabling reuse of custom functions across multiple Actions and Triggers, with independent secrets and dependencies per module.
    • Adds unit testing support for Action Modules via helpers in the @auth0/actions package.
    • Adds IntelliSense autocompletion and type hints for Action Modules in the Auth0 Dashboard and external editors via @auth0/actions.

    +4 more show less

    • Adds the My Organization API and Embeddable UI Components for B2B member management, supporting member invitations (bulk up to 10 per request), role assignment, and a four-tier access level model (none, readonly, limited, full).
    • Adds permission-aware UI components that show or hide actions based on the authenticated user's effective permissions surfaced from the ID token, with no additional API call required.
    • Adds tenant log events for all member, invitation, and role operations for B2B observability.
    • Extends B2B Connect (Early Access) to support automatic session termination when an enterprise IdPIdPA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems. ends a session, email-domain-based enterprise connection discovery, and direct application connections to Auth0 without an external authorization server.
    • Adds api.user.setUserId() method in onExecutePreUserRegistration Actions to assign custom user IDs (UUIDsUUIDsA universally unique identifier, usually a 128-bit value used to identify an object across systems. It is designed to make independently generated identifiers unlikely to collide., domain-specific, or legacy-compatible formats) to new database-connection users at signup, replacing the need for self-hosted signup pages or bulk import.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds connection.created, connection.updated, and connection.deleted events for enterprise connections (Azure AD, ADFS, Google Workspace, Active DirectoryActive DirectoryMicrosoft's directory service for Windows networks that centralises authentication and authorisation; cyber tools target or integrate with it because it controls identity and access across most enterprise environments., LDAPLDAPA protocol for querying and modifying directory services, standardized under RFC 4511, commonly used to look up users, groups, and attributes in corporate identity stores like Active Directory., Ping), deliverable to a webhook or Amazon EventBridgeEventBridgeAWS's managed event bus service that routes events between cloud services, SaaS apps, and custom code using rules and targets, letting tools react to state changes without polling or managing message infrastructure. as CloudEvents-formatted JSON.
    • Adds Action Modules, enabling reuse of custom functions across multiple Actions and Triggers, with independent secrets and dependencies per module.
    • Adds unit testing support for Action Modules via helpers in the @auth0/actions package.
    • Adds IntelliSense autocompletion and type hints for Action Modules in the Auth0 Dashboard and external editors via @auth0/actions.

    +3 more show less

    • Adds the My Organization API and Embeddable UI Components for B2B member management, supporting member invitations (bulk up to 10 per request), role assignment, and a four-tier access level model (none, readonly, limited, full).
    • Adds permission-aware UI components that show or hide actions based on the authenticated user's effective permissions surfaced from the ID token, with no additional API call required.
    • Adds tenant log events for all member, invitation, and role operations for B2B observability.

    1 more in Everything

26. docs update Sep 18, 2026 · issue 078

    Auth0 My Organization API gains member invitations, role guardrails, member management scopes, and a per-user permissions claim in the ID token.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ TRY IT
    Set a connection to limited access so Organization Admins can view members and adjust roles, but cannot delete underlying user accounts.
    copy

    $ curl -X PATCH 'https://<tenant>.auth0.com/api/v2/organizations/<org_id>/connections/<connection_id>' \
      -H 'Authorization: Bearer <mgmt_api_token>' \
      -H 'Content-Type: application/json' \
      -d '{"organization_member_access_level": "limited"}'

    • Adds invitation_landing_client_id field (string) to specify which client application members are redirected to when accepting an invitation — required when using the create:my_org:member_invitations scope.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds enforce_permission_ceiling boolean field: when enabled, prevents an Organization Admin from assigning any role whose permissions exceed their own effective permissions (defaults to false).
    • Adds enforce_self_assignment_restriction boolean field: when enabled, prevents an Organization Admin from assigning any role to themselves (defaults to false).
    • Adds organization_member_access_level enum field (none, readonly, limited, full) on a per-connection, per-organization basis, controlling what an Organization Admin can do to members authenticated via that connection — configurable via PATCH /api/v2/organizations/{id}/connections/{connectionId} or the Auth0 Dashboard under Organizations connection settings.
    • Adds urn:auth0:my_org_current_user_permissions claim to the ID token whenever the /my-org audience is present in a user-based authorization request, containing all my_org:* permissions the authenticated user holds via their assigned roles.

    +4 more show less

    • Adds new OAuth scopes for member invitation management: create:my_org:member_invitations, read:my_org:member_invitations, and delete:my_org:member_invitations.
    • Adds new OAuth scopes for member and role management: read:my_org:members, delete:my_org:memberships, read:my_org:member_roles, create:my_org:member_roles, and delete:my_org:member_roles.
    • Adds read:my_org:user_stores scope to support user store discovery for invitation creation.
    • Adds log event codes my_organization_api_member_succeeded, my_organization_api_member_failed, my_organization_api_invitation_succeeded, my_organization_api_invitation_failed, my_organization_api_role_failed, and my_organization_api_user_stores_failed for tracking My Organization API activity across members, invitations, roles, and user stores.

    9 details in Everything

27. announced Sep 18, 2026 · issue 081

    Auth0 FGA Permissions Index (Early Access) precomputes all user permissions and streams them into your own database for constant-time SQL JOIN-based access checks at scale.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    • Introduces FGA Permissions Index (Early Access), which precomputes every access implied by chosen relations (e.g.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ can_view) on an object type and streams the results directly into the customer's own database, enabling a simple SQL JOIN instead of runtime graph traversal for permission-filtered queries.
    • Supports indexing high-cardinality relations on an object type so that permission lookups on indexed relations become constant-time, while non-indexed relations continue to be evaluated by FGA in real time.

    2 details in Everything

28. announced Sep 18, 2026 · issue 081

    Auth0 Agent Gateway (beta) adds a CIAM control plane for governing customer-facing AI agents across multi-tenant SaaSSaaSSoftware delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. products.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    ⤢
    • New Auth0 Agent Gateway beta provides a centralized policy-enforcement layer that evaluates tool-call authorization in real time using agent, user, and organization context before any external tool is invoked.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Integrates with Auth0 Token Vault and on-behalf-of token exchangetoken exchangeAn OAuth 2.0 protocol extension (RFC 8693) that lets a service trade one token for another with different scopes, audience, or type, enabling delegation and impersonation across service boundaries without re-authenticating the user. to broker short-lived, user-scoped tokens for internal and external APIs — keeping raw credentials out of LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. prompts, context windowscontext windowsThe maximum amount of text, counted in tokens, a model can take in and produce in one request. Everything the model knows about the task has to fit inside it., and logs.
    • Supports organization-aware, multi-tenant routing that isolates tool access and connected credentials (e.g. Slack, Microsoft Teams) per customer tenant, preventing cross-tenant data exposure.
    • Provides an agent kill switch — centralized administrative controls to disable an agent or restrict its access to downstream services and tools across a tenant or deployment.
    • Logs every agent tool call to tenant logs with optional streaming export to SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents. services for enterprise auditability.

    +1 more show less

    • Exposes Auth0 Agent Gateway APIs for early integration during the beta, with accompanying documentation, integration guides, and examples.

    6 details in Everything

29. announced Sep 18, 2026 · issue 081

    Auth0 launches Identity Conversion Suite (Early Access) with Anonymous Sessions and Experiment Center for auth flow A/B testing⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    ⤢ ⤢ ⤢
    └──▷ HOW TO FIND IT
    Trigger an anonymous session and obtain an OAuth 2.0OAuth 2.0An open authorization framework (IETF RFC 6749) that lets a service grant limited API access to a third party without sharing credentials, giving cyber tools a standard way to authenticate against external platforms. access tokenaccess tokenA credential that authorizes a client to use a service or API. It usually has limited permissions and a lifetime; anyone holding it may be able to use those permissions. for a guest user before they authenticate, so cart and wishlist metadata is tracked from first interaction.
    📍Pass referral IDs, shopping cart IDs, or wishlist URLs to Auth0 at the start of the guest session. Auth0 issues a session token and an access token; use the access token to authorize API calls normally. When the guest signs up or logs in, include the session token in the request to the /authorize endpoint so Auth0 transfers all anonymous activity to the authenticated profile.
    A/B test a passkeypasskeyPhishing-resistant sign-in credentials built on FIDO2/WebAuthn: the device holds a private key and proves possession instead of the user typing a password. They sync across a user's devices.-first signup flow against the standard flow for warm visitors (those with saved cart items) to measure completion rate and time-to-auth before a full rollout.
    📍In Experiment Center, define a feature flag for the passkey signup variant, assign the saved cart segment to the passkey variant and the remainder to control, then monitor the dedicated experiment events for exposure, success rate, and time-to-auth split by segment before promoting the winner tenant-wide.
    • Passes the anonymous session token to the Auth0 /authorize endpoint on sign-up or login, making all prior anonymous activity available inside Actions for custom handling.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds Anonymous Sessions: issues OAuth 2OAuth 2An open authorization framework (RFC 6749) that lets a service grant limited access to a user's resources on another service without exposing credentials, giving cyber tools a standard way to authenticate against third-party APIs..0-compliant access tokensaccess tokensA credential that authorizes a client to use a service or API. It usually has limited permissions and a lifetime; anyone holding it may be able to use those permissions. to unauthenticated guest users, enabling guest checkout, cart tracking, pre-login personalization, and secure API access without authentication — with seamless transfer of anonymous metadata into the authenticated profile on sign-up or login.
    • Adds Experiment Center: split authentication traffic into variants (by percentage or segment) for capabilities such as passkeyspasskeysPhishing-resistant sign-in credentials built on FIDO2/WebAuthn: the device holds a private key and proves possession instead of the user typing a password. They sync across a user's devices., MFAMFAMulti-factor authentication, requiring proof from different categories, such as a password and a hardware key, to sign in. It reduces reliance on a password alone. steps, signup form copy, and branding themes — across Universal Login (including Auth0 Custom Universal Login / ACUL), Forms, Actions, and Page Templates — without changing application code.
    • Experiment Center captures exposure, success rate, and time-to-auth per variant and segment as dedicated experiment events, enabling data-backed promotion of winning flows.
    • Both Anonymous Sessions and Experiment Center are available in Early Access to Auth0 Enterprise plan customers.

    5 details in Everything

30. Actions - Modules - GA (2026-09-18) Sep 18, 2026 · issue 079

    Auth0 Actions Modules reaches GA, enabling reusable code, independent secrets, and unit testing across Actions.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    ⤢ ⤢ ⤢ ⤢
    └──▷ HOW TO FIND IT
    Create a new Action Module in the Auth0 Dashboard to house shared initialization logic (e.g. an SDK client) that multiple Actions can import instead of each re-running setup code.
    📍In the Auth0 Dashboard, go to Actions › Modules › Create Module, give it a name, add any required secrets and npm dependencies, then write and publish your shared code.
    • Adds @auth0/actions npm package providing unit-testing helpers and IntelliSense (autocompletion and type hints) for Actions Modules in any editor.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Introduces Actions Modules — create, manage, and share reusable code across multiple Actions and Triggers within an Auth0 Tenant.
    • Supports independent secrets and dependencies defined per Action Module, decoupled from the Actions that import them.
    • Enables cross-trigger reuse of custom functions by importing a single Module into any Action regardless of which Trigger it is bound to.
    • Improves execution performance by moving expensive initialization logic into a Module that is initialized once and reused across Action invocations.
    • Adds @auth0/actions npm package providing unit-testing helpers and IntelliSense (autocompletion and type hints) for Actions Modules in any editor.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Introduces Actions Modules — create, manage, and share reusable code across multiple Actions and Triggers within an Auth0 Tenant.
    • Supports independent secrets and dependencies defined per Action Module, decoupled from the Actions that import them.
    • Enables cross-trigger reuse of custom functions by importing a single Module into any Action regardless of which Trigger it is bound to.

    1 more in Everything

31. Custom User ID Assignment with Actions — Early Access (2026-09-17) Sep 17, 2026 · issue 078

    Auth0 Actions can now assign custom user_id values at signup via api.user.setUserId() in pre-user-registration hooks.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    ⤢ ⤢ ⤢ ⤢
    └──▷ USE IT
    Assign a UUIDUUIDA universally unique identifier, usually a 128-bit value used to identify an object across systems. It is designed to make independently generated identifiers unlikely to collide.-format user_id at signup to keep identity consistent between newly-registered users and records imported from a legacy system.
    javascript copy

    exports.onExecutePreUserRegistration = async (event, api) => {
      const crypto = require('crypto');
      api.user.setUserId(crypto.randomUUID());
    };

    • Adds api.user.setUserId() method callable inside a pre-user-registration Action to assign a custom user_id — UUIDsUUIDsA universally unique identifier, usually a 128-bit value used to identify an object across systems. It is designed to make independently generated identifiers unlikely to collide., domain-specific IDs, or legacy-compatible IDs — to new database-connection users at signup, replacing the automatic auth0|<id> format.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Supports custom user IDs across Database connections (including custom databases with automatic migration), Universal Login sign-up, the Authentication API signup endpoint, and the Management API Create User endpoint.
    • Adds api.user.setUserId() method callable inside a pre-user-registration Action to assign a custom user_id — UUIDsUUIDsA universally unique identifier, usually a 128-bit value used to identify an object across systems. It is designed to make independently generated identifiers unlikely to collide., domain-specific IDs, or legacy-compatible IDs — to new database-connection users at signup, replacing the automatic auth0|<id> format.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    1 more in Everything

32. My Organization API and Embeddable UI Components - Member Management in Early Access! (2026-09-17) Sep 17, 2026 · issue 078

    Auth0 My Organization API adds Member Management in Early Access: bulk invitations, role assignment, and embeddable UI components for B2B SaaSSaaSSoftware delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally..⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    ⤢ ⤢ ⤢ ⤢
    └──▷ HOW TO FIND IT
    Activate the My Organization API for your tenant so organization administrators can begin managing members, invitations, and roles.
    📍In the Auth0 Dashboard, go to Applications › APIs and activate the My Organization API.
    • Adds bulk member invitation via the My Organization API, supporting up to 10 invitees in a single atomic request with pre-assigned roles and routing through a specific identity provideridentity providerA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems. or user store.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds member listing and retrieval through the My Organization API with field projection and checkpoint-based pagination for large organizations.
    • Adds role assignment and removal for organization members directly through the My Organization API or embeddable UI components, with permission guardrails preventing delegated administrators from assigning roles exceeding their own.
    • Introduces a new none, readonly, limited, and full access level model for organization members, computed automatically from the member's organization connection access levels.
    • Adds permission-aware embeddable UI components that show or hide actions based on the authenticated user's effective permissions sourced from the ID token, requiring no additional API call.

    +2 more show less

    • Emits tenant log events for all member, invitation, and role operations for full B2B observability of administrative activity.
    • Enables the My Organization API via the Applications > APIs section of the Auth0 Dashboard.

    7 details in Everything

33. changelog Sep 16, 2026 · issue 076
    ⤢ ⤢ ⤢ ⤢
    └──▷ USE IT
    Set a high-priority fallback Deny All rule in the Tenant ACLACLAn access control list, a set of rules allowing or denying operations for particular users, services or network addresses. It decides who can use a resource. to block any request that did not match a preceding allow rule.
    yaml copy

    match_all: true

34. announced Sep 16, 2026 · issue 078

    Auth0 launches a native integration for v0 that wires real Auth0 tenants — apps, connections, and SDKs — directly from prompts.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    ⤢ ⤢

    ▶ ⤢
    └──▷ HOW TO FIND IT
    Add real Auth0 authentication — including protected routes and session handling — to a v0-built app without leaving your prompt session.
    📍In v0, open your project settings, navigate to the Integrations tab, search for Auth0, click Install, and complete the account link. Then prompt: 'Allow users to sign up and log in to access the application using the Auth0 integration.'
    • New Auth0 integration for v0 lets prompts create Auth0 applications, set up identity connections, and wire the Auth0 SDK into generated code without leaving the v0 conversational workflow.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Supports B2B use cases, enterprise identity provideridentity providerA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems. connections, and MFAMFAMulti-factor authentication, requiring proof from different categories, such as a password and a hardware key, to sign in. It reduces reliance on a password alone. requirements configured directly from v0 prompts against a real Auth0 tenant.
    • Install via v0 project settings under the Integrations tab by searching for Auth0 and clicking Install, then follow on-screen steps to link or create an Auth0 account.

    3 details in Everything

35. B2B Connect - Enterprise in Early Access! (2026-09-16) Sep 16, 2026 · issue 077

    Auth0 B2B Connect Early Access adds real-time connection event streaming, automatic IdPIdPA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems.-driven session termination, email-domain SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. resolution, and direct Auth0 connections without an external authorization server.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    ⤢ ⤢ ⤢ ⤢
    • Streams enterprise connection events (created, updated, deleted) to a webhook, Amazon EventBridgeEventBridgeAWS's managed event bus service that routes events between cloud services, SaaS apps, and custom code using rules and targets, letting tools react to state changes without polling or managing message infrastructure., or a custom event pipeline.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Automatically terminates active application sessions when the enterprise IdP ends the corresponding session, keeping app and IdP session state in sync.
    • Supports connecting an application directly to Auth0 without an external authorization server, with new quickstart guides to get started.

    3 details in Everything

36. Enterprise Connection Events — Early Access (2026-09-16) Sep 16, 2026 · issue 077

    Auth0 adds real-time enterprise connection events — subscribe to created, updated, and deleted via webhook or Amazon EventBridgeEventBridgeAWS's managed event bus service that routes events between cloud services, SaaS apps, and custom code using rules and targets, letting tools react to state changes without polling or managing message infrastructure., no polling required.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    ⤢ ⤢ ⤢ ⤢
    • Adds connection.created, connection.updated, and connection.deleted event subscriptions for enterprise connections (Azure AD, ADFS, Google Workspace, Active DirectoryActive DirectoryMicrosoft's directory service for Windows networks that centralises authentication and authorisation; cyber tools target or integrate with it because it controls identity and access across most enterprise environments., LDAPLDAPA protocol for querying and modifying directory services, standardized under RFC 4511, commonly used to look up users, groups, and attributes in corporate identity stores like Active Directory., and Ping), eliminating the need to poll the Management API for connection changes.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Delivers connection events to a webhook or Amazon EventBridge as CloudEvents-formatted JSON.

    2 details in Everything

37. changelog Sep 15, 2026 · issue 075

    Auth0 adds match_all: true to Tenant ACLACLAn access control list, a set of rules allowing or denying operations for particular users, services or network addresses. It decides who can use a resource. for a blanket Deny All rule across the full tenant scope.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    ⤢ ⤢ ⤢ ⤢
38. changelog Sep 8, 2026 · issue 068

    Auth0 adds self-service XAA config via My Organization API, Advanced MFAMFAMulti-factor authentication, requiring proof from different categories, such as a password and a hardware key, to sign in. It reduces reliance on a password alone. GA, and Cross-App Access Requesting App in Early Access

    ⤢ ⤢ ⤢ ⤢
    └──▷ HOW TO FIND IT
    Enable Cross-App Access Requesting App on an enterprise OIDCOIDCOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user. connection so your app can fetch third-party API tokens for org users without a manual consent step.
    📍In the Auth0 Dashboard, go to Authentication › Enterprise Connections, select your OIDC or Okta Workforce connection, and toggle Cross-App Access Requesting App to enabled.
    Tighten MFA UX by reducing OTPOTPOne-time password: a short-lived numeric or alphanumeric code valid for a single authentication attempt, generated via TOTP or HOTP standards, giving cyber tools phishing-resistant second-factor verification without stored shared secrets. length to 4 digits and capping SMSSMSShort Message Service, the protocol built into cellular networks for sending text messages between phones; cyber tools use it for alerting, two-factor authentication delivery, or phishing simulation over mobile channels. OTP lifetime to 2 minutes for a lower-friction, shorter-window factor.
    📍In the Auth0 Dashboard, go to Security › Multi-factor Auth, open the SMS/Voice or Email factor settings, set OTP Length to 4, and set OTP Lifetime to 120 seconds.
    • Adds self-service configuration of Third-Party Application Access and Cross App Access (XAA) through the My Organization API and Embeddable UI Components (Open Early Access), letting Organization Admins configure third-party app access, connection-level third-party access, and XAA Resource Application roles without routing changes through the Auth0 Dashboard.
    • Advanced MFA Configurations is now Generally Available, enabling configurable Remember this device idle lifetimes (1 hour to 30 days) and absolute lifetimes (up to 90 days), OTP lengths for SMS and email factors (4–10 digits), OTP lifetime for SMS MFA (30 seconds to 1 hour), and OTP lifetime for email MFA (5 minutes to 1 hour).
    • Auth0 now supports acting as a requesting application in Cross-App Access flows (Early Access), built on Auth0 Token Vault using the ID-JAG (Identity Assertion Authorization Grant) protocol, allowing apps to fetch third-party API tokens for enterprise users without requiring manual Connect your account steps; supported on OIDC and Okta Workforce connections with org-aware resolution via org_id.
    • Adds a new Dashboard toggle to enable Cross-App Access Requesting App on enterprise connections.
    • Dashboard Navigation and IA Refresh is available in Early Access, featuring a redesigned sidebar, improved information architecture, consistent breadcrumbs, and a modernized visual experience, toggled per user account from the profile menu.
    • Adds self-service configuration of Third-Party Application Access and Cross App Access (XAA) through the My Organization API and Embeddable UI Components (Open Early Access), letting Organization Admins configure third-party app access, connection-level third-party access, and XAA Resource Application roles without routing changes through the Auth0 Dashboard.
    • Auth0 now supports acting as a requesting application in Cross-App Access flows (Early Access), built on Auth0 Token Vault using the ID-JAG (Identity Assertion Authorization Grant) protocol, allowing apps to fetch third-party API tokens for enterprise users without requiring manual Connect your account steps; supported on OIDC and Okta Workforce connections with org-aware resolution via org_id.
    • Adds a new Dashboard toggle to enable Cross-App Access Requesting App on enterprise connections.

    2 more in Everything

39. announced Sep 8, 2026 · issue 070

    Auth0 Agent Skills adds HealthCheck skill for AI coding agents to audit tenant security, config, and plan fit via Auth0 CheckMate⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    ⤢ ⤢

    ▶ ⤢
    └──▷ TRY IT
    Install Auth0 Agent Skills into your local AI coding environment so your agent can audit live tenant configuration instead of guessing.
    copy

    $ npx skills add auth0/agent-skills

    • Adds npx skills add auth0/agent-skills to install the official Auth0 Agent Skills package into a local terminal or IDE-based AI coding agent.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds the Auth0 HealthCheck skill, which queries a live Auth0 tenant via the Auth0 Management API and Auth0 CheckMate to produce confidence-weighted security posture and capability-fit scores, then generates a prioritized findings report.
    • Integrates Auth0 CheckMate automated scans covering token signing algorithms (RS256 vs HS256), DPoPDPoPAn IETF standard that binds an OAuth access token to a specific client's cryptographic key pair, so a stolen token cannot be replayed by an attacker who lacks the matching private key. configuration, CORSCORSA browser mechanism that lets a server declare which foreign origins may read its HTTP responses, enforced by the browser to block unauthorized cross-site requests from JavaScript. origins, attack protection settings, callback URLs, logout redirects, social connection keys, grant types, and database connection settings.
    • Provides 35+ framework quickstart skill modules that detect the application framework and load relevant SDK guidance for React, Next.js, Node.js, Python, Swift, Flutter, and more.

    4 details in Everything

40. New Deny All Rule for Tenant ACL (2026-09-08) Sep 8, 2026 · issue 069

    Auth0 Tenant ACLACLAn access control list, a set of rules allowing or denying operations for particular users, services or network addresses. It decides who can use a resource. gains a match_all: true Deny All rule to block all incoming traffic without signal-specific matching.

    ⤢ ⤢ ⤢ ⤢
41. docs update Sep 3, 2026 · issue 063

    Auth0 Organizations gain Cross App Access (XAA) resource application settings and third-party client access controls for Organization Admins.

    └──▷ HOW TO FIND IT
    Configure Cross App Access (XAA) and user/client credential access authorization for an Organization connection via the Auth0 dashboard.
    📍1. Go to Auth0 Dashboard › Organizations › [your org] › Connections. 2. Select a connection and open its settings. 3. Under Cross App Access (XAA), enable Resource Application for the connection. 4. Set User Access Authorization to Unauthorized, Authorized, or All. 5. Set Client Credential Access Authorization to Unauthorized, Authorized, or All. 6. Save changes.
    • Adds third_party_client_access object to Organization connection settings, letting tenant admins control whether Organization Admins can enable third-party application access via the My Organization API — defaults to { "default_value": "block", "allowed_values": ["block"] }, meaning third-party access is locked until explicitly opened.
    • Adds Cross App Access (XAA) Resource Application settings for connections, allowing Organization Admins to configure a connection as a XAA Resource Application through the My Organization API.
    • Organization Admins can now configure User Access Authorization (Unauthorized, Authorized, or All) and Client Credential Access Authorization (Unauthorized, Authorized, or All) on connections.

    3 details in Everything

42. My Organization API and Embeddable UI Components - XAA and third-party app access configuration in Early Acces (2026-09-03) Sep 3, 2026 · issue 063

    Auth0 My Organization API and Embeddable UI Components now support self-service XAA and third-party app access configuration in Open Early Access.

    ⤢ ⤢ ⤢ ⤢
    • Adds self-service configuration of third-party application access for an Organization via the My Organization API and Embeddable UI Components, so Organization Admins can manage access without routing changes through the Auth0 Dashboard.
    • Adds self-service configuration of third-party application access for a specific connection of an Organization through the My Organization API and Embeddable UI Components.
    • Adds self-service configuration of the Cross App Access (XAA) Resource Application role for a connection via the My Organization API and Embeddable UI Components.
    • Enables XAA configuration with a domain-verification guardrail: the connection's identity provideridentity providerA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems. must use a domain verified for the associated Organization, scoping cross-app authorization to providers the customer controls.
    • Each delegated setting is independently controllable, allowing platform teams to choose which settings and values are exposed to Organization Admins.

    5 details in Everything

43. Dashboard Navigation & IA Refresh is now in Early Access (2026-09-02) Sep 2, 2026 · issue 063

    Auth0 Dashboard gets a redesigned sidebar and improved information architecture in Early Access opt-in.

    ⤢ ⤢ ⤢ ⤢
    └──▷ HOW TO FIND IT
    Enable the new navigation experience from your profile menu without waiting for a forced rollout.
    📍1. Log in to the Auth0 Dashboard. 2. Click Try now in the popup that appears on login, OR 3. Open your profile menu in the top-right corner and toggle New Navigation on or off at any time.
44. Advanced MFA Configurations are now Generally Available (2026-09-01) Sep 1, 2026 · issue 062

    Auth0 Advanced MFAMFAMulti-factor authentication, requiring proof from different categories, such as a password and a hardware key, to sign in. It reduces reliance on a password alone. Configurations are now GA, enabling customizable OTPOTPOne-time password: a short-lived numeric or alphanumeric code valid for a single authentication attempt, generated via TOTP or HOTP standards, giving cyber tools phishing-resistant second-factor verification without stored shared secrets. lengths, lifetimes, and device-remember windows.

    ⤢ ⤢ ⤢ ⤢
    • Configurable OTP lifetime for SMSSMSShort Message Service, the protocol built into cellular networks for sending text messages between phones; cyber tools use it for alerting, two-factor authentication delivery, or phishing simulation over mobile channels. MFA (30 seconds to 1 hour) and email MFA (5 minutes to 1 hour).

    1 detail in Everything

45. changelog Aug 31, 2026 · issue 060

    Custom Token Exchange hits GA with Dashboard management, shared transaction context, and WebAuthnWebAuthnA web standard that lets a browser prove possession of a passkey or hardware key to a website. It is the browser-facing part of FIDO2 sign-in. biometrics as a first factor.

    ⤢ ⤢ ⤢ ⤢
    └──▷ HOW TO FIND IT
    Create and configure a Custom Token Exchange Profile and its Action directly from the Dashboard to support AI-agent delegated authorization.
    📍1. In the Auth0 Dashboard, go to Actions › Custom Token Exchange Profiles. 2. Click Create Profile and specify the subject token type (Auth0 or external IdP). 3. Attach a new or existing Custom Token Exchange Action containing your validation and authorization logic. 4. Save the profile — Auth0 will now validate incoming exchange requests through this Action before issuing tokens.
    • Custom Token Exchange is now Generally Available for Enterprise, B2B Professional, and B2C Professional customers and during Trial periods — lets applications exchange an existing Auth0 or external-IdPIdPA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems. token for Auth0 access, ID, and refresh tokensrefresh tokensA credential used to obtain a new access token without signing in again. It is sent to the authorization service rather than used directly to call the protected API. via custom Action logic.
    • Adds shared transaction context between Custom Token Exchange Actions and Post-Login Actions via transaction metadata, enabling token customization based on subject or actor token information.
    • Enables Session Delegation through Custom Token Exchange, allowing a service, AI agent, or support agent to establish a web session on behalf of a user.

    3 details in Everything

46. Cross-App Access Requesting App now in Early Access (2026-08-31) Aug 31, 2026 · issue 061

    Auth0 adds Cross-App Access Requesting App (Early Access): fetch third-party API tokens via IdPIdPA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems. trust, no manual user consent per integration.

    ⤢ ⤢ ⤢ ⤢
    • New Dashboard toggle on enterprise connections enables the Cross-App Access Requesting App flow, letting apps silently fetch third-party API tokens for authenticated users without requiring per-integration Connect your account clicks.
    • Built on Auth0 Token Vault using the ID-JAG (Identity Assertion Authorization Grant) protocol; currently supported on OIDCOIDCOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user. and Okta Workforce connections.
    • Org-aware token resolution: in multi-org tenants, requests are scoped by org_id and rejected if the enterprise connection or target resource app is not enabled for that organization, or if the org context is ambiguous across multiple identities.

    3 details in Everything

47. Custom Token Exchange is now Generally Available (2026-08-28) Aug 28, 2026 · issue 058

    Auth0 Custom Token Exchange is now GA, enabling token-for-token swaps with custom Action logic for enterprise and professional tenants.

    ⤢ ⤢ ⤢ ⤢
    • Introduces Custom Token Exchange (GA), allowing applications to exchange an existing token — issued by Auth0 or an external identity provideridentity providerA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems. — for Auth0 access, ID, and refresh tokensrefresh tokensA credential used to obtain a new access token without signing in again. It is sent to the authorization service rather than used directly to call the protected API., validated by a Custom Token Exchange Action.
    • Supports delegated authorization so a service, AI agent, or support agent can act on behalf of a user, including calling APIs on their behalf or establishing a web session via Session Delegation.
    • Adds Dashboard support to create and manage Custom Token Exchange Profiles and their associated Actions directly from the Auth0 Dashboard.
    • Adds shared transaction context: set transaction metadata in a Custom Token Exchange Action and read it from a Post-Login Action to customize resulting tokens based on subject or actor token information.
    • Available to all Enterprise, B2B Professional, and B2C Professional customers, and included in the Trial period for free tenants.

    5 details in Everything

48. changelog Aug 24, 2026 · issue 055

    Auth0 adds Custom Rate Limits (Early Access) for per-client Authentication API throttling with block or notify enforcement modes.

    ⤢ ⤢ ⤢ ⤢
    • Adds API-based self-service configuration of Custom Rate Limit Policies to cap Authentication API OAuth request consumption per individual client, all third-party apps, or CIMDCIMDA text-based Short Message Service protocol from Nokia for exchanging SMS messages between applications and SMS centers, used to build tools that send, receive, or test carrier messaging flows. apps.
    • Adds configurable Rate Limit Policy enforcement modes: block requests outright, or trigger non-blocking notifications for safer policy rollout.

    2 details in Everything

49. changelog Aug 17, 2026 · issue 048

    Auth0 GA's Flexible Password Policy with unified options.password_options object and extends Custom Prompts to Social and Enterprise connections.

    ⤢ ⤢ ⤢ ⤢
    • Adds options.password_options object to database connections, replacing legacy fields (passwordPolicy, password_complexity_options, password_history, password_no_personal_info, password_dictionary) with granular controls for composition, history, dictionary (10,000- or 100,000-word lists plus custom entries), and profile-data blocking — configurable via the Auth0 Dashboard under Authentication > Database > [your connection] > Authentication Methods > Password, or through the Management API.
    • New database connections created from July 2026 onward default to Flexible Password Policy with a minimum password length of 15, no required character types, and no legacy fields — applies whether the connection is created via Dashboard, Management API, Deploy CLI, Terraform, or an Auth0 SDK.
    • Custom Prompts (custom signup/login fields and consent checkboxes configured in Universal Login) now capture data on Social and Enterprise connections in addition to database and passwordless connections, with no configuration changes required — reviewable under Branding → Universal Login → Enhance screens with partials, or via the Management API.

    3 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !PATCH /api/v2/connections/{id} returns 400 invalid_body if the request body includes both password_options and legacy password fields (passwordPolicy, password_complexity_options, password_history, password_no_personal_info, password_dictionary). Automations that read a connection and write it back with legacy fields appended must be updated to send only password_options.
    • !New database connections created from July 2026 default to Flexible Password Policy (minimum length 15, no required character types) rather than legacy password policy defaults. Automations that create connections without specifying a password configuration will receive these new defaults instead of the previous legacy behavior.
50. Custom Rate Limits available in Early Access (2026-08-17) Aug 17, 2026 · issue 049

    Auth0 adds Custom Rate Limits (Early Access) to cap per-client Authentication API RPS via API-driven policy configuration.

    ⤢ ⤢ ⤢ ⤢
    • Adds Custom Rate Limit Policies (Early Access) enabling API-based self-service configuration to cap the number of Authentication API / OAuth requests consumable by individual clients or groups (all third-party apps, or CIMDCIMDA text-based Short Message Service protocol from Nokia for exchanging SMS messages between applications and SMS centers, used to build tools that send, receive, or test carrier messaging flows. apps), preventing any single client from exhausting a tenant's rate limit entitlement.
    • Supports two enforcement modes per Custom Rate Limit Policy: blocking (reject requests that exceed the limit) or non-blocking (trigger notifications only), allowing safer staged rollouts.

    2 details in Everything

51. Flexible Password Policy is now generally available (2026-08-13) Aug 13, 2026 · issue 044

    Auth0 Flexible Password Policy reaches GA, replacing legacy fields with a single options.password_options object for database connections.

    ⤢ ⤢ ⤢ ⤢
    • Adds granular composition controls in options.password_options: minimum length, required character types, and blocking of sequential or repeated characters.
    • Adds password history enforcement in options.password_options to prevent reuse across a configurable number of previous passwords.
    • Adds dictionary blocking in options.password_options using a 10,000- or 100,000-word built-in list plus custom entries.
    • Adds profile-data blocking in options.password_options to reject passwords containing values from user profile fields, with a configurable field list.
    • New database connections created as of July 2026 default to the Flexible Password Policy with a 15-character minimum length and no required character types, aligning with NIST guidance — applies when creating via Dashboard, Management API, Deploy CLI, Terraform, or an Auth0 SDK.

    5 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !PATCH /api/v2/connections/{id} returns 400 invalid_body if a request contains both password_options and any legacy password field (passwordPolicy, password_complexity_options, password_history, password_no_personal_info, password_dictionary) simultaneously — automation that reads a connection and writes it back with legacy fields appended will break and must be updated to send only password_options.
    • !New database connections created without an explicit password configuration now default to options.password_options with a minimum password length of 15 (up from legacy defaults) — pipelines that create connections and expect legacy defaults will receive the new NIST-aligned defaults instead.
52. Custom Prompts now capture the same fields on Social and Enterprise connections (2026-08-10) Aug 10, 2026 · issue 042

    Auth0 Custom Prompts now enforce signup fields and consent checkboxes for Social and Enterprise connections, not just database/passwordless.

    ⤢ ⤢ ⤢ ⤢
    • Custom signup/login fields and consent checkboxes configured in Universal Login now apply to Social and Enterprise connections, closing the gap where users could bypass those prompts entirely when signing in via a social button or enterprise identity provideridentity providerA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems..
    • No configuration changes required — existing Custom Prompts setups automatically extend to all connection types; review or update via Dashboard under Branding → Universal Login → Enhance screens with partials, or via the Management API.

    2 details in Everything

53. changelog Aug 9, 2026 · issue 040

    Auth0 adds Session Delegation via Custom Token Exchange, GA Google Workspace Group Sync, and advanced Organizations Search filtering.

    ⤢ ⤢ ⤢ ⤢
    └──▷ HOW TO FIND IT
    Filter your tenant's Organizations list to find orgs with a specific metadata tag and third-party client access blocked, then share the view via URL.
    📍Navigate to Auth0 Dashboard › Organizations, open the search bar, add a Metadata filter (e.g. key=tier, value=enterprise) and a Third-party client access filter set to block, then copy the URL — the filter pills are persisted in it for sharing or bookmarking.
    • Adds Session Delegation via Custom Token Exchange: requesting a Custom Token Exchange token with a session_transfer audience returns a Session Transfer Token, preserving both sub (the delegated user) and the RFC 8693RFC 8693An IETF standard defining the OAuth 2.0 Token Exchange flow, letting a service swap one token for another with different scopes, audience, or type — enabling delegation and impersonation without re-authenticating the user. act claim (the acting party) throughout the session.
    • Google Workspace Inbound Directory Sync for Groups and Group Membership is now Generally Available for all Auth0 customers.
    • New paginated, searchable table in the Auth0 Management Dashboard lets tenant admins browse, filter, and search synced Google Workspace groups.
    • Self-Service Selective Group Sync lets enterprise IT admins independently configure Google Workspace Directory Sync and choose which groups to sync via the self-service assistant flow.
    • Organizations Search now supports advanced filtering on Name, Display Name, ID, Metadata (custom key-value pairs), third-party client access policy (allow or block), and app entitlement status.

    +1 more show less

    • Up to 5 organization filters can be combined simultaneously using AND/OR logic, with filter state persisted in the URL for sharing or bookmarking.

    6 details in Everything

54. docs update Aug 8, 2026 · issue 039

    Auth0 My Account API gains endpoints to list, verify, create, and delete user authentication methods

    ⤢
    └──▷ TRY IT
    List all authentication methods enrolled for the currently authenticated user.
    copy

    $ curl -X GET 'https://{yourDomain}/me/v1/authentication-methods' \
      -H 'Authorization: Bearer <access_token>'

    Verify a specific authentication method (e.g., after enrollment) to confirm it is active.
    copy

    $ curl -X POST 'https://{yourDomain}/me/v1/authentication-methods/{id}/verify' \
      -H 'Authorization: Bearer <access_token>'

    • Adds GET https://{yourDomain}/me/v1/authentication-methods endpoint to list a user's enrolled authentication methods
    • Adds POST https://{yourDomain}/me/v1/authentication-methods endpoint to create/enroll a new authentication method for the authenticated user
    • Adds POST https://{yourDomain}/me/v1/authentication-methods/{id}/verify endpoint to verify a specific authentication method by ID
    • Adds DELETE https://{yourDomain}/me/v1/authentication-methods/{id} endpoint to remove a specific authentication method by ID

    4 details in Everything

55. Custom Token Exchange - Session Delegation is now available in Open Early Access (2026-08-07) Aug 7, 2026 · issue 039

    Auth0 adds Session Delegation via Custom Token Exchange, letting authorized actors establish web sessions as another user with full audit trails.

    ⤢ ⤢ ⤢ ⤢
    • Requesting a Custom Token Exchange token with a session_transfer audience returns a Session Transfer Token instead of an access tokenaccess tokenA credential that authorizes a client to use a service or API. It usually has limited permissions and a lifetime; anyone holding it may be able to use those permissions., authorized by the same Action logic already controlling delegation.
    • Delegated sessions are redeemed through the standard /authorize endpoint — no extra login step required for the target user.
    • Both identities are preserved throughout: the sub claim identifies the user the session belongs to, while the act claim (RFC 8693RFC 8693An IETF standard defining the OAuth 2.0 Token Exchange flow, letting a service swap one token for another with different scopes, audience, or type — enabling delegation and impersonation without re-authenticating the user.) identifies the acting party (e.g. support agent).
    • Dedicated tenant log events for delegated logins, separate from regular logins, support compliance and traceability.

    4 details in Everything

56. Google Workspace Directory Sync for Groups - Now in General Availability! (2026-08-06) Aug 6, 2026 · issue 038

    Google Workspace Group and Group Membership sync is now GA in Auth0, with paginated dashboard UI and self-service selective group sync.

    ⤢ ⤢ ⤢ ⤢
    • Adds paginated, searchable, filterable table in the Auth0 Management Dashboard for browsing and selecting Google Workspace groups to sync.
    • Enables self-service selective Google Workspace Directory Sync for Groups via the Self-Service assistant flow, letting enterprise IT admins choose all or a subset of groups to synchronize.

    2 details in Everything

57. Organizations Search Expands with Advanced Filtering (2026-08-04) Aug 4, 2026 · issue 035

    Auth0 Organizations Search gains metadata, third-party client access, and app entitlement filters with AND/OR logic.

    ⤢ ⤢ ⤢ ⤢
    └──▷ HOW TO FIND IT
    Find all organizations where a specific metadata key is set and third-party client access is blocked — useful for auditing tenant isolation policies.
    📍In the Auth0 Dashboard, go to Organizations › search bar, add a Metadata filter (e.g. key: tier, value: enterprise), then add a Third-party client access filter set to block, and combine them with AND logic.
    • Adds filtering by Name, Display name, ID, Metadata (custom key-value pairs), Third-party client access (allow or block), and App entitlement active status in the Organizations Search interface.
    • Supports combining up to 5 filters simultaneously with AND/OR logic.
    • Filter pills persist in the URL, enabling shareable and bookmarkable filtered Organization views.

    3 details in Everything

58. changelog Aug 1, 2026 · issue 032

    Auth0 adds AI agent identity, curated IP blocklists, org-scoped roles, cross-app access, and enterprise federation in a wave of new capabilities.

    └──▷ TRY IT
    Block all traffic from active TOR exit nodes and low-reputation IPs at the tenant level using curated Auth0 Threat Intel lists.
    copy

    $ curl -X POST https://<tenant>.auth0.com/api/v2/network-acls \
      -H 'Authorization: Bearer <mgmt_api_token>' \
      -H 'Content-Type: application/json' \
      -d '{
        "description": "Block TOR and low-reputation IPs",
        "active": true,
        "priority": 1,
        "rule": {
          "action": { "block": true },
          "match": {
            "auth0_managed": ["auth0.tor", "auth0.low_reputation"]
          },
          "scope": "authentication"
        }
      }'

    Find a specific user or application across your tenant instantly without navigating menus.
    📍In the Auth0 Dashboard, press Cmd+K (or Ctrl+K), then type the user's email address or application name to search across Applications, APIs, Organizations, and Users in real time.
    • Adds Global Search (Beta) to the Command Palette (Cmd+K), enabling real-time tenant-wide search across Applications, APIs, Organizations, and Users by name, ID, email, or identifier with one-click ID copying.
    • Introduces Enterprise Connect (Beta), letting you federate existing SAMLSAMLA standard for passing signed identity assertions between a sign-in provider and an application. It lets a user sign in through their organization's identity provider. or OIDCOIDCOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user. authorization servers (including Okta) into Auth0 and layer on enterprise SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management., SCIMSCIMA standard for creating, updating and removing user accounts and groups across applications. It helps an identity provider keep access in sync when people join, change roles or leave. user provisioning, and self-service B2B onboarding with Actions-based claim enrichment and connection lifecycle events.
    • Launches Curated Blocklists in Tenant ACLsACLsAn access control list, a set of rules allowing or denying operations for particular users, services or network addresses. It decides who can use a resource. (GA), integrating dynamically updated Auth0 Threat Intel categories — auth0.low_reputation, auth0.tor, auth0.proxy, auth0.vpn, auth0.icloud_relay_proxy — into Network ACLACLAn access control list, a set of rules allowing or denying operations for particular users, services or network addresses. It decides who can use a resource. rules via the auth0_managed matcher block in the Management API.
    • Introduces Agents as Principal (Early Access), giving AI agents a unique first-class identity with their own credentials, audit trail, and delegation chain encoding in tokens — separate from human users and shared clients.
    • Adds Token Vault Privileged Worker (Early Access), allowing background agents to authenticate via Private Key JWTJWTAn open standard (RFC 7519) for encoding claims as a signed, optionally encrypted JSON object passed between parties. Cyber tools use it to verify identity and permissions without querying a central session store. or mTLSmTLSMutual TLS, an encrypted connection where both client and server present certificates to prove their identity. It helps services verify who they are communicating with. and retrieve a specific user's third-party tokens (Gmail, Drive, Slack, etc.) from Token Vault without an active user session, with per-connection and per-scope credential pinning.

    +5 more show less

    • Adds real-time Dashboard Search for Organization Members (Public Beta), supporting search by name, email, ID, and filtering by blocked status.
    • Publishes an Actions Reference Catalog at auth0.com/docs/actions/reference, documenting all trigger-specific Event and API objects available in custom Actions code.
    • Introduces Organization-Level Roles (Early Access), enabling creation, update, deletion, and assignment of roles scoped to individual organizations via the Management API or Dashboard, including pre-assignment during user invitations.
    • Adds Organization-to-Application Entitlement (Early Access), allowing per-org control over which applications organization members can access — enforced natively in Auth0 without custom Actions or metadata logic, opt-in and disabled by default.
    • Launches Cross App Access (XAA) for Resource Applications (Open Early Access), implementing an open standard for passing authorization across domains to support agent-to-app and app-to-app connections with centralized IT policy enforcement, supporting SAML and OIDC enterprise IdPs including Okta, with no code changes required.

    10 details in Everything

59. Global Search in Cmd+K is now in Beta (2026-07-31) Jul 31, 2026 · issue 031

    Auth0 adds Global Search to the Command Palette (Cmd+K), enabling real-time tenant-wide entity lookup in Beta.

    └──▷ HOW TO FIND IT
    Quickly locate a user by email or ID during an incident without leaving your current page.
    📍Press Cmd+K, type the user's email or client ID, and select the matching result to navigate directly to that entity or copy its identifier.
    • New Global Search in Command Palette (Cmd+K) lets you search Applications, APIs, Organizations, and Users by name, ID, email, or identifier in real time.
    • One-click identifier copying from search results lets you instantly grab entity IDs without navigating to detail pages.
    • View more links from search results navigate directly to filtered entity lists for deeper exploration.

    3 details in Everything

60. Agents as Principal now in Early Access! (2026-07-30) Jul 30, 2026 · issue 031

    Auth0 launches Agents as Principal in Early Access, giving AI agents their own identity, credentials, and audit trail.

    • Introduces Agents as Principal: every AI agent gets a unique identity distinct from human users and shared clients, with its own credentials and audit trail.
    • Enables end-to-end delegation tracking: when an agent acts on a user's behalf, the full delegation chain (who delegated, to which agent, through which app) is encoded in the token and auditable at every hop.
    • Supports associating existing external agent identifiers (from your own registry, an MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. server, or elsewhere) with an Auth0 client, avoiding re-provisioning of already-built agents.

    3 details in Everything

61. Curated Blocklists in Tenant Access Control Lists is Now GA! (2026-07-30) Jul 30, 2026 · issue 031

    Auth0 Curated Blocklists for Tenant ACLsACLsAn access control list, a set of rules allowing or denying operations for particular users, services or network addresses. It decides who can use a resource. are now GA, enabling automated IP threat blocking via Auth0-managed threat intelligence.

    └──▷ TRY IT
    Block all TOR exit node traffic at the authentication scope to prevent anonymous abuse via TOR.
    copy

    $ curl -X POST https://<tenant>.auth0.com/api/v2/network-acls \
      -H 'Authorization: Bearer <mgmt_api_token>' \
      -H 'Content-Type: application/json' \
      -d '{
        "description": "Block TOR exit nodes",
        "active": true,
        "priority": 2,
        "rule": {
          "action": { "block": true },
          "match": { "auth0_managed": ["auth0.tor"] },
          "scope": "authentication"
        }
      }'

    • Adds Curated Blocklists to Tenant Access Control Lists (ACLs), letting Attack Protection customers delegate IP risk management to Auth0 Threat Intel instead of manually maintaining IP/ASNASNAutonomous System Number — a globally unique identifier assigned by regional internet registries to a network operator, letting routing protocols distinguish which organization controls a block of IP addresses. lists.
    • Supports five Auth0-managed threat categories: auth0.low_reputation, auth0.tor, auth0.proxy, auth0.vpn, and auth0.icloud_relay_proxy for precise traffic-origin blocking.
    • Introduces the auth0_managed array within the Network ACLs Management API match object to reference dynamically updated curated lists in ACLACLAn access control list, a set of rules allowing or denying operations for particular users, services or network addresses. It decides who can use a resource. rule definitions.

    3 details in Everything

62. Enterprise Connect - Beta (2026-07-30) Jul 30, 2026 · issue 031

    Auth0 Enterprise Connect (Beta) adds modular B2B identity federation with SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management., SCIMSCIMA standard for creating, updating and removing user accounts and groups across applications. It helps an identity provider keep access in sync when people join, change roles or leave. provisioning, and self-service onboarding.

    • Federate existing SAMLSAMLA standard for passing signed identity assertions between a sign-in provider and an application. It lets a user sign in through their organization's identity provider. or OIDCOIDCOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user. authorization servers (including Okta) to Auth0 as a modular B2B identity layer.
    • Layer enterprise SSO and self-service onboarding/setup flows on top of federated connections for B2B customers.
    • Provision users outbound via SCIM wired to federated connections.
    • Inject user profile claims into ID tokens using Actions code during federated authentication.
    • Subscribe to connection lifecycle events (connection.created, connection.updated, connection.deleted) to keep local domain maps in sync as customers onboard.

    5 details in Everything

63. Token Vault Privileged Worker is now Early Access! (2026-07-30) Jul 30, 2026 · issue 031

    Auth0 Token Vault Privileged Worker (Early Access) lets background agents fetch user tokens without an active session.

    • Adds Token Vault Privileged Worker, enabling autonomous/background agents to retrieve a user's third-party tokens (Gmail, Drive, Slack, etc.) from Token Vault without requiring an active user session.
    • Supports Private Key JWTJWTAn open standard (RFC 7519) for encoding claims as a signed, optionally encrypted JSON object passed between parties. Cyber tools use it to verify identity and permissions without querying a central session store. and mTLSmTLSMutual TLS, an encrypted connection where both client and server present certificates to prove their identity. It helps services verify who they are communicating with. authentication for trusted worker identities authorizing token exchanges.
    • Enables pinning each worker credential to specific connections and scopes to limit blast radius of a compromised credential.

    3 details in Everything

64. Dashboard Search for Organization members now in Beta! (2026-07-29) Jul 29, 2026 · issue 029

    Auth0 Dashboard gains real-time search for Organization members by name, email, ID, and blocked status (Public Beta).

    └──▷ HOW TO FIND IT
    Quickly locate a specific organization member without scrolling through paginated lists.
    📍In the Dashboard, go to Organizations › [your organization] › Members, then use the search bar to enter a name, email address, or user ID. Use the Blocked filter to narrow results to blocked members only.
    • Search Organization members in real time by name, email, or ID directly from the Auth0 Dashboard — no more paginating through full member lists.
    • Filter Organization members by blocked status from the Dashboard member search interface.

    2 details in Everything

65. Organization-Level Roles - Early Access (2026-07-29) Jul 29, 2026 · issue 029

    Auth0 adds organization-scoped roles in Early Access, enabling per-org RBACRBACRole-based access control, where permissions are assigned to roles such as reader or administrator and users receive those roles. It makes access easier to manage than individual permission lists. without tenant-wide role sharing or custom workarounds.

    • Adds organization-scoped roles so each Auth0 Organization can have its own independent role definitions and permission assignments.
    • Supports creating, updating, and deleting org-scoped roles via the Management API or Dashboard.
    • Enables assigning org-scoped roles to users and enterprise groups within a specific organization.
    • Supports pre-assigning an org-scoped role when sending a user invitation to an organization.

    4 details in Everything

66. Organization-to-Application Entitlement - Early Access (2026-07-29) Jul 29, 2026 · issue 029

    Auth0 adds native Organization-to-Application Entitlement, letting you restrict which apps org members can access without custom code.

    ⤢
    • Adds Organization-to-Application Entitlement (Early Access): natively enforce which applications members of an organization can access, with automatic denial on unauthorized login attempts — no Actions, metadata checks, or custom logic required.
    • Supports per-org, opt-in enforcement so entitlements can be configured and tested before going live, with no risk of disrupting existing login flows.

    2 details in Everything

67. docs update Jul 27, 2026 · issue 027

    Auth0 launches Metric Streams (Beta) to stream real-time API metrics to Datadog, New Relic, and Splunk via native or OTLPOTLPOpenTelemetry Protocol, a standard way to send traces, metrics and logs between applications, collectors and monitoring systems. It lets telemetry move across compatible tools. integrations.

    └──▷ TRY IT
    Create a Datadog metric stream to monitor Auth0 API request counts in your Datadog account.
    copy

    $ auth0 api post metric-streams \
      --data '{
        "name": "datadog-production",
        "subscriptions": [{ "metric_type": "auth0.api_request.count" }],
        "destination": {
          "type": "datadog",
          "configuration": {
            "api_key": "YOUR_DATADOG_API_KEY",
            "site": "app.datadoghq.com"
          }
        }
      }'

    Create an OTLP metric stream to forward Auth0 API metrics to New Relic for rate limit and error troubleshooting.
    copy

    $ auth0 api post metric-streams \
      --data '{
        "name": "newrelic-production",
        "subscriptions": [{ "metric_type": "metrics_bridge.api_request" }],
        "destination": {
          "type": "otlp",
          "configuration": {
            "endpoint": "https://otlp.nr-data.net",
            "protocol": "http",
            "auth_type": "api_key",
            "api_key": "YOUR_INGEST_LICENSE_KEY",
            "auth_header_name": "api-key"
          }
        }
      }'

    Temporarily pause metric delivery without losing stream configuration, then re-enable it.
    copy

    $ auth0 api patch /api/v2/metric-streams/YOUR_STREAM_ID \
      --data '{"status":"disabled"}'
    
    # Later, re-enable:
    auth0 api patch /api/v2/metric-streams/YOUR_STREAM_ID \
      --data '{"status":"enabled"}'

    • New Metric Streams feature streams real-time Auth0 API metrics (request volume, error rates, rate limits, geographic distribution, authentication flows) to external monitoring platforms.
    • Supports native Datadog integration and OpenTelemetry ProtocolOpenTelemetry ProtocolOpenTelemetry Protocol, a standard way to send traces, metrics and logs between applications, collectors and monitoring systems. It lets telemetry move across compatible tools. (OTLP) for New Relic and Splunk.
    • Exposes auth0.api_request.count metric with rich tagging: API type, operation name, result, failure code, country code, client ID, connection ID, and grant type.
    • Streams can be enabled, disabled, or deleted independently, retaining configuration when disabled.

    4 details in Everything

68. docs update Jul 27, 2026 · docs issue 004

    Auth0 launches Metric Streams (Beta) to stream real-time API metrics to Datadog, New Relic, and Splunk via native or OTLPOTLPOpenTelemetry Protocol, a standard way to send traces, metrics and logs between applications, collectors and monitoring systems. It lets telemetry move across compatible tools. integrations.

    └──▷ TRY IT
    Create a Datadog metric stream to monitor Auth0 API request counts in your Datadog account.
    copy

    $ auth0 api post metric-streams \
      --data '{
        "name": "datadog-production",
        "subscriptions": [{ "metric_type": "auth0.api_request.count" }],
        "destination": {
          "type": "datadog",
          "configuration": {
            "api_key": "YOUR_DATADOG_API_KEY",
            "site": "app.datadoghq.com"
          }
        }
      }'

    Create an OTLP metric stream to forward Auth0 API metrics to New Relic for rate limit and error troubleshooting.
    copy

    $ auth0 api post metric-streams \
      --data '{
        "name": "newrelic-production",
        "subscriptions": [{ "metric_type": "metrics_bridge.api_request" }],
        "destination": {
          "type": "otlp",
          "configuration": {
            "endpoint": "https://otlp.nr-data.net",
            "protocol": "http",
            "auth_type": "api_key",
            "api_key": "YOUR_INGEST_LICENSE_KEY",
            "auth_header_name": "api-key"
          }
        }
      }'

    Temporarily pause metric delivery without losing stream configuration, then re-enable it.
    copy

    $ auth0 api patch /api/v2/metric-streams/YOUR_STREAM_ID \
      --data '{"status":"disabled"}'
    
    # Later, re-enable:
    auth0 api patch /api/v2/metric-streams/YOUR_STREAM_ID \
      --data '{"status":"enabled"}'

    • New Metric Streams feature streams real-time Auth0 API metrics (request volume, error rates, rate limits, geographic distribution, authentication flows) to external monitoring platforms.
    • Supports native Datadog integration and OpenTelemetry ProtocolOpenTelemetry ProtocolOpenTelemetry Protocol, a standard way to send traces, metrics and logs between applications, collectors and monitoring systems. It lets telemetry move across compatible tools. (OTLP) for New Relic and Splunk.
    • Exposes auth0.api_request.count metric with rich tagging: API type, operation name, result, failure code, country code, client ID, connection ID, and grant type.
    • Streams can be enabled, disabled, or deleted independently, retaining configuration when disabled.

    4 details in Everything

69. Cross App Access (XAA) for Resource Applications is now in Open Early Access (2026-07-27) Jul 27, 2026 · issue 027

    Auth0 launches Cross App Access (XAA) for Resource Applications in Open Early Access, enabling secure agent-to-app and app-to-app authorization.

    ⤢
    • Adds Cross App Access (XAA), a new open standard for passing authorization across domains, enabling AI agents and enterprise apps to securely access MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. servers and APIs without per-user consent prompts.
    • Centralizes IT control over cross-application data-sharing connections, improving governance and visibility into which agents and apps access which resources.
    • Supports SAMLSAMLA standard for passing signed identity assertions between a sign-in provider and an application. It lets a user sign in through their organization's identity provider. and OIDCOIDCOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user. enterprise IdPs — including specific support for Okta — with no code changes required on the resource application side.
    • Available in production at no additional cost for Enterprise, B2B Pro, and B2B Essential customers via Auth0 Enterprise Connections; Free tenants can test it during the trial period.

    4 details in Everything

70. changelog Jul 23, 2026 · issue 023

    Auth0 adds Anonymous Sessions beta and self-service SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. third-party access delegation for customer admins.

    └──▷ HOW TO FIND IT
    Enable anonymous sessions for your tenant and a specific application so guest activity is tracked before login.
    📍In the Auth0 Dashboard, go to Settings › (Tenant Settings) and enable Anonymous Sessions length configuration, then navigate to Applications › <your app> › Settings and enable Anonymous Sessions for that client.
    • New Anonymous Sessions (beta, paid plans): create and manage stateless sessions for unauthenticated users via a new POST /anonymous/token endpoint supporting guest checkout, cart persistence, and pre-login personalization.
    • Anonymous sessions can be linked to authenticated users through pre-registration and post-login actions, preserving cross-device activity on the authenticated profile.
    • Anonymous session length is now configurable as a tenant-level setting, and anonymous session support can be enabled per Application and API.
    • Self-Service Enterprise Configuration tickets can now delegate third-party application access decisions to the customer admin, surfacing a new wizard step during SSO setup rather than requiring the setting at ticket creation time.

    4 details in Everything

71. docs update Jul 23, 2026 · docs issue 004

    Auth0 adds Anonymous Sessions beta and self-service SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. third-party access delegation for customer admins.

    └──▷ HOW TO FIND IT
    Enable anonymous sessions for your tenant and a specific application so guest activity is tracked before login.
    📍In the Auth0 Dashboard, go to Settings › (Tenant Settings) and enable Anonymous Sessions length configuration, then navigate to Applications › <your app> › Settings and enable Anonymous Sessions for that client.
    • New Anonymous Sessions (beta, paid plans): create and manage stateless sessions for unauthenticated users via a new POST /anonymous/token endpoint supporting guest checkout, cart persistence, and pre-login personalization.
    • Anonymous sessions can be linked to authenticated users through pre-registration and post-login actions, preserving cross-device activity on the authenticated profile.
    • Anonymous session length is now configurable as a tenant-level setting, and anonymous session support can be enabled per Application and API.
    • Self-Service Enterprise Configuration tickets can now delegate third-party application access decisions to the customer admin, surfacing a new wizard step during SSO setup rather than requiring the setting at ticket creation time.

    4 details in Everything

72. Self-Service Enterprise Configuration: Customer admins can now configure third-party application access during SSO setup (2026-07-22) Jul 22, 2026 · issue 022

    Auth0 Self-Service Enterprise Configuration lets customer admins control third-party app SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. access during their own setup wizard.

    └──▷ HOW TO FIND IT
    When creating a Self-Service Enterprise Configuration ticket, delegate the third-party access decision to the customer admin instead of setting it yourself — useful when you want customers to self-govern whether third-party apps can use their SSO connection.
    📍In the Auth0 console, go to Authentication › Enterprise › Self-Service Enterprise Configuration, create or edit a ticket, and enable third-party access delegation on the ticket instead of setting domain connection access directly.
73. Anonymous sessions are now in beta! (2026-07-20) Jul 20, 2026 · issue 021

    Auth0 launches Anonymous Sessions beta: stateless guest sessions with seamless linking to authenticated users

    └──▷ HOW TO FIND IT
    Enable anonymous sessions for a specific application and API, and set session length, via the Auth0 dashboard.
    📍In the Auth0 dashboard, go to Applications › <your application> and enable Anonymous Sessions. Then go to APIs › <your API> and enable Anonymous Sessions. Finally, set the session length under Tenant Settings › Anonymous Sessions.
    • New POST /anonymous/token endpoint creates, refreshes, and retrieves access tokensaccess tokensA credential that authorizes a client to use a service or API. It usually has limited permissions and a lifetime; anyone holding it may be able to use those permissions. for unauthenticated (anonymous) sessions.
    • Supports seamless session linking — anonymous sessions can be tied to authenticated users via pre-registration and post-login Actions.
    • Activity Preservation carries anonymous session data across devices onto the authenticated user profile upon login.
    • New tenant-level setting to configure anonymous session length.
    • Per-application and per-API configuration options to enable anonymous sessions.

    5 details in Everything

74. Dashboard Search for Roles Now in Beta (2026-07-14) Jul 14, 2026 · issue 015

    Auth0 Dashboard now supports real-time Role search by ID and name, available in Public Beta.

    └──▷ HOW TO FIND IT
    Quickly locate a specific Role without scrolling through paginated lists — useful when managing large numbers of roles.
    📍In the Auth0 Dashboard, go to User Management › Roles and type a Role name or ID into the search bar to filter results in real time.
75. Third-Party Apps for Organizations is now Generally Available (2026-07-10) Jul 10, 2026 · issue 014

    Auth0 Organizations now supports third-party app access with per-org controls and scoped user consent.

    ⤢
    └──▷ TRY IT
    Promote a connection to domain level so a third-party app can authenticate users within a specific organization.
    copy

    $ curl --request PATCH \
      --url 'https://<tenant>.auth0.com/api/v2/connections/<connection_id>' \
      --header 'Authorization: Bearer <mgmt_api_token>' \
      --header 'Content-Type: application/json' \
      --data '{"is_domain_connection": true}'

    Enable third-party app access for a specific organization after opting in (access is blocked by default).
    📍In the Auth0 Dashboard, go to Organizations › <your-org> › Settings and enable third-party application access for that organization.
    • Enables third-party application access for Auth0 Organizations, configurable on a per-organization basis by tenant admins.
    • Blocks third-party app access by default for all existing organizations — admins must explicitly opt in, preserving backward compatibility.
    • Supports domain-level connections (is_domain_connection: true) as a requirement for authenticating org users through third-party apps.
    • Scopes user consent per organization — consent granted in one organization does not propagate to others.

    4 details in Everything

76. Google One Tap Support for Universal Login EA (2026-07-09) Jul 9, 2026 · issue 014

    Auth0 Universal Login now supports Google One Tap for frictionless, one-click sign-in (Early Access).

    └──▷ HOW TO FIND IT
    Enable Google One Tap on your web app via the Auth0 Google Social Connection settings — navigate to the configuration documented in the Auth0 Google Social Connection docs.
    📍In the Auth0 Dashboard, go to Authentication › Social › Google › Settings and enable the Google One Tap option for your Universal Login prompt.
    • Adds Google One Tap support to the Universal Login prompt (Early Access), letting users authenticate instantly via a non-intrusive identity overlay without manual forms or page redirects.

    1 detail in Everything

77. IPSIE session_expiry Claim Support for Okta and OIDC Enterprise Connections (2026-07-08) Jul 8, 2026 · issue 014

    Auth0 adds IPSIE session_expiry claim support for Okta and OIDCOIDCOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user. Enterprise connections to enforce federated session ceilings.

    └──▷ USE IT
    Propagate the enforced session expiry to downstream apps so they can respect the IdPIdPA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems.-driven session ceiling end-to-end.
    javascript copy

    // Post-Login Action
    exports.onExecutePostLogin = async (event, api) => {
      const sessionExpiry = event.session?.expiry;
      if (sessionExpiry) {
        api.idToken.setCustomClaim('session_expiry', sessionExpiry);
      }
    };

    Enable session_expiry enforcement on an existing OIDC Enterprise connection via the Management API.
    copy

    $ curl -X PATCH https://<your-tenant>.auth0.com/api/v2/connections/<connection_id> \
      -H 'Authorization: Bearer <mgmt_api_token>' \
      -H 'Content-Type: application/json' \
      -d '{"options": {"session_expiry": true}}'

    Enable session_expiry support on an Okta/OIDC Enterprise connection through the Auth0 Dashboard.
    📍In the Auth0 Dashboard, go to Authentication › Enterprise, select your Okta or OIDC connection, open its settings, and enable the Session Expiry option.
    • Supports the IPSIE SL1 session_expiry claim for Okta and OIDC Enterprise connections, using the IdP-provided expiry as a hard ceiling on Auth0 session lifetime.
    • Automatically terminates Auth0 sessions when a federated user's upstream IdP session expires, eliminating stale federated sessions and residual access.
    • Enforces session expiry as the minimum of three values: the IdP session_expiry claim, the tenant's absolute session expiration, and any expiry set via Actions.
    • Enables propagation of the final session_expiry value to downstream applications via a Post-Login Action that injects it as a custom claim in the Auth0-issued ID token.
    • Configurable per Okta/OIDC Enterprise connection through the Auth0 Dashboard or Management API.

    5 details in Everything

78. Automate Downstream Provisioning with Outbound SCIM for Users via Event Streams (2026-07-01) Jul 1, 2026 · issue 014

    Auth0 adds an Outbound SCIMSCIMA standard for creating, updating and removing user accounts and groups across applications. It helps an identity provider keep access in sync when people join, change roles or leave. Action template for Event Streams, enabling infrastructure-free user provisioning to any SCIM 2.0SCIM 2.0A standard for creating, updating and removing user accounts and groups across applications. It helps an identity provider keep access in sync when people join, change roles or leave. app.

    └──▷ HOW TO FIND IT
    Enable automated downstream user provisioning to a SCIM 2.0 app without hosting any webhook infrastructure.
    📍In the Auth0 Dashboard, go to Event Streams › Create Stream, select Auth0 Actions as the destination, then apply the Outbound SCIM provisioning template. Edit the script to map Auth0 attributes to your downstream SCIM schema before activating the stream.
    • New Outbound SCIM Action template for Event Streams pushes user.created, user.updated, and user.deleted events to any SCIM 2.0-compliant downstream application without custom infrastructure.
    • Supports SCIM 2.0 REST operations (POST, PUT, DELETE) translated directly from Auth0 user lifecycle events.
    • Template-driven customization lets practitioners map Auth0 attributes to downstream SCIM schemas and enable opt-in UPSERT (create-on-update) behavior for gradual user trickle-in.
    • Built-in fault tolerance handles API timeouts and retries for transient failures natively within the Action script.

    4 details in Everything

79. Refresh Token metadata is now Generally Available (2026-06-22) Jun 22, 2026 · issue 014

    Auth0 Refresh Token Metadata is now GA: attach up to 25 custom key-value pairs to refresh tokensrefresh tokensA credential used to obtain a new access token without signing in again. It is sent to the authorization service rather than used directly to call the protected API. via Actions and the Management API.

    └──▷ USE IT
    Tag refresh tokens with device and region context at login so downstream services can make access decisions without re-querying the IdPIdPA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems..
    javascript copy

    // Post-Login Action
    exports.onExecutePostLogin = async (event, api) => {
      api.refreshToken.setMetadata('deviceName', event.request.user_agent);
      api.refreshToken.setMetadata('loginRegion', event.request.geoip?.countryCode);
      api.refreshToken.setMetadata('orgContext', event.organization?.id);
    };

    Inspect a refresh tokenrefresh tokenA credential used to obtain a new access token without signing in again. It is sent to the authorization service rather than used directly to call the protected API.'s stored metadata via the Management API to audit contextual data tied to a specific token.
    copy

    $ curl -X GET "https://<your-domain>/api/v2/refresh-tokens/<id>" \
      -H "Authorization: Bearer <mgmt_api_token>"

    Update metadata on an existing refresh token — for example, to mark a token as elevated after step-up authentication.
    copy

    $ curl -X PATCH "https://<your-domain>/api/v2/refresh-tokens/<id>" \
      -H "Authorization: Bearer <mgmt_api_token>" \
      -H "Content-Type: application/json" \
      -d '{"metadata": {"stepUpCompleted": "true"}}'

    • Adds Refresh Token Metadata (GA for Enterprise): attach up to 25 custom key-value pairs to refresh tokens that persist throughout the token lifecycle.
    • New api.refreshToken.setMetadata() method in Post-Login Actions lets you store contextual data (device, region, org) at login time.
    • New Management API endpoints support retrieving (GET), updating (PATCH), and revoking (DELETE) refresh tokens with metadata at /api/v2/refresh-tokens/{id}.

    3 details in Everything

80. Google Workspace Directory Sync for Groups - Early Access Updates (2026-06-17) Jun 17, 2026 · issue 014

    Google Workspace Directory Sync for Groups enters open Early Access with native RBACRBACRole-based access control, where permissions are assigned to roles such as reader or administrator and users receive those roles. It makes access easier to manage than individual permission lists. role assignment for synced groups.

    └──▷ HOW TO FIND IT
    Assign a synced Google Workspace group to an Auth0 RBAC role so members automatically receive the correct permissions when they log in.
    📍In the Auth0 Dashboard, go to Authentication › Enterprise › Google Workspace connection › Synchronization, configure your group synchronization preferences, then navigate to User Management › Roles › <your role> › Groups and assign the synced Google Workspace group.
    • Enables Google Workspace Directory Sync for Groups in Early Access for all public cloud customers — no enrolment required.
    • Supports automated group synchronization, Sync all, and partial group selection out-of-the-box.
    • Adds native assignment of synced Google Workspace groups to Auth0 tenant-level RBAC roles and organization-specific roles, so group members automatically inherit permissions at login.

    3 details in Everything

81. Dashboard Search for APIs Now in Beta (2026-06-15) Jun 15, 2026 · issue 014

    Auth0 Dashboard now supports real-time API search by ID, identifier, or name — no more paginated scrolling.

    └──▷ HOW TO FIND IT
    Quickly locate a specific API in large tenants without paging through lists.
    📍In the Auth0 Dashboard, go to Applications › APIs and type the API name, identifier, or ID into the search bar to filter results in real time.