Auth0 Docs

Auth0 Skill

> Auth0 — Identity platform for authentication, authorization, and user management. > Version: Latest | Docs: auth0.com/docs

Quick Reference

| Topic | File | Sections | |-------|------|----------| | Getting Started | getting-started.md | Overview, identity fundamentals, quickstarts, configure Auth0, auth flows, architecture | | Authentication | authentication.md | Universal Login, passwordless, identity providers (social/enterprise/database), protocols (OAuth 2.0, OIDC, SAML), custom token exchange, sessions, cookies | | Customize & Secure | customize-secure.md | Branding, login pages, custom domains, emails, Actions, Rules, Hooks, Forms, tokens (ID/Access/Refresh/JWT), MFA, attack protection, compliance | | Manage & Deploy | manage-deploy.md | User accounts, metadata, migration, search, organizations, RBAC, APIs, SDKs, CLI, Terraform, deployment, monitoring, logs, AI |

Core Concepts

• Tenant: Auth0 account with unique domain (yourtenant.auth0.com)
• Application: Client app (SPA, Web, Native, M2M) registered with Auth0
• API: Protected resource server with scopes
• Connection: Identity source (database, social, enterprise, passwordless)
• Universal Login: Auth0-hosted authentication pages (recommended)
• Token: Credential after authentication (ID Token, Access Token, Refresh Token)
• Action: Custom Node.js code executed during auth flows (replaces Rules/Hooks)
• Organization: B2B customer grouping with per-org connections and branding
• Scope: Permission granted to a client app (e.g., read:items)

Authentication Flows

| Flow | Use Case | |------|----------| | Authorization Code Flow | Server-side web apps | | Authorization Code Flow with PKCE | SPAs, mobile apps | | Client Credentials Flow | Machine-to-machine | | Device Authorization Flow | Input-constrained devices | | Resource Owner Password Flow | Highly-trusted apps (not recommended) | | Implicit Flow with Form Post | Legacy SPAs (deprecated) | | Hybrid Flow | Need ID token immediately + code exchange | | CIBA | Backchannel-initiated authentication | | Custom Token Exchange (RFC 8693) | Token swapping, delegation |

Key Endpoints

| Endpoint | Purpose | |----------|---------| | GET /authorize | Authorization endpoint (user login) | | POST /oauth/token | Token endpoint (exchange code, get tokens) | | GET /userinfo | Get user profile with Access Token | | GET /.well-known/openid-configuration | OIDC discovery document | | GET /.well-known/jwks.json | JSON Web Key Set for JWT verification | | GET /v2/logout | Logout endpoint | | POST /dbconnections/change_password | Password reset | | POST /oauth/revoke | Revoke refresh token | | GET /api/v2/* | Management API | | POST /api/v2/myaccount/* | My Account API (user self-service) |

SDKs

| Platform | SDK | |----------|-----| | React | @auth0/auth0-react | | Angular | @auth0/auth0-angular | | Vue | @auth0/auth0-vue | | Next.js | @auth0/nextjs-auth0 | | Express | express-openid-connect | | iOS/Swift | Auth0.swift | | Android | auth0-android | | React Native | react-native-auth0 | | Flutter | auth0_flutter | | ASP.NET Core | Auth0.AspNetCore | | Java/Spring | auth0-spring-security | | Node.js (Management) | auth0 | | Python (Management) | auth0-python | | Lock (widget) | @auth0/lock | | SPA JS | @auth0/auth0-spa-js |

CLI Commands

auth0 login                                    # Authenticate
auth0 apps create --name "App" --type spa      # Create app
auth0 apps list                                # List apps
auth0 apis create --name "API" --identifier .. # Create API
auth0 users create --connection "..."          # Create user
auth0 users search --query "email:.."          # Search users
auth0 logs list                                # View logs
auth0 logs tail                                # Tail logs
auth0 tenants list                             # List tenants
auth0 test login --client                  # Test login flow

Terraform

provider "auth0" {
  domain        = "yourtenant.auth0.com"
  client_id     = var.auth0_client_id
  client_secret = var.auth0_client_secret
}

resource "auth0_client" "app" {
  name     = "My App"
  app_type = "spa"
  callbacks = ["https://myapp.com/callback"]
}

Official Documentation Links

Get Started

• Auth0 Docs Home
• Quickstarts
• Auth0 Overview
• Identity Fundamentals
• Introduction to Auth0
• IAM
• AuthN vs AuthZ
• Dashboard
• Create Tenants
• Create Applications
• Applications in Auth0
• Register APIs
• Auth0 Teams
• Dashboard Profile
• Tenant Settings
• Manage Dashboard Access
• Client Credentials Exchange
• Auth Flows
• Which OAuth 2.0 Flow
• Authorization Code Flow
• PKCE
• Client Credentials
• Device Authorization
• Resource Owner Password
• CIBA
• Implicit Flow
• Hybrid Flow
• Private Key JWT
• mTLS
• RAR
• PAR
• JAR

Authenticate

• Login
• Universal Login
• Universal Login vs Classic
• Universal Experience
• Logout
• Single Sign-On
• Passwordless
• Passwordless with Universal Login
• Identity Providers
• Social Identity Providers
• Enterprise Connections
• Database Connections
• Connection Settings Best Practices
• Self-Service Enterprise Configuration
• Connection Profile
• User Attribute Profile
• Passkey Authentication
• Protocols
• OAuth 2.0
• OIDC
• SAML
• SAML Configuration
• WS-Federation
• LDAP
• SCIM
• Custom Token Exchange
• CTE Use Cases
• CTE Configuration
• CTE Attack Protection

Manage Users

• User Accounts
• User Profile Structure
• Metadata
• Account Linking
• Link User Accounts
• Password Reset
• User Migration
• Automatic Migration
• Bulk Import
• User Search
• Search Best Practices
• Organizations
• Organizations Overview
• Create First Organization
• Configure Organizations
• Custom Development
• M2M Organizations
• Using Tokens
• Access Control
• RBAC
• Authorization Policies
• Rules for Authorization Policies
• Configure Core RBAC
• Sample Use Cases: RBAC
• Sample Use Cases: Actions with AuthZ
• Sample Use Cases: Rules with AuthZ
• Core vs Extension
• Sessions
• Cookies
• SPA Cookie Auth
• My Account API
• My Organization API

Customize

• Customize Login Pages
• Custom Domains
• Customize Emails
• Customize SMS/Voice
• Internationalization
• Experiment Center
• Actions
• Actions Triggers
• Manage Versions
• Forms
• Events
• Rules
• Hooks
• Extensions
• Integrations
• Log Streams
• Auth0 Marketplace

Secure

• Application Credentials
• Attack Protection
• Continuous Session Protection
• Highly Regulated Identity
• Transactional Authorization
• Customer Managed Keys
• MFA
• MFA Factors
• Enable MFA
• Customize MFA
• Auth0 Guardian
• Security Center
• Security Guidance
• Sender Constraining
• Configure Sender Constraining
• Tokens
• ID Tokens
• Validate ID Tokens
• [Access Toke

…

Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

• Author: pledgeandgrow
• Source: pledgeandgrow/pledge-skills
• License: MIT

Install and usage instructions live in the source repository linked above.