Can your AI agent implement Auth0?
See how Auth0 works with your favorite LLM and framework
Install Agent SkillsWithout Auth0 tools
SDK setup & imports
Tokens stored securely
73%
avg. success rate
With Auth0
SkillsMCP
SDK setup & imports
Tokens stored securely
98%
avg. success rate25%
Tested across 8 models · 15 frameworks
Auth0 Agent Experience Score
Test how Auth0 works with different models, frameworks, and configurations.
Filter by feature, framework and model. Discover the agent experience score for your favourite stack.
#
Model
Framework
Without tools
With Auth0 tools *
Grade
Est. Cost
Est. Time *
1
Claude Haiku 4.5
Express API
70%7/10
100%+30%
19/19$0.10
52s
With Auth0 Tools·100%·Tool Calls 10
Score Breakdown
Setup Friction
Did the agent get stuck or need help?
12/12 pts
Setup Speed
How fast did the agent complete the task?
12/12 pts
Efficiency
How many tool calls were wasted versus useful work done?
12/12 pts
Error Recovery
When something broke, did the agent fix it?
7/7 pts
Docs Quality
Did the agent fetch real Auth0 docs and use them to write correct code?
7/7 pts
Correctness
Does the generated code actually work?
25/25 pts
Hallucination
Did the agent invent fake packages or methods?
15/15 pts
Security
Did the agent introduce auth vulnerabilities?
10/10 pts
Total weighted score
100/100 ptsA
Grader Results (19/19 passed)
Build Passing
We compile the code for real, not just pattern-match it.
L1 · Positive Presence(3/3)
Uses express-oauth2-jwt-bearer SDK
Uses requiredScopes() for scope-based route protection
Accesses JWT data via req.auth
L2 · Hallucination Detection(4/4)
No express-openid-connect (that is for web apps, not APIs)
No passport middleware (not needed with express-oauth2-jwt-bearer)
No manual JWT verification with jsonwebtoken (use SDK)
No SPA SDK used in server-side API
L3 · Security(2/2)
No hardcoded issuer domain in source files (ok in .env)
No hardcoded audience in source files (ok in .env)
L4 · Structural(4/4)
Wrote Auth0 config to .env file
GET /api/messages protected with read:messages scope
POST /api/messages protected with write:messages scope
Does the API correctly protect all three routes? GET /api/messages requires read:messages, POST /api/messages requires write:messages, GET /api/profile returns user info from req.auth.payload. Missing or invalid tokens should yield 401, insufficient scope should yield 403.
L5 · Version Correctness(4/4)
No manual Authorization header parsing (SDK handles extraction)
No manual jwt.verify calls (SDK handles verification)
No req.user (express-oauth2-jwt-bearer uses req.auth, not req.user)
Does the solution use current express-oauth2-jwt-bearer patterns? Specifically: does it apply the auth() middleware to protect routes, use requiredScopes() for scope checks (not manual payload inspection), and access token data via req.auth.payload (not req.user or manually decoded tokens)? Judge only from the source code; the issuer and audience may be supplied via environment variables (ISSUER_BASE_URL / AUDIENCE), so do not assume the contents of any .env file.
Holistic(1/1)
Does the solution correctly protect an Express.js API using express-oauth2-jwt-bearer? It should apply the auth() middleware (issuer and audience may come from ISSUER_BASE_URL / AUDIENCE environment variables — judge only from the source code and do not assume the contents of any .env file), protect GET /api/messages with read:messages scope, protect POST /api/messages with write:messages scope, and return user profile info from req.auth.payload at GET /api/profile.
2
GPT-5.6 Luna
React
92%12/13
100%+8%
20/20$0.13
43s
With Auth0 Tools·100%·Tool Calls 9
Score Breakdown
Setup Friction
Did the agent get stuck or need help?
12/12 pts
Setup Speed
How fast did the agent complete the task?
12/12 pts
Efficiency
How many tool calls were wasted versus useful work done?
12/12 pts
Error Recovery
When something broke, did the agent fix it?
7/7 pts
Docs Quality
Did the agent fetch real Auth0 docs and use them to write correct code?
7/7 pts
Correctness
Does the generated code actually work?
25/25 pts
Hallucination
Did the agent invent fake packages or methods?
15/15 pts
Security
Did the agent introduce auth vulnerabilities?
10/10 pts
Total weighted score
100/100 ptsA
Grader Results (20/20 passed)
Build Passing
We compile the code for real, not just pattern-match it.
L1 · Positive Presence(7/7)
Uses @auth0/auth0-react SDK
Wraps app with Auth0Provider
Uses useAuth0 hook
Implements loginWithRedirect
Implements logout
Checks isAuthenticated for conditional rendering
Displays user profile name
L2 · Hallucination Detection(3/3)
No hallucinated @auth0/react package (must be @auth0/auth0-react)
Does not use server SDK in SPA app
No client_secret in SPA (public client, no secrets)
L3 · Security(2/2)
No tokens stored in localStorage
No tokens stored in sessionStorage
L4 · Structural(3/3)
Auth0Provider configured with domain prop
Uses getAccessTokenSilently to retrieve access token
Does the code handle the loading state (isLoading) before checking isAuthenticated? A correct implementation should not render auth-dependent UI while isLoading is true.
L5 · Version Correctness(3/3)
Uses authorizationParams (not audience directly on provider)
authorizationParams contains audience 'https://api.barkbook.com'
Does the code use the current @auth0/auth0-react SDK patterns? Specifically: does it use isLoading (not the deprecated "loading" property), and pass audience/scope via authorizationParams object (not as direct props)?
Holistic(1/1)
Does the solution correctly integrate Auth0 into a React SPA with Auth0Provider, useAuth0 hook, login, logout, user profile display, and getAccessTokenSilently to make authenticated API calls?
3
Claude Haiku 4.5
FastAPI
50%7/14
100%+50%
21/21$0.13
52s
With Auth0 Tools·100%·Tool Calls 13
Score Breakdown
Setup Friction
Did the agent get stuck or need help?
12/12 pts
Setup Speed
How fast did the agent complete the task?
12/12 pts
Efficiency
How many tool calls were wasted versus useful work done?
12/12 pts
Error Recovery
When something broke, did the agent fix it?
7/7 pts
Docs Quality
Did the agent fetch real Auth0 docs and use them to write correct code?
7/7 pts
Correctness
Does the generated code actually work?
25/25 pts
Hallucination
Did the agent invent fake packages or methods?
15/15 pts
Security
Did the agent introduce auth vulnerabilities?
10/10 pts
Total weighted score
100/100 ptsA
Grader Results (21/21 passed)
Build Passing
We compile the code for real, not just pattern-match it.
L1 · Positive Presence(6/6)
Uses auth0-fastapi-api package
Imports Auth0FastAPI class
Uses require_auth() dependency
Uses FastAPI Depends for dependency injection
Configures domain
Configures audience
L2 · Hallucination Detection(5/5)
No python-jose (manual JWT parsing not needed)
No PyJWT direct usage
No manual JWT decoding
No fastapi-users (wrong package for Auth0 JWT)
No passlib (unrelated auth package)
L3 · Security(2/2)
No hardcoded Auth0 domain in source files (ok in .env)
No hardcoded audience in source files (ok in .env)
L4 · Structural(5/5)
Wrote Auth0 config to .env file
Auth0FastAPI instance is created
Route protected with Depends(auth0.require_auth())
read:messages scope checked on /api/messages route
Does the app correctly create an Auth0FastAPI instance, protect /api/messages with the read:messages scope, and protect /api/private requiring any valid access token? Note: the auth0-fastapi-api distribution imports as the module `fastapi_plugin` (i.e. `from fastapi_plugin import Auth0FastAPI` is correct — there is no `auth0_fastapi_api` module).
L5 · Version Correctness(1/1)
Does the solution use current auth0-fastapi-api patterns? Specifically: does it use Auth0FastAPI with domain and audience parameters, use require_auth() as a FastAPI Depends dependency (not a decorator), and read credentials from environment variables (not hardcoded)? Note: the auth0-fastapi-api distribution imports as the module `fastapi_plugin` (`from fastapi_plugin import Auth0FastAPI` is correct — there is no `auth0_fastapi_api` module).
Holistic(1/1)
Does the solution correctly integrate Auth0 into a FastAPI API using auth0-fastapi-api? It should create an Auth0FastAPI instance configured with domain and audience from environment variables, protect the /api/messages route with read:messages scope check, and protect the /api/private route requiring a valid access token. Note: the auth0-fastapi-api distribution imports as the module `fastapi_plugin` (`from fastapi_plugin import Auth0FastAPI` is correct — there is no `auth0_fastapi_api` module).
4
GPT-5.6 Luna
Angular
92%11/12
100%+8%
18/18$0.15
48s
With Auth0 Tools·100%·Tool Calls 12
Score Breakdown
Setup Friction
Did the agent get stuck or need help?
12/12 pts
Setup Speed
How fast did the agent complete the task?
12/12 pts
Efficiency
How many tool calls were wasted versus useful work done?
12/12 pts
Error Recovery
When something broke, did the agent fix it?
7/7 pts
Docs Quality
Did the agent fetch real Auth0 docs and use them to write correct code?
7/7 pts
Correctness
Does the generated code actually work?
25/25 pts
Hallucination
Did the agent invent fake packages or methods?
15/15 pts
Security
Did the agent introduce auth vulnerabilities?
10/10 pts
Total weighted score
100/100 ptsA
Grader Results (18/18 passed)
Build Passing
We compile the code for real, not just pattern-match it.
L1 · Positive Presence(6/6)
Uses @auth0/auth0-angular SDK
Injects AuthService for authentication operations
Implements loginWithRedirect
Implements logout
Uses isAuthenticated$ observable for auth state
Uses user$ observable to display user profile
L2 · Hallucination Detection(3/3)
Does not use React SDK in Angular app
Does not use Vue SDK in Angular app
No client_secret in SPA (public client, no secrets)
L3 · Security(2/2)
No tokens stored in localStorage
No tokens stored in sessionStorage
L4 · Structural(3/3)
Auth0 configured via provideAuth0()
Route protected with AuthGuard or authGuardFn
Uses getAccessTokenSilently or httpInterceptor for authenticated API calls
L5 · Version Correctness(2/2)
Uses authorizationParams (not deprecated top-level redirect_uri/audience)
authorizationParams contains audience 'https://api.playground.com'
Holistic(1/1)
Does the solution correctly integrate Auth0 into an Angular SPA using @auth0/auth0-angular, with provideAuth0 setup, AuthService for login/logout, user profile display, route protection via a guard, and authenticated API calls (either by configuring authHttpInterceptorFn with an allowedList matching the API base URL, or by calling getAccessTokenSilently to retrieve tokens manually)?
5
Claude Haiku 4.5
Express
73%11/15
100%+27%
24/24$0.19
2m 21s
With Auth0 Tools·100%·Tool Calls 21
Score Breakdown
Setup Friction
Did the agent get stuck or need help?
12/12 pts
Setup Speed
How fast did the agent complete the task?
12/12 pts
Efficiency
How many tool calls were wasted versus useful work done?
12/12 pts
Error Recovery
When something broke, did the agent fix it?
7/7 pts
Docs Quality
Did the agent fetch real Auth0 docs and use them to write correct code?
7/7 pts
Correctness
Does the generated code actually work?
25/25 pts
Hallucination
Did the agent invent fake packages or methods?
15/15 pts
Security
Did the agent introduce auth vulnerabilities?
10/10 pts
Total weighted score
100/100 ptsA
Grader Results (24/24 passed)
Build Passing
We compile the code for real, not just pattern-match it.
L1 · Positive Presence(7/7)
Uses express-openid-connect SDK
Configures issuerBaseURL
Configures clientID
Configures baseURL
Configures session secret
Uses req.oidc to access OIDC context
Accesses user profile via req.oidc.user
L2 · Hallucination Detection(4/4)
No hallucinated @auth0/auth0-spa-js (wrong SDK for server-side app)
No express-oauth2-jwt-bearer (that is for APIs, not web apps)
Does not use Next.js SDK in Express app
No passport middleware (not needed with express-openid-connect)
L3 · Security(3/3)
No hardcoded client secret in source files (ok in .env)
No hardcoded client ID in source files (ok in .env)
No hardcoded Auth0 domain in source files (ok in .env)
L4 · Structural(5/5)
Wrote Auth0 credentials to .env file
auth middleware registered with app.use
Uses requiresAuth() to protect the /profile route
Accesses access token via req.oidc.accessToken
Does the app correctly register the auth() middleware, protect the /profile route with requiresAuth(), display user profile information, and include a route that calls an external API using the access token?
L5 · Version Correctness(3/3)
Uses authorizationParams to pass audience and scope
authorizationParams contains audience 'https://api.barkbook.com'
Does the solution use current express-openid-connect patterns? Specifically: does it use issuerBaseURL (not AUTH0_DOMAIN or domain directly), configure audience via authorizationParams (not as a top-level config key), and use response_type: "code" for the authorization code flow?
Holistic(1/1)
Does the solution correctly integrate Auth0 into an Express web app using express-openid-connect? It should configure the auth() middleware, protect the /profile route with requiresAuth(), display the logged-in user profile, and use the access token to call an external API with audience https://api.barkbook.com.
6
GPT-5.6 Luna
React Native
85%11/13
100%+15%
21/21$0.27
1m 16s
With Auth0 Tools·100%·Tool Calls 18
Score Breakdown
Setup Friction
Did the agent get stuck or need help?
12/12 pts
Setup Speed
How fast did the agent complete the task?
12/12 pts
Efficiency
How many tool calls were wasted versus useful work done?
12/12 pts
Error Recovery
When something broke, did the agent fix it?
7/7 pts
Docs Quality
Did the agent fetch real Auth0 docs and use them to write correct code?
7/7 pts
Correctness
Does the generated code actually work?
25/25 pts
Hallucination
Did the agent invent fake packages or methods?
15/15 pts
Security
Did the agent introduce auth vulnerabilities?
10/10 pts
Total weighted score
100/100 ptsA
Grader Results (21/21 passed)
Build Passing
We compile the code for real, not just pattern-match it.
L1 · Positive Presence(5/5)
Uses the react-native-auth0 SDK
Wraps app with Auth0Provider
Uses the useAuth0 hook
Implements login via authorize()
Implements logout via clearSession()
L2 · Hallucination Detection(5/5)
No web React SDK (correct package is react-native-auth0)
No browser SPA SDK in a native React Native app
Does not use Expo AuthSession in a bare React Native app
Does not fall back to the third-party react-native-app-auth library
Does not register the Expo config plugin in a bare React Native app
L3 · Security(2/2)
No hardcoded client ID in source files (ok in config)
Does not store tokens in insecure AsyncStorage
L4 · Structural(6/6)
Auth0Provider configured with a domain prop
android/app/build.gradle sets the auth0Domain manifestPlaceholder to the real tenant domain
android/app/build.gradle sets the auth0Scheme manifestPlaceholder to <applicationId>.auth0
iOS Info.plist registers the bundle-identifier callback URL scheme
Does the code handle the loading state (isLoading from useAuth0) before rendering auth-dependent UI? A correct implementation should not render login/logout UI while isLoading is true.
Are BOTH native platforms configured for the Auth0 callback in this bare React Native app? Android needs auth0Domain and auth0Scheme manifestPlaceholders in android/app/build.gradle (the RedirectActivity is merged in by the SDK manifest, so declaring it manually is also acceptable), and iOS needs a CFBundleURLTypes entry in ios/scaffold/Info.plist. Answer no if only one platform was configured.
L5 · Version Correctness(1/1)
Does the code use the current react-native-auth0 v5 patterns? Specifically: the Auth0Provider + useAuth0 hook API rather than the legacy imperative `new Auth0({domain, clientId})` client class, and `user` from the hook rather than a manual getCredentials()/userInfo() call to read the profile.
Holistic(1/1)
Does the solution correctly integrate Auth0 into a bare (non-Expo) React Native app using the react-native-auth0 SDK: Auth0Provider wrapping the app with domain and clientId, the useAuth0 hook, authorize() for login and clearSession() for logout, native callback configuration for both Android (manifestPlaceholders) and iOS (CFBundleURLTypes), and the user profile displayed only after isLoading is false?
7
Gemini 3.1 Pro
React
92%12/13
100%+8%
20/20$0.28
50s
With Auth0 Tools·100%·Tool Calls 8
Score Breakdown
Setup Friction
Did the agent get stuck or need help?
12/12 pts
Setup Speed
How fast did the agent complete the task?
12/12 pts
Efficiency
How many tool calls were wasted versus useful work done?
12/12 pts
Error Recovery
When something broke, did the agent fix it?
7/7 pts
Docs Quality
Did the agent fetch real Auth0 docs and use them to write correct code?
7/7 pts
Correctness
Does the generated code actually work?
25/25 pts
Hallucination
Did the agent invent fake packages or methods?
15/15 pts
Security
Did the agent introduce auth vulnerabilities?
10/10 pts
Total weighted score
100/100 ptsA
Grader Results (20/20 passed)
Build Passing
We compile the code for real, not just pattern-match it.
L1 · Positive Presence(7/7)
Uses @auth0/auth0-react SDK
Wraps app with Auth0Provider
Uses useAuth0 hook
Implements loginWithRedirect
Implements logout
Checks isAuthenticated for conditional rendering
Displays user profile name
L2 · Hallucination Detection(3/3)
No hallucinated @auth0/react package (must be @auth0/auth0-react)
Does not use server SDK in SPA app
No client_secret in SPA (public client, no secrets)
L3 · Security(2/2)
No tokens stored in localStorage
No tokens stored in sessionStorage
L4 · Structural(3/3)
Auth0Provider configured with domain prop
Uses getAccessTokenSilently to retrieve access token
Does the code handle the loading state (isLoading) before checking isAuthenticated? A correct implementation should not render auth-dependent UI while isLoading is true.
L5 · Version Correctness(3/3)
Uses authorizationParams (not audience directly on provider)
authorizationParams contains audience 'https://api.barkbook.com'
Does the code use the current @auth0/auth0-react SDK patterns? Specifically: does it use isLoading (not the deprecated "loading" property), and pass audience/scope via authorizationParams object (not as direct props)?
Holistic(1/1)
Does the solution correctly integrate Auth0 into a React SPA with Auth0Provider, useAuth0 hook, login, logout, user profile display, and getAccessTokenSilently to make authenticated API calls?
8
Gemini 3.1 Pro
SPA JS
86%12/14
100%+14%
21/21$0.28
41s
With Auth0 Tools·100%·Tool Calls 8
Score Breakdown
Setup Friction
Did the agent get stuck or need help?
12/12 pts
Setup Speed
How fast did the agent complete the task?
12/12 pts
Efficiency
How many tool calls were wasted versus useful work done?
12/12 pts
Error Recovery
When something broke, did the agent fix it?
7/7 pts
Docs Quality
Did the agent fetch real Auth0 docs and use them to write correct code?
7/7 pts
Correctness
Does the generated code actually work?
25/25 pts
Hallucination
Did the agent invent fake packages or methods?
15/15 pts
Security
Did the agent introduce auth vulnerabilities?
10/10 pts
Total weighted score
100/100 ptsA
Grader Results (21/21 passed)
Build Passing
We compile the code for real, not just pattern-match it.
L1 · Positive Presence(7/7)
Uses @auth0/auth0-spa-js SDK
Initializes Auth0 with createAuth0Client
Implements loginWithRedirect
Handles redirect callback on page load
Implements logout
Checks isAuthenticated for conditional rendering
Uses getTokenSilently to retrieve access token
L2 · Hallucination Detection(4/4)
Does not use React SDK in vanilla JS app
Does not use Vue SDK in vanilla JS app
Does not use Next.js SDK in vanilla JS app
No client_secret in SPA (public client)
L3 · Security(2/2)
No tokens manually stored in localStorage
No tokens manually stored in sessionStorage
L4 · Structural(3/3)
Auth0Client configured with domain
Authenticated API request uses Bearer token in Authorization header
Does the code check isAuthenticated to show/hide UI elements and only render user profile information when the user is authenticated?
L5 · Version Correctness(3/3)
Uses authorizationParams (not deprecated top-level audience/redirect_uri)
authorizationParams contains audience 'https://api.playground.com'
No deprecated promise-chain pattern for getTokenSilently
Holistic(1/1)
Does the solution correctly integrate Auth0 into a vanilla JavaScript SPA using @auth0/auth0-spa-js with createAuth0Client, loginWithRedirect, handleRedirectCallback, logout, user profile display, and getTokenSilently to make authenticated API calls?
9
GPT-5.6 Luna
Expo
73%8/11
100%+27%
17/17$0.32
2m 24s
With Auth0 Tools·100%·Tool Calls 14
Score Breakdown
Setup Friction
Did the agent get stuck or need help?
12/12 pts
Setup Speed
How fast did the agent complete the task?
12/12 pts
Efficiency
How many tool calls were wasted versus useful work done?
12/12 pts
Error Recovery
When something broke, did the agent fix it?
7/7 pts
Docs Quality
Did the agent fetch real Auth0 docs and use them to write correct code?
7/7 pts
Correctness
Does the generated code actually work?
25/25 pts
Hallucination
Did the agent invent fake packages or methods?
15/15 pts
Security
Did the agent introduce auth vulnerabilities?
10/10 pts
Total weighted score
100/100 ptsA
Grader Results (17/17 passed)
Build Passing
We compile the code for real, not just pattern-match it.
L1 · Positive Presence(6/6)
Uses the react-native-auth0 SDK
Wraps app with Auth0Provider
Uses the useAuth0 hook
Implements login via authorize()
Implements logout via clearSession()
Configures a customScheme for the callback URL
L2 · Hallucination Detection(3/3)
No web React SDK (correct package is react-native-auth0)
No browser SPA SDK in a native Expo app
Does not fall back to expo-auth-session instead of the Auth0 SDK
L3 · Security(1/1)
No hardcoded client ID in source files (ok in app.json)
L4 · Structural(4/4)
Registers the react-native-auth0 Expo config plugin with a customScheme in app.json
Auth0Provider configured with a domain prop
Does the code handle the loading state (isLoading from useAuth0) before rendering auth-dependent UI? A correct implementation should not render login/logout UI while isLoading is true.
Does the code wire login and logout correctly for react-native-auth0 on Expo? Specifically: authorize() for login and clearSession() for logout, each passing { customScheme: ... } as the second argument, matching the scheme configured in the app.json plugin.
L5 · Version Correctness(1/1)
Does the code use the current react-native-auth0 v5 Expo patterns? Specifically: the Auth0Provider + useAuth0 hook API (not the legacy imperative Auth0 client class), and the react-native-auth0 Expo config plugin in app.json (not manual native iOS/Android edits)?
Holistic(1/1)
Does the solution correctly integrate Auth0 into an Expo app with the react-native-auth0 SDK: Auth0Provider wrapping the app, the useAuth0 hook, authorize()/clearSession() login and logout with customScheme, the Expo config plugin registered in app.json, and user profile display guarded by isLoading?
10
GPT-5.6 Luna
Next.js
86%12/14
100%+14%
31/31$0.33
1m 46s
With Auth0 Tools·100%·Tool Calls 20
Score Breakdown
Setup Friction
Did the agent get stuck or need help?
12/12 pts
Setup Speed
How fast did the agent complete the task?
12/12 pts
Efficiency
How many tool calls were wasted versus useful work done?
12/12 pts
Error Recovery
When something broke, did the agent fix it?
7/7 pts
Docs Quality
Did the agent fetch real Auth0 docs and use them to write correct code?
7/7 pts
Correctness
Does the generated code actually work?
25/25 pts
Hallucination
Did the agent invent fake packages or methods?
15/15 pts
Security
Did the agent introduce auth vulnerabilities?
10/10 pts
Total weighted score
100/100 ptsA
Grader Results (31/31 passed)
Build Passing
We compile the code for real, not just pattern-match it.
L1 · Positive Presence(8/8)
Uses @auth0/nextjs-auth0 SDK
Uses v4 server import path
Instantiates Auth0Client
Configures AUTH0_CLIENT_ID
Configures AUTH0_CLIENT_SECRET
Configures AUTH0_SECRET
Configures AUTH0_DOMAIN
Uses getSession for session retrieval
L2 · Hallucination Detection(3/3)
No hallucinated @auth0/nextjs-sdk package
No hallucinated next-auth package
Does not use SPA SDK in server app
L3 · Security(3/3)
No hardcoded client secret in source files (ok in .env)
No hardcoded client ID in source files (ok in .env)
No hardcoded Auth0 domain in source files (ok in .env)
L4 · Structural(8/8)
Wrote Auth0 credentials to .env file
Middleware function is exported from middleware or proxy file
Uses auth0.middleware in middleware file
Dashboard page file exists
Uses /auth/login for login redirect
Uses auth0.getAccessToken() for server-side token retrieval
Requests an access token with audience https://api.playground.com
Does the code set up a working authentication flow with login, logout, and a callback route? Is there a protected /dashboard page that checks the user session and redirects unauthenticated users to log in? Note: Next.js 16 supports both middleware.ts (export function middleware) and proxy.ts (export function proxy) — both are valid.
L5 · Version Correctness(8/8)
Does not use v3 env var AUTH0_BASE_URL (v4 uses APP_BASE_URL)
Does not use v3 env var AUTH0_ISSUER_BASE_URL (removed in v4)
Does not use v3 handleAuth (v4 uses middleware)
Does not use v3 route prefix /api/auth/ (v4 uses /auth/)
Does not use v3 withPageAuthRequired (v4 uses proxy/middleware)
Does not use v3 withApiAuthRequired (removed in v4)
Does the solution correctly integrate Auth0 into a Next.js App Router app using Auth0Client from @auth0/nextjs-auth0/server, proxy or middleware-based auth routing, and getSession for server-side session access? It should NOT use the deprecated v3 patterns like handleAuth, withPageAuthRequired, or /api/auth/ routes. Note: Next.js 16 replaces middleware.ts with proxy.ts (export function proxy) — both are valid. There should also be a protected /dashboard page that checks the session and redirects unauthenticated users to log in.
Does the source code rely on the v4 SDK configuration convention — instantiating Auth0Client so it reads the standard AUTH0_DOMAIN / AUTH0_CLIENT_ID / AUTH0_CLIENT_SECRET / AUTH0_SECRET environment variables (or passing those as options) — and avoid referencing the deprecated v3 names AUTH0_BASE_URL or AUTH0_ISSUER_BASE_URL anywhere in source? Judge only from the source code; do not assume the contents of any .env file.
* With Auth0 MCP + Skills enabledLast updated on August 2026
How we built this.
Deterministic by design. Real tasks, automated grading, zero black boxes.
1
Real integration tasks
Identical Auth0 SDK prompts given to each model. No synthetic benchmarks, so you can feel good about your implementation.
2
Automated grading
Pattern matching, security checks, and correctness validators score each response so you don't have to worry about wasting precious tokens.
3
Tool comparison
Each model tested with and without MCP + Skills to measure improvement.
4
Compile verification
A deterministic build check confirms the final code actually compiles. No partial credit for code that only looks right.
Start building with confidence
These tools are how we achieved the benchmark results above. Enable them in your AI agent to integrate Auth0 reliably.
MCP Server
Docs access for agents
Gives agents access to Auth0 documentation, API references, and code examples.
https://auth0.com/docs/mcpSkills
Best practices for agents
Teaches agents Auth0 integration patterns so they follow security best practices.
npx skills add auth0/agent-skills --all