Changelog

added

Auth0 Teams Tenant Member Management and SSO enforcement for Private Cloud (Beta)

Copied to clipboard

We are excited to announce a major update for our Private Cloud customers, extending the powerful management and security capabilities of Auth0 Teams to your private cloud environments. This release introduces the Beta versions of Tenant Member Management and SSO Enforcement, closing the feature gap with our Public Cloud offering.

✨ New Features

Tenant Member Management (Beta) for Private Cloud:

You can now centrally manage tenant membership and roles for your team members directly from the Auth0 Teams dashboard. This feature simplifies user administration by allowing you to:

View and manage all tenant access from a single interface.
Efficiently onboard and off-board users across multiple tenants.
Perform bulk operations to grant or revoke access.

SSO Enforcement (Beta) for Private Cloud:

Strengthen your organization's security posture by requiring all team and tenant members to authenticate using one of your configured Enterprise Identity Provider (IdP) connections. This ensures that access to Auth0 resources is governed by your corporate identity solution.

Activity Log Integration for Tenant Management:

All operations related to Tenant Member Management (e.g., adding, updating or deleting) are now recorded in the Auth0 Teams Activity Log, providing a complete audit trail for compliance and security monitoring. (Note Now available to all Auth0 Teams customers.)

Session Revocation for Private Cloud:

Administrators now have the ability to revoke active user sessions for Private Cloud tenants, providing an immediate way to off-board users or respond to security events.

📈 Improvements

Streamlined Private Cloud User Invites:

Team members can now be invited directly to a Private Cloud tenant through the Teams interface. This removes the previous requirement of first adding the user to the configuration tenant, simplifying and accelerating the onboarding workflow.

Increased Bulk Tenant:

The limit for bulk tenant assignment has been doubled, allowing you to grant or modify access to 10 tenants at once, up from the previous limit of 5.

Beta Program Information

Tenant Member Management and SSO Enforcement features for Private Cloud are being released in Beta.

Continue with Auth0 Teams

August 19, 2025

added

Sender constrained tokens using DPoP is now available in Early Access.

Copied to clipboard

We are delighted to announce that support for sender constraining tokens using Demonstrating Proof of Possession (DPoP) is now available in Early Access.

Demonstrating Proof of Possession (DPoP) as defined in RFC9449, is an application level mechanism for binding tokens issued by Auth0 to the client application that requested that token. This is implemented using asymmetric key cryptography and with keys that are generated and managed by the client application - no public key infrastructure (PKI) is required.

Sender constraining tokens using DPoP can be used to mitigate the risk of tokens being used by unauthorised parties if they are intercepted in transit or exfiltrated from applications. This helps to:

enhance security by mitigating against token theft and misuse by unauthorised parties
improve user experience by being able to use longer-lived access tokens without significantly increasing security risk i.e. not requiring frequent user authentication

Auth0 will be rolling out SDK support for DPoP for native applications, single page applications, backend server APIs, and Auth0 management:

SDKs for iOS Swift and Android Kotlin are available now.
SDKs for Javascript, React, Python and more are coming soon.

To evaluate DPoP for securing your tokens, contact your Auth0 representative. For more details, check out our product documentation.

August 18, 2025

added

JA3 and JA4 TLS Fingerprints Now Available in Tenant Logs and Actions

Copied to clipboard

We have expanded our security telemetry to include JA3 and JA4 TLS fingerprints. TLS fingerprinting is a proven technique for identifying client software based on the TLS handshake.

JA3 is a fingerprinting method that identifies TLS clients based on their connection parameters.
JA4 refines TLS fingerprinting to make client identification more stable and resilient to small variations.

These signals help customers detect and respond to malicious traffic faster, identify suspicious client behavior, and correlate related activity across changing IPs and sessions.

What’s New

Tenant Logs
JA3 and JA4 fingerprints are now logged in applicable authentication and security events such as Success Login, Failed Login, and Anomaly Detection.

Actions Integration
JA3 and JA4 fingerprints are now available in Actions for real-time, custom security responses, but only in the following triggers:

pre-user-registration
post-user-registration
post-login

Tenant Access Control List (ACL) Support
You can also use the Tenant Access Control List to block specific TLS fingerprints directly by adding a rule. Alternatively, you can combine JA3 and JA4 signals with Actions to apply custom business logic, such as requiring MFA or conditionally denying access.

Why It Matters

JA3 and JA4 provide a stable, high-entropy signal that is hard to spoof, helping you correlate malicious activity even across changing IPs and sessions.

Availability

Available for all Enterprise customers. Start using these signals today.

August 12, 2025

upcoming deprecation

Upcoming Removal of Legacy Management API Swagger Endpoint on September 11, 2025

Copied to clipboard

Starting on September 11, 2025, we will be deprecating and removing the legacy, undocumented Management API Swagger Specification.

What is changing?

On September 11 2025, the endpoint path /api/v2/api-docs/ will be removed. After this date, any requests made to this path will result in a 404 Not Found error.

Why are we making this change?

Please note that this endpoint and the Swagger specification it provides were never officially documented or intended for public use. The current Swagger specification available at this endpoint is unmaintained, undocumented, and does not reflect the full capabilities of our Management API. As part of our commitment to providing robust and reliable tools, we are removing this legacy specification to prevent confusion and potential issues.

We strongly encourage all users to migrate to our officially supported OpenAPI 3.1 Specification for the Management API, which is currently in Beta. This new specification is actively maintained and provides a more accurate and comprehensive development experience.

What do you need to do?

If any of your processes are calling the /api/v2/api-docs/ endpoints, take the following steps before September 11, 2025 to ensure your applications and services continue to function without interruption:

Identify any systems, scripts, or CI/CD processes that access https://[your-tenant.yourdomain.com]/api/v2/api-docs/.
Update these systems to use our new, officially supported OpenAPI 3.1 specification. It can be accessed here: https://auth0.com/docs/api/management/v2
Ensure your applications are resilient to a 404 Not Found response from the old endpoint path.

If the above does not address your needs or you have additional questions, contact us using the Auth0 by Okta Support Center or Auth0 by Okta Community.

August 12, 2025

Version 202532

added

Actions - Transaction Metadata (EA)

Copied to clipboard

We are excited to announce that Actions Transaction Metadata is now available in Early Access.

This feature allows developers to set, share, and access, custom data between Actions run in the same post-login execution.

Early Access functionality includes:

Accessing Transaction Metadata: A new event.transaction.metadata object within post-login Actions that contains the custom key/value pairs, which can be accessed through key.
Setting Transaction Metadata: A new api.transaction.setMetadata function within post-login Actions that serves as interface to set the custom key/value pairs.
Immediate Access: Values are available immediately after being set in the calling Action and subsequent Actions.
Values Types: Values can be boolean, number, string, or string serialization of object and array.
Docs:
- New docs section at: https://auth0.com/docs/customize/actions/transaction-metadata
- Updated guidelines at: https://auth0.com/docs/customize/actions/action-coding-guidelines#actions-basics

August 11, 2025

updated

Multi-Resource Refresh Tokens (MRRT) is now in Early Access for all customers

Copied to clipboard

We’re excited to announce that Multi-Resource Refresh Tokens (MRRT) is now in Early Access for all customers.

This feature allows applications to use a single refresh token to request access tokens for multiple resource servers (APIs), each with its own audience and scopes. MRRT simplifies token lifecycle management, enhances developer experience, and improves session continuity across distributed API architectures.

What’s New?

Support for defining audience-specific refresh token policies per client
Use one refresh token to request tokens for multiple APIs — no re-authentication required
Compatible with rotating and expiring refresh tokens
First-party applications only
Management API support available today
iOS and Android SDKs support
Auth0 Deploy CLI and Terraform Support

Learn more

August 11, 2025

Read our documentation Read the Quickstart

updated

Native to Web SSO – Now in Early Access for all Enterprise customers

Copied to clipboard

We’re excited to announce the Early Access of Native to Web SSO is now available for all enterprise customers.

With this release, developers can:

Implement SSO from native iOS or Android apps to browser-based web apps.
Securely issue and consume Session Transfer Tokens.
Leverage device binding enforcement (IP or ASN) for additional security.
Access Session Transfer Token support in Auth0 Actions.
Use the feature across the Auth0 CLI SDK, Terraform Provider, Deploy CLI, and native mobile SDKs (iOS and Android).
Integrate with WS-FED and SAML clients, and invoke Post Login Actions during token consumption.

📘 To get started:

August 11, 2025

added

Flexibility for Passwordless on Universal Login with Connection Switching

Copied to clipboard

We're introducing a new feature that gives your end-users the flexibility to choose how they log in. Using Universal Login Custom Prompts, you can now add custom buttons to your login pages. This empowers your users to easily switch between a traditional database (password-based) connection and a passwordless (OTP-based) connection.

This update allows you to create a seamless experience where users can select their preferred authentication method directly from the login challenge screen.

ConnectionSwitcher

For full details on this new feature, check out our documentation. To learn more about how to use custom prompts, see the custom prompts documentation.

August 7, 2025

Version 202530

updated

Brute‑Force Protection Notifications: Email Notifications Expanded to All Identifier Types

Copied to clipboard

What changed: When the user's email is available, Auth0 will now send an email notification for brute‑force blocks in all identifier scenarios (e.g., phone, username), supplementing existing delivery rules.

Why it matters: Ensures users receive blocking notifications consistently even when logging in via phone or username, improving visibility and response.

To learn more about Brute Force Protection read on online documentation here

August 7, 2025

Read our documentation Read the Quickstart

updated

Enhanced Bot Detection Accuracy and Reduced Friction

Copied to clipboard

We’ve improved our bot detection model to strike a better balance between security and user experience, with specific gains for tenants whose users frequently access resources via VPN.

Highlights of this update include:

Reduced false positives for VPN users: The model now more effectively distinguishes between legitimate users and bots, even when traffic originates from shared IPs or anonymized networks.
Improved user experience without compromising security: These updates are designed to reduce unnecessary friction for valid users while maintaining strong defenses against automated threats.

This enhanced security capability is now available to all Enterprise customers with the Attack Protection add-on. The rollout is currently underway and will be completed over the coming weeks in alignment with individual customer release schedules.

For activation details or to learn more about protecting your applications, please refer to our documentation or contact your account team. We're committed to helping you stay secure in an evolving threat landscape.

July 31, 2025

added

PII Obfuscation/Masking in Log Streaming

Copied to clipboard

Introducing a new capability for log streaming: PII Masking.

This feature allows customers to obfuscate (hash or mask) sensitive personal identifiable information (e.g., email address, phone number, username, etc.) within their log streams. This enhancement improves security and compliance for customers who stream their logs to data lakes or third-party tools.

Key Features:

Customizable PII Masking: Customers can select specific PII data to be masked in their log streams.
Enhanced Security and Compliance: This capability helps customers meet stricter compliance requirements by providing greater control over sensitive data in their logs.
Broad Applicability: PII masking will be available for both new and existing log streams.

This update aligns with Auth0's commitment to improving customer data security and providing more customization in log stream outputs

For more information - Log Streams

July 22, 2025

Version 202528

updated

Cascade Token and Session Revocation for Native to Web SSO is Now Available

Copied to clipboard

We’ve added support for Cascade Revocation in Native to Web SSO.

With this new capability, revoking the original refresh token used in a Native to Web flow will now automatically revoke all dependent web sessions and their issued refresh tokens.

This helps prevent stale or orphaned sessions and ensures that once the root token is no longer valid, all downstream access is properly revoked.

What’s new:

enable_cascade_revocation
When enabled, revoking a native app’s refresh token also revokes all web sessions and refresh tokens created via session_transfer_token.
enable_online_refresh_tokens
When enabled, refresh tokens issued during a Native to Web SSO flow are tied to the lifetime of their associated session (i.e., online tokens).

Default behavior:

Both of these settings are enabled by default, even when not explicitly configured.

This means:

All clients using Native to Web SSO today already benefit from cascade revocation.
Web-issued refresh tokens will automatically expire when their sessions expire.

You can manage or override these settings using the Auth0 Management API.

Why it matters:

This update provides stronger guarantees around token lifecycle and session integrity across platforms:

Prevents misuse of refresh tokens after logout or revocation
Reduces risk from long-lived sessions in embedded web views
Helps developers maintain a tighter, more secure cross-platform SSO experience

Learn more in our Native to Web SSO documentation

July 22, 2025

added

New Private Cloud Region in Mexico

Copied to clipboard

Auth0 is delighted to introduce Mexico as the latest AWS region for Private Cloud deployments.

This new region establishes our first Private Cloud presence in Mexico, directly addressing the needs of one of Latin America's largest and most dynamic digital economies. The addition of the Mexico region provides lower latency for customers throughout the country and helps meet local data residency and compliance requirements.

We remain committed to expanding our global footprint to serve our customers wherever they are in the world.

July 21, 2025

Version 202526

added

Passkey Support for Custom Database Connections with Import Mode Off - Early Access

Copied to clipboard

We are excited to introduce expanded passkey support for custom database connections! Now available without enabling import mode.

What’s New:

You can now enable passkey-based authentication for custom database connections without importing or trickle-migrating users into Auth0 (i.e., with import mode turned off).
End users can easily enroll in passkeys after their first successful login, requiring no prior passkey credentials in your external identity store.
Passkey credentials are securely stored in Auth0, while your external identity store continues to handle all other authentication logic.

This enhancement unlocks frictionless, passkey-based login experiences for enterprises that manage user credentials outside of Auth0 - without requiring user migration or changes to existing identity architecture.

To enable the Limited Early Access release in your Auth0 tenant, contact your Technical Account Manager to request access.

July 15, 2025

Version 202528

added

Multiple Custom Domains on an Auth0 tenant - Early Access

Copied to clipboard

We're thrilled to announce Multiple Custom Domains (MCD) support on a single Auth0 tenant bringing you simpler, more flexible branding and white-labeling. This powerful capability allows you to:

Deliver tailored, branded experiences for your users, including customized login URLs and emails.
Enhance security through consistent use of custom domains across end-user interactions.
Scale B2B SaaS usage rapidly through MCD on a single tenant.

This feature is available to our Enterprise customers.

With Early Access, you'll gain robust capabilities across our Management APIs, Manage Dashboard, and our developer tools (SDKs, Terraform provider, and CLI) for MCD management. You'll find new ways to customize Email templates based on custom domain information. The solution scales effortlessly to meet rapid growth and demanding needs.

Please refer to Auth0 docs for details - Multiple Custom Domains.

Interested in participating in the Early Access program? Please send a request through the Auth0 Support Center.

July 15, 2025

Version 202528

added

My Account API Explorer Now Available

Copied to clipboard

My Account API Explorer is now available! Navigate to: https://auth0.com/docs/api/myaccount to try it out and help navigate & build with the new My Account API (which is in Limited Early Availability).

Using My Account, customers can build self-service management experiences at scale, powered directly from their applications.

To learn more and request access to the My Account API feature, contact your Auth0 account manager.

July 10, 2025

Version 202526

added

Early Access Launch of Right-to-Left Language Support for Universal Login!

Copied to clipboard

Today, we're excited to announce the Early Access release of Right-to-Left (RTL) Language Support for Universal Login—with support for the Guardian Mobile Apps (iOS & Android) coming later this month.

RTL EA Changelog Banner

This update expands Auth0’s global accessibility by enabling seamless support for RTL languages, including Arabic, Persian (Farsi), Hebrew, and Urdu—helping you deliver more inclusive, intuitive login experiences in regions where these languages are the norm. Supporting RTL languages means you can reach new markets, localize experiences with greater precision, and improve accessibility for the nearly 1 billion people who rely on RTL scripts.

Early Access includes managing RTL languages in the Admin Dashboard and API as well as previewing and editing prompt translations. Guardian support (coming later this month) will bring RTL layout rendering to identity verification and MFA workflows.

This release marks a major step forward for Universal Login. As Auth0 continues to pursue our vision of a world where anyone can safely use any technology, powered by their Identity, we are proud to partner with our customers around the world in delivering secure, inclusive, and accessible authentication experiences.

Contact your Auth0 account manager or Auth0 Support to enable Early Access on your tenant.

July 10, 2025

Version 202527

updated

Advanced Customizations for Universal Login (Early Access) - Filtering, Page Templates, Dashboards and Consent screens.

Copied to clipboard

We are excited to announce the next Early Access release of Advanced Customizations for Universal Login! This release adds a couple of highly requested enhancements as well as support for building custom versions of Universal Login’s Consent screens using the new ACUL SDK.

Advanced Customizations for Universal Login enables you to build custom, client-rendered interfaces for Universal Login screens, allowing you to control every pixel of your Universal Login experience.

This release includes:

A new Filters screen configuration object that allows you to set constraints around when the custom UI should be used based on the client and organization information.
A new screen configuration parameter that allows you to use your custom page template with ACUL
Support for building custom versions of the Consent screens
- Consent
- Customized Consent (used with HRI)
A shiny new Dashboard UI for configuring ACUL screens

ACUL Dashboard

DX Updates

The latest versions of the ACUL SDK and Auth0’s CDT tooling include support for the new Filters and page template configurations as well as configuring the consent screens.

We are very close to supporting for everything that Universal Login currently supports out of the box. Checkout our online documentation to learn more about ACUL and stay tuned to the Auth0 Changelog for updates and announcements!

June 30, 2025

deprecated

Multiple Actions for Custom Phone and Email Provider Triggers

Copied to clipboard

We are deprecating the ability to create more than one action per tenant for actions supporting custom phone or email providers and introducing a maximum limit of one action in the respective triggers:

custom-phone-provider
custom-email-provider

This limitation applies to the Management API create an action endpoint (POST - /api/v2/actions/actions) and can impact integrations performing direct API calls and tools like the Auth0 Deploy CLI, the Auth0 Terraform Provider, or the Auth0 CLI.

We have provided additional information and timelines for enforcing this change across tenants through a dashboard and support center notification.

June 27, 2025

Version 202526

updated

Improved bot detection with reduced friction for legitimate users

Copied to clipboard

We’ve upgraded our bot detection model to improve accuracy and reduce friction for legitimate users, particularly on mobile devices and evolving browser platforms.

Highlights of this update include:

Improved interpretation of user-agent signals: The model now better handles previously unseen browser and OS versions, improving accuracy in distinguishing between legitimate users and malicious traffic.
Reduced friction for mobile users: We've updated the model to more accurately recognize native mobile app traffic, resulting in fewer unnecessary CAPTCHA challenges for real users.
Improved user experience without compromising security: These changes are designed to reduce false positives while maintaining robust bot detection coverage.

This enhanced security feature is available now to all Enterprise customers with the Attack Protection add-on. The rollout is currently underway and will be completed in the coming weeks, aligned with individual customer release schedules.

For activation details or to learn more about safeguarding your systems, please refer to our documentation or reach out to your account team. We are committed to supporting you in protecting your digital presence against evolving threats.

June 24, 2025

updated

Auth0 Guide Early Access Enhancement: Security Center Data Assistance

Copied to clipboard

We’re excited to announce that the Okta AI-powered chatbot (Guide) Early Access offering has been enhanced with an additional data source - Security Center Metric Data. This additional capability is available only to Enterprise customers and can answer questions such as “do I have more sign up attacks this week compared to last week?”.

Availability

Guide is available to tenants in the US Public Cloud region. Within that group, Security Center Metric Data is available only for Enterprise customers. Guide will be rolled out to all Public Cloud regions in the near future.

June 23, 2025

added

Private Key JWT Client Authentication for OIDC and Okta Enterprise Connections - Now in Early Access

Copied to clipboard

We’re excited to announce the Early Access release of Private Key JWT Client Authentication for OIDC and Okta Enterprise Connections! Auth0 customers can now leverage a more secure and standards-based method of client authentication for their enterprise identity providers.

Until now, federated connections relied on long-lived client secrets for back-channel authentication. This feature enables signing with asymmetric keys on Okta and OIDC connections, reducing the risk of credential leakage and enabling secure key management and rotation.

While Auth0 already supports Private Key JWT when acting as the Identity Provider, this release extends that security posture to outbound enterprise connections, allowing Auth0 to securely authenticate to upstream IdPs using signed JWTs instead of shared secrets.

For complete setup instructions and more, refer to our documentation.

By using Private Key JWT Client Authentication on your OIDC and Okta Enterprise Connections, you agree to the applicable Free Trial terms in Okta’s Master Subscription Agreement and Okta’s Privacy Policy during use of the Early Access feature. The Free Trial terms can be found within the Master Subscription Agreement.

June 23, 2025

Version 202524

added

Multi-Resource Refresh Tokens (MRRT) Now Available in Early Access

Copied to clipboard

We’re excited to announce that Multi-Resource Refresh Tokens (MRRT) is now in Early Access for Enterprise customers.

What’s New?

Support for defining audience-specific refresh token policies per client
Use one refresh token to request tokens for multiple APIs — no re-authentication required
Compatible with rotating and expiring refresh tokens
First-party applications only
Management API support available today
iOS and Android SDKs support
Auth0 Deploy CLI and Terraform Support

Learn more

June 18, 2025

deprecated

Removal of Access to Specific Event Request Properties in Actions

Copied to clipboard

What is changing?

The service will restrict access to additional property names within the event.request.query and event.request.body objects when executing actions for the post-login and credentials-exchange triggers. Tenants identified as using actions that may reference request properties planned for restriction will maintain access until September 16, 2025.

The service will restrict the following property names in the request-related objects:

auth_session
authn_response
client_secret
client_assertion
refresh_token

Previously, the implementation of an action could access the properties listed above in event.request.query and event.request.body to retrieve the value included in the corresponding network request. Once the planned restrictions become effective for a given tenant, all properties above will be undefined independently of the network request content.

The rollout of these additional restrictions is in progress for tenants where historical data did not show any actions using these property names. Tenants identified as potentially impacted by these restrictions will maintain existing behavior until the previously mentioned date.

Why are we making this change?

By restricting access to these properties, we aim to prevent potential mishandling of sensitive data within the custom code implemented for post-login and credentials-exchange actions. For example, we reduce the risk of unintentionally logging sensitive data in log operations that may output the whole request object.

How are you affected?

If any of your tenant's current actions no longer include any reference to one of the restricted property names or that despite having references to one of the names, it is not in the context of property access to event.request.query and event.request.body objects, then these changes should not impact your tenant.

If there are actual references to restricted request properties, the restriction of these properties may impact the action's logic. After the changes become effective, accessing those request properties will always return undefined. Without revising the actions' implementation, the respective authentication flows risk partial degradation or complete failure.

What action do you need to take?

If your tenants currently have actions referencing one of the restricted properties of the event.request.query and event.request.body objects in their implementation. For applicable actions, you must update their implementation to stop relying on the restricted properties of the request objects.

The exact implementation changes you may need to perform will depend on your overall implementation of the actions and each restricted request property's usage scenario.

For example, for scenarios related to reusing secret information previously available from the request, the support for secret management (event.secrets) as part of actions may provide a potential alternative. If the requests include restricted property names, but the information sent within them is not considered sensitive, you may consider using a different parameter name in the request, or ideally, consider using custom parameters as part of pushed authorization requests to avoid disclosing/interception of the data by end-users in browser-based flows. If the data is static per client or connection, consider storing it as part of client or connection metadata.

June 18, 2025

deprecated

Real-time Webtasks Logs Extension Deprecation

Copied to clipboard

What is changing?

We are deprecating the Real-time Webtask Logs extension with a planned end-of-life after (EOL) September 16, 2025.

As a replacement, we have published the Actions Real-time Logs feature integrated within the Auth0 Dashboard. The extension will cease to be available for new installations, but tenants with the extension already installed will maintain access until the planned EOL.

Why are we making this change?

The transition to the dashboard will improve the security posture and maintainability of the functionality, while simplifying future enhancements.

How are you affected?

For active users of the Real-time Webtask Logs extension, its scheduled removal will affect you, as the transition from extension to a direct dashboard capability inherently implies some user experience differences.

What action do you need to take?

You can start using the Actions Real-time Logs feature by navigating to Auth0 Dashboard > Monitoring > Actions Logs.

We recommend that extension users familiarize themselves with the new user interface to avoid disruption once the extension becomes unavailable.

June 18, 2025

added

Canadian French Language Support Added to Auth0 Dashboard and Docs

Copied to clipboard

We’ve added a new language option-Canadian French-to help our users in Canada and beyond build secure identity solutions more easily. If your language preference is set to Canadian French in your browser settings, Auth0 will detect this and automatically serve the Dashboard and Documentation in Canadian French. You can manually override this setting in the Auth0 Dashboard and Docs via the language switcher in the top-right corner.

June 17, 2025

added

Resilience enhancement - Private Cloud Restoration General Availability

Copied to clipboard

Auth0 is excited to announce the General Availability of Private Cloud Restoration resilience enhancement. This capability would come handy in the event of customer data loss or data corruption, and would assist customers in meeting regulatory requirements such as European Union’s Digital Operational Resilience Act (DORA).

This capability allows customers to request full restoration of their production Private Cloud environment from an Auth0 backup in the last 14 days. It also includes the option for one restoration test per year on a non-production Private Cloud environment. Please refer to Operational policies documentation for more.

June 13, 2025

Version 202524

updated

Customize the Brute-Force Protection Unblock Page with Universal Login - Now Available

Copied to clipboard

You can now customize the Brute-Force Protection unblock page using Universal Login. This update allows for a fully branded experience when users are locked out due to repeated failed login attempts.

What’s New?

Branded unblock experience via Universal Login - The brute-force protection unblock page is now part of Universal Login, giving you full control over its appearance and content. This ensures a seamless, branded experience throughout the recovery flow.
Improved compatibility with email security scanners - Account unblock now occurs when the unblock page loads rather than on clicking the unblock link. This helps prevent issues caused by email security scanners that pre-process links.

To enable these new features

Navigate to Settings > Advanced tab In the Migrations section, near the bottom of the page, disable the existing functionality with the toggle shown below

Brute Force Deprecation Toggle

The existing Brute-Force Protection unblock page and behavior will remain available for now. However, it is planned for deprecation within the next 6 months, giving you ample time to transition to the new and improved experience at your convenience.

For more information about our Brute-Force Protection feature, see our online documentation here

June 10, 2025

deprecated

Copied to clipboard

We’re excited to announce the Early Access release of Native to Web SSO — a new capability that enables session sharing between native mobile apps and web apps using a secure, standards-based approach. This helps create a seamless user experience where authentication in one platform (native or web) carries over to the other, without requiring a separate login.

With this release, developers can:

Implement SSO from native iOS or Android apps to browser-based web apps.
Securely issue and consume Session Transfer Tokens.
Leverage device binding enforcement (IP or ASN) for additional security.
Access Session Transfer Token support in Auth0 Actions.
Use the feature across the Auth0 CLI SDK, Terraform Provider, Deploy CLI, and native mobile SDKs (iOS and Android).
Integrate with WS-FED and SAML clients, and invoke Post Login Actions during token consumption.

📘 To get started:

May 29, 2025

Version 202519

added

Fine-Grained Machine-to-Machine Token Quotas now available in Early Access

Copied to clipboard

We’ve excited to announce that Fine-Grained M2M Token Quotas is now in Early Access for Enterprise customers.

This feature allows setting hourly and daily limits on M2M access tokens at the Application and Organization level. When a quota is reached, affected Applications receive 429 responses until the quota resets. Customers can also enable or disable quotas in real time and monitor usage via tenant logs and HTTP headers.

M2M token quota error

This gives customers granular control over token issuance, helping prevent excessive consumption — especially important when APIs are exposed to Third-Party Apps or internal teams outside their direct control. It addresses common issues like missing token caching, which can lead to uncontrolled token usage, unexpected costs and imbalanced usage across Organizations.

To learn more, check out the documentation.

Reach out to you Auth0 contact to request access!

May 29, 2025

Version 202521

updated

Actions - Name Edit

Copied to clipboard

Action name editing is now available within the Auth0 Dashboard, providing developers the ability to rename existing Actions while ensuring unique names are maintained.

To rename an Action:

Navigate to the specific Action Details page in the Auth0 Dashboard.
At the Action Details page, click the edit button located next to the Action's name to make your changes.
Enter the new name.
Apply or cancel the changes.

May 27, 2025

Version 202521

updated

Advanced Customizations for Universal Login (Early Access) - WebAuthn + Biometrics Authentication, and Logout!

Copied to clipboard

We are excited to announce the next Early Access release of Advanced Customizations for Universal Login! This release adds support for building custom versions of Universal Login’s WebAuthn + Biometrics authentication and the matching MFA and Reset Password Challenge screens, as well as Logout and a few other odds and ends, all using the new ACUL SDK.

MFA WebAuthn Change Key Nickname
MFA WebAuthn Enrollment Success
MFA WebAuthn Error
MFA WebAuthn Platform Challenge
MFA WebAuthn Platform Enrollment
MFA WebAuthn Roaming Challenge
MFA WebAuthn Roaming Enrollment
Reset Password MFA WebAuthn Platform Challenge
Reset Password MFA WebAuthn Roaming Challenge
Logout
Logout Aborted
Logout Complete
MFA Recovery Code Challenge New Code
Email Verification Result
Login Email Verification

DX Updates

The latest versions of the ACUL SDK and our CDT tooling all include support for these new screens.

We are well on our way to adding support for everything that Universal Login currently supports out of the box. Checkout our online documentation to learn more about ACUL and stay tuned to the Auth0 Changelog for updates and announcements!

May 21, 2025

Version 202520

added

Client-Initiated Backchannel Authentication (CIBA) flow is now Generally Available

Copied to clipboard

Asynchronous authentication and authorisation using the Client-Initiated Backchannel Authentication (CIBA) flow is now Generally Available for our Enterprise plan customers. The CIBA flow works as an asynchronous, decoupled flow across two different devices:

Consumption device: initiates the authentication request.
Authentication device: handles end-user authentication, implemented as a custom mobile app which embeds the Guardian mobile SDK.

The flow supports the use of Rich Authorization Requests RFC9396 to provide contextual information to authenticating and/or authorizing users. This enables the CIBA flow to support a number of powerful use cases driven by backend client applications, such as:

Customer authentication by headless devices or devices/applications with limited interaction capabilities.
Customer authentication in call-centre scenarios.
Authorising sensitive operations on behalf of yourself or a third-party e.g. a customer service Agent, an autonomous AI Agent.

For more details, see the product documentation.

May 20, 2025

updated

Edit Tenant Member roles from within Auth0 Teams

Copied to clipboard

We're excited to announce a significant enhancement to the Tenant Member Management feature within Auth0 Teams. All tenant member management tasks can now be completed centrally within the Auth0 Teams Dashboard.

Previously, we introduced tenant member management with support for inviting and assigning dashboard users to team tenants, followed by the ability to remove access from tenants directly within the Teams dashboard.

With this release, a team owner gains the comprehensive ability to perform all Create, Read, Update, and Delete (CRUD) tasks on tenant members directly from the Teams Dashboard. This streamlines administrative workflows and provides unparalleled control over user access across your tenants.

Note: The Tenant Member Management feature is required for this functionality. This feature is on by default for all Self-Service customers and most Public Cloud Enterprise customers. It is configurable for some existing Public Cloud Enterprise customers and is coming soon to Private Cloud customers.

Please refer to the following documentation for more information.

Teams Tenant Member Management Edit

May 19, 2025

Version 202520

updated

Event Streams for Auth0 Extensibility – Now in Early Access

Copied to clipboard

Event Streams is now available for all customers who desire to discover completed changes to Auth0 Users and Organizations as they happen. They can do this by:

Creating an Event Stream in the Manage Dashboard or the Management API
Configuring the Event Streams with the desired destination (Webhook or Amazon EventBridge) and selecting the events to receive

See the Auth0 Docs for further instructions.

May 13, 2025

deprecated

Allow Omitting Password on SMTP Email Provider Host-related Changes

Copied to clipboard

Updating specific configuration fields for a tenant's SMTP Email Provider may require simultaneously specifying the password field used for SMTP client authentication.

We have provided additional information and timelines for enforcing this change across tenants through a dashboard and support center notification.

May 7, 2025

added

Customizable notification text for IOS Guardian SDK

Copied to clipboard

Introducing the customizable notification text for IOS Guardian SDK. With this update, apps using the Guardian SDK on iOS can now fully customize the text of their push notifications—giving you greater control over your user experience and messaging.

May 7, 2025

added

Language Selection for End Users on Universal Login

Copied to clipboard

Enable end users to choose a different language if the automatically selected language based on ui_locales or the browser language header is not preferred. By leveraging Auth0 Custom Prompts you can use your own HTML to customize the look and feel for how end-users perform the language selection on Universal Login. Learn more

May 7, 2025

updated

Auth0 CLI Improvements

Copied to clipboard

We're excited to announce the latest release of the Auth0 CLI! This update brings a host of improvements designed to streamline your development workflow, enhance security capabilities, and provide a more intuitive user experience.

Key Highlights:

Improved Universal Login Customization Flow: Customizing your Universal Login pages is now more straightforward and efficient. We've refined the command-line interface to provide a smoother experience when managing templates and branding, allowing for quicker iterations and deployments.
Support for Blocking User Authentication: Enhance your security posture with the new ability to directly block (and unblock) user authentication via the CLI. This feature provides a quick and effective way to manage access for suspicious or compromised accounts.
Enhanced Logs and User Management Experience: We've significantly improved the experience for viewing and managing your Auth0 logs and users. Expect more intuitive commands, better filtering options, and clearer outputs, making it easier to find the information you need and perform administrative tasks.
Better Tenant Settings Management: Managing your tenant settings is now more accessible and user-friendly. The CLI offers improved commands for viewing and updating various tenant configurations, simplifying your operational overhead.
Extended test login Command to Support Organizations: Testing your login flow with Organizations is now easier than ever. The auth0 test login command has been extended to seamlessly incorporate organization-specific contexts, allowing for more comprehensive testing of your multi-tenant applications.
Bug Fixes and Quality of Life Improvements: This release also includes a variety of bug fixes and other minor enhancements based on your feedback. These improvements contribute to a more stable, performant, and enjoyable experience with the Auth0 CLI.

Checkout the reference documentation for more information: https://auth0.github.io/auth0-cli/

May 5, 2025

added

Sign in with Google now available for Android Applications

Copied to clipboard

Auth0 Developers can now easily and securely authenticate users on native applications by using the Android Credential Manager’s Sign in with Google. This enables a secure and streamlined experience for end-users to login without being prompted for a password and by re-using their existing Google session on the device. Learn more Native Sign in with Google

April 28, 2025

added

Federated Logout for the Okta and OIDC Enterprise Connections in Limited Early Access

Copied to clipboard

We are thrilled to introduce the Limited Early Access release of Federated Logout for Okta and OIDC enterprise connections! Auth0 customers now have a straightforward solution to ensure that an end user is logged out of both Auth0 and OIDC IdP sessions via the Auth0 logout endpoint. This feature is built upon the OpenID Connect RP-initiated federated logout specification, allowing customers to effectively mitigate security risks without the need to directly access IdP logout endpoints.

Federated logout has already been supported for a some IdPs, listed here, as well as through the dedicated Google and Microsoft Entra ID connectors. This features expands federated logout capabilities to all OIDC Identity Providers via the generic OIDC and Okta connectors.

To enable the Federated Logout Limited Early Access release in your Auth0 tenant, please contact your Technical Account Manager to request access.

April 28, 2025

Version 202517

updated

Advanced Customizations for Universal Login (Early Access) - Device Authorization Flow and more MFA Factors!

Copied to clipboard

We are excited to announce the next Early Access release of Advanced Customizations for Universal Login! This release adds support for building custom versions of Universal Login’s Device Authorization screens, the MFA voice, phone, and recovery code screens, and their matching Reset Password Challenge factors all using the new ACUL SDK.

Device Code Activation
Device Code Activation Allowed
Device Code Activation Denied
Device Code Confirmation
MFA Phone Challenge
MFA Phone Enrollment
MFA Voice Challenge
MFA Voice Enrollment
Reset Password MFA Phone Challenge
Reset Password MFA Voice Challenge
MFA Recovery Code Challenge
MFA Recovery Code Enrollment
Reset Password MFA Recovery Code Challenge
Redeem Ticket

DX Updates

The latest versions of the ACUL SDK and our CDT tooling all include support for these new screens.

April 26, 2025

added

Guardian Mobile Enrollment for Mobile Devices

Copied to clipboard

Users can now enroll in Guardian Push directly from their mobile device—no QR code scanning required. Enrollment is supported in both the Guardian App and custom Guardian-powered apps, making setup faster and easier on mobile.

April 22, 2025

Version 202517

updated

Actions - Real-time Logs (GA)

Copied to clipboard

This feature gives developers real-time output from Action, Custom Database Scripts, and Custom Social Connections code when executing console.log and other similar commands.

To use the feature, navigate to the Dashboard > Monitoring > Action Logs.

What's new:

Connection Status: New connectivity status indicator for easier visualization of connection state to server stream.
Functionality: New functionalities for on demand connectivity, easier scrolling, and file downloading, which supplement the already existing ones.
User Experience: Improved user experience regarding look and feel and performance.
Docs: New docs section at: https://auth0.com/docs/customize/actions/actions-real-time-logs

April 16, 2025

added

Token Vault to unlock access to external APIs: Now in Early Access

Copied to clipboard

We’re excited to introduce Token Vault, now available in Early Access. Token Vault enables your applications to securely access third-party APIs on behalf of your users—without requiring you to manage refresh tokens or create custom integrations for a broad range of external APIs and services.

With Token Vault, Auth0 handles storing and refreshing access tokens from identity providers like Google, Github, Microsoft, and more. Your applications can then seamlessly call downstream APIs—such as Google Calendar, GitHub repositories, Microsoft Word, etc.

This feature is currently only available for Public Cloud tenants. To enable the Early Access release for your Auth0 tenant, please connect with your Technical Account Manager.

For complete setup instructions and more, refer to the Token Vault documentation.

To learn about using Token Vault with Auth for GenAI, visit Call Other's APIs on User's Behalf | Auth0.

Let the API access magic unfold!

April 15, 2025

added

Announcing the Auth0 MCP Server

Copied to clipboard

We're super excited to announce the developer beta of Auth0 MCP Server to make tenant management conversational, intuitive, and incredibly efficient for developers. Recently, Model Context Protocol (MCP) has been growing at a rapid pace and has enabled AI agents to communicate with external tools, resources, or remote services on behalf of users.

Auth0 MCP Server lets developers interface with Auth0 using natural language instead of complex APIs or dashboard navigation, dramatically simplifying tenant management workflows. For instance, developers could simply ask Claude to create a new Auth0 app, deploy a new Action, or perform any other supported management operation.

This initial release includes:

Support for 20+ Auth0 Management operations: Create and manage applications, APIs, Actions, Logs, and Forms through simple, natural language conversations.
Secure Authentication: Grant tenant access to your MCP clients via a secure auth flow with built-in support for scopes and session management.
Multi-Step Management Workflows: Perform complex operations like "create an application with specific permissions and deploy a security Action" in a single conversation.
Seamless Integrations: Native support for Claude Desktop, Windsurf, Cursor, and many other MCP clients.

Get started with a simple command: npx @auth0/auth0-mcp-server init

Learn more about the Auth0 MCP Server: https://github.com/auth0/auth0-mcp-server/

April 10, 2025

Version 202511

updated

Auth0 Support Center - Now with Generative Answers (Beta) and Knowledge Articles in Search

Copied to clipboard

Auth0 Support Center Search now provides generative answers to search queries on Support Center. As part of this change, the answers/solutions in Support Center contain results from "Knowledge Articles" which are Auth0-created solutions to specific issues to help you troubleshoot better.

To try it out, navigate to: https://support.auth0.com/ and enter a query in the search box on the homepage. To filter results by the new Knowledge Articles, select "Knowledge" on the left-hand side.

April 8, 2025

added

Announcing Auth for GenAI: Developer Preview Is Live!

Copied to clipboard

We’re excited to announce the Developer Preview of Auth for GenAI, a new offering purpose-built for AI-native, agent-based applications.

Auth for GenAI helps developers securely integrate authentication, API access, and fine-grained authorization into GenAI-powered apps using industry standards all wrapped in developer-friendly SDKs.

This initial release includes:

User Authentication via Universal Login (social, enterprise, passkeys, and more) with account linking
Token Vault enabling AI agents to call APIs (Google, GitHub, Slack, etc.) on user's behalf
Asynchronous Authorization to enable autonomous AI agents to asynchronously ask users for out-of-band authorization on sensitive actions via push notifications
Authorization for RAG with resource-level access control powered by Auth0 FGA
SDK support for Next.js, Node.js, FastAPI, and popular AI frameworks like LangChain, Vercel AI SDK, and LlamaIndex
Sample apps, quickstarts, and ready-to-use templates

Explore the Developer Preview at: https://auth0.com/ai

Join the discussion at our community: https://community.auth0.com/c/auth-gen-ai

April 7, 2025

Version 202514

added

Tenant Access Control List is Now Available in Early Access!!

Copied to clipboard

We’re excited to introduce Tenant Access Control List (ACL), a powerful new security feature that allows you to control who can access your tenant.

With the Tenant ACL, you can define custom rules to allow, block, or redirect requests based on predefined signals, helping you secure and optimize your environment with precision.

Benefits

✔ Reduce Attack Surface – Block malicious traffic before it reaches your tenant.

✔ Enhance Security – Enforce custom access policies based on IPs, geolocation, user agents, and more.

✔ Optimize Performance – Redirect traffic efficiently to improve user experience.

Early Access Availability:

Current Early Access: Available to all Enterprise customers with the Attack Protection add-on with the ability to create up to 10 access control list.

Upcoming Limited Early Access: Rolling out to all Enterprise customers in Q2 2025 with the ability to create up to one access control list.

Please view our online documentation here for additional details and to learn how to enable Tenant Access Control Lists.

April 2, 2025

added

Mobile Driver’s License Verification Service in Limited Early Access!

Copied to clipboard

We’re excited to announce that the Mobile Driver’s License Verification Service is now in Limited Early Access.

Auth0’s Mobile Driver’s License (mDL) Verification Service enables customers to enrich user profiles with trusted information during signup and login flows as well as perform ad-hoc verification and validation checks. Additionally, utilizing a digital credential can streamline processes for businesses and financial institutions while allowing end-users more control over their information.

With this feature, customers can perform ad-hoc mDL verification requests or integrate them into their existing authorization flows with our Forms widget. This Early Access release only supports the ISO/IEC TS 18013-7:2024 standard and the REST API, also known as Web API, protocol.

To enable the Limited Early Access release in your Auth0 tenant, please review the available documentation and if interested, please fill out this form to request access. We are limiting the number of customers for whom this will be enabled and will reach out to you with more details. If you have any feedback, give us a shout in our community channel!

April 1, 2025

Version 202508

added

Self-Service SSO - UI Ticketing and Advanced SAML Configurations

Copied to clipboard

Auth0 is excited to announce new enhancements to the Self-Service SSO experience:

Self-Service SSO Ticket Creation in the Dashboard

Tenant admins can now generate SSO tickets directly from the Manage Dashboard, removing the need for API access. This update simplifies the process for all teams and makes it easier to experiment, configure, and roll out federated SSO integrations.

Enhanced SAML Configuration Options

Tenant admins can now configure whether IdP-Initiated SSO is allowed at the time of ticket creation. Additionally, in the wizard, IT admins have the option to choose whether authentication requests should be signed, offering more flexibility and control to meet varying security and compliance needs.

SS-SSO Ticket Creation

These updates enhance accessibility, security, and ease of use. Learn more about Self-Service SSO in the product documentation.

April 1, 2025

added

New US Public Cloud Region (prod-us-5)

Copied to clipboard

We are excited to announce that we are expanding our US public cloud offering with a brand new environment! prod-us-5 is a testament to our growth and provides a big capacity boost to onboard new Auth0 Public Cloud customers.

This new public cloud environment supports all the standard Auth0 Authentication and Management capabilities in a highly secure, resilient, and scalable deployment infrastructure.

All US Public Cloud customers who are using IP allow list to permit outbound traffic from Auth0 are advised to update their firewall rules with the latest info at their earliest convenience.

April 1, 2025

Version 202512

added

Self-Service SSO - Domain Verification now in Early Access!

Copied to clipboard

We’ve added Domain Verification to the Self-Service SSO workflow — making it easier and more secure for your customers to manage their SSO setup.

Simpified & Secure

Your customers can now verify domains directly within the Self-Service SSO wizard, reducing manual steps and ensuring only trusted domains are used for Home Realm Discovery (HRD). This strengthens security and eliminates the need for external verification workflows.

Flexible Configuration Options

As a tenant admin, you have control over how domain verification is enforced when creating Self-Service SSO tickets:

Off – Domain verification is hidden from the wizard
Optional – Customers can choose to skip verification and still enable connections
Required – A domain must be verified before enabling the connection

This gives you the flexibility to balance user experience and security based on your customers' needs.

SS-SSO - Domain Verification

Learn more about Self-Service SSO in the product documentation.

By using Self-Service SSO Domain Verification, you agree to the applicable Free Trial terms in Okta’s Master Subscription Agreement and Okta’s Privacy Policy during use of the Early Access feature. The Free Trial terms can be found within the Master Subscription Agreement at https://www.okta.com/agreements.

March 31, 2025

Version 202512

updated

Advanced Customizations for Universal Login (Early Access) - Organizations, and MFA TOTP and Password Reset Challenge, oh my!

Copied to clipboard

We are excited to announce the next Early Access release of Advanced Customizations for Universal Login! This release adds support for building custom versions of Universal Login’s Organizations screens, the MFA TOTP screens, and the matching Reset Password Challenge factors all using the new ACUL SDK.

Accept Invitation
Organization Selection
Organization Picker
MFA OTP Enrollment QR
MFA OTP Enrollment Code
MFA OTP Challenge
Reset Password MFA OTP Challenge
Reset Password MFA Email Challenge
Reset Password MFA Push Challenge Push
Reset Password MFA SMS Challenge

DX Updates

The latest versions of the ACUL SDK and our CDT tooling all include support for these new screens.

Typescript SDK (includes a breaking change, see the changelog for migration steps)
Auth0 CLI
Deploy CLI
Terraform Provider Auth0

March 31, 2025

updated

Bot Detection Model Updated

Copied to clipboard

We’ve updated our bot detection model to improve accuracy and keep up with evolving traffic patterns.

Improved detection: The new model is more effective at identifying and stopping bot activity.
More computationally efficient: Updated architecture enables more efficient decision-making.
Trained on fresh data: Reflects the latest trends in traffic to better spot malicious behavior.

This enhanced security capability is now available to all Enterprise customers with the Attack Protection add-on. The rollout is currently underway and will be completed in the coming weeks, aligned with individual customer release schedules.

For details on activation or to learn more, please refer to our documentation or reach out to your account team. We are here to support you in protecting your systems against evolving threats.

March 25, 2025

fixed

Improvements to the Reset Custom Provider Button Functionality

Copied to clipboard

The Auth0 Dashboard allows customers to reset the code for a Custom Provider when they click the Reset button. Previously, this experience was different across Custom Email and Phone Provider in both the behavior of the button and the text displayed throughout the reset process. This behavior has been fixed, and now the reset functionality is consistent across both features.

March 25, 2025

updated

Event Streams for User Life Cycle Management -- Public Beta

Copied to clipboard

Auth0 Customers have historically struggled to easily discover changes to the User Lifecycle (user create, updated or deleted), by relying on suboptimal solutions such as Actions or Logs.

Event Streams changes this: customers can now subscribe to events that trigger each time there is a change in the User Lifecycle, regardless of the connection the customer was created, and route those events to either a Webhook or AWS EventBridge.

Auth0 is now accepting Beta Testers to this new feature. See the Auth0 Docs for further instructions.

March 25, 2025

Version 202511

added

Actions - Execution Error Logs

Copied to clipboard

This feature gives developers better observability regarding Actions execution errors both at the Auth0 Dashboard and external Log Stream Platforms.

Here's a summary of the key points:

Execution Error Handling: The feature captures the unhandled Actions execution errors and facilitates them as Tenant logs.
Event Log Type: There is a new Event Log Type regarding Actions execution errors that can be visualized at the Dashboard > Monitoring > Logs.
Log Streams: The new event log type is also sent through Log Streams.
Log Stream Filter: There is a new Log Stream Filter focused on Actions execution errors.

March 19, 2025

added

Japanese Language Support Added to Auth0 Dashboard and Docs

Copied to clipboard

Copied to clipboard

We're improving both account security and user experience by extending Breached Password Detection to the password reset flow.

🔹 What’s New?

Previously, users could unknowingly reset their passwords to compromised credentials, creating security risks and potentially requiring another reset.

With this update, you can now prevent users from setting their password to a known breached credential during the reset flow -just like during sign-up and login.

Additionally, with this rollout we have also increased coverage of Breached Password Detection on Sign-Up to cover the Management API!

🚀 Benefits

Stronger security – Protects against compromised credentials at every stage.

Better user experience – Avoids unnecessary password resets by blocking breached passwords upfront.

This update helps prevent your users from using known compromised credentials throughout their password lifecycle, giving your users stronger security on their accounts.

For additional details and to learn how to enable Breach Password Detection on Password Reset Flows, please view our online documentation here.

February 26, 2025

Version 202508

added

Node Module Compatibility Check for Custom Database

Copied to clipboard

This feature allows developers to ensure their custom database scripts are compatible with specific Node.js runtime versions.

Here's a summary of the key points:

Bulk Testing Compatibility: The feature can test the compatibility of custom database scripts with different supported Node.js runtime versions.
Database Connections Limit: It is available if your tenant has 1 to 10 database connections with custom database scripts enabled.
Navigation Path: The feature can be accessed by going to Tenant Settings → Advanced → Extensibility → Verify Custom DB Scripts.

Actions Based on Results: After testing, the results can be verified and corrective actions can be taken if any compatibility issues are identified.

Checkout our online documentation to learn more about Extensibility Tenant Settings!

February 24, 2025

Version 202508

updated

Advanced Customizations for Universal Login (Early Access) now with MFA Support!

Copied to clipboard

We are excited to announce the next Early Access release of Advanced Customizations for Universal Login! This release adds support for building custom versions of Universal Login’s MFA enrollment screens and 3 of our most common MFA factors using the new ACUL SDK.

MFA Detect Browser Capabilities
MFA Begin Enroll Options
MFA Enroll Result
MFA Login-options
MFA Email List
MFA Email Challenge
MFA Country Codes
MFA SMS Enrollment
MFA SMS List
MFA SMS Challenge
MFA Push Welcome
MFA Push Enrollment QR
MFA Push List
MFA Push Challenge Push

February 19, 2025

deprecated

Node.js 12 and 16 Extensibility Runtimes

Copied to clipboard

We have deprecated the Node.js 12 and 16 extensibility runtimes in all environments and recommend using the Node.js 22 runtime for your extensibility integrations (such as Actions, Rules, Hooks, Custom Database Connections, and Custom Social Connections).

We have provided additional information and timelines for removing the deprecated runtimes through a dashboard and support center notification.

February 12, 2025

Version 202507

deprecated

Unwarranted session removal after Management API user updates

Copied to clipboard

We have deprecated the invalidation of user sessions when performing database connection user update (PATCH - /api/v2/users/{id}) requests where:

The email or email_verified attributes are set to an unchanged value;
The email_verified attribute is set to a true value.

These changes allow for consistent behavior between setting an email as verified through the Management API and the built-in email verification flows provided by the service. In addition, it improves the overall end-user experience by avoiding session invalidation in situations that do not require it, such as setting either the email or email_verified attributes to unchanged values.

The dashboard will be updated with a migration toggle to opt out of the deprecated behavior ahead of its future end-of-life; we have provided additional information and timelines for enforcing this change through a dashboard and support center notification.

February 11, 2025

added

Optimized TOTP Enrollment for Mobile Devices

Copied to clipboard

End User TOTP enrollment for Native devices is now more intelligent! For end users enrolling into a TOTP factor on a mobile device, Auth0 skips the QR code and prompts for manual code entry with the QR code as a fall back option. Check out Auth0 Temporary OTP for more detail!

February 11, 2025

Version 202507

added

Usage Metrics Dashboard for Okta FGA

Copied to clipboard

We are excited to introduce the Usage Metrics Dashboard in Okta Fine-Grained Authorization (FGA), providing customers with deeper visibility into their authorization usage. This new dashboard, available under the “Manage Account” section of the Okta FGA dashboard, helps teams monitor, analyze and manage their FGA consumption efficiently.

What’s New?

Monitor Key Metrics: Track Monthly Active Users (MAUs), Total Tuple Count, and Monthly Average Requests Per Second (RPS). Time Frame Selection: View trends over the Last Month or Last 3 Months, with the current month’s data always included for the latest insights.
Granular Data Views: Click on “View Table” option to see a detailed breakdown of usage by store and time period.
Hourly Updates: Data is refreshed hourly to help you make informed decisions.

Learn More:

Check out the documentation for details on how to use the dashboard effectively.

February 10, 2025

Version 202506

updated

Email OTP Verification is Now Generally Available

Copied to clipboard

Email OTP Verification is now Generally Available (GA), minor improvements will continue to roll out over the next 1-4 weeks to enhance performance and usability.

With Email OTP Verification, users are required to enter a One-Time Password (OTP) sent to their email during the signup or password reset process. This ensures email verification happens before account creation or password reset is completed, offering enhanced security and reducing the chances of mistyped or fake email accounts.

Key Highlights:

Synchronous Email Verification: Prevents account creation or password reset until users verify their email via OTP.
Improved Security: Helps prevent fake accounts, ensures accurate email addresses, and discourages phishing through email links.
Applicability: Available for both email verification during signup and password reset challenges.

Prerequisites:

Must be using Universal Login.
Connection must have Flexible Identifiers enabled.
Email OTP is only compatible when using the Identifier First Authentication Profile.

To enable this feature, navigate to the Attributes tab on any connection and change the Verification Method under the Email attribute settings from Verification Link to OTP.

February 6, 2025

Version 202505

added

Advanced Customizations for Universal Login (Early Access) is launching today!

Copied to clipboard

At Auth0, we understand that no two customer identity stories are the same. Every company has a brand identity, a secret sauce, and a unique aesthetic vision. Today, we are very excited to introduce the next evolution in customization for Universal Login, Advanced Customizations for Universal Login (ACUL). ACUL enables your team to build custom, client-rendered versions of each Universal Login screen, allowing you to control every pixel of the Universal Login experience.

ACUL EA Changelog Banner

This Early Access release of ACUL is available to all paid customers. Public cloud customers can start using it today! Those on private cloud will be enabled as part of their regular release cycle. This initial EA release provides a new configuration API, CDT and SDK support, and allows you to build custom versions of the following screens:

Login
Login Id
Login Password
Login Passwordless Email Code
Login Passwordless SMS OTP
Signup
Signup Id
Signup Password
Passkey Enrollment
Passkey Enrollment Local
Phone Identifier Enrollment (used for identity verification during Signup)
Phone Identifier Challenge (used for identity verification during Signup)
Email Identifier Challenge (used for identity verification during Signup)
Interstitial Captcha
Reset Password
Reset Password Email
Reset Password Request
Reset Password Error
Reset Password Success

The following flows and capabilities are supported in ACUL EA:

Single step Signup & Login with password and social & enterprise connections
ID First Signup/Login using password, passwordless email/SMS OTP, passkeys, and social & enterprise connections
Basic Reset Password flow with and without Bot Detection
Flexible Identifiers with and without identity verification enabled during Signup
Bot detection with any of our 7 supported Captcha providers during the Signup, Login, and Reset Password flows
Capturing additional data during Signup and Login using custom prompts

This is just the beginning! In the coming months, we will be adding support for every screen and capability that Universal Login currently supports out of the box, a shiny new Dashboard UI for configuring ACUL, and lots more DX goodness!

Checkout our online documentation to learn more about ACUL and stay tuned to the Auth0 Changelog for updates and announcements!

February 6, 2025

Version 202506

added

Custom Token Exchange now available in Early Access

Copied to clipboard

We are thrilled to announce the Early Access release of Custom Token Exchange. Enterprise customers can now request access to use this feature.

Token Exchange is an OAuth grant-type that enables the exchange of security tokens for other security tokens, typically access_tokens. Custom Token Exchange provides a flexible solution using Actions that allows customers to provide their custom logic to control the exchange - i.e. effectively providing the means to implement custom authentication semantics using Actions.

Custom_Token_Exchange_EA_Action

This added flexibility can be used by customers to tackle advanced integration use cases, such as:

Seamlessly migrating users to Auth0
Integrating external IDPs
Exchanging Auth0 tokens for a different audience
... and other use cases where regular federation and/or OIDC flows are not an option

To learn more, read our documentation.

Reach out to you Auth0 contact to request access!

February 3, 2025

added

New Private Cloud Region in India

Copied to clipboard

Auth0 is delighted to introduce Hyderabad as the latest AWS region for Private Cloud deployments.

Hyderabad follows Mumbai as the second AWS region for Auth0 Private Cloud available in India! This new addition unlocks reduced latency and increased flexibility for Auth0 deployments on AWS. We stand committed to meeting our customers’ data residency and resiliency needs in an ever expanding global market.

January 31, 2025

Version 202505

added

Okta Universal Logout Integration Now Supported in Auth0

Copied to clipboard

We’re thrilled to announce that Auth0 now supports Universal Logout integration with Okta Workforce Identity Cloud!

Okta Universal Logout is based on the Global Token Revocation specification and allows security incident management tools Okta Identity Threat Protection to send back-channel requests to revoke users' sessions and refresh tokens when they identify a change in risk.

With this feature, Auth0 customers federating with Okta Workforce Identity using the Okta, SAML, or OpenID Connect connection types no longer need to build a global token revocation endpoint. Instead, with minimal configuration required, they can provide the Okta admin with Auth0’s connection-specific endpoint URL.

This integration provides security benefits for apps that depend on refresh tokens and Auth0 sessions, as both are revoked when Auth0 receives a Universal Logout request for a user. This integration can also trigger Auth0's OIDC back-channel logout feature to terminate custom application sessions.

To learn more about Universal Logout support in Auth0, click here.

This feature will be rolled out to all public cloud environments over the next few days and to private cloud environments as per their release pipeline.

January 31, 2025

Version 202505

added

Enhanced Rate Limit Reporting

Copied to clipboard

Customers now have Enhanced Rate Limit Reporting via Logs, including:

Increased Rate Limit Log (api_limit) Publishing Frequency: receive 1X per minute notifications indicating when you have exhausted a rate limit.
New Rate Limit Warning Log (api_limit_warning): receive 1X per minutes notifiactions indicating when you have exhuasted 80% of your rate limit request token allocation.
Enhanced Logs Schema: additional attributes of HTTP path and method and bucket size will be included to allow for easier mapping between Logs and API Rate Limit Configuration Docs. https://auth0.com/docs/troubleshoot/customer-support/operational-policies/rate-limit-policy/rate-limit-configurations

January 31, 2025

added

New Access Controls for Okta FGA Using Per-Module Authorization

Copied to clipboard

We are excited to introduce the Per-Module Authorization feature. This enables large organizations to securely share authorization models by specifying which application credentials can update data for specific modules.

Teams that are responsible for their own separate services can now limit access to modification of authorization data on a per-module basis. Last year, we released Modular Models, where a single model could be separated into modules across multiple files, allowing teams to use features in their source code management platforms (such as GitHub’s CODEOWNERS feature) to enforce access on who can modify parts of a model.

Per-Module Authorization builds on top of that work to further define permissions for applications. Workflows can be implemented where different teams maintain their portion of an FGA model independently and also ensure that the services and applications owned by the respective teams can only modify their own authorization data.

For more details, refer to Okta FGA’s documentation on how to grant client credentials access to only specific modules.

January 30, 2025

updated

Introducing Next.js SDK v4 (GA)

Copied to clipboard

We are excited to announce the next major version of Next.js SDK. With the introduction of nextjs-auth0 v4, we now support Next.js 15 and React 19, allowing developers to leverage the latest features and improvements in both frameworks. This compatibility not only enhances the development experience but also ensures that applications can take full advantage of performance optimizations. This updated SDK features a simplified architecture and is edge-compatible by default, enhancing performance and flexibility for developers.

What’s new:

Middleware-Based Authentication: Improved compatibility and reduced maintenance by moving to middleware-based handlers.
Enhanced Security: Switched to encrypted cookies and removed outdated cookie logic.
Resolved State Mismatch Issues: Fixed long-standing issues reported by the community.
Improved Session Management: Implemented rolling sessions and eliminated cookie chunking.
Improved Hooks and Helpers: Introduced useUser(), getAccessToken(), and getSession() for easier data fetching and session handling.
Stateful Sessions with Custom Databases: Support for "Bring Your Own Database" (BYODB).
Compatibility with Next.js 15, Turbopack, and React 19
Simplified architecture, API, and configuration options

Learn More:

January 28, 2025

updated

Update to Default From Email Address for Supported Email Providers!

Copied to clipboard

What’s Changing: We are improving the Dashboard configuration experience for email providers. The default From address field will be required when creating or updating email provider configuration through the Dashboard. Customers do not need to take immediate action, and the Management API will maintain the field as optional for backward compatibility.

Key Dashboard Updates:

Configuring New Email Providers: Customers must supply a default From address when configuring a new email provider.
Changing Existing Email Providers: Customers must supply a default From address when updating an existing email provider. Existing configured email providers that do not have a From address configured will continue to work as before.

Why This Matters: An email provider configured without a default From address may lead to a poor user experience because email template customizations are not supported when a customer-defined From address is unavailable. By requiring a default From address at the email provider level, email template customizations will be respected even if the email template does not have a template-specific From address.

Rollout Timing: We plan to roll out this change in the coming days. After the rollout, customers can expect to see the enforcement of this required field on the Dashboard.

January 23, 2025

added

Custom Email Providers is now Generally Available!

Copied to clipboard

We’re excited to announce that Custom Email Providers is now Generally Available.

With this feature, customers can configure custom email providers and customize emails so they can have full control of the email delivery process. This feature utilizes the Actions framework and leverages the Actions Code Editor so you can more completely manage, monitor, and troubleshoot your email communications. Auth0’s CI/CD tooling (Auth0 CLI, Deploy CLI, and Terraform Provider) now fully supports Custom Email Providers. To access these new capabilities, upgrade to the latest versions of Auth0 CLI, Deploy CLI, and Terraform Provider.

We encourage you to get started with Custom Email Providers today by checking out our documentation and if you have any feedback, give us a shout in our community channel!

January 21, 2025

Version 202504

added

Actions - Real-time Logs (Beta)

Copied to clipboard

This Beta feature logs in real-time output form your custom Actions code. This includes all console.log output and exceptions.

For example, a custom Action code such as below:

console.log("Hello world!");

Will show up within Dashboard > Monitoring > Actions Logs as

Actions Real Time logs

You can also use examples such as below to catch and log errors for making it easy to debug and troubleshoot your Actions.

try {
  nonExistentFunction();
} catch (error) {
  console.error(error);
  // Expected output: ReferenceError: nonExistentFunction is not defined
  // (Note: the exact output may be browser-dependent)
}

These logs are not stored and are only available within the dashboard when you are logged in and are on the Dashboard > Monitoring > Actions Logs tab within the browser. These logs are designed to help you troubleshoot as you write or modify your custom Actions code.

January 16, 2025

Version 202503

added

Node 22 for Actions & other features

Copied to clipboard

Node.js 22 is now generally available (GA) as a runtime for your extensibility integrations (such as Actions, Rules, Hooks, Custom Database Connections etc).

New Actions created will now default to Node 22 as the runtime. As part of this release, we have also split runtime selection for Legacy Extensibility (for Rules & Hooks) separate from the general Extensibility (for Custom Database Scripts & Custom Social Connections). These setting are available within Tenant > Settings > Advanced and allows you to individually manage desired runtime configuration as required.

Extensibility Runtime

Please refer to our docs for more details on how to migrate to Node 22.

January 8, 2025

Version 202451

added

Client-Initiated Backchannel Authentication (CIBA) flow is now available in Early Access

Copied to clipboard

We are delighted to announce that support for the Client-Initiated Backchannel Authentication (CIBA) flow is now available in Early Access.

The CIBA flow works as a decoupled authentication flow across two different devices:

Consumption device: initiates the authentication request.
Authentication device: handles end-user authentication, implemented as a custom mobile app which embeds the Guardian mobile SDK.

The CIBA flow supports a number of powerful use cases driven by backend client applications, such as:

Customer authentication by headless devices or devices with limited interaction capabilities.
Customer authentication in call centre scenarios.
Authorising sensitive operations on behalf of yourself or a third-party e.g. a customer service agent.

To evaluate CIBA for securing your sensitive customer interactions, contact your Technical Account Manager. For more details, check out our product documentation.

January 6, 2025

Version 202451

updated

Organization ID is now available in "Successfully revoked a refresh token" logs

Copied to clipboard

We’ve added the Organization ID to the Auth0 Tenant Logs for the Successfully revoked a refresh token (srrt) event. This enhancement allows you to correlate the organization associated with the revoked refresh token for improved tracking and auditing.

December 24, 2024

Version 202450

updated

Actions secret value length increased

Copied to clipboard

We have increased the max secret value length from 2048 to 4096 to allow for larger secrets to be stored within Actions.

Actions Secrets

You can refer to our docs for further details on Actions limitations.

December 20, 2024

added

New high performance tier for Private Cloud on AWS

Copied to clipboard

We're excited to introduce the new 10,000 RPS (100x) tier for Auth0 Private Cloud Performance offering on AWS. This enhanced tier supports a higher volume of authentication requests, complementing the existing 30x and 60x tiers for customers who need high performance thresholds.

Please see Private Cloud documentation to learn more.

December 18, 2024

added

Bot Detection ML Model for Signup Attack Detection Now Available for Classic and Custom Login

Copied to clipboard

The new Bot Detection ML model designed to detect signup attacks is now available for Classic Login and Custom Login implementations.

For customers using Classic or Custom login experiences, this enhancement leverages advanced machine learning to identify and block automated signup attacks effectively.

For those using New Universal Login, no configuration changes are required. This feature was rolled out for New Universal Login in September, as highlighted in the changelog here.

Below is the demo showcasing how to enable this feature in Auth0 for Classic and Custom Login experiences.

This enhanced security capability is now available to all Enterprise customers with the Attack Protection add-on. The rollout is underway and will be completed in the coming weeks, aligned with individual customer release schedules.

For details on activation or to learn more, visit our documentation or reach out to your account team. We’re here to support you in protecting your systems against evolving threats.

December 18, 2024

added

Resilience enhancement - Private Cloud space restoration (Early Access)

Copied to clipboard

Auth0 is pleased to announce the Early Access (EA) of enhanced support for customer data recovery. This resilience feature is available to a set of Private cloud customers during EA. It would come handy in the event of customer data loss or data corruption, and would assist customers in meeting regulatory requirements such as European Union’s Digital Operational Resilience Act (DORA).

Customer will be able to request restoration of their production Private Cloud space from a backup within the past 14 days. Please refer to Operational policies documentation for details.

December 18, 2024

added

Security Center Alerts for Thresholds - Early Access

Copied to clipboard

Introducing a new capability within the Security Center Dashboard offering - Security Center Alerts for Thresholds Early Access. This new feature expands on the Security Center metrics and Thresholds to allow Enterprise customers to not only monitor their tenant security but also receive notifications when a threat metric exceeds their predefined thresholds. Customers can now configure webhook alert notifications on security threat metrics and monitor when threats exceed the acceptable value.

To learn more Alerts for Thresholds, click here

December 17, 2024

updated

Introducing Newly Styled Customizable Email Templates!

Copied to clipboard

We’re excited to announce that all Customizable Email Templates have been styled with a modern look and feel and are now live!

No verbiage or content has been changed on any of the emails and customers that have customized the email templates are unaffected. email-changelog (1)

December 13, 2024

added

Auth0 Teams - Add SSO Connections (Beta)

Copied to clipboard

Single Sign On (SSO) allows one set of credentials to access multiple resources through a centralized identity provider (IdP). Auth0 Teams security policies allows team owners to configure and implement authentication rules that adhere to their organization's IT security policies for access to infrastructure systems or applications.

Announcing in beta the ability for team owners to self-configure and connect their IdP to provide SSO for dashboard administrators. Teams SSO Add connection

Auth0 Teams Self-Service SSO beta is currently limited to Public Cloud Enterprise customers.

Interested in the BETA? Reach out to your Technical Account Manager to enrol in our beta program.

December 13, 2024

updated

Auth0 Dashboard Session Management - GA

Copied to clipboard

Announcing General Availability of Auth0 Dashboard Login Session Management. A feature that allows Auth0 Dashboard admins to view and revoke active dashboard sessions for an added layer of security to the session idle timeout for both our Public and Private Cloud customers. Login Sessions GA

Click here to learn more about Auth0 Dashboard Login Session Management.

December 12, 2024

Version 202450

added

Increased Organization Metadata Slots

Copied to clipboard

We’re excited to announce that we’ve increased the number of metadata slots for Organizations from 10 to 25! This enhancement provides you with more flexibility to store and manage additional data within your organization, enabling a more customized and efficient approach to your workflows.

To learn more about Organizations, click here.

December 11, 2024

Version 202450

added

Customer Managed Keys is now Generally Available

Copied to clipboard

We are delighted to announce that Customer Managed Keys is now generally available. This solution within the Highly Regulated Identity solution suite enables organizations to comply with cryptographic key-related security policies for data protection. Customer Managed Keys provides customers with two options for key management: Control Your Own Key and Bring Your Own Key.

With Control Your Own Key, you can manage the lifecycle of the Tenant Master Key according to your security policy. Bring Your Own Key allows you to maintain ownership of the Root Key that protects the encryption key hierarchy. These features enable compliance with cryptographic key-related security policies for data protection.

You can read more about this in our product documentation.

December 10, 2024

added

New API command within Password Reset / PostChallenge Action Trigger

Copied to clipboard

We added a new API command available in the Password Reset / PostChallenge trigger. This API allows Tenant Developers to specify the url to redirect a user to upon the completion of a password reset on Universal Login.

Here is an example of using the command to redirect the user to a sample url after a successful password reset:

  exports.onExecutePostChallenge = async (event, api) => {
    api.transaction.setResultUrl('https://yourapp.yourdomain.com/profile');
  };

You can learn more in our reference documentation.

December 10, 2024

added

New Batch Check API Endpoint for Okta FGA

Copied to clipboard

We’ve introduced a new Batch Check endpoint to the Okta FGA API, allowing clients to batch multiple authorization checks into a single request. This enhancement reduces the network latency associated with previously needing to performing multiple Check API requests in parallel, resulting in faster and more efficient requests for applications with high authorization demands.

For more details, refer to the Okta FGA Batch Check documentation.

December 9, 2024

Version 202449

added

Bot Detection Enhanced with Additional Tenant-Level Signals

Copied to clipboard

We’re thrilled to announce that our fourth-generation Bot Detection has been upgraded to incorporate additional aggregated tenant-level insights. This upgrade strengthens bot detection across both public and private cloud environments, providing a more precise and robust defense against malicious activity while ensuring a seamless and secure experience for all users.

This enhanced security capability is now available to all Enterprise customers with the Attack Protection add-on. The rollout is currently underway and will be completed in the coming weeks, aligned with individual customer release schedules.

For details on activation or to learn more, please refer to our documentation or reach out to your account team. We are here to support you in protecting your systems against evolving threats.

November 28, 2024

Version 202448

added

Self-Service SSO is now in General Availability (GA)

Copied to clipboard

Auth0 is excited to announce that Self-Service SSO is now in General Availability.

Our Self-Service SSO feature is designed to simplify and streamline the administrative tasks that are essential for every B2B SaaS product. By equipping your business customers to configure their own Single Sign-On setups, we provide them with a seamless, intuitive experience—eliminating the need for complex IT involvement. This flexibility not only enhances security but also improves the overall user experience, giving businesses more control and agility while reducing overhead.

Self-Service SSO

This feature is available for B2B Professional, Enterprise and Enterprise Premium customers.

Click here to learn more.

November 18, 2024

upcoming deprecation

Rules and Hooks are now read-only in Public Cloud

Copied to clipboard

We have transitioned the Rules and Hooks features to a read-only mode in all public cloud environments as part of their announced deprecation plan.

You can still disable, delete or re-enable an existing Rule or Hook. You can also add or remove Rules settings (for updating stored secrets) or Hook secrets but you will no longer be able to modify their script.

If this impacts you, our recommendation is to migrate to Actions. Refer to the following docs for more details:

November 18, 2024

updated

Announcing the Beta Release of nextjs-auth0 SDK v4

Copied to clipboard

Hello everyone,

We're thrilled to announce the beta release of nextjs-auth0 SDK v4! This new version brings significant improvements, new features, and fixes to enhance your development experience.

Important Notice About v3

As we move forward, we will not be updating v3 of the SDK to support Next.js 15. This allows us to focus on v4, which offers a wealth of new features and improvements. This will also enable us to support future releases of Next.js faster and with more confidence. We understand this may pose challenges, and we're here to help.

v3 will continue to receive critical security updates for 6 months after the GA of v4.

Highlights of v4 Beta

Middleware-Based Authentication: Improved compatibility and reduced maintenance by moving to middleware-based handlers.
Enhanced Security: Switched to encrypted cookies and removed outdated cookie logic.
Resolved State Mismatch Issues: Fixed long-standing issues reported by the community.
Improved Session Management: Implemented rolling sessions and eliminated cookie chunking.
Improved Hooks and Helpers: Introduced useUser(), getAccessToken(), and getSession() for easier data fetching and session handling.
Stateful Sessions with Custom Databases: Support for "Bring Your Own Database" (BYODB).
Compatibility with Next.js 15, Turbopack, and React 19
Simplified architecture, API, and configuration options

Try It Out and Provide Feedback

We invite you to explore the beta release and share your feedback to help us improve before the general availability release. We are currently targeting a general availability release by the end of December.

Beta Release: v4.0.0-beta.3

Need Help with Migration?

If you encounter challenges migrating to v4, please don't hesitate to open an issue and our team will assist you. We're committed to making the transition as smooth as possible.

Thank You for Your Support

We appreciate your understanding as we focus on making v4 the best it can be. Your feedback is invaluable, and we're here to support you every step of the way.

Happy coding! 🚀

— The Auth0 DX SDK Team

November 14, 2024

Version 202446

added

Bot Detection Now Upgraded with User-Agent Signals

Copied to clipboard

We are excited to announce that our fourth-generation Bot Detection has been upgraded with user-agent signals, and is now integrated into our proprietary machine learning model. This enhancement improves our capability to detect and thwart bot activity, further strengthening protection against malicious traffic without adding any additional friction for legitimate users.

This security feature is available to all Enterprise customers with the Attack Protection add-on. We are currently rolling out this enhancement and expect to complete the process within the next few weeks, aligned with your individual release schedules.

For activation details or further information, please check our documentation or reach out to your account team. We’re here to support you in safeguarding your systems against evolving threats.

Thank you for trusting us with your security needs.

November 14, 2024

Version 202447

added

Self-Service SSO: Exciting Updates

Copied to clipboard

Auth0 is excited to announce the following updates to Self-Service SSO:

Custom Introduction Text: You can now customize the welcome message on the wizard's landing screen, aligning the experience with your brand’s tone and engaging users right from the start.
PingFederate Support: We've expanded our list of supported Identity Providers (IdPs) to include PingFederate, giving you more flexibility in your authentication options.
Revoking SSO Access Tickets: Our new API endpoint lets you revoke SSO access tickets at any time.
Updated Ticket Expiration: Access tickets are now consumed only when a connection is created, enabled or edited — like when updating SAML or OIDC details — avoiding issues with scanners opening them prematurely.
Customized Login Experience: When creating a ticket, you can now define the login experience — adding optional parameters for Home Realm Discovery, Organization Auto-Membership, and more to tailor every step of the way.

To learn more, see the Self-Service SSO documentation.

November 13, 2024

Version 202445

updated

Additional SAML methods available via Actions

Copied to clipboard

Actions now supports the following APIs within the post-login trigger.

api.samlResponse.setRelayState(relayState)
api.samlResponse.setIssuer(issuer)

You can see all available API methods supported within the post-login trigger along with details on these methods from this link.

November 7, 2024

Version 202445

added

Machine-to-Machine Access for Organizations is now in General Availability (GA)

Copied to clipboard

The possibility to scope machine-to-machine access to a specific organization is now Generally Available. This feature allows you to define the organizations that a given application can access for each API via the Client Credentials Flow.

M2M_for_Orgs_Image

You can easily define and enforce access to one, many, or all the organizations in your tenant and securely expand the reach of your SaaS APIs to more use cases and scenarios, making sure sensitive data and operations are only accessible to authorized parties. After configuring the access rights for your API, you simply have to inspect the org_id in access tokens of incoming requests, independently of whether they come from third-party applications or your own applications.

This feature is available for B2B Professional, Enterprise and Enterprise Premium customers.

To learn more, read the reference documentation.

October 25, 2024

added

High Capacity Private Cloud Burst Offerings (AWS)

Copied to clipboard

Auth0 is delighted to launch Private Performance Burst AWS - 30x (3000 RPS*) and 60x (6000 RPS) offerings for Private Cloud deployments on AWS.

These cost-effective Private Performance options scale the Authentication traffic up to 3000 RPS and 6000 RPS respectively for 80 hours a month, and allow usage up to 1500 RPS and 3000 RPS respectively for the remaining duration.

The elevated transaction capacity comes handy for planned and unplanned traffic spikes, e.g. during product launches, large media events, seasonal activities, and unpredictable usage peaks.

The Private Performance Burst offering is just another milestone in our commitment to providing the functionality and flexibility our beloved customers need.

Please refer to Private Performance Burst documentation page for more information.

*RPS: Requests Per Second

October 23, 2024

added

Define Conditional Relationship Tuples in the Okta FGA Dashboard

Copied to clipboard

The Okta FGA authorization modeling language allows defining conditions that can be used to express certain ABAC authorization policies. Previously, if you wanted to take advantage of that feature you needed to use the Okta FGA API or the FGA CLI.

Now, with the Okta Fine Grained Authorization Dashboard, you can create conditional relationship tuples and specify context parameters in assertions, making it easier to fully define ABAC-like conditions directly within the dashboard.

For more details, refer to the Okta FGA dashboard documentation.

October 9, 2024

added

Extended group attributes now supported for Google Workspace Enterprise connections

Copied to clipboard

The Google Workspace Enterprise connection now supports an Extended Group Attribute Format option. When selected, group memberships are written to the Auth0 user profile as an array of JSON objects containing the group unique ID, group name, and group email address for each group retrieved from Google.

For more information, see Connect Your App to Google Workspace.

This feature is immediately available in the public cloud and will be rolled out to private cloud environments in the next few weeks as per the release pipeline.

October 7, 2024

Version 202440

added

Self-Service SSO: IdP Selection, Keycloak Support and Miscellaneous Improvements

Copied to clipboard

Auth0 is excited to introduce the following updates to Self-Service SSO:

Tenant admins now have the ability to choose which IdPs to display when their customers are setting up an SSO profile through the set up wizard, making the entire process more efficient and customizable.
We've added support for Keycloak expanding the available IdPs.
When no user attributes exist in the SSO profile, we skip the Claims Mapping instructions in the SSO wizard.
When testing the connection, the JSON has been formatted to show on multiple lines.

To learn more, see the Self-Service SSO documentation.

October 2, 2024

added

Custom Phone Providers in Early Access!

Copied to clipboard

We’re excited to announce that Custom Phone Providers in is now in Early Access.

With this feature, customers can configure custom phone providers and customize phone messages associated with using phone number as an identifier. Using a custom phone provider for MFA and passwordless phone messages is planned for a later release.

This early access release enables you to:

Configure your preferred phone provider for phone messages
Leverage various contexts for using different providers, including organization, client, user, and more

We encourage you to get started with Custom Phone Providers today by checking out our documentation and if you have any feedback, give us a shout in our community channel!

October 2, 2024

changed

Support Center Closed Tickets Older than 24 Months to be Deleted

Copied to clipboard

In our continuing effort to improve our security posture, Auth0 will no longer retain closed support tickets older than 24 months. Closed support tickets older than 24 months will be deleted on October 16. To view your support tickets, you can navigate to https://support.auth0.com/tickets . For questions or issues on this change, please reach out to Support.

September 30, 2024

added

New Private Cloud Region in United Arab Emirates (UAE)

Copied to clipboard

Auth0 is delighted to introduce the United Arab Emirates (UAE) as the latest AWS region for Private Cloud deployments.

We are committed to enhancing our presence in the Middle East. The UAE joins Bahrain as the second AWS region for Auth0 Private Cloud in this part of the world. This expansion opens up new possibilities in the UAE, where Private Cloud deployment is already supported on Azure.

September 27, 2024

updated

EN 301 549 Compliance for Universal Login

Copied to clipboard

Okta CIC is excited to announce that Universal Login now satisfies out of the box or provide configurability to satisfy the guidelines for the EN 301 549 standard. We have updated our VPAT to include this information and it is available on Okta.com. By ensuring that Universal Login is accessible to all users, we enable our customers to confidently secure their applications with accessible authentication.

See our online documentation for more details.

September 27, 2024

fixed

Update to Session Termination Behavior when Adding Identifiers

Copied to clipboard

What’s Changing:

We are improving the user experience when adding or updating identifiers (email, phone number, or username) in profiles.

Key Updates:

New Identifier: When a new identifier type (email, phone, or username) is added to a user profile where one does not already exist, the user’s session will not be terminated. This allows for a smoother progressive profiling experience, where users can add new identifiers without disruption.
Changing Existing Identifier: When an existing identifier is modified, the user’s session will terminate, and the user will have to re-authenticate. This ensures security best practices are followed when updating key account information.

Why This Matters: Previously, any update to an identifier (whether adding or changing it) would terminate the user’s session. This could lead to a poor experience, especially during progressive profiling, where users are expected to update or add information without being logged out. With this update, customers can offer a seamless experience for users adding new identifiers while maintaining strict security for changes to existing identifiers.

Rollout Timing: This change will be rolled out progressively over the next 1-4 weeks. Customers can expect to see the updated session handling behavior in their environments during this period.

Action Required: No immediate action is required from customers, but it is recommended to review any user flows that involve the addition or modification of identifiers to ensure they align with this change.

September 27, 2024

added

Email OTP Verification (Early Access)

Copied to clipboard

We have introduced Email OTP Verification as a new method for email verification, available in Early Access. Expect to see the feature in your environments within the next 1-4 weeks.

Key Highlights:

Synchronous Email Verification: Prevents account creation or password reset until users verify their email via OTP.
Improved Security: Helps prevent fake accounts, ensures accurate email addresses, and discourages phishing through email links.
Applicability: Available for both email verification during signup and password reset challenges.

Prerequisites:

Must be using Universal Login.
Connection must have Flexible Identifiers enabled.
Email OTP is only compatible when using the Identifier First Authentication Profile.

To enable this feature, navigate to the Attributes tab on any connection and change the Verification Method under the Email attribute settings from Verification Link to OTP.

Email OTP Verification

September 25, 2024

updated

Actions UI updated

Copied to clipboard

Auth0 Actions dashboard experience & documentation has been updated to consolidate around the concept of "Triggers" (as opposed to our previous mix of Flows and Triggers). A trigger represent points in the Auth0 process where Actions can be added.

We believe this change will make it easier for you to identify available customization options (now simply labelled as triggers) and how they can be leveraged to personalize your identity needs.

Actions Triggers

Please note that this change does not have any impact on the current functional behaviour of Actions within Auht0.

September 25, 2024

added

New endpoints on the Session Management APIs

Copied to clipboard

We are happy to announce that we just added two new endpoints to our Session Management APIs:

POST /api/v2/users/{id}/revoke-access – This endpoint allows you to revoke sessions for a user and decide if you want to revoke the associated Refresh Tokens.

POST /api/v2/sessions/{id}/revoke – This endpoint will revoke the session and all its related Refresh Tokens.

Please refer to the Auth0 Management API for more information.

September 24, 2024

added

Continuous Session Protection now available for enterprise customers

Copied to clipboard

Continuous Session Protection is now generally available for enterprise customers, providing powerful tools to dynamically manage Sessions and Refresh Tokens within Auth0 Actions. This feature offers flexible options to configure expiration settings, access additional session and token data, and revoke sessions when necessary, enhancing security and control.

Key benefits of Continuous Session Protection include:

Dynamic Session and Token Expiration: Configure custom absolute and idle timeouts for Sessions and Refresh Tokens using the new setExpiresAt(Date) and setIdleExpiresAt(Date) methods. These settings can be applied across users, organizations, or specific connections to meet your security and compliance needs.
Enhanced Security with Revocation: Revoke Sessions and Refresh Tokens programmatically using Actions, based on custom logic or risk assessments. This allows you to take immediate action when suspicious behavior is detected or when tokens no longer meet your security policies.
Comprehensive Session and Token Insights: Access additional session and refresh token attributes within Actions, enabling you to make more informed, data-driven decisions for managing user sessions.
These features allow enterprise customers to dynamically improve their security posture by customizing session behavior, enforcing shorter expiration times for high-risk roles (such as administrators), and revoking tokens when necessary to mitigate risks.

To learn more, visit the product documentation: Continuous Session Protection

Continuous-Session-Protection-Action

September 19, 2024

updated

Enhancements to Customize Signup and Login

Copied to clipboard

Passwordless Connection Support

Universal Login now supports customizing the passwordless signup and login authentication flows, allowing customers to address their unique data capture, security, and compliance requirements when users authenticate with email and SMS one-time passwords.

See our online documentation for more information, instructions and examples.

Dev Tooling support for the Partials API

Auth0’s CI/CD tooling (Auth0 CLI, Deploy CLI, Terraform Provider) now fully supports the Partial API including the new Passwordless prompts. As a bonus, Partials can now also be edited using Auth0 CLI’s UL Customize interface. Run auth0 ul customize in your terminal to see it in action. To access these new capabilities, upgrade to the latest versions of Auth0 CLI, Deploy CLI, and Terraform Provider.

Auth0 CLI - Partials API Support

September 19, 2024

added

SaaStart: Multi-tenant B2B SaaS Admin Dashboard in minutes

Copied to clipboard

We're happy to announce SaaStart: a complete B2B SaaS reference application built using Next.js, Radix UI and Auth0 by Okta. Clone the repo to get a head start on the capabilities that you'll need to support enterprise customers of your SaaS app - like multi-tenant user management and access controls, security policies, self-service Single Sign-On configuration and more...

Give us a holler in the Auth0 community if you have any questions!

SaaStart

September 18, 2024

Version 202437

added

Test Custom DB scripts with a specific Node runtime version

Copied to clipboard

You are now able to individually test a Custom Database script for a specific Node runtime version.

Test specific runtime version for Custom DB scripts

This will help to validate script changes against a target runtime version before you modify the default global tenant configuration for Extensibility runtime.

You can read more about how to use this feature in our documentation.

September 17, 2024