Get clients
Retrieve clients (applications and SSO integrations) matching provided filters. A list of fields to include or exclude may also be specified. For more information, read Applications in Auth0 and Single Sign-On.
- The following can be retrieved with any scope:
client_id,app_type,name, anddescription. - The following properties can only be retrieved with the
read:clientsorread:client_keysscope:callbacks,oidc_logout,allowed_origins,web_origins,tenant,global,config_route,callback_url_template,jwt_configuration,jwt_configuration.lifetime_in_seconds,jwt_configuration.secret_encoded,jwt_configuration.scopes,jwt_configuration.alg,api_type,logo_uri,allowed_clients,owners,custom_login_page,custom_login_page_on,sso,addons,form_template,custom_login_page_codeview,resource_servers,client_metadata,mobile,mobile.android,mobile.ios,allowed_logout_urls,token_endpoint_auth_method,is_first_party,oidc_conformant,is_token_endpoint_ip_header_trusted,initiate_login_uri,grant_types,refresh_token,refresh_token.rotation_type,refresh_token.expiration_type,refresh_token.leeway,refresh_token.token_lifetime,refresh_token.policies,organization_usage,organization_require_behavior. - The following properties can only be retrieved with the
read:client_keysorread:client_credentialsscope:encryption_key,encryption_key.pub,encryption_key.cert,client_secret,client_authentication_methodsandsigning_key.
Authorizations
Scopes
Query Parameters
Optional filter by the Client ID Metadata Document URI for CIMD-registered clients.
1 - 120Advanced Query in Lucene syntax.
Permitted Queries:
- client_grant.organization_id:{organization_id}
- client_grant.allow_any_organization:true
- Cannot be used in combination with other filters
- Requires use of the from and take paging parameters (checkpoint paginatinon)
- Reduced rate limits apply. See Rate Limit Configurations
Response
Clients successfully retrieved.
- Option 1 · object[]
- Option 2 · object
- Option 3 · object
The type of application this client represents
native, spa, regular_web, non_interactive, resource_server, express_configuration, rms, box, cloudbees, concur, dropbox, mscrm, echosign, egnyte, newrelic, office365, salesforce, sentry, sharepoint, slack, springcm, zendesk, zoom, sso_integration, oag Whether this client conforms to strict OIDC specifications (true) or uses legacy features (false).
Comma-separated list of URLs allowed to make requests from JavaScript to Auth0 API (typically used with CORS). By default, all your callback URLs will be allowed. This field allows you to enter other origins if necessary. You can also use wildcards at the subdomain level (e.g., https://*.contoso.com). Query strings and hash information are not taken into account when validating these URLs.
Comma-separated list of allowed origins for use with Cross-Origin Authentication, Device Flow, and web message response mode.
List of grant types supported for this application. Can include authorization_code, implicit, refresh_token, client_credentials, password, http://auth0.com/oauth/grant-type/password-realm, http://auth0.com/oauth/grant-type/mfa-oob, http://auth0.com/oauth/grant-type/mfa-otp, http://auth0.com/oauth/grant-type/mfa-recovery-code, urn:openid:params:grant-type:ciba, urn:ietf:params:oauth:grant-type:device_code, and urn:auth0:params:oauth:grant-type:token-exchange:federated-connection-access-token.
Defines the requested authentication method for the token endpoint. Can be none (public client without a client secret), client_secret_post (client uses HTTP POST parameters), or client_secret_basic (client uses HTTP Basic).
none, client_secret_post, client_secret_basic Defines how to proceed during an authentication transaction when client.organization_usage: 'require'. Can be no_prompt (default), pre_login_prompt or post_login_prompt. post_login_prompt requires oidc_conformant: true.
no_prompt, pre_login_prompt, post_login_prompt Defines the available methods for organization discovery during the pre_login_prompt. Users can discover their organization either by email, organization_name or both.
1Method for discovering organizations during the pre_login_prompt. email allows users to find their organization by entering their email address and performing domain matching, while organization_name requires users to enter the organization name directly. These methods can be combined.
email, organization_name Controls whether a confirmation prompt is shown during login flows when the redirect URI uses non-verifiable callback URIs (for example, a custom URI schema such as myapp://, or localhost).
If set to true, a confirmation prompt will not be shown. We recommend that this is set to false for improved protection from malicious apps.
See https://auth0.com/docs/secure/security-guidance/measures-against-app-impersonation for more information.
Indicates whether network binding should be enforced when consuming an anonymous session transfer token. If set to 'ip', consumption must happen from the same IP as the issuer. If set to 'asn', consumption must happen from the same ASN as the issuer. If set to 'none', binding is not enforced. Default value is ip.
ip, asn, none Security mode for third-party clients. strict enforces enhanced security controls: OAuth 2.1 alignment, explicit API authorization, and a curated set of supported features. permissive preserves pre-existing behavior and is only available to tenants with prior third-party client usage. Set on creation and cannot be modified.
strict, permissive Controls whether Auth0 redirects users to the application's callback URL on authentication errors or in email verification flows. open_redirect_protection shows an error page instead of redirecting, and hides the callback domain from email templates. allow_always enables standard redirect behavior. Defaults to open_redirect_protection for third-party clients. Only applies when is_first_party is false and third_party_security_mode is strict. To learn more, read Redirect protection.
allow_always, open_redirect_protection Indicates the type of external metadata used to register the client. This field is omitted for regular clients. The value cimd identifies clients registered via a Client ID Metadata Document. The value dcr identifies clients registered via Dynamic Client Registration.
cimd, dcr Indicates who created the external metadata client. The value admin indicates the client was registered via the Management API. The value client indicates the client was registered dynamically. This field is only present when external_metadata_type is set.
admin, client Indicates whether the Client ID Metadata Document at external_client_id is currently reachable. For clients with external_metadata_created_by set to client the status is calculated from the document; for admin it is always available. When absent, the status is assumed to be available.
available, unavailable