Configure Third-Party Applications

​

Prerequisites

• An Auth0 tenant with at least one API (resource server) configured
• At least one connection promoted to the domain level (for user-facing flows)

​

Create a third-party application

• Auth0 Dashboard
• Management API

1. Navigate to Applications > Applications.
2. Select Create Application.
3. Enter a name for the application and select the application type:
   • Regular Web App for server-side confidential clients
   • Single Page App for browser-based public clients
   • Native for mobile or desktop public clients
4. Check the This application is owned by a third party toggle.
5. Select Create.

Make a POST request to the /api/v2/clients endpoint with the following request body:

Parameter	Type	Description
name	String	Required. The name of the application.
is_first_party	Boolean	Indicates whether the application is first-party (true) or third-party (false).
app_type	String	The type of application (e.g., regular_web, native, spa, non_interactive).
callbacks	Array	A list of allowed callback URLs for the redirect after authentication.
grant_types	Array	A list of types of OAuth2 grants this client is allowed to use. Third-party applications support authorization_code, refresh_token, and client_credentials. To learn more, read Security Controls for Third-Party Applications.
token_endpoint_auth_method	String	The authentication method for the token endpoint (e.g., client_secret_post).

If successful, Auth0 creates the application with a tpc_ Client ID prefix, authorization_code and refresh_token grant types, and sets third_party_security_mode to strict, indicating that enhanced security controls are enabled.

{
  "client_id": "tpc_aBcDeFgHiJkLmNoPqRsTuV",
  "third_party_security_mode": "strict",
  "is_first_party": false,
  "name": "Partner Application",
  "grant_types": ["authorization_code", "refresh_token"],
  ...
}

Parameter	Type	Description
client_id	String	The unique identifier for the application with a tpc prefix to indicate it’s a third-party application created with strict mode enabled.
third_party_security_mode	String	Defines the security profile. Set to strict to enforce enhanced security constraints for third-party apps.
is_first_party	Boolean	Must be set to false when using strict security mode to identify the app as third-party.
name	String	The display name of the application.
grant_types	Array	The OAuth2 grant types this application is authorized to use (e.g., authorization_code).

​

Configure API access policies

• Per-application permissions: Apply granular permissions to each application in your tenant.
• Default permissions for all third-party applications: Apply default permissions to all third-party applications in your tenant.

​

Per-application permissions

• Auth0 Dashboard
• Management API

1. Navigate to Applications > APIs and select the API.
2. Go to the Settings tab.
3. Scroll to Application Access Policy and set User-Delegated Access and Client Access to Per-app authorization.
4. Select Save.

When setting per-application permissions, you must individually authorize API access for each application:

1. Navigate to Applications > APIs and select the API.
2. Go to the Application Access tab.
3. Scroll to the application, select Edit, and then Grant Access for User-Delegated Access and/or Client Access. Then, select your desired permissions.
4. Select Save.

​

Default permissions for all third-party applications

• Auth0 Dashboard
• Management API

1. Navigate to Applications > APIs and select the API.
2. Go to the Settings tab.
3. Scroll to Default Permissions for Third Party Apps.
4. Select Authorized for User-Delegated Access or Client Access.
5. Select the scopes to grant, then select Save.

Make a POST request to the /api/v2/client-grants endpoint with the following request body:

Parameter	Type	Description
default_for	String	Specifies if this grant is automatically applied to certain app types. Set to third_party_clients to ensure all third-party apps have access to this API by default.
audience	String	The unique identifier (URI) of the API the grant is being created for.
scope	Array	A list of permissions (scopes) that are allowed as part of this grant.
subject_type	String	Defines the type of application access allowed for the API: user: Used for user-delegated access, which corresponds to flows that generate a token associated with an end-user. client: Used for machine-to-machine access, such as the Client Credentials Flow.

​

Configure connections

1. Navigate to Auth0 Dashboard > Authentication and select the connection type (Database, Social, Enterprise).
2. Select the connection you want to use with third-party applications.
3. Enable the Promote Connection to Domain Level toggle.

​

Configure Organizations access

1. The connection must be promoted to the domain level, as described in the section above.
2. The Organization must have third_party_client_access set to allow.

​

Behavior summary

​

Configure open redirect protection

• Redirect to the application’s callback URL on authentication errors
• Expose application.callback_domain in email templates

• Auth0 Dashboard
• Management API

1. Navigate to Applications > Applications and select the third-party application.
2. Go to the Settings tab and scroll to Open Redirect Protection.
3. Toggle the setting on or off.
4. Select Save.

Set the redirection_policy property when creating or updating the application:

curl --request PATCH \
  --url 'https://{yourDomain}/api/v2/clients/{CLIENT_ID}' \
  --header 'Authorization: Bearer {YOUR_MANAGEMENT_API_TOKEN}' \
  --header 'Content-Type: application/json' \
  --data '{
    "redirection_policy": "allow_always"
  }'

Set to open_redirect_protection to enable (default) or allow_always to disable.

​

Dynamic Client Registration

​

Learn more

• Third-Party Applications
• Security Controls for Third-Party Applications
• User Consent and Third-Party Applications
• Dynamic Client Registration
• Promote Connections to Domain Level