Skip to main content
Third-party applications are applications owned and operated by an external organization—a partner, independent developer, or AI agent—that authenticate your users and access your APIs. Unlike first-party applications that you directly control, third-party applications operate independently: you grant them access to your resources, but you cannot control what they do with that access. To learn more about the differences between first-party and third-party applications, read First-Party and Third-Party Applications. Third-party applications have the following unique characteristics:
  • Enhanced security controls: Auth0 enforces enhanced security controls for third-party applications, ensuring external applications can only access resources you explicitly authorize. Features intended for first-party use cases are not available.
  • User Consent: Auth0 always requires user consent when a third-party application requests access to APIs. Consent cannot be skipped.
  • Connections: Third-party applications can only authenticate users through domain-level connections. To learn more, read Promote Connections to Domain Level.

​
Use cases

Common third-party application use cases include:
  • Partner integrations: External partners build applications that call your APIs on the user’s behalf. For example, a CRM vendor integrates with your platform so that mutual customers can sync data between both products.
  • AI agents and MCP clients: AI-powered tools such as Claude Code, VS Code with Copilot, or custom MCP servers connect to your APIs to perform actions on the user’s behalf. To learn more, read Auth for MCP.
  • Developer ecosystems: You expose APIs for external developers to build applications on your platform, whether through a developer portal, a marketplace, or Dynamic Client Registration.
  • Cross App Access (XAA): A workforce application in another organization’s tenant accesses your APIs through a trust relationship, where the requesting application is modeled as a third-party application in your tenant. To learn more, read Cross App Access.

​
Supported client types

Third-party applications support both confidential and public client types:
Client typeApplication typeUse case
ConfidentialRegular Web AppServer-side partner integrations
PublicSingle Page AppBrowser-based partner widgets
PublicNativeMobile partner applications

​
Supported grant types

Third-party applications support:
  • authorization_code with mandatory PKCE
  • refresh_token
Additional grant types such as client_credentials are planned for a future release.

​
Get started

To set up a third-party application in Auth0, follow these steps:

​
Step 1: Create the application

Create a third-party application using the Auth0 Dashboard or the Management API.

​
Step 2: Configure API access

Third-party applications always require explicit authorization to access your APIs, even when the API’s access policy is set to Allow All. You configure API access policies through client grants. You can configure default permissions that apply to all third-party applications automatically. This is useful in cases where you manage many third-party applications or use Dynamic Client Registration. To learn more, read Default Permissions for Third-Party Applications. You can also define specific permissions for individual applications through client grants. Per-application permissions take precedence over the defaults. To learn more, read Configure client grants.

​
Step 3: Configure connections

Third-party applications can only authenticate users through connections promoted to the domain level. Domain-level connections are available to all third-party applications in the tenant. To promote a connection to the domain level, read Promote Connections to Domain Level. When a user authenticates through a third-party application, Auth0 displays a consent dialog asking the user to approve the requested permissions. Consent is always required for third-party applications and cannot be skipped. To learn more, read User Consent and Third-Party Applications.

​
Dynamic Client Registration

Dynamic Client Registration creates third-party applications with enhanced security controls by default. Before enabling DCR for third-party applications, you must configure default API permissions so dynamically registered clients can access your APIs.

​
Learn more