Skip to main content
The My Account API is available in Limited Early Access. To request access, contact your Auth0 account manager. To learn more about Auth0’s product release cycle, read Product Release Stages.
The Auth0 My Account API provides a dedicated set of endpoints for users to manage their own account information. Customers can use these APIs to build self-service experiences in their applications or progressively add details to a user account. The My Account API operates within the context of the currently logged-in user and can be used directly within user-facing applications.
Using Auth0 domain vs. custom domainThe My Account API supports using your canonical Auth0 domain or your custom domain, but you must use the same one throughout the entire process, including:
  • Getting an access token
  • Setting the audience value
  • Calling the My Account API endpoint
For more information, read Custom Domains.

​
Activate the My Account API

You can activate the My Account API for your tenant in the :
  1. Navigate to Authentication > APIs.
  2. Locate the MyAccount API banner.
  3. Select Activate.

​
Get an access token

You can get an for the My Account API in the same way you’d get an access token for one of your own APIs.
If you’re going to allow the My Account API to perform sensitive operations (such as enrolling an authentication method), we strongly recommend that you use step-up authentication to enforce additional security policies through multi-factor authentication (MFA).
If you’re using , read the following articles: If you’re using embedded login, read the following articles:

​
Audience

The of the My Account API is https://{yourDomain}/me/.

​
Scope

The My Account API supports the following scopes:
ScopeDescription
create:me:authentication-methodsAllows the user to enroll a new authentication method.

​
Examples

​
Universal Login with authorization code flow

Step 1: Request authorization code
Step 2: Exchange code for access token

​
Embedded login with native passkeys

Step 1: Request login challenge
Step 2: Authenticate existing user

​
Endpoints

The My Account API functionality is currently limited to Native Passkey Enrollment. Auth0 will add support for more self-service capabilities in the future.

​
Authentication methods

Enroll an authentication method
Allows the user to enroll a new authentication method (such as a passkey). ENDPOINT POST https://{yourDomain}/me/authentication-methods SCOPES create:me:authentication-methods BODY PARAMETERS
ParameterData typeRequired?Description
typestringRequiredThe type of authentication method. Available values: passkey.
connectionstringOptionalThe name of the connection on which to create the new authentication method.
identity_user_idstringOptionalThe identifier of the current user identity. Used with linked accounts.

​
Rate limits

During Early Access, the My Account API is limited at a tenant level to 25 requests per second.

​
Cross-Origin Requests

If you intend to call the My Account API directly from a browser-based application (like a Single Page Application) running on a different domain than your Auth0 tenant, you will encounter browser security policies known as Cross-Origin Resource Sharing (CORS). By default, browsers block these cross-origin requests. To allow your application to successfully make requests to the API, you must add your application’s domain (its “origin”) to your client’s configuration:
  1. Navigate to Dashboard > Applications. Select the application to view.
  2. Under Cross-Origin Authentication, toggle on Allow Cross-Origin Authentication.
  3. Locate Allowed Origins (CORS), and enter your application’s origin URL.
  4. Select Save.
To learn more, read Configure Cross-Origin Resource Sharing.
If you do not need to use CORS for your application, ensure that Allow Cross-Origin Authentication is toggled off. Adding your application’s URL to this list tells Auth0 to trust requests from that origin, allowing your client-side application to access the API.