Grant Per-Application Access to an Organization

Auth0 allows you to grant applications access to an Organization to control which applications members of that Organization can log in to. By default, Organizations use an implicit access model in which members can access any application that has:

enabled Auth0 Organizations
a configured active connection

When you enable per-application access for an Organization, only applications you explicitly allow are accessible to its members. You configure per-application access per Organization. When you enable it for one Organization, other Organizations in your tenant are not affected.

Before you start

To configure per-application access:

Your Management API token must have the following scopes: update:organizations and create:organization_clients.
Your application must have Organizations enabled.
Configure your application to use authorization_code or implicit grant types. Applications without these grant types can be associated with an Organization but the Member Access setting has no effect on login.
For Early Access, each Organization supports up to 100 user-facing application associations.

Enable per-application access

When you enable per-application access for an Organization, you switch the Organization from implicit to explicit access enforcement. Members can only log in to applications you have explicitly granted access to. You can pre-configure application grants before enabling enforcement. Auth0 stores grants you add while per-application access is off, and they take effect when you turn it on. When per-application access is enabled, Auth0 blocks first-party applications without an explicit grant. Third-party applications without an explicit grant continue to follow the Organization’s third-party application access policy. To override the policy for a specific third-party application, add it to the list and set its Member Access directly.

Auth0 Dashboard
Management API

Navigate to Auth0 Dashboard > Organizations and select the Organization.
Select the Applications tab.
Enable the Per-Application Access toggle.
Select Save.

Make a PATCH request to the Update an Organization endpoint with is_app_entitlement_active set to true.

cURL

curl --request PATCH \
  --url 'https://YOUR_DOMAIN/api/v2/organizations/ORG_ID' \
  --header 'Authorization: Bearer YOUR_MANAGEMENT_API_TOKEN' \
  --header 'Content-Type: application/json' \
  --data '{
    "is_app_entitlement_active": true
  }'

Parameter	Description
`is_app_entitlement_active`	Controls if explicit per-application access is enforced for this Organization. Set to `true` to enable. Defaults to `false`.

Grant access to an application

When you add an application to an Organization, you control if members can log in through that application with the Member Access setting.

Auth0 Dashboard
Management API

Navigate to Auth0 Dashboard > Organizations and select the Organization.
Select the Applications tab.
Select + Add Application.
Search for and select the application.
Enable Member Access to allow Organization members to log in through this application.
Select Save.

To update member access for an existing application association, toggle Member Access on or off in the applications table and select Save.Check the Authentication column to determine whether the application supports user-based login. If an application’s grant types do not include authorization_code or implicit, Authentication shows Not applicable and the Member Access toggle is disabled. To enable member access for that application, update its grant types in the application’s settings.Third-party applications (strict) can also be added and appear in the table with a Third-party label. Adding a third-party application and setting Member Access overrides the Organization’s Third-Party Application Access policy for that specific application.

Make a POST request to the Create Organization Client Associations endpoint. You can add up to 10 applications per request, up to a maximum of 100 per organization.

cURL

curl --request POST \
  --url 'https://YOUR_DOMAIN/api/v2/organizations/ORG_ID/clients' \
  --header 'Authorization: Bearer YOUR_MANAGEMENT_API_TOKEN' \
  --header 'Content-Type: application/json' \
  --data '{
    "clients": [
      {
        "client_id": "YOUR_CLIENT_ID",
        "use_for_member_access": true
      }
    ]
  }'

Parameter	Description
`client_id`	The Client ID of the application to associate with the Organization.
`use_for_member_access`	When `true`, Organization members can log in through this application when per-application access is enabled. Only takes effect for applications with `authorization_code` or `implicit` grant types. Defaults to `false`.

You can associate machine-to-machine applications with an Organization and set use_for_member_access, but it has no effect on member login. You can pre-configure this value before converting the application to a user-facing type.

Revoke access to an application

Auth0 Dashboard
Management API

Navigate to Auth0 Dashboard > Organizations and select the Organization.
Select the Applications tab.
Select the overflow menu (…) next to the application and select Remove.

Make a DELETE request to the Delete Organization Client Associations endpoint. You can remove up to 10 applications per request. The operation is idempotent — removing an association that does not exist does not return an error.

cURL

curl --request DELETE \
  --url 'https://YOUR_DOMAIN/api/v2/organizations/ORG_ID/clients' \
  --header 'Authorization: Bearer YOUR_MANAGEMENT_API_TOKEN' \
  --header 'Content-Type: application/json' \
  --data '{
    "clients": [
      { "client_id": "YOUR_CLIENT_ID" }
    ]
  }'

List an Organization’s applications

Use the Management API to retrieve all applications associated with an Organization, including the member access status for each.

cURL

curl --request GET \
  --url 'https://YOUR_DOMAIN/api/v2/organizations/ORG_ID/clients' \
  --header 'Authorization: Bearer YOUR_MANAGEMENT_API_TOKEN'

The response includes each associated application and its use_for_member_access value. The response uses checkpoint pagination.

Limitations

Each Organization supports up to 100 user-facing application associations at Early Access. This limit applies to applications with use_for_member_access eligible types (SPA, Regular Web Application, Native). Machine-to-machine association limits are subject to change during Early Access.
Connection-level and client-level settings cannot bypass per-application access enforcement. Third-party applications not explicitly listed in an Organization’s Applications tab are not subject to per-application access enforcement — they continue to follow the organization’s Third-Party Application Access policy.

Manage Users

Manage Access

Grant Per-Application Access to an Organization

Before you start

Enable per-application access

Grant access to an application

Revoke access to an application

List an Organization’s applications

Limitations

Learn more

Before you start

​Enable per-application access

​Grant access to an application

​Revoke access to an application

​List an Organization’s applications

​Limitations

​Learn more

Enable per-application access

Grant access to an application

Revoke access to an application

List an Organization’s applications

Limitations

Learn more