User Search v3 (Generally Available for AWS).

Authorization: RBAC (Generally Available for AWS now includes Geo-HA deployments).

Breached Password Anomaly Detection (Generally Available as a shared service and now includes Customer Hosted deployments). 

Added support for SparkPost as custom email provider. 

Breached Password Anomaly Detection (Generally Available as a shared service and now includes Customer Hosted deployments).

Added support for SparkPost as custom email provide.

A modal with a warning will be preseted to confirm client credentials grant desactiviation when switching to a conflicting state (eg. Changing the authentication endpoint or switching the application type).

A proper error is displayed when trying to use native social flow but Sign in with Apple is disabled.

Added support for emails with Unicode characters. 

Improved error message when using a password too common.

Breached Password Database name can be customized on the Configuration Dashboard.

GET /api/v2/users-by-email support case insensitive search

Fixed a bug allowing tenants to be created that overlap with reserved subdomains.

Fixed a display bug on Api test tab at the Auth0 Dashboard when the user has more than 100 clients.

Fixed issues with  field validations when configuring logs offloading on the Configuration Dashboard.

`connections.disconnected_at` is updated when socket is close on AD/LDAP hub 

Various fixes when enabling authorization and breach password.

Fixed copy to clipboard button on the Auth0 Dashboard.

Removed the endpoint `/public/api/emails/send`.

1911.0 (21819.536)

Fixed an issue loading some UI modules in the Management Dashboard.

Enable `user_metadata.locale` fields for unmigrated users for password reset flow.

Enabled all TCP connections to keep alive for log offloading.

Updated tenant specific error pages for bewit middleware.

1911.1 (21819.549)

Sign in with Apple is now Generally Available.

Added the ability to have zone based configuration allowing different environment configurations for each AWS region.

Includes many enhancements, bugs, and security enhancements. 

PSaaS Configuration can now be grouped by Zones. 

 Support for Sign in with Apple Generally Available. 

Allowed to set the client id and secret when creating an API client. 

ClientID are ensured to be globally unique. 

Validated SMTP Host is not from a local/private subnet in emails providers. 

Enhanced PSaaS nodes security by only having auth0 services to only listen to UNIX sockets.

Added rate limiting for access token exchange. 

When viewing Machine to Machine applications in the API screen we changed the terminology for Scopes to permissions.

We now require username when using Active Directory connections.

Enhanced security to only allow access to RabbitMQ admin through localhost. 

Omitted sensitive attributes from email providers endpoint responses. 

Fixed an issue that may cause an uncaught error when a client cannot be found 

Fixed a bug that prevented Patching an empty scope array in the Authorization API.

1910.0 (21408.512)

The company name set on the Configuration Dashboard now accepts numbers.

Fixed a bug on the GPG keys that prevented PSaaS internal services to be updated.

Fixed validations and formats for Logs offloading and cloud resources options on the PSaaS Configuration dashboard.

Fixed a bug that incorrectly propagated zones configuration.

1910.1 (21408.517)

The OIDC connection is now generally available.


User Search v3 is available in BETA (non-production, AWS use only upon request).


Enhancements, Bug Fixes, and Security Fixes.


User Search v3 available in BETA (non-production use only).

OIDC Connection is out of BETA and now Generally Available.

Increased the notifications polling interval in Management Dashboard to 15 minutes from 2 minutes.

Updated third-party Logos in the Auth0 Management Dashboard.

Added the __device_id__ to the Tenant Logs for MFA events.

Made some UI styling and format enhancements to the SSO tutorials module in the Auth0 Management Dashboard.

Updated the Tenant Log message to exclude a deprecation date, when a tenant has disabled the ability to remove stale IDP attributes.

Updated UI design of Passwordless error status page.

UI enhancements to the IP and GSuite Enterprise Connections module in Auth0 Management Dashboard.

User session is now invalidated when changed password from a custom db connection.

Fixed bug that allows a user with an invalid email to be created when user has an extra dot “.” in local part.

Fixed a bug that required the state parameter for Twitter Social logins when using the new Universal Login experience.

Fixed a broken link on emails providers notification dialog. 

Fixed a bug that cause rules to lack context information when Auth0 is a SAML IDP.

Fixed a bug that might cause some broken links in emails when using custom domains.

Fixed a UI bug when loading SSO settings.

Fixed a bug in the Auth0 Management Dashboard that sowed the password policy as good, but the policy was undefined. 

Deprecating the Markdown syntax for Passwordless email templates, if you deselect markdown you won't be able to reselect it again.

Ensure constant time for password verification.

1909.0 (21109.479 )

Removing ability to access the `/status` endpoint.

1909.1 (21109.480)

Fixed issue that might cause a service disruption when rate limiting is not enabled

1909.2 (21109.484)

Fixes improperly controlled modification of object attributes.

1909.3 (21109.485)

Additional fixes for improperly controlled modification of object attributes.

1909.4 (21109.500)

Added ability to manage PSaaS CLI keys using the new Configuration Dashboard.


Added the abilty to backup Authorization: RBAC to the PSaaS CLI.


Many Feature Enhancements, Bug Fixes and Security Fixes.


Updated the RBAC policy to support the AWS API.

Added the ability to backup Authorization: RBAC's database using the PSaaS CLI.

Removed no longer supported section of the legacy Configuration UI for Root Tenant administrators.

Added the ability to manage PSaaS CLI keys through the new Configuration Dashboard.

Removed  the Name field from the "Postgres" section in the dashboard.

Enabled Brute Force Protection by default on Active Directory Enterprise Connections.

Created and associate the recovery code on the enrollment screen instead of when the first authenticator is associated.

Updated the /u/email-verification handler to be the main handler for all email verification links.

Added client name to users' devices tab in the Management Dashboard.

Added the ability to reset the Multi-Factor for a user when they have Guardian multi-factors.

Added a 404 error message when client not found on WsFederation URL.

Made client available on req.samlp after resuming samlp-authorize.

Changed 400 error message to __'Returned user does not have an expected user_id value'__ in API2.

Added a new log type dropdown filter to the logs. This works in conjunction with the existing free-text filter and acts as a boolean AND.

Modified Management Dashboard's Scope Picker to handle third party APIs.

The PSaaS environments can now be configured to remove attributes from the user normalized profile if they are not returned from the IdP (submit a support ticket to enable on existing tenants).

Added a returnTo WS-Fed logout validation (requires a support ticket to enable).

Disabled send test mail feature when there are unsaved changes.

Added public IPs banner in email providers.

Changed toggle behavior on main trigger switches.

Fixed the word application for API in Manhattan.

Added __code_challenge_methods_supported__ to discovery.

Added support for parallel nodes in sequential updates.

Allowed setting the WAAD strategy version from the Management API v2.

Improved the validation for user_id on the `POST /api/v2/users` endpoint.

Updated logos for Social connections in the Management Dashboard.

Updated Anomaly Detection to add __device_id__ to the pwdleak event.

Added additional validation for username when a user is imported from an external database with import mode configured.

When setting up Authorization: RBAC for the first time the PSaaS platform will now setup the database role creation by default.

Added a display message warning a user when no search results match their search criteria when searching for logs.

 Fixed a bug preventing user search from returning results when searching for users with property names containing forward and backward slashes (i.e. `/api/v2/users?fields=app_metadata.test%2Fslash`).

Fixed a bug preventing the Configuration Dashboard to fail if a node cannot resolve the URL for the Management Dashboard.

Fixed a bug preventing the SMTP Password from being set on the Configuration Dashboard.

Fixed a bug in the Management Dashboard's User Profile view that rendered a non-URI encoded path in the address bar.

Fixed a typo in the block user popup message.

Fixed a bug when deleting a user when the tenant has multiple users with the same __identities.user_id.__

Fixed the Client settings help text displaying if the secret is or is not __base64 __encoded.

Fixed a bug preventing  user.lastLogin and user.lastIP from being set when logging in with __conn.options.set_user_root_attributes == 'on_first_login`__.

Fixed show __clientName__ on Go back button.

Fixed __GET /api/v2/roles/{id}/permissions__ endpoint for 3rd party APIs.

Fixed an error when SMS or email user changes trigger duplicate key errors.

Fixed a bad request issue with email providers on disable.

Fixed a bug that deleted an Email Provider's credential upon a change to the configuration.

Fixed fallback used during LDAP authentication flow .

Fixed code snippet sample string delimiters to double quotes for languages that do not support single quote string delimiters.

Fixed a bug that returned a 500 error when fetching a role that does not exist.

Fixed an issue when creating a custom database user where the __user_id__ was set to undefined using the new Universal Login Experience.

Fixed help tips for friendship permissions on Weibo social connection.

Fixed a bug preventing the Management Dashboard's User Profile view from throwing an error when a User's __user_id__ contains one or more backslashes.

Improved the warning displayed in the Management Dashboard's Tenant Delete Confirmation view when trying to delete a Tenant.

Changed `options.scopes` to `options.scope` for the Sign In with Apple.


Removed Improved Pipeline for i/oauth2/authorize.

Sanitized input of cross-origin temporary login_ticket.

Sanitized username input in the URL for the IdP request in passwordless signup.

Disabled Mandrill from logging email content by default.

1908.0 (20817.435)

Fixed an issue with replication to User Search v2 causing users to be out of sync.

Fixed a potential configuration file disclosure through e-mail attachments.

1908.1 (20817.463)

Fixed issue that might cause a service disruption when rate limiting is not enabled. 

1908.2 (20817.473)

1908.3 (20817.481)

Fixes improperly controlled modification of object attributes.



1908.4 (20817.486)

1908.5 (20817.503)

New Email Multi-Factor Authentication provider.

OpenID Connect and Sign In with Apple connections in Beta.

Availability of the __Sign In with Apple (Beta)__ social connection.

Availability of the __OpenID Connect (Beta)__ enterprise connection.


The `enabled_locales` property in the _/tenants/settings_ endpoints cannot be set to __null__.

Increased margins in the Tenant Logs section of the Management Dashboard.

Added support to configure custom app URLs for MFA pages. 

Preserve description of custom database errors when using the Universal Login Page.

Improved dashboard error messages when tenant creation fails.

Added email Multi-Factor Authentication as an additional MFA provider.

Added validation of the _realm_ parameter in the embedded login flow. 

Preserve errors thrown by password change scripts when using the Universal Login Page.

Enabled the new Configuration Dashboard by default.

Added Universal Login email verification support.

Improved username validation error messages during sign up. 

Use the tenant enabled languages in the Device Authorization flows.

Redirect the user to the confirmation page when the verification code is included in the initial request Device Authorization flow. 

Avoid displaying _Try another method_ when the user has only one enrolled factor.

Added he Assignment column to user roles tab in the Management Dashboard.

Increased the number of connections displayed in the user creation dialog to 10. 

Removed the www-authenticate headers during failed client authentication request to the token endpoint. 

Added support for regional variants for languages in Universal Login.

Modified error messages from /co/authenticate to prevent username enumeration.

Added client-side validation of passwords to Universal Login.

Added language selection section in tenant settings.

Improved error messages returned by the Management API when trying to create verification email jobs on disabled connections. 

Improved error messages returned by the Management API when trying to not passing a users if to the account linking endpoint. 

Added the `Content-Language` header to the Universal Login pages. 

Increased the number of roles that can be assigned to a user in a single Management API call to 1000. 

Disabled basic authentication in the Management API. 

Enable Ubuntu extended support environments hosted by customers. 

Fixed issue in the Dashboard Code Editor that caused it to extend beyond the page boundaries. 

Fixed an uncaught error caused by invalid messages sent by the AD/LDAP connector. 

Fixed uncaught error in dashboard when the Universal Login Page primary color is not defined. 

Fixed error that reported a failure during connection removal even when it succeeded. 

Fixed an issue in the dashboard user page that caused the metadata editor beyond the page boundaries. 

Fixed an issue in the Management Dashboard that caused slow response while searching users that have special characters in their names. 

Fixed error that caused MFA API to fail when the user did not complete the enrollment. 

Fixed an issue that prevented users authenticated with Active Directory to authenticate when passing the connection parameter. 

Fixed an issue that prevented the usage of the custom branding in Universal Login confirmation pages. 

Fixed an error that prevented connection activation alerts from being displayed in the Application details page in the Dashboard. 

Fixed an error that allowed users to use Email MFA without having any other factors enrolled. 

Fixed an uncaught error in Universal Login when the client had no connections enabled. 

Fixed an issue that prevented reordering rules with order: 0. 

Fixed uncaught error caused when a custom database connection does not have configured custom scripts. 

Fixed uncaught errors when saving mail notifications in tenant logs. 

Fixed an error in Universal Login that prevented users to verify their email address during sign up. 

Fixed an issue with the Management API that returned the full profile when only `update:current_user_metadata` scope was present in the bearer token. 

Fixed an issue that caused the deployment of the Authorization database to fail in Managed Private Cloud. 

Fixed an issue that caused the SAML2 add-on Debug link to fail. 

Fixed message returned when updating the SNS endpoint using the Management API. 

Fixed an error that caused push notifications to fail when using Universal Login. 

Fixed an issue that overwrites the user metadata when performing an upsert and the imported user has not metadata. 

Fixed sidebar scrolling in the Private Cloud configuration dashboard. 

Fixed an issue that prevented the Private Cloud configuration dashboard form working when the environment certificates were invalid. 

Auth0

Private Cloud Release Notes

Private Cloud Release Notes

Get the latest release notes for new features and updates in Auth0.