Skip to main content
The End of Life (EOL) date of Rules and Hooks will be November 18, 2026, and they are no longer available to new tenants created as of October 16, 2023. Existing tenants with active Hooks will retain Hooks product access through end of life.We highly recommend that you use Actions to extend Auth0. With Actions, you have access to rich type information, inline documentation, and public npm packages, and can connect external integrations that enhance your overall extensibility experience. To learn more about what Actions offer, read Understand How Auth0 Actions Work.To help with your migration, we offer guides that will help you migrate from Rules to Actions and migrate from Hooks to Actions. We also have a dedicated Move to Actions page that highlights feature comparisons, an Actions demo, and other resources to help you on your migration journey.To read more about the Rules and Hooks deprecation, read our blog post: Preparing for Rules and Hooks End of Life.
Because we plan to remove Rules and Hooks functions in 2026, you should create new Rules or Hooks only in your Development environment and only to test migration to Actions.To learn how to migrate your Rules to Actions, read Migrate from Rules to Actions. To learn how to migrate your Hooks to Actions, read Migrate from Hooks to Actions.
Our default email flow can address the requirements of most applications. Sometimes, however, you may require more flexibility, such as when implementing:
  • localization
  • custom Redirect To URLs based on user or tenant
  • different email templates per application or tenant
The Auth0 provides endpoints to help you manage your email flow to control when and how emails are sent. If necessary, you can also implement your own Custom Email endpoints and use the Auth0 Management API endpoints to help manage the rest of the flow.

​
Verification emails

A verification email should be sent to every user for which the email_verified property is false. Typically, these are users in database connections or users authenticating with social providers that do not validate email addresses upon new user registration. You can send verification emails in more than one way:
  • Management API
  • Rules
The Send an email address verification email endpoint sends the user an email prompting them to verify their email address.
curl --request POST \
  --url 'https://{yourDomain}/api/v2/jobs/verification-email' \
  --header 'authorization: Bearer {yourMgmtApiAccessToken}' \
  --header 'content-type: application/json' \
  --data '{ "user_id": "{userIdOfVerifyEmailRecipient}", "client_id": "{yourAppClientId}","identity": {"user_id": "5457edea1b8f22891a000004","provider": "google-oauth2"}, "organization_id": "{yourOrganizationId}" }'

​
Require verified email for login

You can require users to verify their email before logging in with a rule: 
function (user, context, callback) {
  if (!user.email_verified) {
    return callback(new UnauthorizedError('Please verify your email before logging in.'));
  } else {
    return callback(null, user, context);
  }
}

​
Custom redirects

A custom redirect is useful when you want to direct users to certain URLs based on user attributes or on the tenant. The Auth0 Management API provides a Create Email Verification Ticket endpoint that generates the verification link for each user. This endpoint allows you to specify the result_url to which users will be redirected after they have validated their email address by clicking the link in the verification email. We recommend AllowList the URL in the Auth0 Dashboard. For details, see Add Addresses to AllowList.

​
Welcome emails

A welcome email is sent to users once they have verified their email address.

​
Send welcome email using your own API

Using a rule, you can call your API to send a welcome email only if the user’s email address has been verified and the email has not been sent previously. 
function (user, context, callback) {

  const request = require('request');

  if (!user.email_verified || user.welcome_email_sent) {
    return callback(null, user, context);
  }

  request.post({
    url: 'https://yourapi.yourcompany.com/mail/welcome',
    json: {
      user: user,
      context: context,
      secretToken: configuration.MY_SECRET_TOKEN,
    },
    timeout: 5000
  }, function(err, response, body){
    if (err)
      return callback(new Error(err));

    // Email sent flag persisted in the user's profile.
    user.app_metadata.welcome_email_sent = true;
    return callback(null, user, context);
  });
}

​
Password reset emails

You can create a password change ticket using the Auth0 Management API Create a Password Change Ticket endpoint, and then send the password change ticket URL in an email to the user. When the user clicks the link, they will be prompted to reset their password through the flow.

​
Learn more