In order to provide services to your users, you must be able to identify who those users are. This process is called User Authentication. There are a number of ways to perform authentication of a user - via social media accounts, username and password, - and it’s often recommended that you go beyond a first factor for authenticating the user by enabling (MFA).
It’s important to consider both security and user experience when designing how you will authenticate your users. Providing for multiple primary factors, and/or enforcing more than one factor during authentication, are ways that you can provide both.
There are a number of things you will want to consider when looking at functionality and workflow:
Where will users enter their credentials?
How will you keep user credentials safe?
How will you maintain your authentication system?
How can you provide password authentication for your users?
How can you prevent hackers from trying to log in as your users?
How will you implement authentication in different kinds of applications?
How can you make login easy for your users when they come from different language backgrounds?
How will you provide a good user experience as you migrate away from any legacy authentication system?
What should you consider when integrating applications with Auth0?
Do you need to provide multi-factor authentication?
What do you do if you have a service that doesn’t have a way for the user to log in ahead of time?
Can you pass the same user from one API to another?
What do you do if you need to isolate users by organization?
How will you handle identifying which organization users belong to?
What’s the benefit of providing enterprise connections for your organizations?
Auth0 Universal Login provides users with a safe and secure experience - no matter whether you choose to provide for user ID/password credentials sign in, or allow the so-called Bring Your Own Identity scenarios provided via Social Login. There are also brand recognition benefits to centralizing the login experience with , even if you feel you will also have product-specific branding requirements. The Auth0 UI widgets typically used with Universal Login also provide out-of-the-box support with regards to internationalization for users with different language requirements, and out-of-the-box support for Auth0 features such as MFA and attack protection allow you to put barriers in place in order to prevent hackers attempting to access users’ accounts.Allowing users to sign in via user ID/password credentials means that you’re not reliant on the status of third-party for your users to access your system. You also have the means to require the credentials used to align with your corporate policies. Auth0 assists with this by providing you with multiple options in support of user ID/password logins, and the guidance provided will help you understand you can leverage these options. Adding social support at some stage, as an additional primary authentication factor, gives you added flexibility and can help you better understand your users without the need to question them further by leveraging the information already stored by the various social login providers.If you have an existing legacy identity store, you’ll also want to see User Migration. This section discusses the advantages of migrating to Auth0’s managed identity storage in terms of safety and security.For customer facing applications, Connect (OIDC) is the most frequently used industry standard protocol, and OIDC has first-class citizen support in Auth0. Auth0 provides support for various different approaches for integrating various different applications, so you’ll want to see the section on application integration for the information you’ll need to make an informed choice.When calling one API from another API, or from any situation where there is no authenticated user context - such as one or more cron jobs, report generators, or continuous integration/delivery systems - you will need a way to authorize the application instead of a user. This is a one step process where the application is authenticated (using a and secret) and then authorized in one call. You can learn more about this in our authorization work stream under machine-to-machine (m2m) authorization.Often companies need to segregate their users by organization and sometimes users can have access to more than one organization. Knowing which of these scenarios is relevant to your company will help define how to determine in which connection a user exists: whether you need to do it, when you need to do it, and how to accomplish it. See Home Realm Discovery to determine if this is something relevant to your company.
Do you have, or will you have, more than one application in your system? If the answer to this question is yes, then you will want a centralized sign in experience. To achieve a seamless (SSO) experience between multiple applications, it is critical to have a centralized location to redirect your users for authentication. This allows you a way to provide your users with a consistent experience if you add social authentication in the future, add third party applications to your system, or add multi-factor authentication as an option (or requirement) for your users - and also allow you to take advantage of new features for improving your users’ experience with little, if any, added development effort.
If you have more than one application, the best practice is to redirect to a centralized location to authenticate the user. With Auth0, this means taking advantage of Universal Login, which provides many security and user experience benefits out-of-the-box, including SSO.
Auth0 Universal Login makes authenticating users a short, easy process which can be accomplished in three easy steps (all of our Quickstarts demonstrate this and our SDKs hide the complexity for you too):
Home realm discovery (HRD) is the process of identifying which identity provider (or which connection in Auth0) the user belongs to before authenticating them. There are two ways HRD can occur:
Provide a way for the decision to be made at the application
Have Home Realm Discovery happen on the Universal Login page
Your system may need to do either or both methods so it is important to understand all approaches to HRD so that you can apply the one(s) that make the most sense to your applications.
A common way of determining which realm a user belongs to is when an application is branded for each organization. As part of this, an organization will typically have its own instance of the application, typically accessed via a different URL. This copy or instance can be physically isolated (running on a separate set of servers) or virtually isolated (running on shared servers) and is generally denoted through either a custom hostname (companyA.application1.yourcompany.com) or path (application1.yourcompany.com/companyA).
If your application already knows the specific connection (IdP) required then you can also pass that along when you redirect the user to /authorize, via use of the connection query parameter.
If this is the case for your application(s), then home realm discovery is a simple matter of storing the org_id with the organization-specific application configuration and sending that as the organization parameter when redirecting the user to Universal Login. Doing so will limit the user to that specific organization and its set of configured connections.
If an organization needs more than one IdP, then you may have to do a second round of Home Realm Discovery (once the organization has been identified). Auth0 will typically manage this for you if you are using the Organizations Feature.
If the user is shared between multiple organizations using a single identity, you must support Home Realm Discovery on the Universal Login Page. This will allow Universal Login to identify the user first and then present the realms appropriate for that user leading to a better user experience.Sending the organization and/or connection parameters can be achieved by adding them as a query parameter when you redirect the user to the /authorize endpoint. For more information, see the Authentication API docs. However, you will generally accomplish this using the SDK for whichever language your application is written in.
There are three main approaches to Home Realm Discovery:
Discover the realm through the user’s email subdomain.
Discover the realm by looking up a user identifier in some sort of map of an identifier to realm map.
Allow the user to choose or enter their realm (or organization).
In both of the first two approaches, you may consider doing “Identifier First Login”. This means that you present only the ability to enter an identifier first. After which, you collect the user’s identifier, and then, based on the identifier, you either automatically redirect the user or present a way for the user to enter their password if redirection is unnecessary. Auth0 provides implementation out of the box to take care of all of this, via the use of Universal Login.
Though it is possible to implement Identifier First Login or allow a user to select their organization at the application instead of on the Universal Login Page, this can add complexity with respect to single sign on as well as complexity associated with replicating that behavior in all of your applications. Instead Auth0 recommends implementing some form of HRD through Universal Login.
HRD through Universal Login using the email subdomain
The simplest way to implement home realm discovery on the universal login page is to utilize the email subdomain of the user’s identifier to map that to their Identity Provider. This, of course, only works in situations where the email subdomain will be a 1:1 mapping to an organization or at least to an Identity Provider.Auth0’s Lock widget or Universal Login can do this for you if you are using the domain map in an enterprise connection; however, if you want to build this yourself, you can, but it requires you to build a mapping of email subdomain to connection.Additionally, when using the Universal Login experience, the Organizations Feature will help you in two ways:
If you have not passed an org_id to /authorize when you initiated the login request, Auth0 will present the user with a prompt to enter the organization they belong to.
If the Organization has more than one IdP associated with it, Auth0 will present the user with buttons to choose the organization or a form to enter a username and password.
HRD through Universal Login using the Identifier to Realm Map
A second, more complex alternative is to store a map of identifiers to IdP and provide a public endpoint to access that information. Then on the Universal Login page, you can find the connection and redirect back to /authorize with the connection. The main drawbacks to this approach are latency and, more importantly, security when it comes to identifier discovery: if you’re using email addresses, this makes it much easier for someone to discover whether a particular email address is a user of yours.
Any public endpoint should have rate limiting applied to it to prevent hackers from using it to discover information and to prevent denial of service attacks.
The other option is to allow your users to choose from a list, if you don’t mind making public the list of organizations who use your product, or by allowing the user to enter their organization name explicitly. This would typically be done before redirecting the user to Universal Login. Once the user tells you which organization they belong to, you can redirect to Auth0 with the connection for that organization specified or have Auth0 simply prompt the user for their username and password if the connection is a database connection.
Nearly every B2C application provides the ability for its customers to create a new set of credentials. This is a common form of authentication that all users are familiar with.Username password authentication comes in multiple flavors at Auth0. If your application is a green-field application with no existing user base, then a simple Auth0 out-of-the-box Database Connection will give you everything you need to start authenticating your users. However, if you have a legacy user store (such as your own database of users or an existing LDAP system) you have a couple of different options for migrating your users as discussed in our guidance on User migration.However you end up provisioning the users for your database connection, the authentication of those users is quite similar. It requires you to present users with a form to enter their username and password. As mentioned in the guidance concerning Universal Login, the simplest and safest way to authenticate users with a username and password is to redirect them to a centralized login page and collect their username and password there. This allows Auth0 to determine whether they have already authenticated and skip the login form entirely when it’s not needed.
Collecting credentials only at the centralized login page will reduce the surface area for potential leak of user secrets. It will also reduce the need to collect credentials unnecessarily. See Universal Login for more information.
Once you’ve figured out how you want to authenticate your users, the next step is to determine how you will initiate that authentication. Each application will typically have its own starting point.
Native mobile applications (and desktop applications) should use the system browser for authentication, or they open themselves up to additional security risks. See Native vs. Browser Login on Mobile for more information.
As discussed, we’ve found that most of our customers use OpenID Connect (OIDC) as the industry-standard protocol when it comes to their customer-facing applications. Figuring out which OIDC flow to use is your first task, and you will want to start by reviewing the our grant mapping guidance in the first instance.If you want to allow anonymous users access to any part of our application then you need to determine if you will be redirecting right away or prompting your users to redirect only when required (or perhaps some combination of both; see Redirect Users After Login for further discussion). If users can deep link to a protected version (or area) of your site then you will need to determine the links to your application that will result in an automatic redirect to Auth0.
It is important to consider the user experience when someone first comes to your application. If your application supports anonymous user access (quite common for eCommerce applications) there are different scenarios to consider:
Are they returning to the application after having already logged in, or
If this is the first time they are accessing the application:
Have they already accessed a different application that uses the same Auth0 tenant,
Have they ever (or perhaps not in a long time) authenticated on this device or browser.
When an anonymous user accesses your application, it can often be desirable for the application to discover if the user has already logged into a different application in the same family, or to remember this user even if the application is a SPA with no state. For example, if you can determine that the user is already logged in, you might decide to have the UI header in the application skip displaying a login button and instead have an account or profile menu for the user. To accomplish this you will want to utilize “silent authentication”. Silent authentication will allow you to check to see if the user is logged in without prompting them to log in if they are not. Then the application can present a login button if necessary. If the user is logged in already, however, then you will receive tokens and will not have to present the user with a login button again.
Checking for a login session by redirecting to Auth0 can be helpful for your application, but if this will result in a lot of requests, you should employ a throttling mechanism to avoid latency and/or rate limiting.Calls to the Management API are subject to Auth0 Rate Limiting policy. You must take this into consideration, and to assist, Auth0 generally recommends use of the appropriate Auth0 SDK for your development environment rather than calling our APIs directly.
There are a variety of reasons why someone might link directly to a particular page within your application that is only accessible by authenticated users. If this is possible for your application you should automatically redirect your user to Auth0 if they are not authenticated. Once they authenticate and the returns them to your application, you can redirect them to where they intended to go in the first place.
Most modern authentication frameworks support middleware for redirecting to an authorization server such as Auth0. When selecting one, here are some key considerations:
Support for confidential clients, non-confidential clients, or both
Authentication is the process of determining user identity. The result of authentication in an OIDC context is an . This token contains information about the user and should only be able to be obtained if the user authenticates using one or more factors as defined by the authorization server (the most common form being user ID and password). There are a few things you may also need to consider in addition to obtaining an ID Token:
Do we also need an Access Token in order to call a shared API?
Before you go live, you should ensure that only the grants that you are using for each application are enabled in your configuration for your Application.
If your SDK only supports the Authorization Code grant, or you need an Access Token or , then Authorization Code grant (with or without PKCE) can also be used to retrieve an ID Token. The Authorization Code grant includes an additional API call to exchange the code for a token which can result in additional unnecessary latency if all you need is the ID Token. In many cases the hybrid flow is implemented to provide optimum access to the ID Token while still leveraging Authorization Code grant workflow for the secure and safe retrieval of Access and Refresh Tokens.
While Auth0 supports the use of implicit grant for browser-based applications requiring only an ID Token, it is recommended to use authorization code grant with PKCE. For detailed information, see OAuth2 Implicit Grant and SPA on the Auth0 Blog.If you need a Refresh Token so that you can obtain a new Access Token or ID Token without having to re-authenticate the user, then you must use the authorization code grant.
The reason that authentication systems are important is to prevent from accessing applications and user data that they should not. We want to place as many barriers as possible between those bad actors and access to our systems. One of the easiest ways to do this is to ensure that your attack protection with Auth0 is configured correctly, so take a moment to read the guidance on this subject and ensure that it’s working correctly for you.
Anomaly detection is handled behind the scenes by Auth0 and provides a great security feature for your product. If you’re going to utilize it, ensure that you have set up your Email Provider and configured your Email Templates before turning on email delivery to your users.
In a large scale re-structure it’s not always possible—or practical—to update all your applications at once. In fact, our recommended best practice is to plan for an iterative-style approach when it comes to integrating with Auth0. If your applications already participate in Single Sign-on (SSO), and your legacy identity system supports protocols such as OIDC or , then you have a couple of options available if you want to continue to provide SSO as you integrate with Auth0:
Update your existing identity provider in your legacy SSO system to redirect to Auth0 for login (e.g., using SAML), or
Have Auth0 redirect to your legacy SSO system to login. This requires configuring your legacy system as an IdP in Auth0 (i.e., either using SAML or OIDC).
Supporting an SSO experience with your legacy system can add complexity, but may be worth it to generate a more seamless user experience as you integrate with Auth0. If you intend to go down this path, planning for it early can help ensure that it is possible to achieve. If you don’t already have SSO at a centralized service, then the complexity to add it will unlikely be worth the benefits.
This is a complex topic that will likely need some additional investigation depending on your current legacy architecture, and we recommend you only look into this if you currently have SSO support in your legacy system. Note: if you are currently redirecting from your applications to a centralized system to authenticate your users and that system only asks for credentials if you don’t already have a session with the centralized system, then you have a legacy SSO implementation.
The “bring your own identity” scenario has become a must-have for almost all B2B applications. Most enterprise companies expect to be able to integrate their IdP into your application so their employees don’t need to store another set of credentials. This is a valuable way of simplifying the user authentication experience without compromising security, and using Universal Login makes it easy to start adding support for Enterprise Connections with minimal disruption.
Once you start supporting enterprise connections for users, you must do some form of Home Realm Discovery so that you can determine which connection to send the user to for authentication.
With enterprise connection support, user identities and credentials are managed by the identity provider of your customers’ organization, as well as certain identity claims - which Auth0 will use to populate the user profile.
“Bring your own identity” is a great feature to provide, but if you don’t support this from day one, and sometimes even if you do, you may have an organization that wants to switch to their own IdP after already having used the application for a while. You will need a way to link user accounts to provide an effective way of associating the new identity with the old database identity.
In an era where misuse of user credentials is at an all-time high, protecting your systems when it’s so common for hackers to steal users identity information in general is a challenge. One of the most effective ways though is to provide users with the ability to configure a second factor for protecting their account. More commonly referred to as Multi-Factor Authentication. This will ensure that only a valid user can access their account, even if they use a username and password that may have been compromised from a different application.
It’s quite common for customer facing applications to provide users with an option for adding a second factor rather than forcing them to use a second factor. For more information regarding this, see providing your users with an option to add MFA.
Auth0 supports a number of different options when it comes to enabling MFA for protecting user account access, and there are several practices to ensure that you will truly be providing a flexible second factor barrier to access:
Auth0 Guardian: a service that provides both Push notification generation and an application for allowing or denying requests. Push sends notification to a user’s pre-registered device - typically a mobile or tablet - from which a user can immediately allow or deny account access via the simple press of a button.
Time-based One-Time Password (TOTP): allows you to register a device - such as Google Authenticator - that will generate a one-time password which changes over time and which can be entered as the second factor to validate a user’s account.
SMS: for sending a one-time code over SMS which the user is then prompted to enter before they can finish authenticating.
Voice: for delivering a one-time code through a phone call which the user is then prompted to enter before they can finish authenticating.
Duo: allows you to use your Duo account for multi-factor authentication.
Email: allows you to use your email account for multi-factor authentication.
Whilst MFA workflow using technologies such as Guardian or Google Authenticator is typically provided via a separate application that runs on a mobile or tablet device, if you don’t want your customers to have to download a separate application Auth0 also provides you with an SDK that you can use to build second factor workflow right in your existing mobile device application(s).
We provide planning guidance in PDF format that you can download and refer to for details about our recommended strategies.B2B IAM Project Planning Guide
Many B2B platforms implement some form of isolation and/or branding for their customers’ organization, and this can add complexity to any Identity and Access Management (IAM) system. If this applies to you, then we recommend you take some time to read through our guidance and best practice advice for this type of environment.Multiple Organization Architecture
{"docsConfig":{"theme":"aspen","$schema":"https://mintlify.com/docs.json","name":"Auth0 Docs","description":"Auth0 documentation","colors":{"primary":"#000","light":"#fff","dark":"#fff"},"logo":{"light":"https://mintlify.s3.us-west-1.amazonaws.com/auth0-cq3uo/logo/light.svg","dark":"https://mintlify.s3.us-west-1.amazonaws.com/auth0-cq3uo/logo/dark.svg","href":"https://auth0-migration.mintlify.app/"},"favicon":"/favicon.svg","navbar":{"links":[{"label":"Log In","href":"https://auth0.auth0.com/u/login/"},{"label":"Contact Sales","href":"https://auth0.com/get-started?place=header\u0026type=button\u0026text=talk%20to%20sales"}],"primary":{"type":"button","label":"Sign Up","href":"https://auth0.com/signup"}},"footer":{"socials":{"github":"https://github.com/auth0/docs"}},"styling":{"eyebrows":"breadcrumbs"},"contextual":{"options":["copy","view","chatgpt","claude"]},"navigation":{"pages":[]}},"deployment":{"deploymentMetadataValue":{"subdomain":"auth0-cq3uo","hasAudioNarration":false,"actualSubdomain":"auth0-cq3uo","customDomains":[],"gitSource":{"type":"github","owner":"mintlify-onboarding","repo":"auth0-main","deployBranch":"main","contentDirectory":"","isPrivate":true,"mountPath":"","label":""},"entitlements":{"AI_CHAT":{"status":"DISABLED"}},"buildId":"6ae927d584fc2e71ceb5ecc1:success","clientVersion":"0.0.4076","searchFilterCounts":[{"language":"default","tag":"Documentation","count":1190},{"language":"default","tag":"Customize","count":302},{"language":"default","tag":"Getting Started","count":227},{"language":"default","tag":"Manage Users","count":217},{"language":"default","tag":"Authenticate","count":204},{"language":"default","tag":"Secure","count":179},{"language":"default","tag":"Protect Your Application","count":164},{"language":"default","tag":"Troubleshoot","count":146},{"language":"default","tag":"Provision Users","count":117},{"language":"default","tag":"Plan and Design","count":111}]},"assistantConfig":{},"basePath":"","hasChatPermissions":false,"hasWebMcpPermissions":false,"toggles":[{"name":"kill-isr","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"agent-mintlify-slack","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"agent-integrations-settings","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"rbac-expansion","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"automations-pr-grouping","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"custom-prefix","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"analytics-v7","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"user-flows-analytics","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"no-publish-flow","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"workos-onboarding","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"llms-txt-v2","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"snapshot-serving-live","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"stripTemperatureMiddleware","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"support-platform-pylon-zendesk","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"snapshot-serving","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"instant-rollback","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"granular-notifications-server","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"granular-notifications","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"automations-fable","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"fixed-ai-action-pricing","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"automation-resolve-merge-conflict","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"scoped-publishing","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"mintql","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"page-level-analytics","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"editor-version-history-v2","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"billing-page-v2","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"full-page-search","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"workspace-projects","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"assistant-v5","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"fork-pr-previews","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"revalidation-jwt","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"workos-sso-scim","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"hobby-abuse-scan","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"dashboard-inbox","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"workos-signup","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"turbopuffer-dual-write","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"workos-enabled","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"approve-review-flow","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"editor-metadata","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"sso-setup-deadline-banner","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"turbopuffer-serve","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"live-agents","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"comment-mode","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false}],"googleFontsInlined":false},"customCss":[{"filePath":"styles.css","content":"span.fixed.inset-0.pointer-events-none{background-repeat:no-repeat;background-size:cover;background-position:left -400px!important}.table{width:100%;table-layout:fixed;border-collapse:collapse}.table th,.table td{text-align:left;word-wrap:break-word}.table th:first-child,.table td:first-child{width:30%;max-width:30%}.table th:not(:first-child),.table td:not(:first-child){width:calc(70% / (var(--cols) - 1))}ol ol{list-style-type:decimal!important}:root{--tooltip-link-color: #b3a7ff;--bg: #fff;--text: #262626;--muted: #6b7280;--border: #e5e7eb;--accent: #2563eb;--section-icon-bg: #eef2ff;--card-bg: #fff;--card-shadow: rgba(0, 0, 0, 0.08);--input-bg: #fff;--input-border: #d1d5db;--input-placeholder: #9ca3af;--dash-color: #e9eaec}.dark{--tooltip-link-color: #6742d5;--bg: #0f1115;--text: #e5e7eb;--muted: #a3a3a3;--border: #262a33;--accent: #60a5fa;--section-icon-bg: #1b1f2a;--card-bg: #151923;--card-shadow: rgba(255, 255, 255, 0.06);--input-bg: #141825;--input-border: #2a3140;--input-placeholder: #6b7280;--dash-color: rgba(255, 255, 255, 0.14)}.pipeline-wrapper{position:relative;width:100%;max-width:1202px;aspect-ratio:1202 / 424;margin-bottom:100px}.pipeline-img{position:absolute;inset:0;width:100%;height:auto;display:block}.pipeline-dim-circle{position:absolute;aspect-ratio:1 / 1;border-radius:50%;background:rgba(255, 255, 255, 0.6);pointer-events:none;transition:background 0.15s ease}.dark .pipeline-dim-circle{background:rgba(0, 0, 0, 0.5)}.pipeline-hotspot{position:absolute;aspect-ratio:1 / 1;border-radius:50%;cursor:pointer;border-bottom:none!important;transition:transform 0.15s ease, box-shadow 0.15s ease}.pipeline-hotspot:hover{transform:scale(1.1);box-shadow:0 4px 12px rgba(0, 0, 0, 0.12)}.dark .pipeline-hotspot:hover{box-shadow:0 4px 14px rgba(0, 0, 0, 0.5)}.frame{margin:20px 0}a[href^=\"http\"]:not([href=\"https://auth0.com\"])::after{margin-left:4px;position:relative;top:1px;content:url(\"data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' width='14' height='14' viewBox='0 0 24 24' fill='none' stroke='%23000000' stroke-width='2' stroke-linecap='round' stroke-linejoin='round'%3E\u003cpath d='M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6'>\u003c/path>\u003cpolyline points='15 3 21 3 21 9'>\u003c/polyline>\u003cline x1='10' y1='14' x2='21' y2='3'>\u003c/line>\u003c/svg>\")}.dark a[href^=\"http\"]:not([href=\"https://auth0.com\"])::after{content:url(\"data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' width='14' height='14' viewBox='0 0 24 24' fill='none' stroke='%23ffffff' stroke-width='2' stroke-linecap='round' stroke-linejoin='round'%3E\u003cpath d='M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6'>\u003c/path>\u003cpolyline points='15 3 21 3 21 9'>\u003c/polyline>\u003cline x1='10' y1='14' x2='21' y2='3'>\u003c/line>\u003c/svg>\")}#footer a[href^=\"http\"]::after,#navbar a[href^=\"http\"]::after,#sidebar-content a[href^=\"http\"]::after,a.no_external_icon[href^=\"http\"]::after,a.card[href^=\"http\"]::after{content:none!important}.prose :where(a):not(:where([class~=\"not-prose\"],[class~=\"not-prose\"] *,[class~=\"card\"])){border-bottom:1px solid #000;font-weight:500}.dark .prose :where(a):not(:where([class~=\"not-prose\"],[class~=\"not-prose\"] *,[class~=\"card\"])){border-bottom:1px solid #fff}.prose :where(a:hover):not(:where([class~=\"not-prose\"],[class~=\"not-prose\"] *,[class~=\"card\"])),.dark .prose :where(a:hover):not(:where([class~=\"not-prose\"],[class~=\"not-prose\"] *,[class~=\"card\"])){border-bottom-width:2px}a strong{font-weight:700!important}#navigation-items::-webkit-scrollbar{width:4px}#navigation-items::-webkit-scrollbar-track{background:transparent}#navigation-items::-webkit-scrollbar-thumb{background:#888888ae;border-radius:4px}#navigation-items{scrollbar-width:thin;scrollbar-color:#888 transparent}#content-container h5,#content-container h6{font-weight:700}#content-container h5:not(.callout h5),#content-container h6:not(.callout h6){margin-top:36px!important}.sdk_banner_container{background:linear-gradient(99.42deg, #c376ff 0%, #635dff 100%);background-image:url(\"/images/library/header_bg.svg\"), linear-gradient(99.42deg, #c376ff 0%, #635dff 100%);background-repeat:no-repeat;background-position:right center;background-size:auto 100%}.quickstart_banner_container{background:linear-gradient(333.17deg, rgb(62, 198, 235) -1.51%, rgb(99, 93, 255) 101.22%);background-image:url(\"/images/library/header-bg.svg\"),\n linear-gradient(333.17deg, rgb(62, 198, 235) -1.51%, rgb(99, 93, 255) 101.22%);background-repeat:no-repeat;background-position:right center;background-size:auto 100%}#navbar>div:nth-child(2){background-color:transparent!important;backdrop-filter:blur(20px);transition:background-color 0.2s ease, backdrop-filter 0.2s ease}#navbar[data-is-opaque=\"true\"]>div:nth-child(2){background-color:rgb(255, 255, 255, 0.95)!important;backdrop-filter:blur(20px)}.dark #navbar[data-is-opaque=\"true\"]>div:nth-child(2){background-color:rgba(15, 17, 21, 0.75)!important}#navbar[data-is-opaque=\"false\"]>div:nth-child(2){background-color:rgba(255, 255, 255, 0.6)!important;backdrop-filter:blur(20px)}.dark #navbar[data-is-opaque=\"false\"]>div:nth-child(2){background-color:transparent!important;backdrop-filter:blur(20px)}#navigation-items .px-1.py-3,.sidebar-group .px-1.py-3,.sidebar-groups .px-1.py-3{padding:0!important;height:2px;width:100%;background:repeating-linear-gradient(\n to right,\n var(--dash-color, #ccc) 0px,\n var(--dash-color, #ccc) 8px,\n transparent 8px,\n transparent 16px\n )!important;margin:20px 0!important}#navigation-items .px-1.py-3>*,.sidebar-group .px-1.py-3>*,.sidebar-groups .px-1.py-3>*{display:none}.glossary_h2{margin-bottom:0!important}.glossary_h3{margin-top:30px!important}.glossary_list li{list-style-type:none!important;padding-left:0!important}.glossary_list li:before{content:none}.label{display:inline-block;padding:2px 10px;font-size:12px;font-weight:600;text-transform:uppercase;border-radius:4px;letter-spacing:1px;background:transparent}.label-danger{border:1px solid #e74c3c;color:#e74c3c}.label-primary{border:1px solid #3498db;color:#3498db}.breadcrumb-list{display:flex;flex-wrap:wrap}.breadcrumb-item{white-space:nowrap}.z-10.absolute.w-full.h-full.border-b.border-gray-100,#sidebar-content,.dark #sidebar-content{border-color:transparent!important}#table-of-contents-content li a{border-left-width:0!important}#topbar-cta-button a span{background-color:#000!important}.dark #topbar-cta-button a span{background-color:#fff!important;color:#000!important}#topbar-cta-button a svg{display:none}.navbar-link a,.dark .navbar-link a{background-color:#fff;border:1px solid #cecdca!important;padding-top:7px;padding-bottom:7px}.dark .navbar-link a{background-color:rgb(255 255 255 / 0.1);border-color:#454545!important}.dark .navbar-link a:hover{background-color:rgba(255, 255, 255, 0.007)}.topbar-right-container ul.flex.items-center>li{order:10}.topbar-right-container ul.flex.items-center>li:nth-child(1){order:1}.topbar-right-container ul.flex.items-center>li:nth-child(3){order:2}.topbar-right-container ul.flex.items-center>li:nth-child(4){order:2}.topbar-right-container ul.flex.items-center>li:nth-child(2){order:3}ul.flex.items-center>li>a[href*=\"/u/login\"]{order:1;background-color:transparent!important;border-color:transparent!important}#code-snippet-feedback-button svg{display:none!important}#code-snippet-feedback-button::after{content:\"\";display:block;width:16px;height:16px;background-image:url(\"data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' width='24' height='24' viewBox='0 0 24 24' fill='none' stroke='rgb(156 163 175)' stroke-width='2' stroke-linecap='round' stroke-linejoin='round' class='lucide lucide-triangle-alert-icon lucide-triangle-alert'%3E%3Cpath d='m21.73 18-8-14a2 2 0 0 0-3.48 0l-8 14A2 2 0 0 0 4 21h16a2 2 0 0 0 1.73-3'/%3E%3Cpath d='M12 9v4'/%3E%3Cpath d='M12 17h.01'/%3E%3C/svg%3E\");background-size:contain;background-repeat:no-repeat;background-position:center}#code-snippet-feedback-button:hover::after{background-image:url(\"data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' width='24' height='24' viewBox='0 0 24 24' fill='none' stroke='rgb(107 114 128)' stroke-width='2' stroke-linecap='round' stroke-linejoin='round' class='lucide lucide-triangle-alert-icon lucide-triangle-alert'%3E%3Cpath d='m21.73 18-8-14a2 2 0 0 0-3.48 0l-8 14A2 2 0 0 0 4 21h16a2 2 0 0 0 1.73-3'/%3E%3Cpath d='M12 9v4'/%3E%3Cpath d='M12 17h.01'/%3E%3C/svg%3E\")}.dark #code-snippet-feedback-button::after{background-image:url(\"data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' width='24' height='24' viewBox='0 0 24 24' fill='none' stroke='rgba(255,255,255,0.4)' stroke-width='2' stroke-linecap='round' stroke-linejoin='round' class='lucide lucide-triangle-alert-icon lucide-triangle-alert'%3E%3Cpath d='m21.73 18-8-14a2 2 0 0 0-3.48 0l-8 14A2 2 0 0 0 4 21h16a2 2 0 0 0 1.73-3'/%3E%3Cpath d='M12 9v4'/%3E%3Cpath d='M12 17h.01'/%3E%3C/svg%3E\")}.dark #code-snippet-feedback-button:hover::after{background-image:url(\"data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' width='24' height='24' viewBox='0 0 24 24' fill='none' stroke='rgba(255,255,255,0.6)' stroke-width='2' stroke-linecap='round' stroke-linejoin='round' class='lucide lucide-triangle-alert-icon lucide-triangle-alert'%3E%3Cpath d='m21.73 18-8-14a2 2 0 0 0-3.48 0l-8 14A2 2 0 0 0 4 21h16a2 2 0 0 0 1.73-3'/%3E%3Cpath d='M12 9v4'/%3E%3Cpath d='M12 17h.01'/%3E%3C/svg%3E\")}.libraries_card{display:flex;flex-direction:column;justify-content:space-between}.login_list li::before{content:none}.login_list h2{margin:0!important}.login_list a{border-bottom:none!important}.libraries_cards a svg{width:12px!important;height:12px!important}[data-component-part=\"tooltip-content\"]{text-align:left!important;padding:6px 14px!important;border-radius:4px!important}[data-component-part=\"tooltip-content\"] .flex{justify-content:flex-start!important}.dark [data-component-part=\"tooltip-content\"]{background-color:#ffffff!important;color:#000000!important;border-color:#000000!important}[data-component-part=\"tooltip-content\"] a{color:var(--tooltip-link-color)!important;text-align:left!important;opacity:1;transition:opacity 0.2s ease-in-out}[data-component-part=\"tooltip-content\"] a:hover{opacity:0.7}.prose :where(a code):not(:where([class~=\"not-prose\"],[class~=\"not-prose\"] *)){text-decoration:none!important}.dark #sidebar-group a img{background-color:transparent!important}.sidebar-group a{background-color:#efefef!important}.dark .sidebar-group a{background-color:#282828!important}.nav-tabs a[href=\"/\"]{display:none}"},{"filePath":"recipe.css","content":"#content-area:has(.recipe-container){overflow:visible!important}.recipe-content .recipe-section:first-of-type{margin-top:1rem}.active-section{opacity:1!important}"}],"page":{"pagePath":"docs/get-started/architecture-scenarios/business-to-business/authentication","slug":"/docs/get-started/architecture-scenarios/business-to-business/authentication","pageMetadata":{"og:description":"How authentication works in your B2B IAM implementation.","og:image":"https://cdn2.auth0.com/docs/1.14553.0/img/share-image.png","og:title":"Authentication (B2B)","og:url":"https://auth0.com/docs/","permalink":"authentication","title":"Authentication (B2B)","twitter:description":"How authentication works in your B2B IAM implementation.","twitter:title":"Authentication (B2B)","description":null,"href":"/docs/get-started/architecture-scenarios/business-to-business/authentication"},"pageType":"default","mdx":{"mdxSource":{"compiledSource":"\"use strict\";const{Fragment:_Fragment,jsx:_jsx,jsxs:_jsxs}=arguments[0];const{useMDXComponents:_provideComponents}=arguments[0];function _createMdxContent(props){const _components={a:`a`,code:`code`,em:`em`,li:`li`,ol:`ol`,p:`p`,strong:`strong`,ul:`ul`,..._provideComponents(),...props.components},{Heading,Info,Tooltip,Warning}=_components;if(!Heading)_missingMdxReference(`Heading`,true);if(!Info)_missingMdxReference(`Info`,true);if(!Tooltip)_missingMdxReference(`Tooltip`,true);if(!Warning)_missingMdxReference(`Warning`,true);return _jsxs(_Fragment,{children:[_jsxs(_components.p,{children:[`In order to provide services to your users, you must be able to identify who those users are. This process is called User Authentication. There are a number of ways to perform authentication of a user - via social media accounts, username and password,\\xA0`,_jsx(Tooltip,{tip:`Passwordless: Form of authentication that does not rely on a password as the first factor.`,cta:`View Glossary`,href:`/docs/glossary?term=passwordless`,children:`passwordless`}),`\\xA0- and it’s often recommended that you go beyond a first factor for authenticating the user by enabling `,_jsx(Tooltip,{tip:`Passwordless: Form of authentication that does not rely on a password as the first factor.`,cta:`View Glossary`,href:`/docs/glossary?term=multi-factor+authentication`,children:`multi-factor authentication`}),` (MFA).`]}),`\n`,_jsxs(Info,{children:[_jsx(Heading,{level:`3`,id:`best-practice`,children:`Best Practice`}),_jsx(_components.p,{children:`It’s important to consider both security and user experience when designing how you will authenticate your users. Providing for multiple primary factors, and/or enforcing more than one factor during authentication, are ways that you can provide both.`})]}),`\n`,_jsx(_components.p,{children:`There are a number of things you will want to consider when looking at functionality and workflow:`}),`\n`,_jsxs(_components.ul,{children:[`\n`,_jsx(_components.li,{children:`Where will users enter their credentials?`}),`\n`,_jsx(_components.li,{children:`How will you keep user credentials safe?`}),`\n`,_jsx(_components.li,{children:`How will you maintain your authentication system?`}),`\n`,_jsx(_components.li,{children:`How can you provide password authentication for your users?`}),`\n`,_jsx(_components.li,{children:`How can you prevent hackers from trying to log in as your users?`}),`\n`,_jsx(_components.li,{children:`How will you implement authentication in different kinds of applications?`}),`\n`,_jsx(_components.li,{children:`How can you make login easy for your users when they come from different language backgrounds?`}),`\n`,_jsx(_components.li,{children:`How will you provide a good user experience as you migrate away from any legacy authentication system?`}),`\n`,_jsx(_components.li,{children:`What should you consider when integrating applications with Auth0?`}),`\n`,_jsx(_components.li,{children:`Do you need to provide multi-factor authentication?`}),`\n`,_jsx(_components.li,{children:`What do you do if you have a service that doesn’t have a way for the user to log in ahead of time?`}),`\n`,_jsxs(_components.li,{children:[`Can you pass the same user `,_jsx(Tooltip,{tip:`Access Token: Authorization credential, in the form of an opaque string or JWT, used to access an API.`,cta:`View Glossary`,href:`/docs/glossary?term=access+token`,children:`access token`}),` from one API to another?`]}),`\n`,_jsx(_components.li,{children:`What do you do if you need to isolate users by organization?`}),`\n`,_jsx(_components.li,{children:`How will you handle identifying which organization users belong to?`}),`\n`,_jsx(_components.li,{children:`What’s the benefit of providing enterprise connections for your organizations?`}),`\n`]}),`\n`,_jsxs(_components.p,{children:[`Auth0\\xA0`,_jsx(_components.a,{href:`#universal-login`,children:`Universal Login`}),`\\xA0provides users with a safe and secure experience - no matter whether you choose to provide for user ID/password credentials sign in, or allow the so-called Bring Your Own Identity scenarios provided via\\xA0`,_jsx(_components.a,{href:`https://auth0.com/learn/social-login/`,children:`Social Login`}),`. There are also brand recognition benefits to centralizing the login experience with `,_jsx(Tooltip,{tip:`Universal Login: Your application redirects to Universal Login, hosted on Auth0's Authorization Server, to verify a user's identity.`,cta:`View Glossary`,href:`/docs/glossary?term=Universal+Login`,children:`Universal Login`}),`, even if you feel you will also have product-specific\\xA0`,_jsx(_components.a,{href:`/docs/get-started/architecture-scenarios/business-to-consumer/branding`,children:`branding`}),`\\xA0requirements. The Auth0 UI widgets typically used with Universal Login also provide out-of-the-box support with regards to\\xA0`,_jsx(_components.a,{href:`/docs/customize/internationalization-and-localization/universal-login-internationalization`,children:`internationalization`}),`\\xA0for users with different language requirements, and out-of-the-box support for Auth0 features such as\\xA0`,_jsx(_components.a,{href:`#multi-factor-authentication-mfa-`,children:`MFA`}),`\\xA0and\\xA0`,_jsx(_components.a,{href:`#anomaly-detection`,children:`attack protection`}),`\\xA0allow you to put barriers in place in order to prevent hackers attempting to access users’ accounts.`]}),`\n`,_jsxs(_components.p,{children:[`Allowing users to sign in via user ID/password credentials means that you’re not reliant on the status of third-party `,_jsx(Tooltip,{tip:`Identity Provider (IdP): Service that stores and manages digital identities.`,cta:`View Glossary`,href:`/docs/glossary?term=identity+providers`,children:`identity providers`}),` for your users to access your system. You also have the means to require the credentials used to align with your corporate policies. Auth0 assists with this by providing you with multiple options in support of user ID/password logins, and the\\xA0`,_jsx(_components.a,{href:`#username-and-password-authentication`,children:`guidance provided`}),`\\xA0will help you understand you can leverage these options. Adding\\xA0`,_jsx(_components.a,{href:`#social-authentication`,children:`social`}),`\\xA0support at some stage, as an additional primary authentication factor, gives you added flexibility and can help you better understand your users without the need to question them further by leveraging the information already stored by the various social login\\xA0`,_jsx(_components.a,{href:`/docs/authenticate/identity-providers/identity-providers-social`,children:`providers`}),`.`]}),`\n`,_jsxs(_components.p,{children:[`If you have an existing legacy identity store, you’ll also want to see\\xA0`,_jsx(_components.a,{href:`/docs/get-started/architecture-scenarios/business-to-consumer/provisioning`,children:`User Migration`}),`. This section discusses the advantages of migrating to Auth0’s managed identity storage in terms of safety and security.`]}),`\n`,_jsxs(_components.p,{children:[`For customer facing applications, `,_jsx(Tooltip,{tip:`OpenID: Open standard for authentication that allows applications to verify users' identities without collecting and storing login information.`,cta:`View Glossary`,href:`/docs/glossary?term=OpenID`,children:`OpenID`}),` Connect (`,_jsx(_components.a,{href:`/docs/authenticate/protocols/openid-connect-protocol`,children:`OIDC`}),`) is the most frequently used industry standard protocol, and OIDC has first-class citizen support in Auth0. Auth0 provides support for various different approaches for integrating various different applications, so you’ll want to see the section on\\xA0`,_jsx(_components.a,{href:`#application-integration`,children:`application integration`}),`\\xA0for the information you’ll need to make an informed choice.`]}),`\n`,_jsxs(_components.p,{children:[`When calling one API from another API, or from any situation where there is no authenticated user context - such as one or more cron jobs, report generators, or continuous integration/delivery systems - you will need a way to authorize the\\xA0application\\xA0instead of a\\xA0user. This is a one step process where the application is authenticated (using a `,_jsx(Tooltip,{tip:`Client ID: Identification value given to your registered resource from Auth0.`,cta:`View Glossary`,href:`/docs/glossary?term=client+ID`,children:`client ID`}),` and secret) and then authorized in one call. You can learn more about this in our authorization work stream under\\xA0`,_jsx(_components.a,{href:`/docs/get-started/architecture-scenarios/business-to-business/authorization`,children:`machine-to-machine (m2m) authorization`}),`.`]}),`\n`,_jsxs(_components.p,{children:[`Often companies need to segregate their users by organization and sometimes users can have access to more than one organization. Knowing which of these scenarios is relevant to your company will help define how to determine in which connection a user exists: whether you need to do it, when you need to do it, and how to accomplish it. See\\xA0`,_jsx(_components.a,{href:`#home-realm-discovery`,children:`Home Realm Discovery`}),`\\xA0to determine if this is something relevant to your company.`]}),`\n`,_jsx(Heading,{level:`2`,id:`universal-login`,children:`Universal Login`}),`\n`,_jsxs(_components.p,{children:[`Do you have, or will you have, more than one application in your system? If the answer to this question is yes, then you will want a centralized sign in experience. To achieve a seamless\\xA0`,_jsx(Tooltip,{tip:`Single Sign-On (SSO): Service that, after a user logs into one applicaton, automatically logs that user in to other applications.`,cta:`View Glossary`,href:`/docs/glossary?term=Single+Sign-on`,children:`Single Sign-on`}),` (SSO)\\xA0experience between multiple applications, it is critical to have a centralized location to redirect your users for authentication. This allows you a way to provide your users with a consistent experience if you add social authentication in the future, add third party applications to your system, or add multi-factor authentication as an option (or requirement) for your users - and also allow you to take advantage of new features for improving your users’ experience with little, if any, added development effort.`]}),`\n`,_jsxs(Info,{children:[_jsx(Heading,{level:`3`,id:`best-practice-2`,children:`Best Practice`}),_jsxs(_components.p,{children:[`If you have more than one application, the best practice is to redirect to a `,_jsx(_components.a,{href:`/docs/authenticate/login/auth0-universal-login`,children:`centralized location`}),` to authenticate the user. With Auth0, this means taking advantage of `,_jsx(_components.a,{href:`/docs/authenticate/login/auth0-universal-login`,children:`Universal Login`}),`, which provides many security and user experience benefits out-of-the-box, including `,_jsx(_components.a,{href:`/docs/authenticate/single-sign-on`,children:`SSO`}),`.`]})]}),`\n`,_jsx(_components.p,{children:`Auth0 Universal Login makes authenticating users a short, easy process which can be accomplished in three easy steps (all of our Quickstarts demonstrate this and our SDKs hide the complexity for you too):`}),`\n`,_jsxs(_components.ol,{children:[`\n`,_jsxs(_components.li,{children:[`Determine how and when you want to\\xA0`,_jsx(_components.a,{href:`#application-integration`,children:`redirect from your application`}),`.`]}),`\n`,_jsxs(_components.li,{children:[`Set up the appropriate\\xA0`,_jsx(_components.a,{href:`/docs/get-started/architecture-scenarios/business-to-consumer/branding`,children:`branding`}),`\\xA0and/or customized HTML in your Auth0 configuration.`]}),`\n`,_jsxs(_components.li,{children:[`Set up your application to\\xA0`,_jsx(_components.a,{href:`#application-integration`,children:`receive and handle the response`}),`\\xA0from the Authorization Server.`]}),`\n`]}),`\n`,_jsx(Heading,{level:`2`,id:`home-realm-discovery`,children:`Home realm discovery`}),`\n`,_jsx(_components.p,{children:`Home realm discovery (HRD) is the process of identifying which identity provider (or which connection in Auth0) the user belongs to\\xA0before\\xA0authenticating them. There are two ways HRD can occur:`}),`\n`,_jsxs(_components.ul,{children:[`\n`,_jsx(_components.li,{children:`Provide a way for the decision to be made at the application`}),`\n`,_jsx(_components.li,{children:`Have Home Realm Discovery happen on the Universal Login page`}),`\n`]}),`\n`,_jsx(_components.p,{children:`Your system may need to do either or both methods so it is important to understand all approaches to HRD so that you can apply the one(s) that make the most sense to your applications.`}),`\n`,_jsx(Heading,{level:`3`,id:`application-driven-hrd`,children:`Application driven HRD`}),`\n`,_jsxs(_components.p,{children:[`A common way of determining which realm a user belongs to is when an application is branded for each organization. As part of this, an organization will typically have its own instance of the application, typically accessed via a different URL. This copy or instance can be physically isolated (running on a separate set of servers) or virtually isolated (running on shared servers) and is generally denoted through either a custom hostname (`,_jsx(_components.code,{children:`companyA.application1.yourcompany.com`}),`) or path (`,_jsx(_components.code,{children:`application1.yourcompany.com/companyA`}),`).`]}),`\n`,_jsxs(Info,{children:[_jsx(Heading,{level:`3`,id:`best-practice-3`,children:`Best practice`}),_jsxs(_components.p,{children:[`If your application already knows the specific connection (IdP) required then you can also pass that along when you redirect the user to `,_jsx(_components.code,{children:`/authorize`}),`, via use of the `,_jsx(_components.code,{children:`connection`}),` query parameter.`]})]}),`\n`,_jsxs(_components.p,{children:[`If this is the case for your application(s), then home realm discovery is a simple matter of storing the `,_jsx(_components.code,{children:`org_id`}),` with the organization-specific application configuration and sending that as the organization parameter when redirecting the user to Universal Login. Doing so will limit the user to that specific organization and its set of configured connections.`]}),`\n`,_jsxs(Info,{children:[_jsx(Heading,{level:`3`,id:`best-practice-4`,children:`Best practice`}),_jsx(_components.p,{children:`If an organization needs more than one IdP, then you may have to do a second round of Home Realm Discovery (once the organization has been identified). Auth0 will typically manage this for you if you are using the Organizations Feature.`})]}),`\n`,_jsxs(_components.p,{children:[`If the user is shared between multiple organizations using a single identity, you must support\\xA0`,_jsx(_components.a,{href:`#hrd-through-universal-login`,children:`Home Realm Discovery on the Universal Login Page`}),`. This will allow Universal Login to identify the user first and then present the realms appropriate for that user leading to a better user experience.`]}),`\n`,_jsxs(_components.p,{children:[`Sending the organization and/or connection parameters can be achieved by adding them as a query parameter when you redirect the user to the `,_jsx(_components.code,{children:`/authorize`}),` endpoint. For more information, see the\\xA0`,_jsx(_components.a,{href:`https://auth0.com/docs/api/authentication#authorization-code-flow`,children:`Authentication API docs`}),`. However, you will generally accomplish this using the SDK for whichever language your application is written in.`]}),`\n`,_jsx(Heading,{level:`3`,id:`hrd-through-universal-login`,children:`HRD through Universal Login`}),`\n`,_jsx(_components.p,{children:`There are three main approaches to Home Realm Discovery:`}),`\n`,_jsxs(_components.ul,{children:[`\n`,_jsx(_components.li,{children:`Discover the realm through the user’s email subdomain.`}),`\n`,_jsx(_components.li,{children:`Discover the realm by looking up a user identifier in some sort of map of an identifier to realm map.`}),`\n`,_jsx(_components.li,{children:`Allow the user to choose or enter their realm (or organization).`}),`\n`]}),`\n`,_jsxs(_components.p,{children:[`In both of the first two approaches, you may consider doing “Identifier First Login”. This means that you present only the ability to enter an identifier first. After which, you collect the user’s identifier, and then, based on the identifier, you either automatically redirect the user or present a way for the user to enter their password if redirection is unnecessary. Auth0 provides implementation out of the box to take care of all of this, via the use of `,_jsx(_components.a,{href:`/docs/authenticate/login/auth0-universal-login/identifier-first`,children:`Universal Login`}),`.`]}),`\n`,_jsx(Warning,{children:_jsx(_components.p,{children:`Though it is possible to implement Identifier First Login or allow a user to select their organization at the application instead of on the Universal Login Page, this can add complexity with respect to single sign on as well as complexity associated with replicating that behavior in all of your applications. Instead Auth0 recommends implementing some form of HRD through Universal Login.`})}),`\n`,_jsx(Heading,{level:`4`,id:`hrd-through-universal-login-using-the-email-subdomain`,children:`HRD through Universal Login using the email subdomain`}),`\n`,_jsx(_components.p,{children:`The simplest way to implement home realm discovery on the universal login page is to utilize the email subdomain of the user’s identifier to map that to their Identity Provider. This, of course, only works in situations where the email subdomain will be a 1:1 mapping to an organization or at least to an Identity Provider.`}),`\n`,_jsxs(_components.p,{children:[`Auth0’s `,_jsx(_components.a,{href:`/docs/libraries/lock`,children:`Lock`}),` widget or `,_jsx(_components.a,{href:`/docs/authenticate/login/auth0-universal-login/universal-login-vs-classic-login/universal-experience`,children:`Universal Login`}),` can do this for you if you are using the domain map in an enterprise connection; however, if you want to build this yourself, you can, but it requires you to build a mapping of email subdomain to connection.`]}),`\n`,_jsxs(_components.p,{children:[`Additionally, when using the Universal Login experience, the `,_jsx(_components.a,{href:`/docs/manage-users/organizations/organizations-overview`,children:`Organizations Feature`}),` will help you in two ways:`]}),`\n`,_jsxs(_components.ol,{children:[`\n`,_jsxs(_components.li,{children:[`If you have not passed an org_id to `,_jsx(_components.code,{children:`/authorize`}),` when you initiated the login request, Auth0 will present the user with a prompt to enter the organization they belong to.`]}),`\n`,_jsx(_components.li,{children:`If the Organization has more than one IdP associated with it, Auth0 will present the user with buttons to choose the organization or a form to enter a username and password.`}),`\n`]}),`\n`,_jsx(Heading,{level:`4`,id:`hrd-through-universal-login-using-the-identifier-to-realm-map`,children:`HRD through Universal Login using the Identifier to Realm Map`}),`\n`,_jsx(_components.p,{children:`A second, more complex alternative is to store a map of identifiers to IdP and provide a public endpoint to access that information. Then on the Universal Login page, you can find the connection and redirect back to /authorize with the connection. The main drawbacks to this approach are latency and, more importantly, security when it comes to identifier discovery: if you’re using email addresses, this makes it much easier for someone to discover whether a particular email address is a user of yours.`}),`\n`,_jsxs(Info,{children:[_jsx(Heading,{level:`3`,id:`best-practice-5`,children:`Best practice`}),_jsx(_components.p,{children:`Any public endpoint should have rate limiting applied to it to prevent hackers from using it to discover information and to prevent denial of service attacks.`})]}),`\n`,_jsx(Heading,{level:`4`,id:`hrd-through-universal-login-using-user-choice`,children:`HRD through Universal Login using user choice`}),`\n`,_jsx(_components.p,{children:`The other option is to allow your users to choose from a list, if you don’t mind making public the list of organizations who use your product, or by allowing the user to enter their organization name explicitly. This would typically be done before redirecting the user to Universal Login. Once the user tells you which organization they belong to, you can redirect to Auth0 with the connection for that organization specified or have Auth0 simply prompt the user for their username and password if the connection is a database connection.`}),`\n`,_jsx(Heading,{level:`2`,id:`username-and-password-authentication`,children:`Username and password authentication`}),`\n`,_jsx(_components.p,{children:`Nearly every B2C application provides the ability for its customers to create a new set of credentials. This is a common form of authentication that all users are familiar with.`}),`\n`,_jsxs(_components.p,{children:[`Username password authentication comes in multiple flavors at Auth0. If your application is a green-field application with no existing user base, then a simple Auth0 out-of-the-box\\xA0`,_jsx(_components.a,{href:`/docs/authenticate/identity-providers/database`,children:`Database Connection`}),`\\xA0will give you everything you need to start authenticating your users. However, if you have a legacy user store (such as your own database of users or an existing LDAP system) you have a couple of different options for migrating your users as discussed in our guidance on\\xA0`,_jsx(_components.a,{href:`/docs/get-started/architecture-scenarios/business-to-business/provisioning`,children:`User migration`}),`.`]}),`\n`,_jsxs(_components.p,{children:[`However you end up provisioning the users for your database connection, the authentication of those users is quite similar. It requires you to present users with a form to enter their username and password. As mentioned in the guidance concerning\\xA0`,_jsx(_components.a,{href:`#universal-login`,children:`Universal Login`}),`, the simplest and safest way to authenticate users with a username and password is to redirect them to a centralized login page and collect their username and password there. This allows Auth0 to determine whether they have already authenticated and skip the login form entirely when it’s not needed.`]}),`\n`,_jsxs(Info,{children:[_jsx(Heading,{level:`3`,id:`best-practice-6`,children:`Best Practice`}),_jsxs(_components.p,{children:[`Collecting credentials only at the centralized login page will reduce the surface area for potential leak of user secrets. It will also reduce the need to collect credentials unnecessarily. See `,_jsx(_components.a,{href:`#universal-login`,children:`Universal Login`}),` for more information.`]})]}),`\n`,_jsx(Heading,{level:`2`,id:`application-integration`,children:`Application integration`}),`\n`,_jsx(_components.p,{children:`Once you’ve figured out how you want to authenticate your users, the next step is to determine how you will initiate that authentication. Each application will typically have its own starting point.`}),`\n`,_jsx(Warning,{children:_jsxs(_components.p,{children:[`Native mobile applications (and desktop applications) should use the system browser for authentication, or they open themselves up to additional security risks. See\\xA0`,_jsx(_components.a,{href:`/docs/design/browser-based-vs-native-experience-on-mobile`,children:`Native vs. Browser Login on Mobile`}),`\\xA0for more information.`]})}),`\n`,_jsxs(_components.p,{children:[`As discussed, we’ve found that most of our customers use\\xA0`,_jsx(_components.a,{href:`/docs/authenticate/protocols/openid-connect-protocol`,children:`OpenID Connect (OIDC)`}),`\\xA0as the industry-standard protocol when it comes to their customer-facing applications. Figuring out which\\xA0OIDC flow\\xA0to use is your first task, and you will want to start by reviewing the our\\xA0`,_jsx(_components.a,{href:`/docs/get-started/applications/application-grant-types`,children:`grant mapping`}),`\\xA0guidance in the first instance.`]}),`\n`,_jsxs(_components.p,{children:[`If you want to allow anonymous users access to any part of our application then you need to determine if you will be redirecting right away or prompting your users to redirect only when required (or perhaps some combination of both; see\\xA0`,_jsx(_components.a,{href:`/docs/authenticate/login/redirect-users-after-login`,children:`Redirect Users After Login`}),`\\xA0for further discussion). If users can\\xA0`,_jsx(_components.a,{href:`#deep-linking-to-protected-endpoints`,children:`deep link`}),`\\xA0to a protected version (or area) of your site then you will need to determine the links to your application that will result in an automatic redirect to Auth0.`]}),`\n`,_jsx(Heading,{level:`3`,id:`anonymous-access`,children:`Anonymous access`}),`\n`,_jsx(_components.p,{children:`It is important to consider the user experience when someone first comes to your application. If your application supports anonymous user access (quite common for eCommerce applications) there are different scenarios to consider:`}),`\n`,_jsxs(_components.ul,{children:[`\n`,_jsxs(_components.li,{children:[`\n`,_jsx(_components.p,{children:`Are they returning to the application after having already logged in, or`}),`\n`]}),`\n`,_jsxs(_components.li,{children:[`\n`,_jsx(_components.p,{children:`If this is the first time they are accessing the application:`}),`\n`,_jsxs(_components.ul,{children:[`\n`,_jsx(_components.li,{children:`Have they already accessed a different application that uses the same Auth0 tenant,`}),`\n`,_jsx(_components.li,{children:`Have they ever (or perhaps not in a long time) authenticated on this device or browser.`}),`\n`]}),`\n`]}),`\n`]}),`\n`,_jsxs(_components.p,{children:[`When an anonymous user accesses your application, it can often be desirable for the application to discover if the user has already logged into a different application in the same family, or to remember this user even if the application is a\\xA0`,_jsx(_components.a,{href:`/docs/quickstart/spa`,children:`SPA`}),`\\xA0with no state. For example, if you can determine that the user is already logged in, you might decide to have the UI header in the application skip displaying a login button and instead have an account or profile menu for the user. To accomplish this you will want to utilize “`,_jsx(_components.a,{href:`/docs/authenticate/login/configure-silent-authentication`,children:`silent authentication`}),`”. Silent authentication will allow you to check to see if the user is logged in without prompting them to log in if they are not. Then the application can present a login button if necessary. If the user is logged in already, however, then you will receive tokens and will not have to present the user with a login button again.`]}),`\n`,_jsxs(Warning,{children:[_jsx(_components.p,{children:`Checking for a login session by redirecting to Auth0 can be helpful for your application, but if this will result in a lot of requests, you should employ a throttling mechanism to avoid latency and/or rate limiting.`}),_jsxs(_components.p,{children:[`Calls to the Management API are subject to\\xA0`,_jsx(_components.a,{href:`/docs/troubleshoot/customer-support/operational-policies/rate-limit-policy`,children:`Auth0 Rate Limiting policy`}),`. You must take this into consideration, and to assist, Auth0 generally recommends use of the appropriate\\xA0`,_jsx(_components.a,{href:`/docs/libraries`,children:`Auth0 SDK`}),`\\xA0for your development environment rather than calling our APIs directly.`]})]}),`\n`,_jsx(Heading,{level:`3`,id:`deep-linking-to-protected-endpoints`,children:`Deep linking to protected endpoints`}),`\n`,_jsxs(_components.p,{children:[`There are a variety of reasons why someone might link directly to a particular page within your application that is only accessible by authenticated users. If this is possible for your application you should automatically redirect your user to Auth0 if they are not authenticated. Once they authenticate and the `,_jsx(Tooltip,{tip:`Authorization Server: Centralized server that contributes to defining the boundaries of a user’s access. For example, your authorization server can control the data, tasks, and features available to a user.`,cta:`View Glossary`,href:`/docs/glossary?term=authorization+server`,children:`authorization server`}),` returns them to your application, you can\\xA0`,_jsx(_components.a,{href:`/docs/authenticate/login/redirect-users-after-login`,children:`redirect them`}),`\\xA0to where they intended to go in the first place.`]}),`\n`,_jsx(Heading,{level:`3`,id:`best-practice-7`,children:`Best Practice`}),`\n`,_jsx(_components.p,{children:`Most modern authentication frameworks support middleware for redirecting to an authorization server such as Auth0. When selecting one, here are some key considerations:`}),`\n`,_jsxs(_components.ul,{children:[`\n`,_jsx(_components.li,{children:`Support for confidential clients, non-confidential clients, or both`}),`\n`,_jsxs(_components.li,{children:[`Support for configuration via `,_jsx(_components.a,{href:`/docs/get-started/applications/configure-applications-with-oidc-discovery`,title:`Configure Applications with OIDC Discovery`,children:`discovery endpoint`}),` or explicitly inline`]}),`\n`,_jsx(_components.li,{children:`Support for token validation including expirations, signatures, claims and scopes`}),`\n`,_jsxs(_components.li,{children:[`Support for `,_jsx(Tooltip,{tip:`Refresh Token: Token used to obtain a renewed Access Token without forcing users to log in again.`,cta:`View Glossary`,href:`/docs/glossary?term=Refresh+Tokens`,children:`Refresh Tokens`}),` if needed`]}),`\n`]}),`\n`,_jsx(Heading,{level:`3`,id:`authenticating-the-user`,children:`Authenticating the user`}),`\n`,_jsxs(_components.p,{children:[`Authentication is the process of determining user identity. The result of authentication in an OIDC context is an `,_jsx(Tooltip,{tip:`ID Token: Credential meant for the client itself, rather than for accessing a resource.`,cta:`View Glossary`,href:`/docs/glossary?term=ID+Token`,children:`ID Token`}),`. This token contains information about the user and should only be able to be obtained if the user authenticates using one or more factors as defined by the authorization server (the most common form being\\xA0`,_jsx(_components.a,{href:`#username-and-password-authentication`,children:`user ID and password`}),`). There are a few things you may also need to consider in addition to obtaining an ID Token:`]}),`\n`,_jsxs(_components.ul,{children:[`\n`,_jsxs(_components.li,{children:[`Do we also need an\\xA0`,_jsx(_components.a,{href:`/docs/secure/tokens/access-tokens`,children:`Access Token`}),`\\xA0in order to call a shared API?`]}),`\n`,_jsxs(_components.li,{children:[`Is your application a single-page application and only requires an\\xA0`,_jsx(_components.a,{href:`/docs/secure/tokens/id-tokens`,children:`ID Token`}),`? See\\xA0`,_jsx(_components.a,{href:`/docs/get-started/authentication-and-authorization-flow/authorization-code-flow-with-pkce/call-your-api-using-the-authorization-code-flow-with-pkce`,children:`Authorization Code Grant with PKCE`}),`\\xA0for more information.`]}),`\n`,_jsxs(_components.li,{children:[`Is your application a native application (mobile or desktop) and/or do you need a\\xA0`,_jsx(_components.a,{href:`/docs/secure/tokens/refresh-tokens`,children:`Refresh Token`}),`? See\\xA0`,_jsx(_components.a,{href:`/docs/get-started/authentication-and-authorization-flow/authorization-code-flow-with-pkce/call-your-api-using-the-authorization-code-flow-with-pkce`,children:`Authorization Code Grant with PKCE`}),`\\xA0for more information.`]}),`\n`]}),`\n`,_jsx(Warning,{children:_jsxs(_components.p,{children:[`Before you go live, you should ensure that\\xA0`,_jsx(_components.strong,{children:`only`}),`\\xA0the grants that you are using for each application are enabled in your\\xA0`,_jsx(_components.a,{href:`/docs/get-started/applications/update-grant-types`,children:`configuration for your Application`}),`.`]})}),`\n`,_jsx(Heading,{level:`3`,id:`authorization-code-grant-with-or-without-pkce`,children:`Authorization code grant (with or without PKCE)`}),`\n`,_jsxs(_components.p,{children:[`If your SDK only supports the Authorization Code grant, or you need an Access Token or `,_jsx(Tooltip,{tip:`Refresh Token: Token used to obtain a renewed Access Token without forcing users to log in again.`,cta:`View Glossary`,href:`/docs/glossary?term=Refresh+Token`,children:`Refresh Token`}),`, then Authorization Code grant (with or without\\xA0`,_jsx(_components.a,{href:`/docs/get-started/authentication-and-authorization-flow/authorization-code-flow-with-pkce`,children:`PKCE`}),`) can also be used to retrieve an ID Token. The Authorization Code grant includes an additional API call to exchange the code for a token which can result in additional unnecessary latency if all you need is the ID Token. In many cases the\\xA0`,_jsx(_components.a,{href:`/docs/get-started/authentication-and-authorization-flow/hybrid-flow`,children:`hybrid flow`}),`\\xA0is implemented to provide optimum access to the ID Token while still leveraging Authorization Code grant workflow for the secure and safe retrieval of Access and Refresh Tokens.`]}),`\n`,_jsxs(Warning,{children:[_jsxs(_components.p,{children:[`While Auth0 supports the use of implicit grant for browser-based applications requiring only an ID Token, it is recommended to use authorization code grant with `,_jsx(_components.a,{href:`/docs/get-started/authentication-and-authorization-flow/authorization-code-flow-with-pkce`,children:`PKCE`}),`. For detailed information, see `,_jsx(_components.a,{href:`https://auth0.com/blog/oauth2-implicit-grant-and-spa/`,children:`OAuth2 Implicit Grant and SPA`}),` on the Auth0 Blog.`]}),_jsxs(_components.p,{children:[`If you need a\\xA0`,_jsx(_components.a,{href:`/docs/secure/tokens/refresh-tokens`,children:`Refresh Token`}),`\\xA0so that you can obtain a new Access Token or ID Token without having to re-authenticate the user, then you must use the\\xA0`,_jsx(_components.a,{href:`/docs/get-started/authentication-and-authorization-flow/authorization-code-flow/call-your-api-using-the-authorization-code-flow`,children:`authorization code grant`}),`.`]})]}),`\n`,_jsx(Heading,{level:`2`,id:`attack-protection`,children:`Attack protection`}),`\n`,_jsxs(_components.p,{children:[`The reason that authentication systems are important is to prevent `,_jsx(Tooltip,{tip:`Bad Actors: Entity (a person or group) that poses a threat to the business or environment with the intention to cause harm.`,cta:`View Glossary`,href:`/docs/glossary?term=bad+actors`,children:`bad actors`}),` from accessing applications and user data that they should not. We want to place as many barriers as possible between those bad actors and access to our systems. One of the easiest ways to do this is to ensure that your\\xA0`,_jsx(_components.a,{href:`/docs/secure/attack-protection`,children:`attack protection`}),`\\xA0with Auth0 is configured correctly, so take a moment to read the guidance on this subject and ensure that it’s working correctly for you.`]}),`\n`,_jsxs(Info,{children:[_jsx(Heading,{level:`3`,id:`best-practice-8`,children:`Best Practice`}),_jsxs(_components.p,{children:[`Anomaly detection is handled behind the scenes by Auth0 and provides a great security feature for your product. If you’re going to utilize it, ensure that you have set up your `,_jsx(_components.a,{href:`/docs/get-started/architecture-scenarios/business-to-business/operations#email-provider-setup`,children:`Email Provider`}),` and configured your `,_jsx(_components.a,{href:`/docs/get-started/architecture-scenarios/business-to-business/branding#email-template-customization`,children:`Email Templates`}),` before turning on email delivery to your users.`]})]}),`\n`,_jsx(Heading,{level:`2`,id:`sso-with-legacy-systems`,children:`SSO with legacy systems`}),`\n`,_jsxs(_components.p,{children:[`In a large scale re-structure it’s not always possible—or practical—to update all your applications at once. In fact, our recommended best practice is to plan for an iterative-style approach when it comes to integrating with Auth0. If your applications already participate in Single Sign-on (SSO), and your legacy identity system supports protocols such as OIDC or `,_jsx(Tooltip,{tip:`Security Assertion Markup Language (SAML): Standardized protocol allowing two parties to exchange authentication information without a password.`,cta:`View Glossary`,href:`/docs/glossary?term=SAML`,children:`SAML`}),`, then you have a couple of options available if you want to continue to provide SSO as you integrate with Auth0:`]}),`\n`,_jsxs(_components.ul,{children:[`\n`,_jsxs(_components.li,{children:[`Update your existing identity provider in your legacy SSO system to redirect to Auth0 for login (e.g., using\\xA0`,_jsx(_components.a,{href:`/docs/authenticate/single-sign-on/outbound-single-sign-on/configure-auth0-saml-identity-provider`,children:`SAML`}),`), or`]}),`\n`,_jsxs(_components.li,{children:[`Have Auth0 redirect to your legacy SSO system to login. This requires configuring your legacy system as an IdP in Auth0 (i.e., either using\\xA0`,_jsx(_components.a,{href:`/docs/authenticate/protocols/saml/saml-sso-integrations/configure-auth0-saml-service-provider`,children:`SAML`}),`\\xA0or\\xA0`,_jsx(_components.a,{href:`/docs/authenticate/identity-providers/identity-providers-social`,children:`OIDC`}),`).`]}),`\n`]}),`\n`,_jsxs(Info,{children:[_jsx(Heading,{level:`3`,id:`best-practice-9`,children:`Best Practice`}),_jsx(_components.p,{children:`Supporting an SSO experience with your legacy system can add complexity, but may be worth it to generate a more seamless user experience as you integrate with Auth0. If you intend to go down this path, planning for it early can help ensure that it is possible to achieve. If you don’t already have SSO at a centralized service, then the complexity to add it will unlikely be worth the benefits.`})]}),`\n`,_jsx(_components.p,{children:`This is a complex topic that will likely need some additional investigation depending on your current legacy architecture, and we recommend you only look into this if you currently have SSO support in your legacy system. Note: if you are currently redirecting from your applications to a centralized system to authenticate your users and that system only asks for credentials if you don’t already have a session with the centralized system, then you have a legacy SSO implementation.`}),`\n`,_jsx(Heading,{level:`2`,id:`enterprise-login`,children:`Enterprise Login`}),`\n`,_jsxs(_components.p,{children:[`The “bring your own identity” scenario has become a must-have for almost all B2B applications. Most enterprise companies expect to be able to integrate their IdP into your application so their employees don’t need to store another set of credentials. This is a valuable way of simplifying the user authentication experience without compromising security, and using\\xA0`,_jsx(_components.a,{href:`#universal-login`,children:`Universal Login`}),`\\xA0makes it easy to start adding support for\\xA0`,_jsx(_components.a,{href:`/docs/authenticate/identity-providers/identity-providers-enterprise`,children:`Enterprise Connections`}),`\\xA0with minimal disruption.`]}),`\n`,_jsxs(Info,{children:[_jsx(Heading,{level:`3`,id:`best-practice-10`,children:`Best Practice`}),_jsxs(_components.p,{children:[`Once you start supporting enterprise connections for users, you must do some form of `,_jsx(_components.a,{href:`#home-realm-discovery`,children:`Home Realm Discovery`}),` so that you can determine which connection to send the user to for authentication.`]})]}),`\n`,_jsxs(_components.p,{children:[`With enterprise connection support, user identities and credentials are managed by the identity provider of your customers’ organization, as well as certain identity claims - which Auth0 will use to populate the user\\xA0`,_jsx(_components.a,{href:`/docs/get-started/architecture-scenarios/business-to-business/profile-management`,children:`profile`}),`.`]}),`\n`,_jsxs(Info,{children:[_jsx(Heading,{level:`3`,id:`best-practice-11`,children:`Best Practice`}),_jsxs(_components.p,{children:[`“Bring your own identity” is a great feature to provide, but if you don’t support this from day one, and sometimes even if you do, you may have an organization that wants to switch to their own IdP after already having used the application for a while. You will need a way to `,_jsx(_components.a,{href:`/docs/manage-users/user-accounts/user-account-linking`,children:`link user accounts`}),` to provide an effective way of associating the new identity with the old database identity.`]})]}),`\n`,_jsx(Heading,{level:`2`,id:`multi-factor-authentication-mfa`,children:`Multi-factor authentication (MFA)`}),`\n`,_jsxs(_components.p,{children:[`In an era where misuse of user credentials is at an all-time high, protecting\\xA0your\\xA0systems when it’s so common for hackers to steal users identity information in general is a challenge. One of the most effective ways though is to provide users with the ability to configure a second factor for protecting their account. More commonly referred to as\\xA0`,_jsx(_components.a,{href:`/docs/secure/multi-factor-authentication`,children:`Multi-Factor Authentication`}),`. This will ensure that only a valid user can access their account, even if they use a username and password that may have been compromised from a different application.`]}),`\n`,_jsxs(Info,{children:[_jsx(Heading,{level:`3`,id:`best-practice-12`,children:`Best Practice`}),_jsxs(_components.p,{children:[`It’s quite common for customer facing applications to provide users with an `,_jsx(_components.em,{children:`option`}),` for adding a second factor rather than `,_jsx(_components.em,{children:`forcing`}),` them to use a second factor. For more information regarding this, see `,_jsx(_components.a,{href:`https://auth0.com/learn/multifactor-authentication-customers/`,children:`providing your users with an option to add MFA`}),`.`]})]}),`\n`,_jsx(_components.p,{children:`Auth0 supports a number of different options when it comes to enabling MFA for protecting user account access, and there are several practices to ensure that you will truly be providing a flexible second factor barrier to access:`}),`\n`,_jsxs(_components.ul,{children:[`\n`,_jsxs(_components.li,{children:[`Auth0\\xA0`,_jsx(_components.a,{href:`https://auth0.com/multifactor-authentication`,children:`Guardian`}),`: a service that provides both\\xA0Push\\xA0notification generation and an application for allowing or denying requests.\\xA0Push\\xA0sends notification to a user’s pre-registered device - typically a mobile or tablet - from which a user can immediately allow or deny account access via the simple press of a button.`]}),`\n`,_jsxs(_components.li,{children:[`Time-based One-Time Password (`,_jsx(_components.a,{href:`https://auth0.com/blog/from-theory-to-practice-adding-two-factor-to-node-dot-js/`,children:`TOTP`}),`): allows you to register a device - such as Google Authenticator - that will generate a one-time password which changes over time and which can be entered as the second factor to validate a user’s account.`]}),`\n`,_jsx(_components.li,{children:`SMS: for sending a one-time code over SMS which the user is then prompted to enter before they can finish authenticating.`}),`\n`,_jsx(_components.li,{children:`Voice: for delivering a one-time code through a phone call which the user is then prompted to enter before they can finish authenticating.`}),`\n`,_jsx(_components.li,{children:`Duo: allows you to use your Duo account for multi-factor authentication.`}),`\n`,_jsx(_components.li,{children:`Email: allows you to use your email account for multi-factor authentication.`}),`\n`]}),`\n`,_jsxs(_components.p,{children:[`Whilst MFA workflow using technologies such as Guardian or Google Authenticator is typically provided via a separate application that runs on a mobile or tablet device, if you don’t want your customers to have to download a separate application Auth0 also provides you with an\\xA0`,_jsx(_components.a,{href:`https://auth0.com/blog/announcing-guardian-whitelabel-sdk/`,children:`SDK`}),`\\xA0that you can use to build second factor workflow right in your existing mobile device application(s).`]}),`\n`,_jsx(Heading,{level:`2`,id:`project-planning-guide`,children:`Project Planning Guide`}),`\n`,_jsx(_components.p,{children:`We provide planning guidance in PDF format that you can download and refer to for details about our recommended strategies.`}),`\n`,_jsx(_components.p,{children:_jsx(_components.a,{href:`https://assets.ctfassets.net/cdy7uua7fh8z/63F0WOPJdVzsPMxV1Xvp8x/7a329487c5e890d8e820f6a48983b46a/B2B_Project_Planning.pdf`,children:`B2B IAM Project Planning Guide`})}),`\n`,_jsx(Heading,{level:`2`,id:`multiple-organization-architecture-multitenancy`,children:`Multiple Organization Architecture (Multitenancy)`}),`\n`,_jsx(_components.p,{children:`Many B2B platforms implement some form of isolation and/or branding for their customers’ organization, and this can add complexity to any Identity and Access Management (IAM) system. If this applies to you, then we recommend you take some time to read through our guidance and best practice advice for this type of environment.`}),`\n`,_jsx(_components.p,{children:_jsx(_components.a,{href:`/docs/get-started/architecture-scenarios/multiple-organization-architecture`,children:`Multiple Organization Architecture`})})]})}function MDXContent(props={}){const{wrapper:MDXLayout}={..._provideComponents(),...props.components};return MDXLayout?_jsx(MDXLayout,{...props,children:_jsx(_createMdxContent,{...props})}):_createMdxContent(props)}return{default:MDXContent};function _missingMdxReference(id,component){throw new Error(`Expected `+(component?`component`:`object`)+\" `\"+id+\"` to be defined: you likely forgot to import, pass, or provide it.\")}","frontmatter":{},"scope":{"config":{},"pageMetadata":{"og:description":"How authentication works in your B2B IAM implementation.","og:image":"https://cdn2.auth0.com/docs/1.14553.0/img/share-image.png","og:title":"Authentication (B2B)","og:url":"https://auth0.com/docs/","permalink":"authentication","title":"Authentication (B2B)","twitter:description":"How authentication works in your B2B IAM implementation.","twitter:title":"Authentication (B2B)","description":null,"href":"/docs/get-started/architecture-scenarios/business-to-business/authentication"}}},"mdxSourceWithNoJs":null},"mdxExtracts":{"tableOfContents":[{"title":"Best Practice","slug":"best-practice","depth":3,"children":[]},{"title":"Universal Login","slug":"universal-login","depth":2,"children":[{"title":"Best Practice","slug":"best-practice-2","depth":3,"children":[]}]},{"title":"Home realm discovery","slug":"home-realm-discovery","depth":2,"children":[{"title":"Application driven HRD","slug":"application-driven-hrd","depth":3,"children":[]},{"title":"Best practice","slug":"best-practice-3","depth":3,"children":[]},{"title":"Best practice","slug":"best-practice-4","depth":3,"children":[]},{"title":"HRD through Universal Login","slug":"hrd-through-universal-login","depth":3,"children":[]},{"title":"HRD through Universal Login using the email subdomain","slug":"hrd-through-universal-login-using-the-email-subdomain","depth":4,"children":[]},{"title":"HRD through Universal Login using the Identifier to Realm Map","slug":"hrd-through-universal-login-using-the-identifier-to-realm-map","depth":4,"children":[]},{"title":"Best practice","slug":"best-practice-5","depth":3,"children":[]},{"title":"HRD through Universal Login using user choice","slug":"hrd-through-universal-login-using-user-choice","depth":4,"children":[]}]},{"title":"Username and password authentication","slug":"username-and-password-authentication","depth":2,"children":[{"title":"Best Practice","slug":"best-practice-6","depth":3,"children":[]}]},{"title":"Application integration","slug":"application-integration","depth":2,"children":[{"title":"Anonymous access","slug":"anonymous-access","depth":3,"children":[]},{"title":"Deep linking to protected endpoints","slug":"deep-linking-to-protected-endpoints","depth":3,"children":[]},{"title":"Best Practice","slug":"best-practice-7","depth":3,"children":[]},{"title":"Authenticating the user","slug":"authenticating-the-user","depth":3,"children":[]},{"title":"Authorization code grant (with or without PKCE)","slug":"authorization-code-grant-with-or-without-pkce","depth":3,"children":[]}]},{"title":"Attack protection","slug":"attack-protection","depth":2,"children":[{"title":"Best Practice","slug":"best-practice-8","depth":3,"children":[]}]},{"title":"SSO with legacy systems","slug":"sso-with-legacy-systems","depth":2,"children":[{"title":"Best Practice","slug":"best-practice-9","depth":3,"children":[]}]},{"title":"Enterprise Login","slug":"enterprise-login","depth":2,"children":[{"title":"Best Practice","slug":"best-practice-10","depth":3,"children":[]},{"title":"Best Practice","slug":"best-practice-11","depth":3,"children":[]}]},{"title":"Multi-factor authentication (MFA)","slug":"multi-factor-authentication-mfa","depth":2,"children":[{"title":"Best Practice","slug":"best-practice-12","depth":3,"children":[]}]},{"title":"Project Planning Guide","slug":"project-planning-guide","depth":2,"children":[]},{"title":"Multiple Organization Architecture (Multitenancy)","slug":"multiple-organization-architecture-multitenancy","depth":2,"children":[]}],"codeExamples":{}},"jsLinks":["/_mintlify/custom/auth0-cq3uo/84646ae98d13f7f8/userback.js","/_mintlify/custom/auth0-cq3uo/37494d5bfda1cb0d/scripts/appendRelatedPages.js","/_mintlify/custom/auth0-cq3uo/bfc1698888fc9ee0/navbar-controller.js"],"subdomain":"auth0-cq3uo","siteName":"Auth0 Docs","title":"Authentication (B2B)","navMaps":{"firstHrefInVersion":{},"firstHrefInLanguage":{}},"lastModified":"2025-09-11T17:41:09.137Z","originalFileLocation":"docs/get-started/architecture-scenarios/business-to-business/authentication.mdx"},"headHtml":"\u003cscript data-mint-head>(function(){var d=document.documentElement,p=null;if(!p){try{p=localStorage.getItem(\"isDarkMode\")}catch(e){}if(p==='true')p='dark';else if(p==='false')p='light';if(p!=='light'\u0026\u0026p!=='dark'\u0026\u0026p!=='system')p=\"system\"}var r=p==='system'?(matchMedia(\"(prefers-color-scheme: dark)\").matches?'dark':'light'):p;d.classList.remove(r==='dark'?'light':'dark');d.classList.add(r);d.setAttribute(\"data-theme-preference\",p)})();\u003c/script>\u003cmeta data-mint-head name=\"application-name\" content=\"Auth0 Docs\">\u003cmeta data-mint-head name=\"generator\" content=\"Mintlify\">\u003clink data-mint-head rel=\"apple-touch-icon\" type=\"image/png\" sizes=\"180x180\" href=\"https://mintlify.s3.us-west-1.amazonaws.com/auth0-cq3uo/_generated/favicon/apple-touch-icon.png?v=3\">\u003clink data-mint-head rel=\"icon\" type=\"image/png\" sizes=\"32x32\" href=\"https://mintlify.s3.us-west-1.amazonaws.com/auth0-cq3uo/_generated/favicon/favicon-32x32.png?v=3\">\u003clink data-mint-head rel=\"icon\" type=\"image/png\" sizes=\"16x16\" href=\"https://mintlify.s3.us-west-1.amazonaws.com/auth0-cq3uo/_generated/favicon/favicon-16x16.png?v=3\">\u003clink data-mint-head rel=\"shortcut icon\" type=\"image/x-icon\" href=\"https://mintlify.s3.us-west-1.amazonaws.com/auth0-cq3uo/_generated/favicon/favicon.ico?v=3\">\u003cmeta data-mint-head property=\"og:title\" content=\"Authentication (B2B)\">\u003cmeta data-mint-head property=\"og:description\" content=\"How authentication works in your B2B IAM implementation.\">\u003cmeta data-mint-head property=\"og:site_name\" content=\"Auth0 Docs\">\u003cmeta data-mint-head property=\"og:url\" content=\"https://auth0-cq3uo.mintlify.app/docs/get-started/architecture-scenarios/business-to-business/authentication\">\u003cmeta data-mint-head property=\"og:type\" content=\"website\">\u003cmeta data-mint-head property=\"og:image\" content=\"https://cdn2.auth0.com/docs/1.14553.0/img/share-image.png\">\u003cmeta data-mint-head property=\"og:image:width\" content=\"1200\">\u003cmeta data-mint-head property=\"og:image:height\" content=\"630\">\u003cmeta data-mint-head name=\"twitter:card\" content=\"summary_large_image\">\u003cmeta data-mint-head name=\"twitter:title\" content=\"Authentication (B2B)\">\u003cmeta data-mint-head name=\"twitter:description\" content=\"How authentication works in your B2B IAM implementation.\">\u003cmeta data-mint-head name=\"twitter:image\" content=\"https://cdn2.auth0.com/docs/1.14553.0/img/share-image.png\">\u003cmeta data-mint-head name=\"twitter:image:width\" content=\"1200\">\u003cmeta data-mint-head name=\"twitter:image:height\" content=\"630\">\u003cmeta data-mint-head name=\"msapplication-config\" content=\"https://mintlify.s3.us-west-1.amazonaws.com/auth0-cq3uo/_generated/favicon/browserconfig.xml?v=3\">\u003cmeta data-mint-head name=\"apple-mobile-web-app-title\" content=\"Auth0 Docs\">\u003cmeta data-mint-head name=\"msapplication-TileColor\" content=\"#000\">\u003clink data-mint-head rel=\"canonical\" href=\"https://auth0-cq3uo.mintlify.app/docs/get-started/architecture-scenarios/business-to-business/authentication\">\u003clink data-mint-head rel=\"alternate\" type=\"application/xml\" href=\"/sitemap.xml\">\u003clink data-mint-head rel=\"alternate\" type=\"text/markdown\" href=\"/docs/get-started/architecture-scenarios/business-to-business/authentication.md\">\u003cscript data-mint-head type=\"application/ld+json\">{\"@context\":\"https://schema.org\",\"@graph\":[{\"@type\":\"Organization\",\"@id\":\"https://auth0-cq3uo.mintlify.app/#organization\",\"name\":\"Auth0 Docs\",\"url\":\"https://auth0-cq3uo.mintlify.app\",\"logo\":{\"@type\":\"ImageObject\",\"url\":\"https://mintlify.s3.us-west-1.amazonaws.com/auth0-cq3uo/logo/light.svg\"}},{\"@type\":\"WebSite\",\"@id\":\"https://auth0-cq3uo.mintlify.app#website\",\"name\":\"Auth0 Docs\",\"url\":\"https://auth0-cq3uo.mintlify.app\",\"publisher\":{\"@id\":\"https://auth0-cq3uo.mintlify.app/#organization\"}},{\"@type\":\"WebPage\",\"@id\":\"https://auth0-cq3uo.mintlify.app/docs/get-started/architecture-scenarios/business-to-business/authentication#webpage\",\"url\":\"https://auth0-cq3uo.mintlify.app/docs/get-started/architecture-scenarios/business-to-business/authentication\",\"name\":\"Authentication (B2B)\",\"dateModified\":\"2025-09-11T17:41:09.137Z\",\"isPartOf\":{\"@id\":\"https://auth0-cq3uo.mintlify.app#website\"},\"breadcrumb\":{\"@id\":\"https://auth0-cq3uo.mintlify.app/docs/get-started/architecture-scenarios/business-to-business/authentication#breadcrumb\"}},{\"@type\":\"BreadcrumbList\",\"@id\":\"https://auth0-cq3uo.mintlify.app/docs/get-started/architecture-scenarios/business-to-business/authentication#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Plan and Design\",\"item\":\"https://auth0-cq3uo.mintlify.app/docs/get-started/authentication-and-authorization-flow\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Architecture Scenarios\",\"item\":\"https://auth0-cq3uo.mintlify.app/docs/get-started/architecture-scenarios\"},{\"@type\":\"ListItem\",\"position\":3,\"name\":\"Business to Business\",\"item\":\"https://auth0-cq3uo.mintlify.app/docs/get-started/architecture-scenarios/business-to-business\"},{\"@type\":\"ListItem\",\"position\":4,\"name\":\"Authentication (B2B)\",\"item\":\"https://auth0-cq3uo.mintlify.app/docs/get-started/architecture-scenarios/business-to-business/authentication\"}]},{\"@type\":[\"Article\",\"TechArticle\"],\"@id\":\"https://auth0-cq3uo.mintlify.app/docs/get-started/architecture-scenarios/business-to-business/authentication#article\",\"headline\":\"Authentication (B2B)\",\"name\":\"Authentication (B2B)\",\"url\":\"https://auth0-cq3uo.mintlify.app/docs/get-started/architecture-scenarios/business-to-business/authentication\",\"mainEntityOfPage\":{\"@id\":\"https://auth0-cq3uo.mintlify.app/docs/get-started/architecture-scenarios/business-to-business/authentication#webpage\"},\"image\":\"https://cdn2.auth0.com/docs/1.14553.0/img/share-image.png\",\"dateModified\":\"2025-09-11T17:41:09.137Z\",\"publisher\":{\"@id\":\"https://auth0-cq3uo.mintlify.app/#organization\"},\"isPartOf\":{\"@id\":\"https://auth0-cq3uo.mintlify.app#website\"}}]}\u003c/script>\u003cscript data-mint-head type=\"application/ld+json\">{\"@context\":\"https://schema.org\",\"@type\":\"WebSite\",\"name\":\"Auth0 Docs\",\"creator\":{\"@type\":\"Organization\",\"name\":\"Mintlify\",\"url\":\"https://mintlify.com\"}}\u003c/script>","siteName":"Auth0 Docs","nav":{"global":null,"tabs":[{"tab":"Home","pages":[{"title":"Home","href":""}]},{"tab":"Documentation","dropdowns":[{"dropdown":"Getting Started","icon":"play","description":"Learn the basics","pages":[{"title":"Get Started","href":"/docs/get-started"},{"group":"Auth0 Onboarding","pages":[{"sidebarTitle":"Overview","title":"Auth0 Onboarding","href":"/docs/get-started/onboarding"},{"title":"Self-Service Machine-to-Machine","href":"/docs/get-started/onboarding/self-service-m2m"}]},{"group":"Learn the Basics","pages":[{"group":"Identity Fundamentals","pages":[{"sidebarTitle":"Overview","title":"Identity Fundamentals","href":"/docs/get-started/identity-fundamentals"},{"title":"Introduction to Identity and Access Management (IAM)","href":"/docs/get-started/identity-fundamentals/identity-and-access-management"},{"title":"Introduction to Auth0","href":"/docs/get-started/identity-fundamentals/introduction-to-auth0"},{"title":"Authentication vs. Authorization","href":"/docs/get-started/identity-fundamentals/authentication-and-authorization"}]},{"group":"Auth0 Overview","pages":[{"sidebarTitle":"Overview","title":"Auth0 Overview","href":"/docs/get-started/auth0-overview"},{"group":"Auth0 Dashboard","pages":[{"sidebarTitle":"Overview","title":"Auth0 Dashboard","href":"/docs/get-started/auth0-overview/dashboard"},{"title":"About the Activity Page","href":"/docs/get-started/auth0-overview/dashboard/activity"}]},{"group":"Create Tenants","pages":[{"sidebarTitle":"Overview","title":"Create Tenants","href":"/docs/get-started/auth0-overview/create-tenants"},{"title":"Create Multiple Tenants","href":"/docs/get-started/auth0-overview/create-tenants/create-multiple-tenants"},{"title":"Link Multiple Tenants to a Single Subscription","href":"/docs/get-started/auth0-overview/create-tenants/child-tenants"},{"title":"Set Up Multiple Environments","href":"/docs/get-started/auth0-overview/create-tenants/set-up-multiple-environments"},{"title":"Multi-Tenant Applications Best Practices","href":"/docs/get-started/auth0-overview/create-tenants/multi-tenant-apps-best-practices"}]},{"group":"Create Applications","pages":[{"title":"Create Applications","href":"/docs/get-started/auth0-overview/create-applications"},{"title":"Register Native Applications","href":"/docs/get-started/auth0-overview/create-applications/native-apps"},{"title":"Register Single-Page Web Applications","href":"/docs/get-started/auth0-overview/create-applications/single-page-web-apps"},{"title":"Register Regular Web Applications","href":"/docs/get-started/auth0-overview/create-applications/regular-web-apps"},{"title":"Register Machine-to-Machine Applications","href":"/docs/get-started/auth0-overview/create-applications/machine-to-machine-apps"},{"title":"Configure an Identity Provider in Access Gateway","href":"/docs/get-started/auth0-overview/create-applications/configure-an-identity-provider-in-access-gateway"}]},{"title":"Register APIs","href":"/docs/get-started/auth0-overview/set-up-apis"}]}]},{"group":"Configure Auth0","pages":[{"group":"Auth0 Teams","pages":[{"sidebarTitle":"Overview","title":"Auth0 Teams","href":"/docs/get-started/auth0-teams"},{"title":"Tenant Management","href":"/docs/get-started/auth0-teams/tenant-management"},{"title":"Team Member Management","href":"/docs/get-started/auth0-teams/team-member-management"},{"title":"Tenant Member Management","href":"/docs/get-started/auth0-teams/tenant-member-management"},{"title":"Configure Security Policies","href":"/docs/get-started/auth0-teams/configure-security-policies"},{"title":"Troubleshoot Teams","href":"/docs/get-started/auth0-teams/troubleshoot-teams"},{"title":"Team Activity","href":"/docs/get-started/auth0-teams/team-activity"},{"title":"About the Quarterly Snapshot","href":"/docs/get-started/auth0-teams/quarterly-snapshot"}]},{"group":"Dashboard Profile","pages":[{"sidebarTitle":"Overview","title":"Dashboard Profile","href":"/docs/get-started/dashboard-profile"},{"title":"Auth0 Dashboard Login Session Management","href":"/docs/get-started/dashboard-profile/auth0-dashboard-login-session-management"},{"title":"Light and Dark themes","href":"/docs/get-started/dashboard-profile/light-and-dark-themes"}]},{"group":"Tenant Settings","pages":[{"sidebarTitle":"Overview","title":"Tenant Settings","href":"/docs/get-started/tenant-settings"},{"group":"Signing Keys","pages":[{"sidebarTitle":"Overview","title":"Signing Keys","href":"/docs/get-started/tenant-settings/signing-keys"},{"title":"Rotate Signing Keys","href":"/docs/get-started/tenant-settings/signing-keys/rotate-signing-keys"},{"title":"Revoke Signing Keys","href":"/docs/get-started/tenant-settings/signing-keys/revoke-signing-keys"},{"title":"View Signing Certificates","href":"/docs/get-started/tenant-settings/signing-keys/view-signing-certificates"},{"title":"Customer Provided Public Signing Keys","href":"/docs/get-started/tenant-settings/signing-keys/customer-signing-keys"}]},{"title":"Configure Device User Code Settings","href":"/docs/get-started/tenant-settings/configure-device-user-code-settings"},{"title":"Enable Single Sign-On for Tenants","href":"/docs/get-started/tenant-settings/enable-sso-for-legacy-tenants"},{"title":"Find Your Tenant Name or Tenant ID","href":"/docs/get-started/tenant-settings/find-your-tenant-name-or-tenant-id"}]},{"group":"Applications in Auth0","pages":[{"sidebarTitle":"Overview","title":"Applications in Auth0","href":"/docs/get-started/applications"},{"title":"Application Settings","href":"/docs/get-started/applications/application-settings"},{"title":"Credential Settings","href":"/docs/get-started/applications/credentials"},{"title":"Subdomain URL Placeholders","href":"/docs/get-started/applications/wildcards-for-subdomains"},{"group":"Confidential and Public Applications","pages":[{"sidebarTitle":"Overview","title":"Confidential and Public Applications","href":"/docs/get-started/applications/confidential-and-public-applications"},{"title":"Check if Application is Confidential or Public","href":"/docs/get-started/applications/confidential-and-public-applications/view-application-type"},{"title":"First-Party and Third-Party Applications","href":"/docs/get-started/applications/confidential-and-public-applications/first-party-and-third-party-applications"},{"title":"View Application Ownership","href":"/docs/get-started/applications/confidential-and-public-applications/view-application-ownership"},{"title":"Update Application Ownership","href":"/docs/get-started/applications/confidential-and-public-applications/update-application-ownership"},{"title":"Enable Third-Party Applications","href":"/docs/get-started/applications/confidential-and-public-applications/enable-third-party-applications"},{"title":"User Consent and Third-Party Applications","href":"/docs/get-started/applications/confidential-and-public-applications/user-consent-and-third-party-applications"}]},{"title":"Dynamic Application Registration","href":"/docs/get-started/applications/dynamic-client-registration"},{"title":"Set Up Database Connections","href":"/docs/get-started/applications/set-up-database-connections"},{"title":"Test Database Connections","href":"/docs/get-started/applications/test-database-connections"},{"title":"Application Grant Types","href":"/docs/get-started/applications/application-grant-types"},{"title":"Update Grant Types","href":"/docs/get-started/applications/update-grant-types"},{"title":"Revoke Access to APIs Using Application Grants","href":"/docs/get-started/applications/revoke-api-access"},{"title":"Signing Algorithms","href":"/docs/get-started/applications/signing-algorithms"},{"title":"Change Application Signing Algorithms","href":"/docs/get-started/applications/change-application-signing-algorithms"},{"title":"Configure Application Metadata","href":"/docs/get-started/applications/configure-application-metadata"},{"title":"Update Application Connections","href":"/docs/get-started/applications/update-application-connections"},{"title":"Rotate Credentials","href":"/docs/get-started/applications/rotate-credentials"},{"title":"Rotate Client Secrets","href":"/docs/get-started/applications/rotate-client-secret"},{"title":"Enable Android App Links Support","href":"/docs/get-started/applications/enable-android-app-links-support"},{"title":"Enable Universal Links Support in Apple Xcode","href":"/docs/get-started/applications/enable-universal-links-support-in-apple-xcode"},{"title":"Configure Cross-Origin Resource Sharing","href":"/docs/get-started/applications/set-up-cors"},{"title":"Configure Applications with OIDC Discovery","href":"/docs/get-started/applications/configure-applications-with-oidc-discovery"},{"title":"Configure WS-Fed Applications","href":"/docs/get-started/applications/configure-ws-fed-applications"},{"group":"Configure FAPI Compliance","pages":[{"sidebarTitle":"Overview","title":"Configure FAPI Compliance","href":"/docs/get-started/applications/configure-fapi-compliance"},{"title":"Configure Auth0 to pass OpenID FAPI Certification Tests","href":"/docs/get-started/applications/configure-fapi-compliance/configure-auth0-to-pass-openid-fapi-certification-tests"}]},{"title":"Configure Pushed Authorization Requests (PAR)","href":"/docs/get-started/applications/configure-par"},{"title":"Configure JWT-secured Authorization Requests (JAR)","href":"/docs/get-started/applications/configure-jar"},{"group":"Configure mTLS Authentication","pages":[{"sidebarTitle":"Overview","title":"Configure mTLS Authentication","href":"/docs/get-started/applications/configure-mtls"},{"title":"Set up the Customer Edge","href":"/docs/get-started/applications/configure-mtls/set-up-the-customer-edge"},{"title":"Configure mTLS Authentication for a Tenant","href":"/docs/get-started/applications/configure-mtls/configure-mtls-for-a-tenant"},{"title":"Configure mTLS Authentication for a Client","href":"/docs/get-started/applications/configure-mtls/configure-mtls-for-a-client"}]},{"title":"Configure Private Key JWT Authentication","href":"/docs/get-started/applications/configure-private-key-jwt"},{"title":"Remove Applications","href":"/docs/get-started/applications/remove-applications"},{"title":"Test Applications Locally","href":"/docs/get-started/applications/work-with-auth0-locally"},{"title":"Enable Single Sign-On Integrations for Applications","href":"/docs/get-started/applications/enable-sso-for-applications"},{"title":"Configure Client-Initiated Backchannel Authentication","href":"/docs/get-started/applications/configure-client-initiated-backchannel-authentication"}]},{"group":"APIs","pages":[{"sidebarTitle":"Overview","title":"APIs","href":"/docs/get-started/apis"},{"title":"API Settings","href":"/docs/get-started/apis/api-settings"},{"title":"Add API Permissions","href":"/docs/get-started/apis/add-api-permissions"},{"title":"Delete API Permissions","href":"/docs/get-started/apis/delete-api-permissions"},{"group":"Scopes","pages":[{"sidebarTitle":"Overview","title":"Scopes","href":"/docs/get-started/apis/scopes"},{"title":"API Scopes","href":"/docs/get-started/apis/scopes/api-scopes"},{"title":"OpenID Connect Scopes","href":"/docs/get-started/apis/scopes/openid-connect-scopes"},{"title":"Sample Use Cases: Scopes and Claims","href":"/docs/get-started/apis/scopes/sample-use-cases-scopes-and-claims"}]},{"title":"Configure Access Token Profile","href":"/docs/get-started/apis/configure-access-token-profile"},{"title":"Configure JSON Web Encryption (JWE)","href":"/docs/get-started/apis/configure-json-web-encryption"},{"title":"Configure Logical API for Multiple APIs","href":"/docs/get-started/apis/set-logical-api"},{"title":"Configure Rich Authorization Requests (RAR)","href":"/docs/get-started/apis/configure-rich-authorization-requests"},{"title":"Create Machine-to-Machine Applications for Testing","href":"/docs/get-started/apis/create-m2m-app-test"},{"title":"Enable Role-Based Access Control for APIs","href":"/docs/get-started/apis/enable-role-based-access-control-for-apis"}]},{"group":"Manage Dashboard Access","pages":[{"sidebarTitle":"Overview","title":"Manage Dashboard Access","href":"/docs/get-started/manage-dashboard-access"},{"title":"Dashboard Access by Role","href":"/docs/get-started/manage-dashboard-access/feature-access-by-role"},{"title":"Add Tenant Members","href":"/docs/get-started/manage-dashboard-access/add-dashboard-users"},{"title":"Edit Tenant Members","href":"/docs/get-started/manage-dashboard-access/edit-dashboard-users"},{"title":"Remove Tenant Members","href":"/docs/get-started/manage-dashboard-access/remove-dashboard-users"},{"title":"Update Dashboard User Email Addresses","href":"/docs/get-started/manage-dashboard-access/update-dashboard-user-email"},{"group":"Auth0 AI","pages":[{"title":"Multi-Factor Authentication for Dashboard Users","href":"/docs/get-started/manage-dashboard-access/add-change-remove-mfa"},{"title":"Add Multi-Factor Authentication for Auth0 Dashboard Access","href":"/docs/get-started/manage-dashboard-access/add-change-remove-mfa/add-mfa"},{"title":"Remove or Change Dashboard Multi-Factor Authentication","href":"/docs/get-started/manage-dashboard-access/add-change-remove-mfa/remove-or-change-dashboard-multi-factor-authentication"}]},{"title":"Configure Single Sign-on for Auth0 Dashboard","href":"/docs/get-started/manage-dashboard-access/configure-single-sign-on-for-auth0-dashboard"}]}]},{"group":"Plan and Design","pages":[{"group":"Authentication and Authorization Flows","pages":[{"sidebarTitle":"Overview","title":"Authentication and Authorization Flows","href":"/docs/get-started/authentication-and-authorization-flow"},{"title":"Which OAuth 2.0 Flow Should I Use?","href":"/docs/get-started/authentication-and-authorization-flow/which-oauth-2-0-flow-should-i-use"},{"group":"Authorization Code Flow","pages":[{"sidebarTitle":"Overview","title":"Authorization Code Flow","href":"/docs/get-started/authentication-and-authorization-flow/authorization-code-flow"},{"title":"Add Login Using the Authorization Code Flow","href":"/docs/get-started/authentication-and-authorization-flow/authorization-code-flow/add-login-auth-code-flow"},{"title":"Call Your API Using the Authorization Code Flow","href":"/docs/get-started/authentication-and-authorization-flow/authorization-code-flow/call-your-api-using-the-authorization-code-flow"},{"title":"Authorization Code Flow with Rich Authorization Requests (RAR)","href":"/docs/get-started/authentication-and-authorization-flow/authorization-code-flow/authorization-code-flow-with-rar"},{"title":"Authorization Code Flow with Pushed Authorization Requests (PAR)","href":"/docs/get-started/authentication-and-authorization-flow/authorization-code-flow/authorization-code-flow-with-par"},{"title":"Authorization Code Flow with JWT-Secured Authorization Requests (JAR)","href":"/docs/get-started/authentication-and-authorization-flow/authorization-code-flow/authorization-code-flow-with-jar"},{"title":"Authorization Code Flow with PAR and JAR","href":"/docs/get-started/authentication-and-authorization-flow/authorization-code-flow/authorization-code-flow-with-par-and-jar"}]},{"group":"Authorization Code Flow with Proof Key for Code Exchange","pages":[{"title":"Authorization Code Flow with Proof Key for Code Exchange (PKCE)","href":"/docs/get-started/authentication-and-authorization-flow/authorization-code-flow-with-pkce"},{"title":"Add Login Using the Authorization Code Flow with PKCE","href":"/docs/get-started/authentication-and-authorization-flow/authorization-code-flow-with-pkce/add-login-using-the-authorization-code-flow-with-pkce"},{"title":"Call Your API Using the Authorization Code Flow with PKCE","href":"/docs/get-started/authentication-and-authorization-flow/authorization-code-flow-with-pkce/call-your-api-using-the-authorization-code-flow-with-pkce"}]},{"group":"Client Credentials Flow","pages":[{"sidebarTitle":"Overview","title":"Client Credentials Flow","href":"/docs/get-started/authentication-and-authorization-flow/client-credentials-flow"},{"title":"Call Your API Using the Client Credentials Flow","href":"/docs/get-started/authentication-and-authorization-flow/client-credentials-flow/call-your-api-using-the-client-credentials-flow"},{"title":"Customize Tokens Using Hooks with Client Credentials Flow","href":"/docs/get-started/authentication-and-authorization-flow/client-credentials-flow/customize-tokens-using-hooks-with-client-credentials-flow"}]},{"group":"Client-Initiated Backchannel Authentication Flow","pages":[{"sidebarTitle":"Overview","title":"Client-Initiated Backchannel Authentication Flow","href":"/docs/get-started/authentication-and-authorization-flow/client-initiated-backchannel-authentication-flow"},{"title":"User Authentication with CIBA","href":"/docs/get-started/authentication-and-authorization-flow/client-initiated-backchannel-authentication-flow/user-authentication-with-ciba"},{"title":"User Authorization with CIBA","href":"/docs/get-started/authentication-and-authorization-flow/client-initiated-backchannel-authentication-flow/user-authorization-with-ciba"}]},{"group":"Device Authorization Flow","pages":[{"sidebarTitle":"Overview","title":"Device Authorization Flow","href":"/docs/get-started/authentication-and-authorization-flow/device-authorization-flow"},{"title":"Call Your API Using the Device Authorization Flow","href":"/docs/get-started/authentication-and-authorization-flow/device-authorization-flow/call-your-api-using-the-device-authorization-flow"}]},{"group":"Implicit Flow with Form Post","pages":[{"sidebarTitle":"Overview","title":"Implicit Flow with Form Post","href":"/docs/get-started/authentication-and-authorization-flow/implicit-flow-with-form-post"},{"title":"Mitigate Replay Attacks When Using the Implicit Flow","href":"/docs/get-started/authentication-and-authorization-flow/implicit-flow-with-form-post/mitigate-replay-attacks-when-using-the-implicit-flow"},{"title":"Add Login Using the Implicit Flow with Form Post","href":"/docs/get-started/authentication-and-authorization-flow/implicit-flow-with-form-post/add-login-using-the-implicit-flow-with-form-post"}]},{"group":"Hybrid Flow","pages":[{"sidebarTitle":"Overview","title":"Hybrid Flow","href":"/docs/get-started/authentication-and-authorization-flow/hybrid-flow"},{"title":"Call Your API Using the Hybrid Flow","href":"/docs/get-started/authentication-and-authorization-flow/hybrid-flow/call-api-hybrid-flow"}]},{"group":"Resource Owner Password Flow","pages":[{"sidebarTitle":"Overview","title":"Resource Owner Password Flow","href":"/docs/get-started/authentication-and-authorization-flow/resource-owner-password-flow"},{"title":"Call Your API Using Resource Owner Password Flow","href":"/docs/get-started/authentication-and-authorization-flow/resource-owner-password-flow/call-your-api-using-resource-owner-password-flow"},{"title":"Avoid Common Issues with Resource Owner Password Flow and Attack Protection","href":"/docs/get-started/authentication-and-authorization-flow/resource-owner-password-flow/avoid-common-issues-with-resource-owner-password-flow-and-attack-protection"}]},{"title":"Authenticate with Private Key JWT","href":"/docs/get-started/authentication-and-authorization-flow/authenticate-with-private-key-jwt"},{"title":"Authenticate with mTLS","href":"/docs/get-started/authentication-and-authorization-flow/authenticate-with-mtls"},{"title":"Client Credentials Exchange","href":"/docs/get-started/authentication-and-authorization-flow/client-credentials-exchange"}]},{"group":"Architecture Scenarios","pages":[{"sidebarTitle":"Overview","title":"Architecture Scenarios","href":"/docs/get-started/architecture-scenarios"},{"group":"Business to Consumer","pages":[{"sidebarTitle":"Overview","title":"Business to Consumer","href":"/docs/get-started/architecture-scenarios/business-to-consumer"},{"title":"Architecture (B2C)","href":"/docs/get-started/architecture-scenarios/business-to-consumer/architecture"},{"title":"Provisioning (B2C)","href":"/docs/get-started/architecture-scenarios/business-to-consumer/provisioning"},{"title":"Authentication (B2C)","href":"/docs/get-started/architecture-scenarios/business-to-consumer/authentication"},{"title":"Branding (B2C)","href":"/docs/get-started/architecture-scenarios/business-to-consumer/branding"},{"title":"Deployment Automation (B2C)","href":"/docs/get-started/architecture-scenarios/business-to-consumer/deployment"},{"title":"Quality Assurance (B2C)","href":"/docs/get-started/architecture-scenarios/business-to-consumer/quality-assurance"},{"title":"Profile Management (B2C)","href":"/docs/get-started/architecture-scenarios/business-to-consumer/profile-management"},{"title":"Authorization (B2C)","href":"/docs/get-started/architecture-scenarios/business-to-consumer/authorization"},{"title":"Logout (B2C)","href":"/docs/get-started/architecture-scenarios/business-to-consumer/logout"},{"title":"Operations (B2C)","href":"/docs/get-started/architecture-scenarios/business-to-consumer/operations"},{"group":"Launch Preparation","pages":[{"title":"Launch Preparation (B2C)","href":"/docs/get-started/architecture-scenarios/business-to-consumer/launch"},{"title":"Tenant Check (B2C)","href":"/docs/get-started/architecture-scenarios/business-to-consumer/launch/tenant-check"},{"title":"Testing Complete (B2C)","href":"/docs/get-started/architecture-scenarios/business-to-consumer/launch/testing"},{"title":"Operations Readiness (B2C)","href":"/docs/get-started/architecture-scenarios/business-to-consumer/launch/operations-readiness"},{"title":"Compliance Readiness (B2C)","href":"/docs/get-started/architecture-scenarios/business-to-consumer/launch/compliance-readiness"},{"title":"Support Readiness (B2C)","href":"/docs/get-started/architecture-scenarios/business-to-consumer/launch/support-readiness"},{"title":"Launch Day Preparation (B2C)","href":"/docs/get-started/architecture-scenarios/business-to-consumer/launch/launch-day"}]}]},{"group":"Business to Business","pages":[{"sidebarTitle":"Overview","title":"Business to Business","href":"/docs/get-started/architecture-scenarios/business-to-business"},{"title":"Architecture (B2B)","href":"/docs/get-started/architecture-scenarios/business-to-business/architecture"},{"title":"Provisioning (B2B)","description":null,"href":"/docs/get-started/architecture-scenarios/business-to-business/provisioning"},{"title":"Authentication (B2B)","href":"/docs/get-started/architecture-scenarios/business-to-business/authentication"},{"title":"Branding (B2B)","description":null,"href":"/docs/get-started/architecture-scenarios/business-to-business/branding"},{"title":"Deployment Automation (B2B)","href":"/docs/get-started/architecture-scenarios/business-to-business/deployment"},{"title":"Quality Assurance (B2B)","href":"/docs/get-started/architecture-scenarios/business-to-business/quality-assurance"},{"title":"Profile Management (B2B)","href":"/docs/get-started/architecture-scenarios/business-to-business/profile-management"},{"title":"Authorization (B2B)","href":"/docs/get-started/architecture-scenarios/business-to-business/authorization"},{"title":"Logout (B2B)","href":"/docs/get-started/architecture-scenarios/business-to-business/logout"},{"title":"Operations (B2B)","href":"/docs/get-started/architecture-scenarios/business-to-business/operations"},{"group":"Launch Preparation (B2B)","pages":[{"sidebarTitle":"Overview","title":"Launch Preparation (B2B)","href":"/docs/get-started/architecture-scenarios/business-to-business/launch"},{"title":"Tenant Check (B2B)","href":"/docs/get-started/architecture-scenarios/business-to-business/launch/tenant-check"},{"title":"Testing Complete (B2B)","href":"/docs/get-started/architecture-scenarios/business-to-business/launch/testing"},{"title":"Operations Readiness (B2B)","href":"/docs/get-started/architecture-scenarios/business-to-business/launch/operations-readiness"},{"title":"Compliance Readiness (B2B)","href":"/docs/get-started/architecture-scenarios/business-to-business/launch/compliance-readiness"},{"title":"Support Readiness (B2B)","href":"/docs/get-started/architecture-scenarios/business-to-business/launch/support-readiness"},{"title":"Launch Day Preparation (B2B)","href":"/docs/get-started/architecture-scenarios/business-to-business/launch/launch-day"}]}]},{"title":"Business to Employees","href":"/docs/get-started/architecture-scenarios/b2e"},{"group":"Multiple Organization Architecture","pages":[{"sidebarTitle":"Overview","title":"Multiple Organization Architecture","href":"/docs/get-started/architecture-scenarios/multiple-organization-architecture"},{"group":"Single Identity Provider Organizations","pages":[{"sidebarTitle":"Overview","title":"Single Identity Provider Organizations","href":"/docs/get-started/architecture-scenarios/multiple-organization-architecture/single-identity-provider-organizations"},{"title":"Single Identity Provider: Provisioning","href":"/docs/get-started/architecture-scenarios/multiple-organization-architecture/single-identity-provider-organizations/provisioning"},{"title":"Single Identity Provider: Authentication","href":"/docs/get-started/architecture-scenarios/multiple-organization-architecture/single-identity-provider-organizations/authentication"},{"title":"Single Identity Provider: Branding","href":"/docs/get-started/architecture-scenarios/multiple-organization-architecture/single-identity-provider-organizations/branding"},{"title":"Single Identity Provider: Authorization","href":"/docs/get-started/architecture-scenarios/multiple-organization-architecture/single-identity-provider-organizations/authorization"},{"title":"Single Identity Provider: Profile Management","href":"/docs/get-started/architecture-scenarios/multiple-organization-architecture/single-identity-provider-organizations/profile-management"},{"title":"Single Identity Provider: Logout","href":"/docs/get-started/architecture-scenarios/multiple-organization-architecture/single-identity-provider-organizations/logout"}]},{"title":"Multiple Identity Provider Organizations","href":"/docs/get-started/architecture-scenarios/multiple-organization-architecture/multiple-idp-orgs"}]},{"group":"SSO for Regular Web Apps","pages":[{"title":"Regular Web Applications with Single Sign-On","href":"/docs/get-started/architecture-scenarios/sso-for-regular-web-apps"},{"title":"Solution Overview (Web Apps + SSO)","href":"/docs/get-started/architecture-scenarios/sso-for-regular-web-apps/part-1"},{"title":"Auth0 Configuration (Web Apps + SSO)","href":"/docs/get-started/architecture-scenarios/sso-for-regular-web-apps/part-2"},{"title":"Application Implementation (Web Apps + SSO)","href":"/docs/get-started/architecture-scenarios/sso-for-regular-web-apps/part-3"},{"title":"ASP.NET Core Implementation (Web Apps + SSO)","href":"/docs/get-started/architecture-scenarios/sso-for-regular-web-apps/implementation-aspnetcore"},{"title":"Conclusion (Web Apps + SSO)","href":"/docs/get-started/architecture-scenarios/sso-for-regular-web-apps/part-4"}]},{"group":"Server Application + API","pages":[{"title":"Server Applications with API","href":"/docs/get-started/architecture-scenarios/server-application-api"},{"title":"Solution Overview (Server Apps + API)","href":"/docs/get-started/architecture-scenarios/server-application-api/part-1"},{"title":"Auth0 Configuration (Server Apps + API)","href":"/docs/get-started/architecture-scenarios/server-application-api/part-2"},{"title":"Application Implementation (Server Apps + API)","href":"/docs/get-started/architecture-scenarios/server-application-api/part-3"},{"title":"Server Apps + API: Node.js Implementation for the API","href":"/docs/get-started/architecture-scenarios/server-application-api/api-implementation-nodejs"},{"title":"Server Apps + API: Python Implementation for the Cron Job","href":"/docs/get-started/architecture-scenarios/server-application-api/cron-implementation-python"},{"title":"Conclusion (Server Apps + API)","href":"/docs/get-started/architecture-scenarios/server-application-api/part-4"}]},{"group":"SPA + API","pages":[{"title":"Single-Page Applications (SPA) with API","href":"/docs/get-started/architecture-scenarios/spa-api"},{"title":"Solution Overview (SPAs + API)","href":"/docs/get-started/architecture-scenarios/spa-api/part-1"},{"title":"Auth0 Configuration (SPAs + API)","href":"/docs/get-started/architecture-scenarios/spa-api/part-2"},{"title":"API and SPA Configuration (SPAs + API)","href":"/docs/get-started/architecture-scenarios/spa-api/part-3"},{"title":"SPA Angular 2 Implementation (SPAs + API)","href":"/docs/get-started/architecture-scenarios/spa-api/spa-implementation-angular2"},{"title":"Node.js API Implementation (SPAs + API)","href":"/docs/get-started/architecture-scenarios/spa-api/api-implementation-nodejs"},{"title":"Conclusion (SPAs + API)","href":"/docs/get-started/architecture-scenarios/spa-api/part-4"}]},{"group":"Mobile + API","pages":[{"title":"Mobile Applications with API","href":"/docs/get-started/architecture-scenarios/mobile-api"},{"title":"Solution Overview (Mobile Apps + API)","href":"/docs/get-started/architecture-scenarios/mobile-api/part-1"},{"title":"Auth0 Configuration (Mobile Apps + API)","href":"/docs/get-started/architecture-scenarios/mobile-api/part-2"},{"title":"API and Mobile Configuration (Mobile Apps + API)","href":"/docs/get-started/architecture-scenarios/mobile-api/part-3"},{"title":"Android Mobile Application Implementation (Mobile Apps + API)","href":"/docs/get-started/architecture-scenarios/mobile-api/mobile-implementation-android"},{"title":"Node.js API Implementation (Mobile Apps + API)","href":"/docs/get-started/architecture-scenarios/mobile-api/api-implementation-nodejs"},{"title":"Conclusion (Mobile Apps + API)","href":"/docs/get-started/architecture-scenarios/mobile-api/part-4"}]},{"title":"Implementation Planning Checklists","href":"/docs/get-started/architecture-scenarios/checklists"},{"title":"Implementation Resources","href":"/docs/get-started/architecture-scenarios/implementation-resources"}]},{"group":"Professional Services","pages":[{"title":"Auth0 Professional Services","href":"/docs/get-started/professional-services"},{"title":"Professional Services: Discover and Design","href":"/docs/get-started/professional-services/discover-design"},{"title":"Professional Services: Implement","href":"/docs/get-started/professional-services/implement"},{"title":"Professional Services: Maintain and Improve","href":"/docs/get-started/professional-services/maintain-improve"}]}]},{"group":"Auth0 AI","pages":[{"title":"Auth0 Guide","href":"/docs/get-started/auth0-guide"},{"title":"Auth for GenAI","href":"/docs/get-started/auth-for-genai"},{"group":"Auth0 Model Context Protocol (MCP) Server","pages":[{"sidebarTitle":"Overview","title":"Auth0 Model Context Protocol (MCP) Server","href":"/docs/get-started/auth0-mcp-server"},{"title":"Getting Started with Auth0 Model Context Protocol (MCP) Server","href":"/docs/get-started/auth0-mcp-server/getting-started-with-auth0-mcp-server"},{"group":"Auth0 Model Context Protocol (MCP) Server Guides","pages":[{"sidebarTitle":"Overview","title":"Auth0 Model Context Protocol (MCP) Server Guides","href":"/docs/get-started/auth0-mcp-server/auth0-mcp-server-guides"},{"title":"Streamline API Authorization Flows with Auth0 Model Context Protocol (MCP) Server","href":"/docs/get-started/auth0-mcp-server/auth0-mcp-server-guides/streamline-api-authorization-flows-with-auth0-model-context-protocol-mcp"},{"title":"Implement Advanced Security Monitoring with Auth0 Model Context Protocol (MCP) Server","href":"/docs/get-started/auth0-mcp-server/auth0-mcp-server-guides/implement-advanced-security-monitoring-with-auth0-model-context-protocol-mcp"},{"title":"Understanding Scopes","href":"/docs/get-started/auth0-mcp-server/auth0-mcp-server-guides/understanding-scopes"}]},{"title":"Auth0 Model Context Protocol (MCP) Server Tools Reference","href":"/docs/get-started/auth0-mcp-server/auth0-mcp-tools-reference"}]}]}]},{"dropdown":"Authenticate","icon":"lock","description":"Auth0 simplifies the use of open industry standards","pages":[{"title":"Authenticate","href":"/docs/authenticate"},{"group":"Add Login","pages":[{"group":"Login","pages":[{"sidebarTitle":"Overview","title":"Login","href":"/docs/authenticate/login"},{"group":"Auth0 Universal Login","pages":[{"sidebarTitle":"Overview","title":"Auth0 Universal Login","href":"/docs/authenticate/login/auth0-universal-login"},{"group":"Universal Login vs. Classic Login","pages":[{"sidebarTitle":"Overview","title":"Universal Login vs. Classic Login","href":"/docs/authenticate/login/auth0-universal-login/universal-login-vs-classic-login"},{"title":"Universal Login Experience","href":"/docs/authenticate/login/auth0-universal-login/universal-login-vs-classic-login/universal-experience"},{"title":"Classic Login Experience","href":"/docs/authenticate/login/auth0-universal-login/universal-login-vs-classic-login/classic-experience"}]},{"group":"Passwordless Login","pages":[{"title":"Configure Universal Login with Passwordless","href":"/docs/authenticate/login/auth0-universal-login/passwordless-login"},{"title":"Configure WebAuthn with Device Biometrics for Passwordless Authentication","href":"/docs/authenticate/login/auth0-universal-login/passwordless-login/webauthn-device-biometrics"},{"title":"Configure Email or SMS for Passwordless Authentication","href":"/docs/authenticate/login/auth0-universal-login/passwordless-login/email-or-sms"}]},{"title":"Configure Default Login Routes","href":"/docs/authenticate/login/auth0-universal-login/configure-default-login-routes"},{"title":"Configure Identifier First Authentication","href":"/docs/authenticate/login/auth0-universal-login/identifier-first"},{"title":"Default Auth0 Error Page","href":"/docs/authenticate/login/auth0-universal-login/error-pages"}]},{"title":"Hosted Login vs. Embedded Login","href":"/docs/authenticate/login/universal-vs-embedded-login"},{"title":"Embedded Login","href":"/docs/authenticate/login/embedded-login"},{"title":"Native Login","href":"/docs/authenticate/login/native-login"},{"title":"Cross-Origin Authentication","href":"/docs/authenticate/login/cross-origin-authentication"},{"title":"Configure Silent Authentication","href":"/docs/authenticate/login/configure-silent-authentication"},{"title":"Redirect Users","href":"/docs/authenticate/login/redirect-users-after-login"},{"title":"Force Reauthentication in OIDC","href":"/docs/authenticate/login/max-age-reauthentication"},{"group":"Logout","pages":[{"sidebarTitle":"Overview","title":"Logout","href":"/docs/authenticate/login/logout"},{"title":"OIDC Back-Channel Logout","href":"/docs/authenticate/login/logout/back-channel-logout"},{"title":"Configure OIDC Back-Channel Logout","href":"/docs/authenticate/login/logout/back-channel-logout/configure-back-channel-logout"},{"title":"OIDC Back-Channel Logout Initiators","href":"/docs/authenticate/login/logout/back-channel-logout/oidc-back-channel-logout-initiators"},{"title":"Universal Logout","href":"/docs/authenticate/login/logout/universal-logout"},{"title":"Log Users Out of Applications","href":"/docs/authenticate/login/logout/log-users-out-of-applications"},{"title":"Log Users Out of Auth0 with OIDC Endpoint","href":"/docs/authenticate/login/logout/log-users-out-of-auth0"},{"title":"Log Users Out of Identity Providers","href":"/docs/authenticate/login/logout/log-users-out-of-idps"},{"title":"Log Users Out of SAML Identity Providers","href":"/docs/authenticate/login/logout/log-users-out-of-saml-idps"},{"title":"Redirect Users with Alternative Logout","href":"/docs/authenticate/login/logout/redirect-users-after-logout"}]},{"group":"OIDC-Conformant Authentication","pages":[{"title":"Adopt OIDC-Conformant Authentication","href":"/docs/authenticate/login/oidc-conformant-authentication"},{"title":"Access Tokens with OIDC","href":"/docs/authenticate/login/oidc-conformant-authentication/oidc-adoption-access-tokens"},{"title":"External APIs with OIDC","href":"/docs/authenticate/login/oidc-conformant-authentication/oidc-adoption-apis"},{"title":"Authorization Code Flow with OIDC","href":"/docs/authenticate/login/oidc-conformant-authentication/oidc-adoption-auth-code-flow"},{"title":"Client Credentials Flow with OIDC","href":"/docs/authenticate/login/oidc-conformant-authentication/oidc-adoption-client-credentials-flow"},{"title":"Delegation with OIDC","href":"/docs/authenticate/login/oidc-conformant-authentication/oidc-adoption-delegation"},{"title":"Implicit Flow with OIDC","href":"/docs/authenticate/login/oidc-conformant-authentication/oidc-adoption-implicit-flow"},{"title":"Refresh Tokens with OIDC","href":"/docs/authenticate/login/oidc-conformant-authentication/oidc-adoption-refresh-tokens"},{"title":"Resource Owner Password Flow with OIDC","href":"/docs/authenticate/login/oidc-conformant-authentication/oidc-adoption-rop-flow"},{"title":"Single Sign-On with OIDC","href":"/docs/authenticate/login/oidc-conformant-authentication/oidc-adoption-sso"}]}]},{"group":"Single Sign-On","pages":[{"sidebarTitle":"Overview","title":"Single Sign-On","href":"/docs/authenticate/single-sign-on"},{"title":"Service-Provider-Initiated Single Sign-On","href":"/docs/authenticate/single-sign-on/inbound-single-sign-on"},{"group":"Identity-Provider-Initiated Single Sign-On","pages":[{"sidebarTitle":"Overview","title":"Identity-Provider-Initiated Single Sign-On","href":"/docs/authenticate/single-sign-on/outbound-single-sign-on"},{"group":"Configure Auth0 as SAML Identity Provider","pages":[{"sidebarTitle":"Overview","title":"Configure Auth0 as SAML Identity Provider","href":"/docs/authenticate/single-sign-on/outbound-single-sign-on/configure-auth0-saml-identity-provider"},{"title":"Configure Amazon Web Services as SAML Service Provider","href":"/docs/authenticate/single-sign-on/outbound-single-sign-on/configure-auth0-saml-identity-provider/configure-saml2-web-app-addon-for-aws"},{"title":"Configure Atlassian as SAML Service Provider","href":"/docs/authenticate/single-sign-on/outbound-single-sign-on/configure-auth0-saml-identity-provider/configure-auth0-as-identity-provider-for-atlassian"},{"title":"Configure Cisco WebEx as SAML Service Provider","href":"/docs/authenticate/single-sign-on/outbound-single-sign-on/configure-auth0-saml-identity-provider/configure-auth0-as-identity-provider-for-cisco-webex"},{"title":"Configure Datadog as SAML Service Provider","href":"/docs/authenticate/single-sign-on/outbound-single-sign-on/configure-auth0-saml-identity-provider/configure-auth0-as-identity-provider-for-datadog"},{"title":"Configure Egencia as SAML Service Provider","href":"/docs/authenticate/single-sign-on/outbound-single-sign-on/configure-auth0-saml-identity-provider/configure-auth0-as-identity-provider-for-egencia"},{"title":"Configure Freshdesk as SAML Service Provider","href":"/docs/authenticate/single-sign-on/outbound-single-sign-on/configure-auth0-saml-identity-provider/configure-auth0-as-identity-provider-for-freshdesk"},{"title":"Configure GitHub Enterprise Cloud as SAML Service Provider","href":"/docs/authenticate/single-sign-on/outbound-single-sign-on/configure-auth0-saml-identity-provider/configure-saml2-web-app-addon-for-github-enterprise-cloud"},{"title":"Configure GitHub Enterprise Server as SAML Service Provider","href":"/docs/authenticate/single-sign-on/outbound-single-sign-on/configure-auth0-saml-identity-provider/configure-saml2-web-app-addon-for-github-enterprise-server"},{"title":"Configure Google Workspace as SAML Service Provider","href":"/docs/authenticate/single-sign-on/outbound-single-sign-on/configure-auth0-saml-identity-provider/configure-auth0-as-idp-for-google-g-suite"},{"title":"Configure Heroku as SAML Service Provider","href":"/docs/authenticate/single-sign-on/outbound-single-sign-on/configure-auth0-saml-identity-provider/configure-saml2-web-app-addon-for-heroku"},{"title":"Configure Hosted Graphite as SAML Service Provider","href":"/docs/authenticate/single-sign-on/outbound-single-sign-on/configure-auth0-saml-identity-provider/configure-auth0-as-identity-provider-for-hosted-graphite"},{"title":"Configure Litmos as SAML Service Provider","href":"/docs/authenticate/single-sign-on/outbound-single-sign-on/configure-auth0-saml-identity-provider/configure-auth0-as-identity-provider-for-litmos"},{"title":"Configure Oracle Eloqua Marketing Cloud as SAML Service Provider","href":"/docs/authenticate/single-sign-on/outbound-single-sign-on/configure-auth0-saml-identity-provider/configure-saml2-addon-eloqua"},{"title":"Configure Pluralsight as SAML Service Provider","href":"/docs/authenticate/single-sign-on/outbound-single-sign-on/configure-auth0-saml-identity-provider/configure-auth0-as-identity-provider-for-pluralsight"},{"title":"Configure Sprout Video as SAML Service Provider","href":"/docs/authenticate/single-sign-on/outbound-single-sign-on/configure-auth0-saml-identity-provider/configure-auth0-as-identity-provider-for-sprout-video"},{"title":"Configure Tableau Online as SAML Service Provider","href":"/docs/authenticate/single-sign-on/outbound-single-sign-on/configure-auth0-saml-identity-provider/configure-auth0-as-identity-provider-for-tableau-online"},{"title":"Configure Tableau Server as SAML Service Provider","href":"/docs/authenticate/single-sign-on/outbound-single-sign-on/configure-auth0-saml-identity-provider/configure-auth0-as-identity-provider-for-tableau-server"},{"title":"Configure Workday as SAML Service Provider","href":"/docs/authenticate/single-sign-on/outbound-single-sign-on/configure-auth0-saml-identity-provider/configure-auth0-as-identity-provider-for-workday"},{"title":"Configure Workpath as SAML Service Provider","href":"/docs/authenticate/single-sign-on/outbound-single-sign-on/configure-auth0-saml-identity-provider/configure-auth0-as-identity-provider-for-workpath"}]}]},{"group":"Native to Web SSO","pages":[{"sidebarTitle":"Overview","title":"Native to Web SSO","href":"/docs/authenticate/single-sign-on/native-to-web"},{"title":"Configure and Implement Native to Web SSO","href":"/docs/authenticate/single-sign-on/native-to-web/configure-implement-native-to-web"},{"title":"Use Case: Configure mobile-to-web payment flows using Native to Web SSO","href":"/docs/authenticate/single-sign-on/native-to-web/configure-mobile-to-web-payment-flows"},{"title":"Native to Web SSO and Sessions","href":"/docs/authenticate/single-sign-on/native-to-web/native-to-web-sso-and-sessions"},{"title":"Native to Web SSO Best Practices","href":"/docs/authenticate/single-sign-on/native-to-web/native-to-web-sso-best-practices"}]},{"title":"API Endpoints for Single Sign-On","href":"/docs/authenticate/single-sign-on/api-endpoints-for-single-sign-on"},{"title":"Okta Access Gateway","href":"/docs/authenticate/single-sign-on/okta-access-gateway"}]},{"group":"Passwordless","pages":[{"title":"Passwordless Authentication","href":"/docs/authenticate/passwordless"},{"group":"Authentication Methods","pages":[{"title":"Passwordless Authentication Methods","href":"/docs/authenticate/passwordless/authentication-methods"},{"title":"Passwordless Authentication with Email","href":"/docs/authenticate/passwordless/authentication-methods/email-otp"},{"title":"Passwordless Authentication with Magic Links","href":"/docs/authenticate/passwordless/authentication-methods/email-magic-link"},{"title":"Passwordless Authentication with SMS","href":"/docs/authenticate/passwordless/authentication-methods/sms-otp"},{"title":"Set Up Custom SMS Gateway for Passwordless Connections","href":"/docs/authenticate/passwordless/authentication-methods/use-sms-gateway-passwordless"}]},{"group":"Implement Login","pages":[{"title":"Implement Login with Passwordless","href":"/docs/authenticate/passwordless/implement-login"},{"title":"Passwordless Authentication with Universal Login","href":"/docs/authenticate/passwordless/implement-login/universal-login"},{"group":"Embedded Login","pages":[{"title":"Passwordless Authentication with Embedded Login","href":"/docs/authenticate/passwordless/implement-login/embedded-login"},{"title":"Using Passwordless APIs","href":"/docs/authenticate/passwordless/implement-login/embedded-login/relevant-api-endpoints"},{"title":"Embedded Passwordless Authentication for SPAs","href":"/docs/authenticate/passwordless/implement-login/embedded-login/spa"},{"title":"Embedded Passwordless Login in Native Applications","href":"/docs/authenticate/passwordless/implement-login/embedded-login/native"},{"title":"Embedded Passwordless Login in Regular Web Applications","href":"/docs/authenticate/passwordless/implement-login/embedded-login/webapps"}]}]},{"title":"Passwordless with Universal Login","href":"/docs/authenticate/passwordless/passwordless-with-universal-login"},{"title":"Passwordless Connection Limitations","href":"/docs/authenticate/passwordless/passwordless-connection-limitations"},{"title":"Passwordless Connections Best Practices","href":"/docs/authenticate/passwordless/best-practices"},{"title":"Sample Use Cases - Rules with Passwordless Authentication","href":"/docs/authenticate/passwordless/sample-use-cases-rules"}]},{"title":"Custom Token Exchange","href":"/docs/authenticate/custom-token-exchange"}]},{"group":"Provision Users","pages":[{"group":"Identity Providers","pages":[{"sidebarTitle":"Overview","title":"Identity Providers","href":"/docs/authenticate/identity-providers"},{"group":"Social Identity Providers","pages":[{"sidebarTitle":"Overview","title":"Social Identity Providers","href":"/docs/authenticate/identity-providers/social-identity-providers"},{"title":"Connect Apps to Generic OAuth2 Authorization Servers","href":"/docs/authenticate/identity-providers/social-identity-providers/oauth2"},{"title":"Add Sign In with Apple to Native iOS Apps","href":"/docs/authenticate/identity-providers/social-identity-providers/apple-native"},{"title":"Add Facebook Login to Native Apps","href":"/docs/authenticate/identity-providers/social-identity-providers/facebook-native"},{"title":"Add Sign In with Google to Native Android Apps","href":"/docs/authenticate/identity-providers/social-identity-providers/google-native"},{"title":"Handle Declined Authorization Permissions","href":"/docs/authenticate/identity-providers/social-identity-providers/reprompt-permissions"},{"title":"Test Social Connections with Auth0 Developer Keys","href":"/docs/authenticate/identity-providers/social-identity-providers/devkeys"},{"title":"Create a Custom Social Connection with TikTok","href":"/docs/authenticate/identity-providers/social-identity-providers/tiktok"}]},{"group":"Enterprise Identity Providers","pages":[{"group":"Connect Your App to Active Directory using LDAP","pages":[{"sidebarTitle":"Overview","title":"Connect Your App to Active Directory using LDAP","href":"/docs/authenticate/identity-providers/enterprise-identity-providers/active-directory-ldap"},{"group":"AD/LDAP Connector","pages":[{"sidebarTitle":"Overview","title":"AD/LDAP Connector","href":"/docs/authenticate/identity-providers/enterprise-identity-providers/active-directory-ldap/ad-ldap-connector"},{"title":"AD/LDAP Connector System Requirements","href":"/docs/authenticate/identity-providers/enterprise-identity-providers/active-directory-ldap/ad-ldap-connector/ad-ldap-connector-requirements"},{"title":"Install and Configure AD/LDAP Connector","href":"/docs/authenticate/identity-providers/enterprise-identity-providers/active-directory-ldap/ad-ldap-connector/install-configure-ad-ldap-connector"},{"title":"Configure AD/LDAP Connector Authentication with Client Certificates","href":"/docs/authenticate/identity-providers/enterprise-identity-providers/active-directory-ldap/ad-ldap-connector/configure-ad-ldap-connector-client-certificates"},{"title":"Configure AD/LDAP Connector Authentication with Kerberos","href":"/docs/authenticate/identity-providers/enterprise-identity-providers/active-directory-ldap/ad-ldap-connector/configure-ad-ldap-connector-with-kerberos"},{"title":"AD/LDAP Connector Configuration File Schema","href":"/docs/authenticate/identity-providers/enterprise-identity-providers/active-directory-ldap/ad-ldap-connector/ad-ldap-connector-config-file-schema"},{"title":"Import and Export AD/LDAP Connector Configurations","href":"/docs/authenticate/identity-providers/enterprise-identity-providers/active-directory-ldap/ad-ldap-connector/import-export-ad-ldap-connector-configs"},{"title":"Map AD/LDAP Profile Attributes to Auth0 User Profile","href":"/docs/authenticate/identity-providers/enterprise-identity-providers/active-directory-ldap/ad-ldap-connector/map-ad-ldap-profile-attributes-to-auth0"},{"title":"Point AD/LDAP Connector to Auth0 Connections","href":"/docs/authenticate/identity-providers/enterprise-identity-providers/active-directory-ldap/ad-ldap-connector/ad-ldap-connector-to-auth0"},{"title":"Update AD/LDAP Connectors","href":"/docs/authenticate/identity-providers/enterprise-identity-providers/active-directory-ldap/ad-ldap-connector/update-ad-ldap-connectors"},{"title":"Disable AD/LDAP Connection Credential Caching","href":"/docs/authenticate/identity-providers/enterprise-identity-providers/active-directory-ldap/ad-ldap-connector/disable-credential-caching"},{"title":"Deploy AD/LDAP Connectors for High Availability Environments","href":"/docs/authenticate/identity-providers/enterprise-identity-providers/active-directory-ldap/ad-ldap-connector/ad-ldap-high-availability"},{"title":"Set Up AD/LDAP Connector Test Environment","href":"/docs/authenticate/identity-providers/enterprise-identity-providers/active-directory-ldap/ad-ldap-connector/ad-ldap-connector-test-environment"},{"title":"Monitor AD/LDAP Connector with System Center Operations Manager","href":"/docs/authenticate/identity-providers/enterprise-identity-providers/active-directory-ldap/ad-ldap-connector/ad-ldap-connector-scom"}]}]},{"sidebarTitle":"Overview","title":"Connect Your App to Active Directory using LDAP","href":"/docs/authenticate/identity-providers/enterprise-identity-providers/active-directory-ldap"},{"title":"Connect Your App to ADFS","href":"/docs/authenticate/identity-providers/enterprise-identity-providers/adfs"},{"title":"Connect Your Native App to Microsoft Azure Active Directory Using Resource Owner Flow","href":"/docs/authenticate/identity-providers/enterprise-identity-providers/azure-active-directory-native"},{"title":"Connect Your App to Google Workspace","href":"/docs/authenticate/identity-providers/enterprise-identity-providers/google-apps"},{"title":"Connect to OpenID Connect Identity Provider","href":"/docs/authenticate/identity-providers/enterprise-identity-providers/oidc"},{"title":"Connect Your Auth0 Application with Okta Workforce Enterprise Connection","href":"/docs/authenticate/identity-providers/enterprise-identity-providers/okta"},{"title":"Configure PKCE and Claim Mapping for OIDC Connections","href":"/docs/authenticate/identity-providers/enterprise-identity-providers/configure-pkce-claim-mapping-for-oidc"},{"title":"Connect Your PingFederate Server to Auth0","href":"/docs/authenticate/identity-providers/enterprise-identity-providers/ping-federate"},{"title":"Connect Your App to SAML Identity Providers","href":"/docs/authenticate/identity-providers/enterprise-identity-providers/saml"},{"title":"Connect Your App to Microsoft Azure Active Directory","href":"/docs/authenticate/identity-providers/enterprise-identity-providers/azure-active-directory/v2"},{"title":"Choose a Connection Type for Azure AD","href":"/docs/authenticate/identity-providers/enterprise-identity-providers/choose-a-connection-type-for-azure-ad"},{"title":"Email Verification for Azure AD and ADFS","href":"/docs/authenticate/identity-providers/enterprise-identity-providers/azuread-adfs-email-verification"},{"title":"Enable Enterprise Connections","href":"/docs/authenticate/identity-providers/enterprise-identity-providers/enable-enterprise-connections"},{"title":"Test Enterprise Connections","href":"/docs/authenticate/identity-providers/enterprise-identity-providers/test-enterprise-connections"}]},{"title":"Legal Identity Providers","href":"/docs/authenticate/identity-providers/legal"},{"title":"View Connections","href":"/docs/authenticate/identity-providers/view-connections"},{"title":"Test Connections","href":"/docs/authenticate/identity-providers/test-connections"},{"title":"Locate the Connection ID or Name","href":"/docs/authenticate/identity-providers/locate-the-connection-id"},{"title":"Retrieve Connection Options","href":"/docs/authenticate/identity-providers/retrieve-connection-options"},{"title":"Pass Parameters to Identity Providers","href":"/docs/authenticate/identity-providers/pass-parameters-to-idps"},{"title":"Promote Connections to Domain Level","href":"/docs/authenticate/identity-providers/promote-connections-to-domain-level"},{"title":"Call an Identity Provider API","href":"/docs/authenticate/identity-providers/calling-an-external-idp-api"},{"title":"Add Scopes/Permissions to Call Identity Provider APIs","href":"/docs/authenticate/identity-providers/adding-scopes-for-an-external-idp"}]},{"group":"Database Connections","pages":[{"sidebarTitle":"Overview","title":"Database Connections","href":"/docs/authenticate/database-connections"},{"title":"Auth0 User Store","href":"/docs/authenticate/database-connections/auth0-user-store"},{"group":"Your User Store","pages":[{"title":"Custom Database Connections","href":"/docs/authenticate/database-connections/custom-db"},{"title":"Authenticate with Your Own User Store","href":"/docs/authenticate/database-connections/custom-db/overview-custom-db-connections"},{"title":"Create Custom Database Connections","href":"/docs/authenticate/database-connections/custom-db/create-db-connection"},{"title":"Test Custom Database Connections","href":"/docs/authenticate/database-connections/custom-db/test-custom-database-connections"},{"title":"Troubleshoot Custom Databases","href":"/docs/authenticate/database-connections/custom-db/error-handling"},{"group":"Action Script Templates","pages":[{"title":"Custom Database Action Script Templates","href":"/docs/authenticate/database-connections/custom-db/templates"},{"title":"Change Password Script Templates","href":"/docs/authenticate/database-connections/custom-db/templates/change-password"},{"title":"Create Script Templates","href":"/docs/authenticate/database-connections/custom-db/templates/create"},{"title":"Delete Script Templates","href":"/docs/authenticate/database-connections/custom-db/templates/delete"},{"title":"Get User Script Templates","href":"/docs/authenticate/database-connections/custom-db/templates/get-user"},{"title":"Login Script Templates","href":"/docs/authenticate/database-connections/custom-db/templates/login"},{"title":"Verify Script Templates","href":"/docs/authenticate/database-connections/custom-db/templates/verify"},{"title":"Change Email Script Template","href":"/docs/authenticate/database-connections/custom-db/templates/change-email"}]},{"group":"Custom Database and Action Script Best Practices","pages":[{"title":"Custom Database Connection and Action Script Best Practices","href":"/docs/authenticate/database-connections/custom-db/custom-database-connections-scripts"},{"title":"Custom Database Connection Anatomy Best Practices","href":"/docs/authenticate/database-connections/custom-db/custom-database-connections-scripts/anatomy"},{"title":"Custom Database Action Script Environment Best Practices","href":"/docs/authenticate/database-connections/custom-db/custom-database-connections-scripts/environment"},{"title":"Custom Database Action Script Execution Best Practices","href":"/docs/authenticate/database-connections/custom-db/custom-database-connections-scripts/execution"},{"title":"Custom Database Connection Security Best Practices","href":"/docs/authenticate/database-connections/custom-db/custom-database-connections-scripts/connection-security"}]}]},{"group":"Passkeys","pages":[{"sidebarTitle":"Overview","title":"Passkeys","href":"/docs/authenticate/database-connections/passkeys"},{"title":"Configure Passkey Policy","href":"/docs/authenticate/database-connections/passkeys/configure-passkey-policy"},{"title":"Monitor Passkey Events in Tenant Logs","href":"/docs/authenticate/database-connections/passkeys/monitor-passkey-events-in-tenant-logs"}]},{"title":"Password Options in Auth0 Database Connections","href":"/docs/authenticate/database-connections/password-options"},{"title":"Password Strength in Auth0 Database Connections","href":"/docs/authenticate/database-connections/password-strength"},{"title":"Change Users' Passwords","href":"/docs/authenticate/database-connections/password-change"},{"title":"Adding Username for Database Connections","href":"/docs/authenticate/database-connections/require-username"},{"title":"Login Script for IBM DB2","href":"/docs/authenticate/database-connections/db2-script"},{"title":"Activate and Configure Attributes for Flexible Identifiers","href":"/docs/authenticate/database-connections/activate-and-configure-attributes-for-flexible-identifiers"},{"title":"Flexible Identifiers and Attributes","href":"/docs/authenticate/database-connections/flexible-identifiers-and-attributes"},{"title":"Non-Unique Emails","href":"/docs/authenticate/database-connections/non-unique-emails"}]},{"group":"Enterprise Connections","pages":[{"sidebarTitle":"Overview","title":"Enterprise Connections","href":"/docs/authenticate/enterprise-connections"},{"group":"Self-Service Single Sign-On","pages":[{"sidebarTitle":"Overview","title":"Self-Service Single Sign-On","href":"/docs/authenticate/enterprise-connections/self-service-SSO"},{"title":"Manage Self-Service SSO","href":"/docs/authenticate/enterprise-connections/self-service-SSO/manage-self-service-sso"}]},{"title":"Private Key JWT Client Authentication for Okta and OIDC Connections","href":"/docs/authenticate/enterprise-connections/private-key-jwt-client-auth"}]},{"group":"Protocols","pages":[{"sidebarTitle":"Overview","title":"Protocols","href":"/docs/authenticate/protocols"},{"group":"SAML","pages":[{"sidebarTitle":"Overview","title":"SAML","href":"/docs/authenticate/protocols/saml"},{"title":"SAML Identity Provider Configuration Settings","href":"/docs/authenticate/protocols/saml/saml-identity-provider-configuration-settings"},{"group":"SAML Configuration","pages":[{"sidebarTitle":"Overview","title":"SAML Configuration","href":"/docs/authenticate/protocols/saml/saml-configuration"},{"title":"Customize SAML Assertions","href":"/docs/authenticate/protocols/saml/saml-configuration/customize-saml-assertions"},{"title":"Deprovision Users in SAML Integrations","href":"/docs/authenticate/protocols/saml/saml-configuration/deprovision-users-in-saml-integrations"},{"title":"Test SAML SSO with Auth0 as Service Provider and Identity Provider","href":"/docs/authenticate/protocols/saml/saml-configuration/configure-auth0-as-service-and-identity-provider"},{"title":"Map SAML Attributes with Auth0 as IdP/SAML Add-on","href":"/docs/authenticate/protocols/saml/saml-configuration/saml-attribute-mapping-examples"}]},{"group":"SAML Single Sign-On Integrations","pages":[{"sidebarTitle":"Overview","title":"SAML Single Sign-On Integrations","href":"/docs/authenticate/protocols/saml/saml-sso-integrations"},{"title":"Configure SAML Identity Provider-Initiated Single Sign-On","href":"/docs/authenticate/protocols/saml/saml-sso-integrations/identity-provider-initiated-single-sign-on"},{"title":"Configure IdP-Initiated SAML Sign-on to OIDC Apps","href":"/docs/authenticate/protocols/saml/saml-sso-integrations/configure-idp-initiated-saml-sign-on-to-oidc-apps"},{"group":"Configure Auth0 as SAML Service Provider","pages":[{"sidebarTitle":"Overview","title":"Configure Auth0 as SAML Service Provider","href":"/docs/authenticate/protocols/saml/saml-sso-integrations/configure-auth0-saml-service-provider"},{"title":"Configure ADFS as SAML Identity Provider","href":"/docs/authenticate/protocols/saml/saml-sso-integrations/configure-auth0-saml-service-provider/configure-adfs-saml-connections"},{"title":"Configure Okta as SAML Identity Provider","href":"/docs/authenticate/protocols/saml/saml-sso-integrations/configure-auth0-saml-service-provider/configure-okta-as-saml-identity-provider"},{"title":"Configure OneLogin as SAML Identity Provider","href":"/docs/authenticate/protocols/saml/saml-sso-integrations/configure-auth0-saml-service-provider/configure-onelogin-as-saml-identity-provider"},{"title":"Configure PingFederate as SAML Identity Provider","href":"/docs/authenticate/protocols/saml/saml-sso-integrations/configure-auth0-saml-service-provider/configure-pingfederate-as-saml-identity-provider"},{"title":"Configure Salesforce as SAML Identity Provider","href":"/docs/authenticate/protocols/saml/saml-sso-integrations/configure-auth0-saml-service-provider/configure-salesforce-as-saml-identity-provider"},{"title":"Configure SiteMinder as SAML Identity Provider","href":"/docs/authenticate/protocols/saml/saml-sso-integrations/configure-auth0-saml-service-provider/configure-siteminder-as-saml-identity-provider"},{"title":"Configure SSOCircle as SAML Identity Provider","href":"/docs/authenticate/protocols/saml/saml-sso-integrations/configure-auth0-saml-service-provider/configure-ssocircle-as-saml-identity-provider"}]},{"title":"Enable SAML2 Web App Addon","href":"/docs/authenticate/protocols/saml/saml-sso-integrations/enable-saml2-web-app-addon"},{"title":"Sign and Encrypt SAML Requests","href":"/docs/authenticate/protocols/saml/saml-sso-integrations/sign-and-encrypt-saml-requests"},{"title":"Work with Certificates and Keys as Strings","href":"/docs/authenticate/protocols/saml/saml-sso-integrations/work-with-certificates-and-keys-as-strings"}]}]},{"title":"OpenID Connect Protocol","href":"/docs/authenticate/protocols/openid-connect-protocol"},{"title":"OAuth 2.0 Authorization Framework","href":"/docs/authenticate/protocols/oauth"},{"title":"Web Services Federation Protocol","href":"/docs/authenticate/protocols/ws-fed-protocol"},{"title":"Lightweight Directory Access Protocol","href":"/docs/authenticate/protocols/ldap-protocol"},{"group":"System for Cross-domain Identity Management (SCIM)","pages":[{"sidebarTitle":"Overview","title":"System for Cross-domain Identity Management (SCIM)","href":"/docs/authenticate/protocols/scim"},{"title":"Configure Inbound SCIM","href":"/docs/authenticate/protocols/scim/configure-inbound-scim"},{"title":"Inbound SCIM for Azure AD SAML Connections","href":"/docs/authenticate/protocols/scim/inbound-scim-for-azure-ad-saml-connections"},{"title":"Inbound SCIM for Older Azure AD Connections","href":"/docs/authenticate/protocols/scim/inbound-scim-for-older-azure-ad-connections"},{"title":"Inbound SCIM for New Azure AD Connections","href":"/docs/authenticate/protocols/scim/inbound-scim-for-new-azure-ad-connections"},{"title":"Inbound SCIM for Okta Workforce Connections","href":"/docs/authenticate/protocols/scim/inbound-scim-for-okta-workforce-connections"},{"title":"Configure Inbound SCIM for Identity Providers using SAML or OpenID","href":"/docs/authenticate/protocols/scim/configure-inbound-scim-for-identity-providers-using-saml-or-openid"},{"title":"Inbound SCIM for Okta Workforce SAML Connections","href":"/docs/authenticate/protocols/scim/inbound-scim-for-okta-workforce-saml-connections"},{"title":"Manage an Inbound SCIM Deployment with the Management API","href":"/docs/authenticate/protocols/scim/manage-an-inbound-scim-deployment-with-the-management-api"}]}]},{"title":"Connection Settings Best Practices","href":"/docs/authenticate/connection-settings-best-practices"}]}]},{"dropdown":"Manage Users","icon":"user-gear","description":"Import, group, and administer users and control their access","pages":[{"title":"Manage Users","href":"/docs/manage-users"},{"group":"Manage Users","pages":[{"group":"User Accounts","pages":[{"sidebarTitle":"Overview","title":"User Accounts","href":"/docs/manage-users/user-accounts"},{"title":"Manage Users Using the Dashboard","href":"/docs/manage-users/user-accounts/manage-users-using-the-dashboard"},{"title":"Manage Users Using the Management API","href":"/docs/manage-users/user-accounts/manage-users-using-the-management-api"},{"group":"User Profiles","pages":[{"sidebarTitle":"Overview","title":"User Profiles","href":"/docs/manage-users/user-accounts/user-profiles"},{"title":"User Profile Structure","href":"/docs/manage-users/user-accounts/user-profiles/user-profile-structure"},{"title":"Sample User Profiles","href":"/docs/manage-users/user-accounts/user-profiles/sample-user-profiles"},{"title":"Normalized User Profiles","href":"/docs/manage-users/user-accounts/user-profiles/normalized-user-profiles"},{"title":"Normalized User Profile Schema","href":"/docs/manage-users/user-accounts/user-profiles/normalized-user-profile-schema"},{"title":"Understand How Progressive Profiling Works","href":"/docs/manage-users/user-accounts/user-profiles/progressive-profiling"},{"title":"User Profile Root Attributes","href":"/docs/manage-users/user-accounts/user-profiles/root-attributes"},{"group":"Root Attributes","pages":[{"title":"Set Root Attributes During User Import","href":"/docs/manage-users/user-accounts/user-profiles/root-attributes/set-root-attributes-during-user-import"},{"title":"Set Root Attributes During User Signup","href":"/docs/manage-users/user-accounts/user-profiles/root-attributes/set-root-attributes-during-user-sign-up"},{"title":"Update Root Attributes for Users","href":"/docs/manage-users/user-accounts/user-profiles/root-attributes/update-root-attributes-for-users"}]},{"title":"Use Verified Email in User Profiles","href":"/docs/manage-users/user-accounts/user-profiles/verified-email-usage"},{"title":"Configure Identity Provider Connection for User Profile Updates","href":"/docs/manage-users/user-accounts/user-profiles/configure-connection-sync-with-auth0"},{"title":"Update User Profiles Using Your Database","href":"/docs/manage-users/user-accounts/user-profiles/update-user-profiles-using-your-database"}]},{"group":"Metadata","pages":[{"sidebarTitle":"Metadata","title":"Understand How Metadata Works in User Profiles","href":"/docs/manage-users/user-accounts/metadata"},{"title":"Metadata Field Names and Data Types","href":"/docs/manage-users/user-accounts/metadata/metadata-fields-data"},{"title":"Manage Metadata Using the Management API","href":"/docs/manage-users/user-accounts/metadata/manage-metadata-api"},{"title":"Manage Metadata with Rules","href":"/docs/manage-users/user-accounts/metadata/manage-metadata-rules"},{"title":"Manage Metadata with Lock","href":"/docs/manage-users/user-accounts/metadata/manage-metadata-lock"},{"title":"Configure Application Metadata","href":"/docs/manage-users/user-accounts/metadata/configure-application-metadata"},{"title":"Manage User Metadata with the post-login Action Trigger","href":"/docs/manage-users/user-accounts/metadata/manage-user-metadata"}]},{"title":"Verify Emails using Auth0","href":"/docs/manage-users/user-accounts/verify-emails"},{"group":"User Account Linking","pages":[{"sidebarTitle":"Overview","title":"User Account Linking","href":"/docs/manage-users/user-accounts/user-account-linking"},{"title":"Link User Accounts","href":"/docs/manage-users/user-accounts/user-account-linking/link-user-accounts"},{"title":"Unlink User Accounts","href":"/docs/manage-users/user-accounts/user-account-linking/unlink-user-accounts"},{"title":"User-Initiated Account Linking: Client-Side Implementation","href":"/docs/manage-users/user-accounts/user-account-linking/user-initiated-account-linking-client-side-implementation"},{"title":"User Account Linking: Server-Side Implementation","href":"/docs/manage-users/user-accounts/user-account-linking/suggested-account-linking-server-side-implementation"}]},{"title":"Create Users","href":"/docs/manage-users/user-accounts/create-users"},{"title":"Identify Users","href":"/docs/manage-users/user-accounts/identify-users"},{"title":"View User Details","href":"/docs/manage-users/user-accounts/view-user-details"},{"title":"Change User Pictures","href":"/docs/manage-users/user-accounts/change-user-picture"},{"title":"Manage User Access to Applications","href":"/docs/manage-users/user-accounts/manage-user-access-to-applications"},{"title":"Deny User Access to an API with Rules","href":"/docs/manage-users/user-accounts/deny-api-access"},{"title":"Block and Unblock Users","href":"/docs/manage-users/user-accounts/block-and-unblock-users"},{"title":"Unlink Devices from Users","href":"/docs/manage-users/user-accounts/unlink-devices-from-users"},{"title":"Delete Users","href":"/docs/manage-users/user-accounts/delete-users"},{"title":"Get User Information on Unbounce Landing Pages","href":"/docs/manage-users/user-accounts/get-user-information-on-unbounce-landing-pages"},{"title":"Resend Verification Emails","href":"/docs/manage-users/user-accounts/resend-verification-emails"}]},{"group":"User Migration","pages":[{"title":"Import and Export Users","href":"/docs/manage-users/user-migration"},{"title":"Configure Automatic Migration from Your Database","href":"/docs/manage-users/user-migration/configure-automatic-migration-from-your-database"},{"title":"Bulk User Imports","href":"/docs/manage-users/user-migration/bulk-user-imports"},{"title":"Bulk User Import Database Schema and Examples","href":"/docs/manage-users/user-migration/bulk-user-import-database-schema-and-examples"},{"title":"Bulk User Exports","href":"/docs/manage-users/user-migration/bulk-user-exports"},{"title":"User Import / Export Extension","href":"/docs/manage-users/user-migration/user-import-export-extension"},{"title":"User Migration Scenarios","href":"/docs/manage-users/user-migration/user-migration-scenarios"},{"title":"Bulk User Import / Export","href":"/docs/manage-users/user-migration/bulk-user-import-export"}]},{"group":"User Search","pages":[{"title":"Search for Users","href":"/docs/manage-users/user-search"},{"title":"Retrieve Users with the Get Users Endpoint","href":"/docs/manage-users/user-search/retrieve-users-with-get-users-endpoint"},{"title":"Retrieve Users with Get Users by Email Endpoint","href":"/docs/manage-users/user-search/retrieve-users-with-get-users-by-email-endpoint"},{"title":"Retrieve Users with the Get Users by ID Endpoint","href":"/docs/manage-users/user-search/retrieve-users-with-get-users-by-id-endpoint"},{"title":"Sort Search Results","href":"/docs/manage-users/user-search/sort-search-results"},{"title":"View Search Results by Page","href":"/docs/manage-users/user-search/view-search-results-by-page"},{"title":"User Search Query Syntax","href":"/docs/manage-users/user-search/user-search-query-syntax"},{"title":"User Search Best Practices","href":"/docs/manage-users/user-search/user-search-best-practices"}]},{"group":"Organizations","pages":[{"title":"Auth0 Organizations","href":"/docs/manage-users/organizations"},{"title":"Understand How Auth0 Organizations Work","href":"/docs/manage-users/organizations/organizations-overview"},{"title":"Create Your First Organization","href":"/docs/manage-users/organizations/create-first-organization"},{"title":"Login Flows for Organizations","href":"/docs/manage-users/organizations/login-flows-for-organizations"},{"title":"Custom Development with Organizations","href":"/docs/manage-users/organizations/custom-development"},{"title":"Work with Tokens and Organizations","href":"/docs/manage-users/organizations/using-tokens"},{"group":"Configure Organizations","pages":[{"sidebarTitle":"Overview","title":"Configure Organizations","href":"/docs/manage-users/organizations/configure-organizations"},{"title":"Create Organizations","href":"/docs/manage-users/organizations/configure-organizations/create-organizations"},{"title":"Delete Organizations","href":"/docs/manage-users/organizations/configure-organizations/delete-organizations"},{"title":"Use Organization Names in Authentication API","href":"/docs/manage-users/organizations/configure-organizations/use-org-name-authentication-api"},{"title":"Define Organization Behavior","href":"/docs/manage-users/organizations/configure-organizations/define-organization-behavior"},{"title":"Enable Organization Connections","href":"/docs/manage-users/organizations/configure-organizations/enable-connections"},{"title":"Disable Organization Connections","href":"/docs/manage-users/organizations/configure-organizations/disable-connections"},{"title":"Invite Organization Members","href":"/docs/manage-users/organizations/configure-organizations/invite-members"},{"title":"Send Organization Membership Invitations","href":"/docs/manage-users/organizations/configure-organizations/send-membership-invitations"},{"title":"Grant Just-In-Time Membership to an Organization Connection","href":"/docs/manage-users/organizations/configure-organizations/grant-just-in-time-membership"},{"title":"Assign Members to an Organization","href":"/docs/manage-users/organizations/configure-organizations/assign-members"},{"title":"Remove Members From Organizations","href":"/docs/manage-users/organizations/configure-organizations/remove-members"},{"title":"Add Roles to Organization Members","href":"/docs/manage-users/organizations/configure-organizations/add-member-roles"},{"title":"Remove Roles from Organization Members","href":"/docs/manage-users/organizations/configure-organizations/remove-member-roles"},{"title":"Retrieve Organizations","href":"/docs/manage-users/organizations/configure-organizations/retrieve-organizations"},{"title":"Search for Organizations","href":"/docs/manage-users/organizations/configure-organizations/search-for-organizations"},{"title":"Retrieve Organization Connections","href":"/docs/manage-users/organizations/configure-organizations/retrieve-connections"},{"title":"Retrieve Organization Members","href":"/docs/manage-users/organizations/configure-organizations/retrieve-members"},{"title":"Search Organization Members","href":"/docs/manage-users/organizations/configure-organizations/search-organization-members"},{"title":"Retrieve User's Organization Memberships","href":"/docs/manage-users/organizations/configure-organizations/retrieve-user-membership"},{"title":"Retrieve Member Roles for an Organization","href":"/docs/manage-users/organizations/configure-organizations/retrieve-member-roles"}]},{"group":"Machine-to-Machine (M2M) Access for Organizations","pages":[{"sidebarTitle":"Overview","title":"Machine-to-Machine (M2M) Access for Organizations","href":"/docs/manage-users/organizations/organizations-for-m2m-applications"},{"title":"Configure Your Application For M2M Access","href":"/docs/manage-users/organizations/organizations-for-m2m-applications/configure-your-application-for-m2m-access"},{"title":"Authorize M2M Access","href":"/docs/manage-users/organizations/organizations-for-m2m-applications/authorize-m2m-access"},{"title":"Revoke M2M Access","href":"/docs/manage-users/organizations/organizations-for-m2m-applications/revoke-m2m-access"},{"title":"Audit M2M Access","href":"/docs/manage-users/organizations/organizations-for-m2m-applications/audit-m2m-access"}]}]},{"title":"My Account API","href":"/docs/manage-users/my-account-api"}]},{"group":"Manage Access","pages":[{"group":"Access Control","pages":[{"sidebarTitle":"Overview","title":"Access Control","href":"/docs/manage-users/access-control"},{"title":"Role-Based Access Control","href":"/docs/manage-users/access-control/rbac"},{"title":"Authorization Policies","href":"/docs/manage-users/access-control/authorization-policies"},{"title":"Rules for Authorization Policies","href":"/docs/manage-users/access-control/rules-for-authorization-policies"},{"title":"Sample Use Cases: Role-Based Access Control","href":"/docs/manage-users/access-control/sample-use-cases-role-based-access-control"},{"title":"Sample Use Cases: Actions with Authorization","href":"/docs/manage-users/access-control/sample-use-cases-actions-with-authorization"},{"title":"Sample Use Cases: Rules with Authorization","href":"/docs/manage-users/access-control/sample-use-cases-rules-with-authorization"},{"title":"Authorization Core vs. Authorization Extension","href":"/docs/manage-users/access-control/authorization-core-vs-authorization-extension"},{"group":"Configure Core RBAC","pages":[{"title":"Configure Core Authorization Features for Role-Based Access Control","href":"/docs/manage-users/access-control/configure-core-rbac"},{"group":"Manage Role-Based Access Control Roles","pages":[{"sidebarTitle":"Overview","title":"Manage Role-Based Access Control Roles","href":"/docs/manage-users/access-control/configure-core-rbac/roles"},{"title":"View Users Assigned to Roles","href":"/docs/manage-users/access-control/configure-core-rbac/roles/view-users-assigned-to-roles"},{"title":"View Role Permissions","href":"/docs/manage-users/access-control/configure-core-rbac/roles/view-role-permissions"},{"title":"Remove Permissions from Roles","href":"/docs/manage-users/access-control/configure-core-rbac/roles/remove-permissions-from-roles"},{"title":"Edit Role Definitions","href":"/docs/manage-users/access-control/configure-core-rbac/roles/edit-role-definitions"},{"title":"Delete Roles","href":"/docs/manage-users/access-control/configure-core-rbac/roles/delete-roles"},{"title":"Create Roles","href":"/docs/manage-users/access-control/configure-core-rbac/roles/create-roles"},{"title":"Add Permissions to Roles","href":"/docs/manage-users/access-control/configure-core-rbac/roles/add-permissions-to-roles"}]},{"group":"Manage Role-Based Access Control Users","pages":[{"sidebarTitle":"Overview","title":"Manage Role-Based Access Control Users","href":"/docs/manage-users/access-control/configure-core-rbac/rbac-users"},{"title":"View Roles Assigned to Users","href":"/docs/manage-users/access-control/configure-core-rbac/rbac-users/view-user-roles"},{"title":"View User Permissions","href":"/docs/manage-users/access-control/configure-core-rbac/rbac-users/view-user-permissions"},{"title":"Remove Roles from Users","href":"/docs/manage-users/access-control/configure-core-rbac/rbac-users/remove-roles-from-users"},{"title":"Remove Permissions from Users","href":"/docs/manage-users/access-control/configure-core-rbac/rbac-users/remove-permissions-from-users"},{"title":"Assign Roles to Users","href":"/docs/manage-users/access-control/configure-core-rbac/rbac-users/assign-roles-to-users"},{"title":"Assign Permissions to Users","href":"/docs/manage-users/access-control/configure-core-rbac/rbac-users/assign-permissions-to-users"}]},{"title":"Manage Role-Based Access Control Permissions","href":"/docs/manage-users/access-control/configure-core-rbac/manage-permissions"},{"title":"Enable Role-Based Access Control for APIs","href":"/docs/manage-users/access-control/configure-core-rbac/enable-role-based-access-control-for-apis"}]}]},{"group":"Sessions","pages":[{"sidebarTitle":"Overview","title":"Sessions","href":"/docs/manage-users/sessions"},{"title":"Session Layers","href":"/docs/manage-users/sessions/session-layers"},{"title":"Session Lifetime Limits","href":"/docs/manage-users/sessions/session-lifetime-limits"},{"title":"Configure Session Lifetime Settings","href":"/docs/manage-users/sessions/configure-session-lifetime-settings"},{"title":"Non-Persistent Sessions","href":"/docs/manage-users/sessions/non-persistent-sessions"},{"title":"Sessions with Actions","href":"/docs/manage-users/sessions/manage-sessions-actions"},{"title":"Manage Multi-Site Sessions with Auth0 SDK","href":"/docs/manage-users/sessions/manage-multi-site-sessions"},{"title":"Manage User Sessions with Auth0 Management API","href":"/docs/manage-users/sessions/manage-user-sessions-with-auth0-management-api"}]},{"group":"Cookies","pages":[{"sidebarTitle":"Overview","title":"Cookies","href":"/docs/manage-users/cookies"},{"title":"Authentication API Cookies","href":"/docs/manage-users/cookies/authentication-api-cookies"},{"title":"Authenticate Single-Page Apps With Cookies","href":"/docs/manage-users/cookies/spa-authenticate-with-cookies"},{"title":"SameSite Cookie Attribute Changes","href":"/docs/manage-users/cookies/samesite-cookie-attribute-changes"}]}]}]},{"dropdown":"Customize","icon":"puzzle","description":"Seamlessly integrate Auth0 with your own brand","pages":[{"title":"Customize","href":"/docs/customize"},{"group":"Brand Customization","pages":[{"group":"Customize Login Pages","pages":[{"sidebarTitle":"Overview","title":"Customize Login Pages","href":"/docs/customize/login-pages"},{"group":"Customize Universal Login","pages":[{"sidebarTitle":"Overview","title":"Customize Universal Login","href":"/docs/customize/login-pages/universal-login"},{"title":"Customize Universal Login Page Themes","href":"/docs/customize/login-pages/universal-login/customize-themes"},{"title":"Customize Universal Login Page Templates","href":"/docs/customize/login-pages/universal-login/customize-templates"},{"title":"Customize Universal Login Text Elements","href":"/docs/customize/login-pages/universal-login/customize-text-elements"},{"group":"Customize Signup and Login Prompts","pages":[{"sidebarTitle":"Overview","title":"Customize Signup and Login Prompts","href":"/docs/customize/login-pages/universal-login/customize-signup-and-login-prompts"},{"title":"Configure Flexible Connection Switching","href":"/docs/customize/login-pages/universal-login/customize-signup-and-login-prompts/connection-switching"},{"title":"Configure Flexible Language Selection","href":"/docs/customize/login-pages/universal-login/customize-signup-and-login-prompts/language-selection"},{"title":"Use Dynamic Variables to Internationalize Custom Form Elements","href":"/docs/customize/login-pages/universal-login/customize-signup-and-login-prompts/use-dynamic-variables-to-internationalize-custom-form-elements"},{"title":"Use Actions to Validate and Store End-user Data Gathered By Signup Prompt Customizations","href":"/docs/customize/login-pages/universal-login/customize-signup-and-login-prompts/use-actions-to-validate-and-store-end-user-data-gathered-by-signup-prompt"}]}]},{"group":"Customize Classic Login","pages":[{"sidebarTitle":"Overview","title":"Customize Classic Login","href":"/docs/customize/login-pages/classic-login"},{"title":"Customize Classic Login Pages","href":"/docs/customize/login-pages/classic-login/customization-classic"},{"title":"Customize Classic Login Pages with Lock or SDK","href":"/docs/customize/login-pages/classic-login/customize-with-lock-sdk"},{"title":"Customize Lock Error Messages","href":"/docs/customize/login-pages/classic-login/customize-lock-error-messages"},{"title":"Customize Classic Password Reset Page","href":"/docs/customize/login-pages/classic-login/customize-password-reset-page"},{"title":"Classic Login Page Version Control","href":"/docs/customize/login-pages/classic-login/version-control"}]},{"title":"Customize Consent Prompts","href":"/docs/customize/login-pages/customize-consent-prompts"},{"title":"Customize Error Pages","href":"/docs/customize/login-pages/custom-error-pages"},{"group":"Advanced Customizations for Universal Login","pages":[{"sidebarTitle":"Overview","title":"Advanced Customizations for Universal Login","href":"/docs/customize/login-pages/advanced-customizations"},{"group":"Getting Started with Advanced Customizations","pages":[{"title":"Getting Started with ACUL","href":"/docs/customize/login-pages/advanced-customizations/getting-started"},{"title":"Configure ACUL Screens","href":"/docs/customize/login-pages/advanced-customizations/getting-started/configure-acul-screens"},{"title":"Auth0 ACUL JS SDK Quickstart","href":"/docs/customize/login-pages/advanced-customizations/getting-started/sdk-quickstart"},{"title":"Deploy and Host Advanced Customizations","href":"/docs/customize/login-pages/advanced-customizations/getting-started/deploy-and-host-advanced-customizations"}]},{"group":"Build User Flows","pages":[{"sidebarTitle":"Overview","title":"Build User Flows","href":"/docs/customize/login-pages/advanced-customizations/build-user-flows"},{"title":"Build Signup with Password","href":"/docs/customize/login-pages/advanced-customizations/build-user-flows/signup-password"},{"title":"Build Identifier First Signup with Password","href":"/docs/customize/login-pages/advanced-customizations/build-user-flows/id-first-signup"},{"title":"Build Login with Password","href":"/docs/customize/login-pages/advanced-customizations/build-user-flows/login-password"},{"title":"Build Identifier First Login with Password","href":"/docs/customize/login-pages/advanced-customizations/build-user-flows/id-first-login"},{"title":"Build SMS \u0026 Email Passwordless Login","href":"/docs/customize/login-pages/advanced-customizations/build-user-flows/sms-email-passwordless"},{"title":"Add a CAPTCHA","href":"/docs/customize/login-pages/advanced-customizations/build-user-flows/add-a-captcha"},{"title":"Add Custom Prompts to Your Identifier First Signup Screen","href":"/docs/customize/login-pages/advanced-customizations/build-user-flows/add-custom-prompts-to-your-identifier-first-signup-screen"}]},{"group":"Advanced Customization JS SDK Reference","pages":[{"sidebarTitle":"Overview","title":"Advanced Customizations for Universal Login","href":"/docs/customize/login-pages/advanced-customizations"},{"title":"Getting Started with ACUL","href":"/docs/customize/login-pages/advanced-customizations/getting-started"},{"sidebarTitle":"Overview","title":"Build User Flows","href":"/docs/customize/login-pages/advanced-customizations/build-user-flows"},{"title":"ACUL JS SDK","href":"/docs/customize/login-pages/advanced-customizations/reference"},{"title":"Accept Invitation screen class","href":"/docs/customize/login-pages/advanced-customizations/reference/accept-invitation"},{"title":"Consent screen class","href":"/docs/customize/login-pages/advanced-customizations/reference/consent-screen-class"},{"title":"Customized Consent screen class","href":"/docs/customize/login-pages/advanced-customizations/reference/customized-consent-screen-class"},{"title":"Device Code Activation screen classes","href":"/docs/customize/login-pages/advanced-customizations/reference/device-code-activation"},{"title":"Email OTP Challenge screen class","href":"/docs/customize/login-pages/advanced-customizations/reference/email-otp-challenge-screen-class"},{"title":"Email Verification Result screen class","href":"/docs/customize/login-pages/advanced-customizations/reference/email-verification-result-screen-class"},{"title":"Interstitial Captcha screen class","href":"/docs/customize/login-pages/advanced-customizations/reference/interstitial-captcha-screen-class"},{"title":"Login screen classes","href":"/docs/customize/login-pages/advanced-customizations/reference/login-screen-classes"},{"title":"Logout screen classes","href":"/docs/customize/login-pages/advanced-customizations/reference/logout-screen-classes"},{"group":"Multi-Factor Authentication screen classes","pages":[{"sidebarTitle":"Overview","title":"Multi-Factor Authentication screen classes","href":"/docs/customize/login-pages/advanced-customizations/reference/mfa"},{"title":"Multi-Factor Authentication Email screen classes","href":"/docs/customize/login-pages/advanced-customizations/reference/mfa/mfa-email"},{"title":"Multi-Factor Authentication OTP screen classes","href":"/docs/customize/login-pages/advanced-customizations/reference/mfa/mfa-otp"},{"title":"Multi-Factor Authentication Phone screen classes","href":"/docs/customize/login-pages/advanced-customizations/reference/mfa/mfa-phone"},{"title":"Multi-Factor Authentication Push screen classes","href":"/docs/customize/login-pages/advanced-customizations/reference/mfa/mfa-push"},{"title":"Multi-Factor Authentication Recovery Code screen classes","href":"/docs/customize/login-pages/advanced-customizations/reference/mfa/mfa-recovery-code"},{"title":"Multi-Factor Authentication SMS screen classes","href":"/docs/customize/login-pages/advanced-customizations/reference/mfa/mfa-sms"},{"title":"Multi-Factor Authentication Voice screen classes","href":"/docs/customize/login-pages/advanced-customizations/reference/mfa/mfa-voice"},{"title":"Multi-Factor Authentication Webauthn screen classes","href":"/docs/customize/login-pages/advanced-customizations/reference/mfa/mfa-webauthn"}]},{"title":"Organization screen classes","href":"/docs/customize/login-pages/advanced-customizations/reference/organization"},{"title":"Redeem Ticket screen class","href":"/docs/customize/login-pages/advanced-customizations/reference/redeem-ticket"},{"title":"Reset Password screen classes","href":"/docs/customize/login-pages/advanced-customizations/reference/reset-password-screen-classes"},{"title":"Signup screen classes","href":"/docs/customize/login-pages/advanced-customizations/reference/signup-screen-classes"}]}]}]},{"group":"Custom Domains","pages":[{"sidebarTitle":"Overview","title":"Custom Domains","href":"/docs/customize/custom-domains"},{"title":"Configure Custom Domains with Auth0-Managed Certificates","href":"/docs/customize/custom-domains/auth0-managed-certificates"},{"group":"Self-Managed Certificates","pages":[{"title":"Configure Custom Domains with Self-Managed Certificates","href":"/docs/customize/custom-domains/self-managed-certificates"},{"title":"Configure Google Cloud Platform with Load Balancing as Reverse Proxy","href":"/docs/customize/custom-domains/self-managed-certificates/configure-gcp-as-reverse-proxy"},{"title":"Configure Cloudflare as Reverse Proxy","href":"/docs/customize/custom-domains/self-managed-certificates/configure-cloudflare-for-use-as-reverse-proxy"},{"title":"Configure AWS CloudFront as Reverse Proxy","href":"/docs/customize/custom-domains/self-managed-certificates/configure-aws-cloudfront-for-use-as-reverse-proxy"},{"title":"Configure Azure CDN as Reverse Proxy","href":"/docs/customize/custom-domains/self-managed-certificates/configure-azure-cdn-for-use-as-reverse-proxy"},{"title":"Configure Akamai as Reverse Proxy","href":"/docs/customize/custom-domains/self-managed-certificates/configure-akamai-for-use-as-reverse-proxy"},{"title":"TLS (SSL) Versions and Ciphers","href":"/docs/customize/custom-domains/self-managed-certificates/tls-ssl"}]},{"title":"Configure Features to Use Custom Domains","href":"/docs/customize/custom-domains/configure-features-to-use-custom-domains"},{"group":"Multiple Custom Domains","pages":[{"title":"Multiple Custom Domains (MCD) Early Access","href":"/docs/customize/custom-domains/multiple-custom-domains"},{"title":"Multiple Custom Domain Use Cases","href":"/docs/customize/custom-domains/multiple-custom-domains/mcd-use-cases"},{"title":"Multiple Custom Domains Best Practices","href":"/docs/customize/custom-domains/multiple-custom-domains/mcd-best-practices"}]}]},{"group":"Customize Emails","pages":[{"sidebarTitle":"Overview","title":"Customize Emails","href":"/docs/customize/email"},{"title":"Customize Email Handling","href":"/docs/customize/email/manage-email-flow"},{"group":"Email Templates","pages":[{"title":"Customize Email Templates","href":"/docs/customize/email/email-templates"},{"title":"Use Liquid Syntax in Email Templates","href":"/docs/customize/email/email-templates/use-liquid-syntax-in-email-templates"},{"title":"Email Template Descriptions","href":"/docs/customize/email/email-templates/email-template-descriptions"}]},{"group":"Configure a Custom Email Provider","pages":[{"sidebarTitle":"Overview","title":"Configure a Custom Email Provider","href":"/docs/customize/email/configure-a-custom-email-provider"},{"title":"Configure a Custom Email Provider with Terraform","href":"/docs/customize/email/configure-a-custom-email-provider/configure-a-custom-email-provider-with-terraform"},{"title":"Action Triggers: custom-email-provider Event Object","href":"/docs/customize/email/configure-a-custom-email-provider/action-triggers-custom-email-provider-event-object"},{"title":"Action Triggers: custom-email-provider API Object","href":"/docs/customize/email/configure-a-custom-email-provider/action-triggers-custom-email-provider-api-object"}]},{"title":"Customize Blocked Account Emails","href":"/docs/customize/email/customize-blocked-account-emails"},{"title":"Send Email Invitations for Application Signup","href":"/docs/customize/email/send-email-invitations-for-application-signup"},{"group":"SMTP Email Providers","pages":[{"title":"Configure External SMTP Email Providers","href":"/docs/customize/email/smtp-email-providers"},{"title":"Configure Amazon SES as External SMTP Email Provider","href":"/docs/customize/email/smtp-email-providers/configure-amazon-ses-as-external-smtp-email-provider"},{"title":"Configure Azure Communication Services as External SMTP Email Provider","href":"/docs/customize/email/smtp-email-providers/configure-azure-comm-service-as-smtp-email-provider"},{"title":"Configure Mandrill as External SMTP Email Provider","href":"/docs/customize/email/smtp-email-providers/configure-mandrill-as-external-smtp-email-provider"},{"title":"Configure Microsoft 365 Exchange Online as External SMTP Email Provider","href":"/docs/customize/email/smtp-email-providers/configure-365-exchange-as-smtp-email-provider"},{"title":"Configure SendGrid as External SMTP Email Provider","href":"/docs/customize/email/smtp-email-providers/configure-sendgrid-as-external-smtp-email-provider"},{"title":"Configure SparkPost as External SMTP Email Provider","href":"/docs/customize/email/smtp-email-providers/configure-sparkpost-as-external-smtp-email-provider"},{"title":"Configure Mailgun as External SMTP Email Provider","href":"/docs/customize/email/smtp-email-providers/configure-mailgun-as-external-smtp-email-provider"},{"title":"Configure Custom External SMTP Email Provider","href":"/docs/customize/email/smtp-email-providers/configure-custom-external-smtp-email-provider"}]},{"title":"Configure Test SMTP Email Server","href":"/docs/customize/email/configure-test-smtp-email-servers"},{"title":"Troubleshoot Custom Email Provider Delivery Issues","href":"/docs/customize/email/troubleshoot-custom-email-provider-delivery-issues"}]},{"group":"Customize Phone Messages","pages":[{"sidebarTitle":"Overview","title":"Customize Phone Messages","href":"/docs/customize/phone-messages"},{"group":"Auth0's Unified Phone Experience","pages":[{"sidebarTitle":"Overview","title":"Auth0's Unified Phone Experience","href":"/docs/customize/phone-messages/unified-phone"},{"title":"Use Auth0's Unified Phone Experience for Multi-Factor Authentication","href":"/docs/customize/phone-messages/unified-phone/use-auth0s-unified-phone-experience-for-multi-factor-authentication"},{"title":"Use the Unified Phone Experience for Passwordless","href":"/docs/customize/phone-messages/unified-phone/unified-phone-experience-passwordless"},{"title":"Configure Auth0 Unified Phone Experience","href":"/docs/customize/phone-messages/unified-phone/configure-unified-phone"}]},{"group":"Configure Phone Messaging Providers","pages":[{"sidebarTitle":"Overview","title":"Configure Phone Messaging Providers","href":"/docs/customize/phone-messages/configure-phone-messaging-providers"},{"title":"Configure Twilio as a Phone Messaging Provider","href":"/docs/customize/phone-messages/configure-phone-messaging-providers/configure-twilio-as-a-phone-messaging-provider"},{"group":"Configure a Custom Phone Provider","pages":[{"sidebarTitle":"Overview","title":"Configure a Custom Phone Provider","href":"/docs/customize/phone-messages/configure-phone-messaging-providers/configure-a-custom-phone-provider"},{"title":"Configure a Custom Phone Provider with Terraform","href":"/docs/customize/phone-messages/configure-phone-messaging-providers/configure-a-custom-phone-provider/configure-a-custom-phone-provider-with-terraform"},{"title":"Configure a Custom Phone Provider with Twilio Verify","href":"/docs/customize/phone-messages/configure-phone-messaging-providers/configure-a-custom-phone-provider/configure-a-custom-phone-provider-with-twilio-verify"},{"title":"Action Triggers: custom-phone-provider API Object","href":"/docs/customize/phone-messages/configure-phone-messaging-providers/configure-a-custom-phone-provider/action-triggers-custom-phone-provider-api-object"},{"title":"Actions Triggers: custom-phone-provider Event Object","href":"/docs/customize/phone-messages/configure-phone-messaging-providers/configure-a-custom-phone-provider/actions-triggers-custom-phone-provider-event-object"}]}]},{"title":"Customize Phone Templates","href":"/docs/customize/phone-messages/customize-phone-templates"}]},{"title":"Customize Multi-factor Authentication SMS and Voice Messages","href":"/docs/customize/customize-sms-or-voice-messages"},{"group":"Internationalization and Localization","pages":[{"sidebarTitle":"Overview","title":"Internationalization and Localization","href":"/docs/customize/internationalization-and-localization"},{"title":"Universal Login Internationalization","href":"/docs/customize/internationalization-and-localization/universal-login-internationalization"},{"title":"Lock Internationalization","href":"/docs/customize/internationalization-and-localization/lock-internationalization"},{"title":"Lock.swift Internationalization","href":"/docs/customize/internationalization-and-localization/lock-swift-internationalization"},{"title":"Lock.Android Internationalization","href":"/docs/customize/internationalization-and-localization/lock-android-internationalization"},{"title":"Customize Translation of Lock Password Options","href":"/docs/customize/internationalization-and-localization/password-options-translation"}]}]},{"group":"Code Customization","pages":[{"group":"Actions","pages":[{"title":"Auth0 Actions","href":"/docs/customize/actions"},{"title":"Understand How Auth0 Actions Work","href":"/docs/customize/actions/actions-overview"},{"title":"Write Your First Action","href":"/docs/customize/actions/write-your-first-action"},{"group":"Explore Triggers","pages":[{"sidebarTitle":"Overview","title":"Explore Triggers","href":"/docs/customize/actions/explore-triggers"},{"group":"Signup and Login Triggers","pages":[{"sidebarTitle":"Overview","title":"Signup and Login Triggers","href":"/docs/customize/actions/explore-triggers/signup-and-login-triggers"},{"group":"Login Trigger","pages":[{"sidebarTitle":"Overview","title":"Login Trigger","href":"/docs/customize/actions/explore-triggers/signup-and-login-triggers/login-trigger"},{"title":"Actions Triggers: post-login - Event Object","href":"/docs/customize/actions/explore-triggers/signup-and-login-triggers/login-trigger/post-login-event-object"},{"title":"Actions Triggers: post-login - API Object","href":"/docs/customize/actions/explore-triggers/signup-and-login-triggers/login-trigger/post-login-api-object"},{"title":"Redirect with Actions","href":"/docs/customize/actions/explore-triggers/signup-and-login-triggers/login-trigger/redirect-with-actions"},{"title":"Releases","href":"/docs/customize/actions/explore-triggers/signup-and-login-triggers/login-trigger/releases"}]},{"group":"Pre-user Registration Trigger","pages":[{"sidebarTitle":"Overview","title":"Pre-user Registration Trigger","href":"/docs/customize/actions/explore-triggers/signup-and-login-triggers/pre-user-registration-trigger"},{"title":"Actions Triggers: pre-user-registration - Event Object","href":"/docs/customize/actions/explore-triggers/signup-and-login-triggers/pre-user-registration-trigger/pre-user-registration-event-object"},{"title":"Actions Triggers: pre-user-registration - API Object","href":"/docs/customize/actions/explore-triggers/signup-and-login-triggers/pre-user-registration-trigger/pre-user-registration-api-object"}]},{"group":"Post-user Registration Trigger","pages":[{"sidebarTitle":"Overview","title":"Post-user Registration Trigger","href":"/docs/customize/actions/explore-triggers/signup-and-login-triggers/post-user-registration-trigger"},{"title":"Actions Triggers: post-user-registration - Event Object","href":"/docs/customize/actions/explore-triggers/signup-and-login-triggers/post-user-registration-trigger/post-user-registration-event-object"},{"title":"Actions - Triggers - post-user-registration - API object","href":"/docs/customize/actions/explore-triggers/signup-and-login-triggers/post-user-registration-trigger/post-user-registration-api-object"}]}]},{"group":"MFA Notifications Trigger","pages":[{"title":"MFA Notifications Triggers","href":"/docs/customize/actions/explore-triggers/mfa-notifications-trigger"},{"title":"Actions Triggers: send-phone-message - Event Object","href":"/docs/customize/actions/explore-triggers/mfa-notifications-trigger/send-phone-message-event-object"},{"title":"Actions Triggers: send-phone-message - API Object","href":"/docs/customize/actions/explore-triggers/mfa-notifications-trigger/send-phone-message-api-object"}]},{"group":"Password Reset Triggers","pages":[{"sidebarTitle":"Overview","title":"Password Reset Triggers","href":"/docs/customize/actions/explore-triggers/password-reset-triggers"},{"group":"Post-challenge Trigger","pages":[{"title":"Post-challenge trigger","href":"/docs/customize/actions/explore-triggers/password-reset-triggers/post-challenge-trigger"},{"title":"Actions Triggers: post-challenge - Event Object","href":"/docs/customize/actions/explore-triggers/password-reset-triggers/post-challenge-trigger/post-challenge-event-object"},{"title":"Actions Triggers: post-challenge - API Object","href":"/docs/customize/actions/explore-triggers/password-reset-triggers/post-challenge-trigger/post-challenge-api-object"}]},{"group":"Post Change Password Trigger","pages":[{"sidebarTitle":"Overview","title":"Post Change Password Trigger","href":"/docs/customize/actions/explore-triggers/password-reset-triggers/post-change-password-trigger"},{"title":"Actions Triggers: post-change-password - Event Object","href":"/docs/customize/actions/explore-triggers/password-reset-triggers/post-change-password-trigger/post-change-password-event-object"},{"title":"Actions Triggers: post-change-password - API Object","href":"/docs/customize/actions/explore-triggers/password-reset-triggers/post-change-password-trigger/post-change-password-api-object"}]}]},{"group":"Machine to Machine Trigger","pages":[{"title":"Machine to Machine Triggers","href":"/docs/customize/actions/explore-triggers/machine-to-machine-trigger"},{"title":"Actions Triggers: credentials-exchange - Event Object","href":"/docs/customize/actions/explore-triggers/machine-to-machine-trigger/credentials-exchange-event-object"},{"title":"Actions Triggers: credentials-exchange - API Object","href":"/docs/customize/actions/explore-triggers/machine-to-machine-trigger/credentials-exchange-api-object"}]}]},{"title":"Action Use Cases","href":"/docs/customize/actions/use-cases"},{"title":"Action Coding Guidelines","href":"/docs/customize/actions/action-coding-guidelines"},{"title":"Actions Limitations","href":"/docs/customize/actions/limitations"},{"title":"Actions Transaction Metadata","href":"/docs/customize/actions/transaction-metadata"},{"title":"Manage Dependencies","href":"/docs/customize/actions/manage-dependencies"},{"title":"Manage Versions","href":"/docs/customize/actions/manage-versions"},{"title":"Test Actions","href":"/docs/customize/actions/test-actions"},{"title":"Releases","href":"/docs/customize/actions/releases"},{"group":"Migrate to Actions","pages":[{"sidebarTitle":"Overview","title":"Migrate to Actions","href":"/docs/customize/actions/migrate"},{"title":"Migrate from Rules to Actions","href":"/docs/customize/actions/migrate/migrate-from-rules-to-actions"},{"title":"Migration tooling","href":"/docs/customize/actions/migrate/migrate-a-rule-to-an-action"},{"title":"Migrate from Hooks to Actions","href":"/docs/customize/actions/migrate/migrate-from-hooks-to-actions"},{"title":"Migrate from Actions Beta to Final","href":"/docs/customize/actions/migrate/migrate-from-actions-beta-to-final"},{"title":"Actions Migration Limitations","href":"/docs/customize/actions/migrate/actions-migration-limitations"}]},{"title":"Templates for Actions","href":"/docs/customize/actions/actions-templates"},{"title":"Actions Real-time Logs","href":"/docs/customize/actions/actions-real-time-logs"}]},{"group":"Events","pages":[{"sidebarTitle":"Overview","title":"Events","href":"/docs/customize/events"},{"title":"Event Types","href":"/docs/customize/events/event-types"},{"title":"Create an Event Stream","href":"/docs/customize/events/create-an-event-stream"},{"title":"Event Testing, Observability, and Failure Recovery","href":"/docs/customize/events/event-testing-observability-and-failure-recovery"},{"title":"Events Best Practices","href":"/docs/customize/events/events-best-practices"}]},{"group":"Forms","pages":[{"sidebarTitle":"Overview","title":"Forms","href":"/docs/customize/forms"},{"title":"Nodes and components","href":"/docs/customize/forms/nodes-and-components"},{"group":"Flows","pages":[{"title":"Introduction to Flows","href":"/docs/customize/forms/flows"},{"group":"Integrations","pages":[{"sidebarTitle":"Overview","title":"Integrations","href":"/docs/customize/forms/flows/integrations"},{"title":"Auth0","href":"/docs/customize/forms/flows/integrations/auth0"},{"title":"Data verification","href":"/docs/customize/forms/flows/integrations/data-verification"},{"title":"HTTP Request","href":"/docs/customize/forms/flows/integrations/http-request"},{"title":"JSON","href":"/docs/customize/forms/flows/integrations/json"},{"title":"JSON Web Token","href":"/docs/customize/forms/flows/integrations/json-web-token"},{"title":"Logic","href":"/docs/customize/forms/flows/integrations/logic"},{"title":"Mailjet","href":"/docs/customize/forms/flows/integrations/mailjet"},{"title":"SendGrid","href":"/docs/customize/forms/flows/integrations/sendgrid"},{"title":"Telegram","href":"/docs/customize/forms/flows/integrations/telegram"},{"title":"Twilio","href":"/docs/customize/forms/flows/integrations/twilio"},{"title":"WhatsApp","href":"/docs/customize/forms/flows/integrations/whatsapp"},{"title":"XML","href":"/docs/customize/forms/flows/integrations/xml"}]},{"title":"Execution and Debugger","href":"/docs/customize/forms/flows/flow-execution-and-debugger"}]},{"title":"Variables and helper functions","href":"/docs/customize/forms/variables"},{"title":"Routers","href":"/docs/customize/forms/routers"},{"title":"Custom Field Components","href":"/docs/customize/forms/custom-field-components"},{"title":"Render Forms using Actions","href":"/docs/customize/forms/render"},{"title":"Vault","href":"/docs/customize/forms/vault"},{"title":"Custom Messages and Translation","href":"/docs/customize/forms/custom-messages-and-translation"},{"title":"Resources: Templates","url":"https://developer.auth0.com/resources/templates/forms","href":"/docs/customize/forms/resource-template-forms"},{"title":"Use Cases: Configure a progressive profile form using Forms","href":"/docs/customize/forms/configure-progressive-profile-form"},{"title":"Use Cases: Configure an update policy form using Forms","href":"/docs/customize/forms/configure-update-policy-form"},{"title":"Use Cases: Configure additional signup steps using Forms","href":"/docs/customize/forms/configure-additional-signup-steps"}]},{"group":"Rules","pages":[{"title":"Auth0 Rules","href":"/docs/customize/rules"},{"title":"Create Rules","href":"/docs/customize/rules/create-rules"},{"title":"Configure Global Variables for Rules","href":"/docs/customize/rules/configure-global-variables-for-rules"},{"title":"Store Rule Configurations","href":"/docs/customize/rules/configuration"},{"title":"Cache Expensive Resources in Rules","href":"/docs/customize/rules/cache-resources"},{"title":"Debug Rules","href":"/docs/customize/rules/debug-rules"},{"title":"Use the Management API from within Rules","href":"/docs/customize/rules/use-management-api"},{"title":"Redirect Users from Within Rules","href":"/docs/customize/rules/redirect-users"},{"title":"User Object Properties in Rules","href":"/docs/customize/rules/user-object-in-rules"},{"title":"Context Object Properties in Rules","href":"/docs/customize/rules/context-object"},{"title":"Raise Errors from Rules","href":"/docs/customize/rules/raise-errors-from-rules"}]},{"group":"Hooks","pages":[{"title":"Auth0 Hooks","href":"/docs/customize/hooks"},{"title":"Create Hooks","href":"/docs/customize/hooks/create-hooks"},{"title":"Update Hooks","href":"/docs/customize/hooks/update-hooks"},{"title":"Delete Hooks","href":"/docs/customize/hooks/delete-hooks"},{"title":"Enable/Disable Hooks","href":"/docs/customize/hooks/enable-disable-hooks"},{"title":"View Hooks","href":"/docs/customize/hooks/view-hooks"},{"title":"View Logs for Hooks","href":"/docs/customize/hooks/view-logs-for-hooks"},{"group":"Hook Secrets","pages":[{"sidebarTitle":"Overview","title":"Hook Secrets","href":"/docs/customize/hooks/hook-secrets"},{"title":"Create Hook Secrets","href":"/docs/customize/hooks/hook-secrets/create-hook-secrets"},{"title":"Update Hook Secrets","href":"/docs/customize/hooks/hook-secrets/update-hook-secrets"},{"title":"Delete Hook Secrets","href":"/docs/customize/hooks/hook-secrets/delete-hook-secrets"},{"title":"View Hook Secrets","href":"/docs/customize/hooks/hook-secrets/view-hook-secrets"}]}]}]},{"group":"Third-Party Customization","pages":[{"group":"Extensions","pages":[{"title":"Auth0 Extensions","href":"/docs/customize/extensions"},{"group":"Authorization Extension","pages":[{"sidebarTitle":"Overview","title":"Authorization Extension","href":"/docs/customize/extensions/authorization-extension"},{"title":"Install Authorization Extension","href":"/docs/customize/extensions/authorization-extension/install-authorization-extension"},{"title":"Configure Authorization Extension","href":"/docs/customize/extensions/authorization-extension/configure-authorization-extension"},{"title":"Set Up Users in Authorization Extension Dashboard","href":"/docs/customize/extensions/authorization-extension/set-up-authorization-extension-users"},{"title":"Enable API Access to Authorization Extension","href":"/docs/customize/extensions/authorization-extension/enable-api-access-to-authorization-extension"},{"title":"Import and Export Authorization Extension Data","href":"/docs/customize/extensions/authorization-extension/import-and-export-authorization-extension-data"},{"title":"Use Rules with the Authorization Extension","href":"/docs/customize/extensions/authorization-extension/use-rules-with-the-authorization-extension"},{"title":"Migrate to Authorization Extension v2","href":"/docs/customize/extensions/authorization-extension/migrate-to-authorization-extension-v2"}]},{"group":"Delegated Administration Extension","pages":[{"title":"Delegated Administration Extension v3","href":"/docs/customize/extensions/delegated-administration-extension"},{"title":"Install Delegated Admin Extension","href":"/docs/customize/extensions/delegated-administration-extension/install-delegated-admin-extension"},{"title":"Create Delegated Admin Applications","href":"/docs/customize/extensions/delegated-administration-extension/create-delegated-admin-applications"},{"group":"Delegated Administration Extension Hooks","pages":[{"title":"Delegated Administration: Extension Hooks","href":"/docs/customize/extensions/delegated-administration-extension/delegated-administration-hooks"},{"title":"Delegated Administration: Access Hook","href":"/docs/customize/extensions/delegated-administration-extension/delegated-administration-hooks/delegated-administration-access-hook"},{"title":"Delegated Administration: Filter Hook","href":"/docs/customize/extensions/delegated-administration-extension/delegated-administration-hooks/delegated-administration-filter-hook"},{"title":"Delegated Administration: Memberships Query Hook","href":"/docs/customize/extensions/delegated-administration-extension/delegated-administration-hooks/delegated-administration-memberships-query-hook"},{"title":"Delegated Administration: Settings Query Hook","href":"/docs/customize/extensions/delegated-administration-extension/delegated-administration-hooks/delegated-administration-settings-query-hook"},{"title":"Delegated Administration: Write Hook","href":"/docs/customize/extensions/delegated-administration-extension/delegated-administration-hooks/delegated-administration-write-hook"}]},{"title":"Delegated Administration: Manage Users","href":"/docs/customize/extensions/delegated-administration-extension/delegated-administration-manage-users"}]},{"group":"Single Sign-On Dashboard Extension","pages":[{"sidebarTitle":"Overview","title":"Single Sign-On Dashboard Extension","href":"/docs/customize/extensions/single-sign-on-dashboard-extension"},{"title":"Install Single Sign-On Dashboard Extension","href":"/docs/customize/extensions/single-sign-on-dashboard-extension/install-sso-dashboard-extension"},{"title":"Create Single Sign-on (SSO) Dashboard Application","href":"/docs/customize/extensions/single-sign-on-dashboard-extension/create-sso-dashboard-application"},{"title":"Add Applications to Single Sign-On Dashboard","href":"/docs/customize/extensions/single-sign-on-dashboard-extension/add-applications-to-the-sso-dashboard"},{"title":"Update Applications in the SSO Dashboard","href":"/docs/customize/extensions/single-sign-on-dashboard-extension/update-applications-on-the-sso-dashboard"}]},{"title":"Authentication API Debugger Extension","href":"/docs/customize/extensions/authentication-api-debugger-extension"},{"title":"Auth0 AD/LDAP Connector Health Monitor Extension","href":"/docs/customize/extensions/ad-ldap-connector-health-monitor"},{"title":"Real-time Webtask Logs Extension","href":"/docs/customize/extensions/real-time-webtask-logs"},{"title":"Account Link Extension","href":"/docs/customize/extensions/account-link-extension"},{"title":"User Import / Export Extension","href":"/docs/customize/extensions/user-import-export-extension"}]},{"group":"Integrations","pages":[{"group":"Integrate with Amazon Web Services and Products","pages":[{"sidebarTitle":"Overview","title":"Integrate with Amazon Web Services and Products","href":"/docs/customize/integrations/aws"},{"title":"Configure Amazon Web Services for Delegated Authentication","href":"/docs/customize/integrations/aws/how-to-set-up-aws-for-delegated-authentication"},{"title":"Configure Amazon Web Services for Single Sign-On","href":"/docs/customize/integrations/aws/configure-amazon-web-services-for-sso"},{"title":"Secure AWS API Gateway Endpoints Using Custom Authorizers","href":"/docs/customize/integrations/aws/aws-api-gateway-custom-authorizers"},{"title":"Use Amazon Web Services Session Tags for Role-Based Access Control","href":"/docs/customize/integrations/aws/session-tags"},{"group":"Serverless Apps with API Gateway and Lambda","pages":[{"title":"Build Serverless Applications Using Token-Based Authentication with AWS API Gateway and Lambda","href":"/docs/customize/integrations/aws/aws-api-gateway-delegation"},{"title":"AWS API Gateway Tutorial Step 1","href":"/docs/customize/integrations/aws/aws-api-gateway-delegation/aws-api-gateway-delegation-1"},{"title":"AWS API Gateway Tutorial Step 2","href":"/docs/customize/integrations/aws/aws-api-gateway-delegation/aws-api-gateway-delegation-2"},{"title":"AWS API Gateway Tutorial Step 3","href":"/docs/customize/integrations/aws/aws-api-gateway-delegation/aws-api-gateway-delegation-3"},{"title":"AWS API Gateway Tutorial Step 4","href":"/docs/customize/integrations/aws/aws-api-gateway-delegation/aws-api-gateway-delegation-4"},{"title":"AWS API Gateway Tutorial Step 5","href":"/docs/customize/integrations/aws/aws-api-gateway-delegation/aws-api-gateway-delegation-5"}]},{"title":"Integrate with Amazon Cognito","href":"/docs/customize/integrations/aws/amazon-cognito"},{"title":"Secure AWS API Gateway Using Cognito","href":"/docs/customize/integrations/aws/aws-api-gateway-cognito"}]},{"title":"Integrate with Azure API Management","href":"/docs/customize/integrations/azure-api-management"},{"title":"Secure Google Cloud Endpoints with Auth0","href":"/docs/customize/integrations/google-cloud-endpoints"},{"title":"Secure a CLI with Auth0","href":"/docs/customize/integrations/secure-a-cli-with-auth0"},{"title":"Secure Apigee with Auth0","href":"/docs/customize/integrations/apigee"},{"title":"Single Sign-On Integrations","href":"/docs/customize/integrations/sso-integrations"},{"group":"Marketing Tool Integrations","pages":[{"title":"Export User Data to Marketing Tools","href":"/docs/customize/integrations/marketing-tool-integrations"},{"title":"Export User Data to Adobe Campaign","href":"/docs/customize/integrations/marketing-tool-integrations/adobe-campaign"},{"title":"Export User Data to Alterian","href":"/docs/customize/integrations/marketing-tool-integrations/alterian"},{"title":"Export User Data to Constant Contact","href":"/docs/customize/integrations/marketing-tool-integrations/constant-contact"},{"title":"Export User Data to Oracle Eloqua","href":"/docs/customize/integrations/marketing-tool-integrations/eloqua"},{"title":"Export User Data to MailChimp","href":"/docs/customize/integrations/marketing-tool-integrations/mailchimp"},{"title":"Export User Data to Marketo","href":"/docs/customize/integrations/marketing-tool-integrations/marketo"},{"title":"Export User Data to Sailthru","href":"/docs/customize/integrations/marketing-tool-integrations/sailthru"},{"title":"Export User Data to Salesforce","href":"/docs/customize/integrations/marketing-tool-integrations/export-user-data-salesforce"},{"title":"Export User Data to Salesforce Marketing Cloud","href":"/docs/customize/integrations/marketing-tool-integrations/salesforce-marketing-cloud"},{"title":"Export User Data to Watson Campaign Automation","href":"/docs/customize/integrations/marketing-tool-integrations/watson-campaign-automation"}]},{"group":"Marketplace Partners","pages":[{"sidebarTitle":"Overview","title":"Marketplace Partners","href":"/docs/customize/integrations/marketplace-partners"},{"title":"Introduction to Integrating with Auth0","href":"/docs/customize/integrations/marketplace-partners/introduction-to-integrating-with-auth0"},{"title":"Defining an Integration Use Case","href":"/docs/customize/integrations/marketplace-partners/defining-an-integration-use-case"},{"title":"Actions Integrations for Partners","href":"/docs/customize/integrations/marketplace-partners/actions-integrations-for-partners"},{"title":"Redirect Actions for Partners","href":"/docs/customize/integrations/marketplace-partners/redirect-actions-for-partners"},{"title":"Social Connections for Partners","href":"/docs/customize/integrations/marketplace-partners/social-connections-for-partners"},{"title":"SSO Integrations for Partners","href":"/docs/customize/integrations/marketplace-partners/sso-integrations-for-partners"},{"title":"Writing Tips for Installation Guides","href":"/docs/customize/integrations/marketplace-partners/writing-tips-for-installation-guides"}]},{"title":"Integrate with Netlify","href":"/docs/customize/integrations/integrate-with-netlify"},{"title":"Integrate with SharePoint 2010/2013","href":"/docs/customize/integrations/sharepoint-2010-2013"},{"title":"Integrate with Vercel","href":"/docs/customize/integrations/integrate-with-vercel"},{"title":"Connect Provider Hosted Apps to SharePoint Online","href":"/docs/customize/integrations/connecting-provider-hosted-apps-to-sharepoint-online"},{"group":"CMS Identity Plugins","pages":[{"sidebarTitle":"Overview","title":"CMS Identity Plugins","href":"/docs/customize/integrations/cms"},{"group":"Login by Auth0 Wordpress Plugin","pages":[{"title":"Login by Auth0 WordPress Plugin","href":"/docs/customize/integrations/cms/wordpress-plugin"},{"title":"Integrate with WordPress","href":"/docs/customize/integrations/cms/wordpress-plugin/integrate-with-wordpress"},{"title":"Install Login by Auth0","href":"/docs/customize/integrations/cms/wordpress-plugin/install-login-by-auth0"},{"title":"Configure Login by Auth0","href":"/docs/customize/integrations/cms/wordpress-plugin/configure-login-by-auth0"},{"title":"User Migration in Login by Auth0 WordPress Plugin","href":"/docs/customize/integrations/cms/wordpress-plugin/user-migration-in-login-by-auth0"},{"title":"Extend Login by Auth0 WordPress Plugin","href":"/docs/customize/integrations/cms/wordpress-plugin/extend-login-by-auth0"},{"title":"Troubleshoot Login by Auth0 WordPress Plugin","href":"/docs/customize/integrations/cms/wordpress-plugin/troubleshoot-login-by-auth0"},{"title":"Troubleshoot WordPress Plugin Invalid State Errors","href":"/docs/customize/integrations/cms/wordpress-plugin/troubleshoot-wordpress-plugin-invalid-state-errors"}]}]},{"title":"Authenticating \u0026 Authorizing a Tessel device with Auth0","href":"/docs/customize/integrations/authenticating-and-authorizing-a-tessel-device-with-auth0"},{"title":"Authenticating \u0026 Authorizing Devices using MQTT with Auth0","href":"/docs/customize/integrations/authenticate-devices-using-mqtt"},{"title":"Migrate Office365 Connections to Windows Azure AD","href":"/docs/customize/integrations/migrate-office365-connections-to-windows-azure-ad"},{"title":"Office 365 Custom Provisioning","href":"/docs/customize/integrations/office-365-custom-provisioning"}]},{"group":"Log Streams","pages":[{"sidebarTitle":"Overview","title":"Log Streams","href":"/docs/customize/log-streams"},{"url":"https://marketplace.auth0.com/features/log-streaming","title":"Integrated Log Streaming Services","href":"/docs/customize/log-streams/integrate-log-stream-service"},{"title":"Create Custom Log Streams Using Webhooks","href":"/docs/customize/log-streams/custom-log-streams"},{"title":"Check Log Stream Health","href":"/docs/customize/log-streams/check-log-stream-health"},{"title":"Log Stream Filters","href":"/docs/customize/log-streams/event-filters"},{"title":"Use Auth0 App for Splunk","href":"/docs/customize/log-streams/splunk-dashboard"},{"title":"Use Auth0 App for Sumo Logic","href":"/docs/customize/log-streams/sumo-logic-dashboard"},{"title":"Use Auth0 Dashboard Templates with Datadog","href":"/docs/customize/log-streams/datadog-dashboard-templates"}]},{"url":"https://marketplace.auth0.com/","title":"Auth0 Marketplace","href":"/docs/customize/auth0-marketplace"}]}]},{"dropdown":"Secure","icon":"shield-check","description":"Make sure only the right people can access your applications","pages":[{"title":"Secure","href":"/docs/secure"},{"group":"Protect Your Application","pages":[{"group":"Application Credentials","pages":[{"sidebarTitle":"Overview","title":"Application Credentials","href":"/docs/secure/application-credentials"},{"title":"Generate RSA Key Pair","href":"/docs/secure/application-credentials/generate-rsa-key-pair"}]},{"group":"Attack Protection","pages":[{"sidebarTitle":"Overview","title":"Attack Protection","href":"/docs/secure/attack-protection"},{"group":"Bot Detection","pages":[{"sidebarTitle":"Overview","title":"Bot Detection","href":"/docs/secure/attack-protection/bot-detection"},{"title":"Add Bot Detection to Native Applications","href":"/docs/secure/attack-protection/bot-detection/bot-detection-native-apps"},{"title":"Add Bot Detection to Passwordless Flows","href":"/docs/secure/attack-protection/bot-detection/bot-detection-passwordless-flows"},{"title":"Add Bot Detection to Custom Login Pages","href":"/docs/secure/attack-protection/bot-detection/bot-detection-custom-login-pages"},{"title":"Configure Third-Party CAPTCHA Provider Integrations","href":"/docs/secure/attack-protection/bot-detection/configure-captcha"}]},{"title":"Breached Password Detection","href":"/docs/secure/attack-protection/breached-password-detection"},{"title":"Brute-Force Protection","href":"/docs/secure/attack-protection/brute-force-protection"},{"title":"Suspicious IP Throttling","href":"/docs/secure/attack-protection/suspicious-ip-throttling"},{"title":"View Attack Protection Log Events","href":"/docs/secure/attack-protection/view-attack-protection-events"},{"title":"Prevent Attacks and Redirect Users with OAuth 2.0 State Parameters","href":"/docs/secure/attack-protection/state-parameters"},{"group":"Playbooks","pages":[{"sidebarTitle":"Overview","title":"Playbooks","href":"/docs/secure/attack-protection/playbooks"},{"title":"Bot Detection Playbook","href":"/docs/secure/attack-protection/playbooks/bot-detection-playbook"},{"title":"Breached Password Playbook","href":"/docs/secure/attack-protection/playbooks/breached-password-playbook"},{"title":"Brute Force Protection Playbook","href":"/docs/secure/attack-protection/playbooks/brute-force-protection-playbook"},{"title":"MFA Playbook","href":"/docs/secure/attack-protection/playbooks/mfa-playbook"}]}]},{"title":"Continuous Session Protection","href":"/docs/secure/continuous-session-protection"},{"group":"Highly Regulated Identity","pages":[{"sidebarTitle":"Overview","title":"Highly Regulated Identity","href":"/docs/secure/highly-regulated-identity"},{"title":"Transactional Authorization with Authorization Code Flow","href":"/docs/secure/highly-regulated-identity/transactional-authorization-with-authorization-code-flow"},{"group":"Customer Managed Keys","pages":[{"sidebarTitle":"Overview","title":"Customer Managed Keys","href":"/docs/secure/highly-regulated-identity/customer-managed-keys"},{"title":"Configure Customer Managed Keys with the Dashboard","href":"/docs/secure/highly-regulated-identity/customer-managed-keys/customer-managed-keys-dashboard"},{"title":"Configure Customer Managed Keys with the Management API","href":"/docs/secure/highly-regulated-identity/customer-managed-keys/customer-managed-keys-management-api"}]}]},{"group":"Auth0’s Mobile Driver's License Verification Service","pages":[{"sidebarTitle":"Overview","title":"Auth0’s Mobile Driver's License Verification Service","href":"/docs/secure/mdl-verification"},{"title":"Create the Mobile Driver’s License Verification API","href":"/docs/secure/mdl-verification/create-mdl-api"},{"title":"Mobile Driver's License Verification API","href":"/docs/secure/mdl-verification/mdl-verification-api"},{"title":"Configure Mobile Driver’s License Verification Presentation Request","href":"/docs/secure/mdl-verification/configure-mdl-verification-request"},{"title":"Mobile Driver's License Conditional Verification Check","href":"/docs/secure/mdl-verification/mdl-conditional-check"}]},{"group":"Multi-Factor Authentication","pages":[{"title":"Multi-Factor Authentication (MFA)","href":"/docs/secure/multi-factor-authentication"},{"title":"Enable Multi-Factor Authentication","href":"/docs/secure/multi-factor-authentication/enable-mfa"},{"group":"Multi-Factor Authentication Factors","pages":[{"sidebarTitle":"Overview","title":"Multi-Factor Authentication Factors","href":"/docs/secure/multi-factor-authentication/multi-factor-authentication-factors"},{"title":"Configure Push Notifications for MFA","href":"/docs/secure/multi-factor-authentication/multi-factor-authentication-factors/configure-push-notifications-for-mfa"},{"title":"Configure OTP Notifications for MFA","href":"/docs/secure/multi-factor-authentication/multi-factor-authentication-factors/configure-otp-notifications-for-mfa"},{"title":"Configure Email Notifications for MFA","href":"/docs/secure/multi-factor-authentication/multi-factor-authentication-factors/configure-email-notifications-for-mfa"},{"title":"Configure SMS and Voice Notifications for MFA","href":"/docs/secure/multi-factor-authentication/multi-factor-authentication-factors/configure-sms-voice-notifications-mfa"}]},{"title":"WebAuthn as Multi-Factor Authentication","href":"/docs/secure/multi-factor-authentication/webauthn-as-mfa"},{"title":"Configure Cisco Duo Security for MFA","href":"/docs/secure/multi-factor-authentication/configure-cisco-duo-for-mfa"},{"group":"FIDO Authentication with WebAuthn","pages":[{"sidebarTitle":"Overview","title":"FIDO Authentication with WebAuthn","href":"/docs/secure/multi-factor-authentication/fido-authentication-with-webauthn"},{"title":"Configure WebAuthn with Security Keys for MFA","href":"/docs/secure/multi-factor-authentication/fido-authentication-with-webauthn/configure-webauthn-security-keys-for-mfa"},{"title":"Configure WebAuthn with Device Biometrics for MFA","href":"/docs/secure/multi-factor-authentication/fido-authentication-with-webauthn/configure-webauthn-device-biometrics-for-mfa"}]},{"group":"Adaptive MFA","pages":[{"sidebarTitle":"Overview","title":"Adaptive MFA","href":"/docs/secure/multi-factor-authentication/adaptive-mfa"},{"title":"Enable Adaptive MFA","href":"/docs/secure/multi-factor-authentication/adaptive-mfa/enable-adaptive-mfa"},{"title":"Customize Adaptive MFA","href":"/docs/secure/multi-factor-authentication/adaptive-mfa/customize-adaptive-mfa"},{"title":"Adaptive MFA Log Events","href":"/docs/secure/multi-factor-authentication/adaptive-mfa/adaptive-mfa-log-events"}]},{"group":"Auth0 Guardian","pages":[{"sidebarTitle":"Overview","title":"Auth0 Guardian","href":"/docs/secure/multi-factor-authentication/auth0-guardian"},{"title":"Guardian.swift iOS SDK","href":"/docs/secure/multi-factor-authentication/auth0-guardian/guardian-for-ios-sdk"},{"title":"Guardian for Android SDK","href":"/docs/secure/multi-factor-authentication/auth0-guardian/guardian-for-android-sdk"}]},{"group":"Customize MFA","pages":[{"title":"Customize Multi-Factor Authentication Pages","href":"/docs/secure/multi-factor-authentication/customize-mfa"},{"title":"Customize MFA Selection for Universal Login","href":"/docs/secure/multi-factor-authentication/customize-mfa/customize-mfa-selection-universal-login"},{"title":"Customize MFA Enrollments for Universal Login","href":"/docs/secure/multi-factor-authentication/customize-mfa/customize-mfa-enrollments-universal-login"},{"title":"Customize MFA for Classic Login","href":"/docs/secure/multi-factor-authentication/customize-mfa/customize-mfa-classic-login"},{"title":"MFA Theme Language Dictionary","href":"/docs/secure/multi-factor-authentication/customize-mfa/mfa-theme-language-dictionary"},{"title":"MFA Widget Theme Options","href":"/docs/secure/multi-factor-authentication/customize-mfa/mfa-widget-theme-options"}]},{"group":"Authenticate Using ROPG Flow with MFA","pages":[{"title":"Authenticate Using the Resource Owner Password Flow with MFA","href":"/docs/secure/multi-factor-authentication/authenticate-using-ropg-flow-with-mfa"},{"title":"Enroll and Challenge SMS and Voice Authenticators","href":"/docs/secure/multi-factor-authentication/authenticate-using-ropg-flow-with-mfa/enroll-challenge-sms-voice-authenticators"},{"title":"Enroll and Challenge OTP Authenticators","href":"/docs/secure/multi-factor-authentication/authenticate-using-ropg-flow-with-mfa/enroll-and-challenge-otp-authenticators"},{"title":"Enroll and Challenge Push Authenticators","href":"/docs/secure/multi-factor-authentication/authenticate-using-ropg-flow-with-mfa/enroll-and-challenge-push-authenticators"},{"title":"Enroll and Challenge Email Authenticators","href":"/docs/secure/multi-factor-authentication/authenticate-using-ropg-flow-with-mfa/enroll-and-challenge-email-authenticators"},{"title":"Import User MFA Authenticator Enrollments","href":"/docs/secure/multi-factor-authentication/authenticate-using-ropg-flow-with-mfa/import-user-mfa-authenticator-enrollments"},{"title":"Challenge with Recovery Codes","href":"/docs/secure/multi-factor-authentication/authenticate-using-ropg-flow-with-mfa/challenge-with-recovery-codes"}]},{"group":"Step-Up Authentication","pages":[{"title":"Add Step-up Authentication","href":"/docs/secure/multi-factor-authentication/step-up-authentication"},{"title":"Configure Step-up Authentication for APIs","href":"/docs/secure/multi-factor-authentication/step-up-authentication/configure-step-up-authentication-for-apis"},{"title":"Configure Step-up Authentication for Web Apps","href":"/docs/secure/multi-factor-authentication/step-up-authentication/configure-step-up-authentication-for-web-apps"}]},{"title":"Configure Recovery Codes for MFA","href":"/docs/secure/multi-factor-authentication/configure-recovery-codes-for-mfa"},{"group":"Manage Authentication Factors with APIs","pages":[{"sidebarTitle":"Overview","title":"Manage Authentication Factors with APIs","href":"/docs/secure/multi-factor-authentication/manage-mfa-auth0-apis"},{"title":"Manage Authentication Methods with Management API","href":"/docs/secure/multi-factor-authentication/manage-mfa-auth0-apis/manage-authentication-methods-with-management-api"},{"title":"Manage Authentication Factors with Authentication API","href":"/docs/secure/multi-factor-authentication/manage-mfa-auth0-apis/manage-authenticator-factors-mfa-api"}]},{"title":"Reset User Multi-Factor Authentication and Recovery Codes","href":"/docs/secure/multi-factor-authentication/reset-user-mfa"},{"group":"Multi-factor Authentication Developer Resources","pages":[{"title":"Multi-Factor Authentication Developer Resources","href":"/docs/secure/multi-factor-authentication/multi-factor-authentication-developer-resources"},{"title":"Auth0 MFA API","href":"/docs/secure/multi-factor-authentication/multi-factor-authentication-developer-resources/mfa-api"},{"title":"Create Custom Enrollment Tickets","href":"/docs/secure/multi-factor-authentication/multi-factor-authentication-developer-resources/create-custom-enrollment-tickets"},{"title":"Install Guardian SDK","href":"/docs/secure/multi-factor-authentication/multi-factor-authentication-developer-resources/install-guardian-sdk"},{"title":"Guardian Error Code Reference","href":"/docs/secure/multi-factor-authentication/multi-factor-authentication-developer-resources/guardian-error-code-reference"},{"url":"https://github.com/auth0/auth0-guardian.js","title":"Auth0 MFA Client Library","href":"/docs/secure/multi-factor-authentication/multi-factor-authentication-developer-resources/mfa-client-library"},{"url":"https://github.com/auth0/auth0-guardian.js/tree/master/example","title":"Create Custom MFA Widget","href":"/docs/secure/multi-factor-authentication/multi-factor-authentication-developer-resources/create-custom-mfa"}]}]},{"group":"Security Center","pages":[{"sidebarTitle":"Overview","title":"Security Center","href":"/docs/secure/security-center"},{"title":"Metrics","href":"/docs/secure/security-center/metrics"},{"title":"Prioritized Log Streams","href":"/docs/secure/security-center/prioritized-log-streams"},{"title":"Configure Security Monitoring Alerts","href":"/docs/secure/security-center/security-alerts"}]},{"group":"Security Guidance","pages":[{"sidebarTitle":"Overview","title":"Security Center","href":"/docs/secure/security-center"},{"title":"Security Guidance","href":"/docs/secure/security-guidance"},{"title":"General Security Tips","href":"/docs/secure/security-guidance/tips"},{"group":"Security Bulletins","pages":[{"sidebarTitle":"Overview","title":"Security Bulletins","href":"/docs/secure/security-guidance/security-bulletins"},{"title":"CVE-2022-23539, CVE-2022-23541, CVE-2022-23540: Security Update for jsonwebtoken","href":"/docs/secure/security-guidance/security-bulletins/2022-12-21-jsonwebtoken"},{"title":"CVE-2022-23505: Security Update for passport-wsfed-saml2 Library","href":"/docs/secure/security-guidance/security-bulletins/cve-2022-23505"},{"title":"CVE-2022-24794: Security Update for Express OpenID Connect Library","href":"/docs/secure/security-guidance/security-bulletins/cve-2022-24794"},{"title":"CVE-2021-43812: Security Update for Next.js Auth0 Library","href":"/docs/secure/security-guidance/security-bulletins/cve-2021-43812"},{"title":"CVE-2021-41246: Security Update for Express OpenID Connect Library","href":"/docs/secure/security-guidance/security-bulletins/cve-2021-41246"},{"title":"CVE-2021-32702: Security Update for Auth0 Next.js Library","href":"/docs/secure/security-guidance/security-bulletins/cve-2021-32702"},{"title":"CVE-2021-32641: Security Update for Auth0 Lock Library","href":"/docs/secure/security-guidance/security-bulletins/cve-2021-32641"},{"title":"CVE 2020-15259: Security Update for ad-ldap-connector","href":"/docs/secure/security-guidance/security-bulletins/cve-2020-15259"},{"title":"CVE-2020-15240: Security Update for omniauth-auth0 JWT Validation","href":"/docs/secure/security-guidance/security-bulletins/cve-2020-15240"},{"title":"CVE-2020-15125: Security Update for node-auth0 Library","href":"/docs/secure/security-guidance/security-bulletins/cve-2020-15125"},{"title":"CVE-2020-15119: Security Update for Auth0 Lock Library","href":"/docs/secure/security-guidance/security-bulletins/cve-2020-15119"},{"title":"CVE-2020-15084: Security Update for express-jwt Library","href":"/docs/secure/security-guidance/security-bulletins/cve-2020-15084"},{"title":"CVE-2020-5391, CVE-2020-5392, CVE-2020-6753, CVE-2020-7948, CVE-2020-7947: Security Update for WordPress Plugin for Auth0","href":"/docs/secure/security-guidance/security-bulletins/2020-03-31-wpauth0"},{"title":"CVE-2020-5263: Security Update for auth0.js Library","href":"/docs/secure/security-guidance/security-bulletins/cve-2020-5263"},{"title":"CVE-2019-20174: Security Update for Auth0 Lock Library","href":"/docs/secure/security-guidance/security-bulletins/cve-2019-20174"},{"title":"CVE-2019-16929: Security Vulnerability in auth0.net","href":"/docs/secure/security-guidance/security-bulletins/cve-2019-16929"},{"title":"CVE-2019-13483: Security Vulnerability in Passport-SharePoint","href":"/docs/secure/security-guidance/security-bulletins/cve-2019-13483"},{"title":"CVE-2019-7644: Security Vulnerability in Auth0-WCF-Service-JWT","href":"/docs/secure/security-guidance/security-bulletins/cve-2019-7644"},{"title":"CVE-2019-20173: Security Update for WordPress Plugin for Auth0 wp-auth0","href":"/docs/secure/security-guidance/security-bulletins/cve-2019-20173"},{"title":"CVE-2018-15121: Security Vulnerability in auth0-aspnet and auth0-aspnet-owin","href":"/docs/secure/security-guidance/security-bulletins/cve-2018-15121"},{"title":"CVE-2018-11537: Security Update for angular-jwt Allow List Bypass","href":"/docs/secure/security-guidance/security-bulletins/cve-2018-11537"},{"title":"CVE-2018-7307: Security Vulnerability for auth0.js \u003c 9.3","href":"/docs/secure/security-guidance/security-bulletins/cve-2018-7307"},{"title":"CVE-2018-6874: Security Vulnerability in the Auth0 Authentication Service","href":"/docs/secure/security-guidance/security-bulletins/cve-2018-6874"},{"title":"CVE-2018-6873: Security Vulnerability in the Auth0 Authentication Service","href":"/docs/secure/security-guidance/security-bulletins/cve-2018-6873"},{"title":"CVE-2017-17068: Security Update for auth0.js Popup Callback Vulnerability","href":"/docs/secure/security-guidance/security-bulletins/cve-2017-17068"},{"title":"CVE-2017-16897: Security Update for passport-wsfed-saml2 Passport Strategy Library","href":"/docs/secure/security-guidance/security-bulletins/cve-2017-16897"},{"title":"Auth0 Security Bulletin for Rules","href":"/docs/secure/security-guidance/security-bulletins/2019-01-10-rules"},{"title":"Auth0 Security Bulletin for Assigning Scopes Based on Email Address","href":"/docs/secure/security-guidance/security-bulletins/2019-09-05-scopes"}]},{"group":"Data Security","pages":[{"sidebarTitle":"Overview","title":"Data Security","href":"/docs/secure/security-guidance/data-security"},{"title":"Auth0 IP Addresses for Allow Lists","href":"/docs/secure/security-guidance/data-security/allowlist"},{"title":"Add User Attributes to Deny List","href":"/docs/secure/security-guidance/data-security/denylist"},{"title":"User Data Storage","href":"/docs/secure/security-guidance/data-security/user-data-storage"},{"title":"Token Storage","href":"/docs/secure/security-guidance/data-security/token-storage"}]},{"title":"Prevent Common Cybersecurity Threats","href":"/docs/secure/security-guidance/prevent-threats"},{"title":"Incident Response: Using Logs","href":"/docs/secure/security-guidance/incident-response-using-logs"}]},{"group":"Sender Constraining","pages":[{"sidebarTitle":"Overview","title":"Sender Constraining","href":"/docs/secure/sender-constraining"},{"title":"Demonstrating Proof-of-Possession (DPoP)","href":"/docs/secure/sender-constraining/demonstrating-proof-of-possession-dpop"},{"title":"mTLS Sender Constraining","href":"/docs/secure/sender-constraining/mtls-sender-constraining"},{"title":"Configure Sender Constraining","href":"/docs/secure/sender-constraining/configure-sender-constraining"}]},{"group":"Tokens","pages":[{"sidebarTitle":"Overview","title":"Tokens","href":"/docs/secure/tokens"},{"group":"JSON Web Tokens","pages":[{"sidebarTitle":"Overview","title":"JSON Web Tokens","href":"/docs/secure/tokens/json-web-tokens"},{"title":"JSON Web Token Structure","href":"/docs/secure/tokens/json-web-tokens/json-web-token-structure"},{"title":"JSON Web Token Claims","href":"/docs/secure/tokens/json-web-tokens/json-web-token-claims"},{"title":"Create Custom Claims","href":"/docs/secure/tokens/json-web-tokens/create-custom-claims"},{"title":"Validate JSON Web Tokens","href":"/docs/secure/tokens/json-web-tokens/validate-json-web-tokens"},{"title":"JSON Web Key Sets","href":"/docs/secure/tokens/json-web-tokens/json-web-key-sets"},{"title":"JSON Web Key Set Properties","href":"/docs/secure/tokens/json-web-tokens/json-web-key-set-properties"},{"title":"Locate JSON Web Key Sets","href":"/docs/secure/tokens/json-web-tokens/locate-json-web-key-sets"}]},{"group":"ID Tokens","pages":[{"sidebarTitle":"Overview","title":"ID Tokens","href":"/docs/secure/tokens/id-tokens"},{"title":"Validate ID Tokens","href":"/docs/secure/tokens/id-tokens/validate-id-tokens"},{"title":"Get ID Tokens","href":"/docs/secure/tokens/id-tokens/get-id-tokens"},{"title":"ID Token Structure","href":"/docs/secure/tokens/id-tokens/id-token-structure"},{"title":"Update ID Token Lifetime","href":"/docs/secure/tokens/id-tokens/update-id-token-lifetime"}]},{"group":"Access Tokens","pages":[{"sidebarTitle":"Overview","title":"Access Tokens","href":"/docs/secure/tokens/access-tokens"},{"title":"Access Token Profiles","href":"/docs/secure/tokens/access-tokens/access-token-profiles"},{"title":"Get Access Tokens","href":"/docs/secure/tokens/access-tokens/get-access-tokens"},{"title":"Use Access Tokens","href":"/docs/secure/tokens/access-tokens/use-access-tokens"},{"title":"Validate Access Tokens","href":"/docs/secure/tokens/access-tokens/validate-access-tokens"},{"title":"Update Access Token Lifetime","href":"/docs/secure/tokens/access-tokens/update-access-token-lifetime"},{"title":"Identity Provider Access Tokens","href":"/docs/secure/tokens/access-tokens/identity-provider-access-tokens"},{"title":"Management API Access Tokens","href":"/docs/secure/tokens/access-tokens/management-api-access-tokens"},{"title":"JSON Web Encryption","href":"/docs/secure/tokens/access-tokens/json-web-encryption"}]},{"title":"Delegation Tokens","href":"/docs/secure/tokens/delegation-tokens"},{"group":"Refresh Tokens","pages":[{"sidebarTitle":"Overview","title":"Refresh Tokens","href":"/docs/secure/tokens/refresh-tokens"},{"title":"Get Refresh Tokens","href":"/docs/secure/tokens/refresh-tokens/get-refresh-tokens"},{"title":"Use Refresh Tokens","href":"/docs/secure/tokens/refresh-tokens/use-refresh-tokens"},{"title":"Configure Refresh Token Expiration","href":"/docs/secure/tokens/refresh-tokens/configure-refresh-token-expiration"},{"title":"Refresh Token Rotation","href":"/docs/secure/tokens/refresh-tokens/refresh-token-rotation"},{"title":"Configure Refresh Token Rotation","href":"/docs/secure/tokens/refresh-tokens/configure-refresh-token-rotation"},{"title":"Use Refresh Token Rotation","href":"/docs/secure/tokens/refresh-tokens/use-refresh-token-rotation"},{"title":"Disable Refresh Token Rotation","href":"/docs/secure/tokens/refresh-tokens/disable-refresh-token-rotation"},{"title":"Revoke Refresh Tokens","href":"/docs/secure/tokens/refresh-tokens/revoke-refresh-tokens"},{"title":"Refresh Tokens with Actions","href":"/docs/secure/tokens/refresh-tokens/manage-refresh-tokens-actions"},{"group":"Multi-Resource Refresh Token","pages":[{"sidebarTitle":"Overview","title":"Multi-Resource Refresh Token","href":"/docs/secure/tokens/refresh-tokens/multi-resource-refresh-token"},{"title":"Configure and Implement Multi-Resource Refresh Token","href":"/docs/secure/tokens/refresh-tokens/multi-resource-refresh-token/configure-and-implement-multi-resource-refresh-token"}]}]},{"title":"Revoke Tokens","href":"/docs/secure/tokens/revoke-tokens"},{"title":"Manage Refresh Tokens with Auth0 Management API","href":"/docs/secure/tokens/manage-refresh-tokens-with-auth0-management-api"},{"title":"Token Best Practices","href":"/docs/secure/tokens/token-best-practices"},{"group":"Token Vault","pages":[{"sidebarTitle":"Overview","title":"Token Vault","href":"/docs/secure/tokens/token-vault"},{"title":"Call APIs with Token Vault","href":"/docs/secure/tokens/token-vault/call-apis-with-token-vault"},{"title":"Configure Token Vault","href":"/docs/secure/tokens/token-vault/configure-token-vault"}]}]}]},{"group":"Protect Your Tenant","pages":[{"group":"Tenant Access Control List","pages":[{"sidebarTitle":"Overview","title":"Tenant Access Control List","href":"/docs/secure/tenant-access-control-list"},{"title":"Configure Rules","href":"/docs/secure/tenant-access-control-list/configure-rules"},{"title":"Use Cases","href":"/docs/secure/tenant-access-control-list/use-cases"},{"title":"Reference","href":"/docs/secure/tenant-access-control-list/reference"}]}]},{"group":"Compliance","pages":[{"group":"Data Privacy and Compliance","pages":[{"title":"Auth0 Data Privacy and Compliance","href":"/docs/secure/data-privacy-and-compliance"},{"group":"GDPR","pages":[{"title":"Auth0 General Data Protection Regulation Compliance","href":"/docs/secure/data-privacy-and-compliance/gdpr"},{"title":"GDPR: Conditions for Consent","href":"/docs/secure/data-privacy-and-compliance/gdpr/gdpr-conditions-for-consent"},{"title":"GDPR: Track Consent with Custom UI","href":"/docs/secure/data-privacy-and-compliance/gdpr/gdpr-track-consent-with-custom-ui"},{"title":"GDPR: Track Consent with Lock","href":"/docs/secure/data-privacy-and-compliance/gdpr/gdpr-track-consent-with-lock"},{"title":"GDPR: Right to Access, Correct, and Erase Data","href":"/docs/secure/data-privacy-and-compliance/gdpr/gdpr-right-to-access-correct-and-erase-data"},{"title":"GDPR: Data Minimization","href":"/docs/secure/data-privacy-and-compliance/gdpr/gdpr-data-minimization"},{"title":"GDPR: Data Portability","href":"/docs/secure/data-privacy-and-compliance/gdpr/gdpr-data-portability"},{"title":"GDPR: Protect and Secure User Data","href":"/docs/secure/data-privacy-and-compliance/gdpr/gdpr-protect-and-secure-user-data"}]},{"title":"Auth0 Data Processing","href":"/docs/secure/data-privacy-and-compliance/data-processing"}]}]}]},{"dropdown":"Deploy and Monitor","icon":"chart-simple","description":"Plan, check, and execute your Auth0 deployment","pages":[{"title":"Deploy and Monitor","href":"/docs/deploy-monitor"},{"group":"Deployment","pages":[{"title":"Deployment Options","href":"/docs/deploy-monitor/deployment-options"},{"group":"Private Cloud Deployments","pages":[{"sidebarTitle":"Overview","title":"Private Cloud Deployments","href":"/docs/deploy-monitor/deploy-private-cloud"},{"title":"Private Cloud on AWS","href":"/docs/deploy-monitor/deploy-private-cloud/private-cloud-on-aws"},{"title":"Private Cloud on Azure","href":"/docs/deploy-monitor/deploy-private-cloud/private-cloud-on-azure"},{"title":"Private Cloud Add-on Features","href":"/docs/deploy-monitor/deploy-private-cloud/private-cloud-add-on-features"}]},{"group":"Pre-Deployment Checks","pages":[{"sidebarTitle":"Overview","title":"Pre-Deployment Checks","href":"/docs/deploy-monitor/pre-deployment-checks"},{"title":"Run Production Readiness Checks","href":"/docs/deploy-monitor/pre-deployment-checks/how-to-run-production-checks"},{"title":"Production Readiness Checks: Critical Fixes","href":"/docs/deploy-monitor/pre-deployment-checks/production-check-required-fixes"},{"title":"Production Readiness Checks: Non-Critical Fixes","href":"/docs/deploy-monitor/pre-deployment-checks/production-check-recommended-fixes"},{"title":"Production Readiness Checks: Best Practices","href":"/docs/deploy-monitor/pre-deployment-checks/production-checks-best-practices"},{"title":"Run Pre-Deployment Tests","href":"/docs/deploy-monitor/pre-deployment-checks/predeployment-tests"},{"title":"Pre-Launch Tips","href":"/docs/deploy-monitor/pre-deployment-checks/pre-launch-tips"}]},{"title":"Deployment Checklist","href":"/docs/deploy-monitor/deploy-checklist"},{"group":"Deploy CLI Tool","pages":[{"sidebarTitle":"Overview","title":"Deploy CLI Tool","href":"/docs/deploy-monitor/deploy-cli-tool"},{"title":"Use as a CLI","href":"/docs/deploy-monitor/deploy-cli-tool/use-as-a-cli"},{"title":"Use as a Node Module","href":"/docs/deploy-monitor/deploy-cli-tool/use-as-a-node-module"},{"title":"Configure the Deploy CLI","href":"/docs/deploy-monitor/deploy-cli-tool/configure-the-deploy-cli"},{"title":"Authenticate with your Tenant","href":"/docs/deploy-monitor/deploy-cli-tool/authenticate-with-your-tenant"},{"title":"Keyword Replacement","href":"/docs/deploy-monitor/deploy-cli-tool/keyword-replacement"},{"title":"Incorporate into Multi-environment Workflows","href":"/docs/deploy-monitor/deploy-cli-tool/incorporate-into-multi-environment-workflows"},{"title":"Exclude Resources From Management","href":"/docs/deploy-monitor/deploy-cli-tool/exclude-resources-from-management"},{"title":"Resource-specific Documentation","href":"/docs/deploy-monitor/deploy-cli-tool/resource-specific-documentation"},{"title":"Available Resource Configuration Formats","href":"/docs/deploy-monitor/deploy-cli-tool/available-resource-configuration-formats"}]},{"title":"Auth0 Terraform Provider","href":"/docs/deploy-monitor/auth0-terraform-provider"},{"title":"Deployment Best Practices","href":"/docs/deploy-monitor/deployment-best-practices"}]},{"group":"Monitoring","pages":[{"group":"Monitor","pages":[{"title":"Monitor Auth0","href":"/docs/deploy-monitor/monitor"},{"title":"Check Auth0 Status","href":"/docs/deploy-monitor/monitor/check-auth0-status"},{"title":"Check External Services Status","href":"/docs/deploy-monitor/monitor/check-external-services-status"},{"title":"Monitor Applications","href":"/docs/deploy-monitor/monitor/monitor-applications"},{"title":"Monitor Auth0 Using System Center Operations Manager","href":"/docs/deploy-monitor/monitor/monitor-using-scom"}]},{"group":"Logs","pages":[{"sidebarTitle":"Overview","title":"Logs","href":"/docs/deploy-monitor/logs"},{"title":"Personally Identifiable Information in Auth0 Logs","href":"/docs/deploy-monitor/logs/pii-in-logs"},{"title":"Log Data Retention","href":"/docs/deploy-monitor/logs/log-data-retention"},{"title":"View Logs","href":"/docs/deploy-monitor/logs/view-log-events"},{"title":"Filter Log Events","href":"/docs/deploy-monitor/logs/log-event-filters"},{"title":"Prompt Details in Tenant Logs","href":"/docs/deploy-monitor/logs/prompt-details-in-tenant-logs"},{"title":"Retrieve Log Logs Using the Management API","href":"/docs/deploy-monitor/logs/retrieve-log-events-using-mgmt-api"},{"title":"Log Type Codes","href":"/docs/deploy-monitor/logs/log-event-type-codes"},{"title":"Log Search Query Syntax","href":"/docs/deploy-monitor/logs/log-search-query-syntax"}]}]}]},{"dropdown":"Troubleshoot","icon":"crosshairs","description":"Explore solutions to common challenges","pages":[{"title":"Troubleshoot","href":"/docs/troubleshoot"},{"group":"Get Support","pages":[{"group":"Customer Support","pages":[{"sidebarTitle":"Overview","title":"Customer Support","href":"/docs/troubleshoot/customer-support"},{"title":"Premier Success Plans","href":"/docs/troubleshoot/customer-support/support-plans"},{"title":"Support Channels","href":"/docs/troubleshoot/customer-support/support-channels"},{"title":"Self Service Support","href":"/docs/troubleshoot/customer-support/self-service-support"},{"title":"Product Support Matrix","href":"/docs/troubleshoot/customer-support/product-support-matrix"},{"title":"Service Levels","href":"/docs/troubleshoot/customer-support/services-level-descriptions"},{"title":"Open and Manage Support Tickets","href":"/docs/troubleshoot/customer-support/open-and-manage-support-tickets"},{"group":"Manage Subscriptions","pages":[{"sidebarTitle":"Overview","title":"Manage Subscriptions","href":"/docs/troubleshoot/customer-support/manage-subscriptions"},{"title":"Downgrade or Cancel Auth0 Subscriptions","href":"/docs/troubleshoot/customer-support/manage-subscriptions/downgrade-or-cancel-subscriptions"},{"title":"Delete or Reset Tenants","href":"/docs/troubleshoot/customer-support/manage-subscriptions/delete-or-reset-tenant"},{"title":"Export Data","href":"/docs/troubleshoot/customer-support/manage-subscriptions/export-data"},{"title":"Monitor Subscription Usage","href":"/docs/troubleshoot/customer-support/manage-subscriptions/monitor-subscription-usage"}]},{"title":"Reset Account Passwords","href":"/docs/troubleshoot/customer-support/reset-account-passwords"},{"title":"Software Updates","href":"/docs/troubleshoot/customer-support/software-updates"},{"title":"Auth0 Versioning Strategy","href":"/docs/troubleshoot/customer-support/versioning-strategy"},{"group":"Operational Policies","pages":[{"sidebarTitle":"Overview","title":"Auth0 Operational Policies","href":"/docs/troubleshoot/customer-support/operational-policies"},{"title":"Billing Policy","href":"/docs/troubleshoot/customer-support/operational-policies/billing-policy"},{"title":"Auth0 Public Cloud Service Endpoints","href":"/docs/troubleshoot/customer-support/operational-policies/public-cloud-service-endpoints"},{"title":"Data Export and Transfer Policy","href":"/docs/troubleshoot/customer-support/operational-policies/data-export-and-transfer-policy"},{"title":"Change Freeze Policy","href":"/docs/troubleshoot/customer-support/operational-policies/change-freeze-policy"},{"title":"Load Testing Policy","href":"/docs/troubleshoot/customer-support/operational-policies/load-testing-policy"},{"title":"Penetration Testing Policy","href":"/docs/troubleshoot/customer-support/operational-policies/penetration-testing-policy"},{"group":"Rate Limit Policy","pages":[{"sidebarTitle":"Overview","title":"Rate Limit Policy","href":"/docs/troubleshoot/customer-support/operational-policies/rate-limit-policy"},{"title":"Rate Limit Use Cases","href":"/docs/troubleshoot/customer-support/operational-policies/rate-limit-policy/rate-limit-use-cases"},{"group":"Rate Limit Configurations","pages":[{"sidebarTitle":"Overview","title":"Rate Limit Configurations","href":"/docs/troubleshoot/customer-support/operational-policies/rate-limit-policy/rate-limit-configurations"},{"title":"Free","href":"/docs/troubleshoot/customer-support/operational-policies/rate-limit-policy/rate-limit-configurations/free-public"},{"title":"Self Service","href":"/docs/troubleshoot/customer-support/operational-policies/rate-limit-policy/rate-limit-configurations/self-service-public"},{"title":"Enterprise","href":"/docs/troubleshoot/customer-support/operational-policies/rate-limit-policy/rate-limit-configurations/enterprise-public"},{"title":"Tier Dev Private Cloud","href":"/docs/troubleshoot/customer-support/operational-policies/rate-limit-policy/rate-limit-configurations/tier-20-development-private-cloud"},{"title":"Private Cloud Basic 100 RPS (1x)","href":"/docs/troubleshoot/customer-support/operational-policies/rate-limit-policy/rate-limit-configurations/tier-100-rps-private-cloud"},{"title":"Private Cloud Performance 500 RPS (5x)","href":"/docs/troubleshoot/customer-support/operational-policies/rate-limit-policy/rate-limit-configurations/tier-500-rps-private-cloud"},{"title":"Private Cloud Performance 1500 RPS (15x)","href":"/docs/troubleshoot/customer-support/operational-policies/rate-limit-policy/rate-limit-configurations/tier-1500-rps-private-cloud"},{"title":"Private Cloud Performance 3000 RPS (30x) and 3000 RPS (30x) Burst","href":"/docs/troubleshoot/customer-support/operational-policies/rate-limit-policy/rate-limit-configurations/tier-3000-rps-private-cloud"},{"title":"Private Cloud Performance 6000 RPS (60x) and 6000 RPS (60x) Burst","href":"/docs/troubleshoot/customer-support/operational-policies/rate-limit-policy/rate-limit-configurations/tier-6000-rps-private-cloud"},{"title":"Private Cloud Performance 10,000 RPS (100x)","href":"/docs/troubleshoot/customer-support/operational-policies/rate-limit-policy/rate-limit-configurations/tier-10000-rps-private-cloud"}]}]},{"title":"Entity Limit Policy","href":"/docs/troubleshoot/customer-support/operational-policies/entity-limit-policy"}]},{"url":"https://auth0.com/changelog","title":"Auth0 Changelog","href":"/docs/troubleshoot/customer-support/auth0-changelog"},{"title":"Responsible Disclosure Program Security Support Tickets","href":"/docs/troubleshoot/customer-support/responsible-disclosure-program-security-support-tickets"},{"title":"Auth0 Enterprise and Premier Support","href":"/docs/troubleshoot/customer-support/auth0-enterprise-and-premier-support"},{"title":"Update Billing Information","href":"/docs/troubleshoot/customer-support/update-billing-information"}]}]},{"group":"Troubleshoot","pages":[{"group":"Commonplace Issues","pages":[{"title":"Troubleshoot Basic Issues","href":"/docs/troubleshoot/basic-issues"},{"title":"Verify Platform","href":"/docs/troubleshoot/basic-issues/verify-platform"},{"title":"Verify Connections","href":"/docs/troubleshoot/basic-issues/verify-connections"},{"title":"Verify Domain","href":"/docs/troubleshoot/basic-issues/verify-domain"},{"title":"Verify Rules","href":"/docs/troubleshoot/basic-issues/verify-rules"},{"title":"Check Error Messages","href":"/docs/troubleshoot/basic-issues/check-error-messages"},{"title":"Troubleshoot Invalid Token Errors","href":"/docs/troubleshoot/basic-issues/invalid-token-errors"},{"title":"Check for Deprecation Errors","href":"/docs/troubleshoot/basic-issues/search-logs-for-deprecation-errors"},{"title":"Deprecation Errors","href":"/docs/troubleshoot/basic-issues/check-deprecation-errors"},{"title":"Recover Administrative Access to a Tenant","href":"/docs/troubleshoot/basic-issues/recover-administrative-access-to-a-tenant"}]},{"group":"Authentication Issues","pages":[{"title":"Troubleshoot Authentication Issues","href":"/docs/troubleshoot/authentication-issues"},{"title":"Check API Calls","href":"/docs/troubleshoot/authentication-issues/check-api-calls"},{"title":"Check Login and Logout Issues","href":"/docs/troubleshoot/authentication-issues/check-login-and-logout-issues"},{"title":"Check User Profiles","href":"/docs/troubleshoot/authentication-issues/check-user-profiles"},{"title":"Troubleshoot Role-Based Access Control and Authorization","href":"/docs/troubleshoot/authentication-issues/troubleshoot-rbac-authorization"},{"title":"Troubleshoot Multi-Factor Authentication Issues","href":"/docs/troubleshoot/authentication-issues/troubleshoot-mfa-issues"},{"title":"Troubleshoot SAML Configurations","href":"/docs/troubleshoot/authentication-issues/troubleshoot-saml-configurations"},{"title":"Troubleshoot SAML Errors","href":"/docs/troubleshoot/authentication-issues/saml-errors"},{"title":"Self Change Password Errors","href":"/docs/troubleshoot/authentication-issues/self-change-password-errors"},{"title":"Troubleshoot Authorization Extension","href":"/docs/troubleshoot/authentication-issues/troubleshoot-authorization-extension"},{"title":"Troubleshoot Renew Tokens When Using Safari","href":"/docs/troubleshoot/authentication-issues/renew-tokens-when-using-safari"}]},{"group":"Integration and Extensibility Issues","pages":[{"title":"Troubleshoot Integration and Extensibility Issues","href":"/docs/troubleshoot/integration-extensibility-issues"},{"title":"Troubleshoot Custom Domains","href":"/docs/troubleshoot/integration-extensibility-issues/troubleshoot-custom-domains"},{"title":"Troubleshoot AD/LDAP Connector","href":"/docs/troubleshoot/integration-extensibility-issues/troubleshoot-ad-ldap-connector"},{"title":"Troubleshoot Extensions","href":"/docs/troubleshoot/integration-extensibility-issues/troubleshoot-extensions"},{"title":"Troubleshoot Deploy CLI Tool","href":"/docs/troubleshoot/integration-extensibility-issues/troubleshoot-the-deploy-cli-tool"}]},{"group":"Deploy and Monitor Issues","pages":[{"sidebarTitle":"Overview","title":"Deploy and Monitor Issues","href":"/docs/troubleshoot/deploy-monitor-issues"},{"title":"Troubleshoot Log Event Codes","href":"/docs/troubleshoot/deploy-monitor-issues/troubleshoot-log-event-codes"}]},{"group":"Troubleshooting Tools","pages":[{"sidebarTitle":"Overview","title":"Troubleshooting Tools","href":"/docs/troubleshoot/troubleshooting-tools"},{"title":"Generate and Analyze HAR Files","href":"/docs/troubleshoot/troubleshooting-tools/generate-and-analyze-har-files"},{"title":"Generate and Analyze HAR Files","href":"/docs/troubleshoot/troubleshooting-tools/sanitize-http-traces"},{"url":"https://www.jwt.io/","title":"JSON Web Token Inspector","href":"/docs/troubleshoot/troubleshooting-tools/jwt"}]},{"title":"Debugging Best Practices","href":"/docs/troubleshoot/debugging-best-practices"},{"title":"Error Handling Best Practices","href":"/docs/troubleshoot/error-handling-best-practices"},{"title":"Performance Best Practices","href":"/docs/troubleshoot/performance-best-practices"},{"title":"General Usage and Operations Best Practices","href":"/docs/troubleshoot/general-usage-and-operations-best-practices"}]},{"group":"Auth0 Product Lifecycle","pages":[{"group":"Product Lifecycle","pages":[{"sidebarTitle":"Overview","title":"Product Lifecycle","href":"/docs/troubleshoot/product-lifecycle"},{"title":"Product Release Stages","href":"/docs/troubleshoot/product-lifecycle/product-release-stages"},{"title":"Migration Process","href":"/docs/troubleshoot/product-lifecycle/migration-process"},{"group":"Deprecations and Migrations","pages":[{"sidebarTitle":"Overview","title":"Deprecations and Migrations","href":"/docs/troubleshoot/product-lifecycle/deprecations-and-migrations"},{"title":"Migrate from Node 18 to Node 22","href":"/docs/troubleshoot/product-lifecycle/deprecations-and-migrations/migrate-nodejs-22"}]},{"group":"Past Migrations","pages":[{"sidebarTitle":"Overview","title":"Past Migrations","href":"/docs/troubleshoot/product-lifecycle/past-migrations"},{"title":"Migrate from Node 12 and 16 to Node 18","href":"/docs/troubleshoot/product-lifecycle/past-migrations/migrate-nodejs-16-to-nodejs-18"},{"title":"Migrate from edge.js extensibility features","href":"/docs/troubleshoot/product-lifecycle/past-migrations/migrate-from-edge-js-extensibility-features"},{"title":"Migrate from oracledb extensibility features","href":"/docs/troubleshoot/product-lifecycle/past-migrations/migrate-from-oracledb-extensibility-features"},{"title":"Migrate Custom Claims","href":"/docs/troubleshoot/product-lifecycle/past-migrations/custom-claims-migration"},{"title":"Migrate from Log Extensions","href":"/docs/troubleshoot/product-lifecycle/past-migrations/migrate-from-log-extensions"},{"title":"Migrate Tenant Hostname Validation","href":"/docs/troubleshoot/product-lifecycle/past-migrations/tenant-hostname-migration"},{"title":"Migrate to Node.js 16","href":"/docs/troubleshoot/product-lifecycle/past-migrations/migrate-to-nodejs-16"},{"title":"Migrate from Node.js 8 to Node.js 12","href":"/docs/troubleshoot/product-lifecycle/past-migrations/migrate-to-nodejs-12"},{"title":"Migrate to Management API v2 Endpoint Paginated Queries","href":"/docs/troubleshoot/product-lifecycle/past-migrations/migrate-to-paginated-queries"},{"title":"Migrate to New Tenant Member Roles","href":"/docs/troubleshoot/product-lifecycle/past-migrations/migrate-tenant-member-roles"},{"title":"Migrate from Search v2 to v3","href":"/docs/troubleshoot/product-lifecycle/past-migrations/migrate-v2-v3"},{"title":"Migrate to Passwordless Endpoint from Confidential Applications","href":"/docs/troubleshoot/product-lifecycle/past-migrations/migrate-to-passwordless"},{"title":"Clickjacking Protection for Universal Login Change","href":"/docs/troubleshoot/product-lifecycle/past-migrations/clickjacking-protection-for-universal-login"},{"title":"Migrate to Management API Endpoints with Access Tokens","href":"/docs/troubleshoot/product-lifecycle/past-migrations/migrate-to-calling-api-with-access-tokens"},{"title":"Migrate to Access Tokens for Account Linking","href":"/docs/troubleshoot/product-lifecycle/past-migrations/link-user-accounts-with-access-tokens-migration"},{"title":"Migrate Your Resource Owner Passwordless Credentials Exchange","href":"/docs/troubleshoot/product-lifecycle/past-migrations/resource-owner-passwordless-credentials-exchange"},{"title":"Migrate Your Resource Owner Password Flow","href":"/docs/troubleshoot/product-lifecycle/past-migrations/migration-oauthro-oauthtoken"},{"title":"Instagram Connection Deprecation","href":"/docs/troubleshoot/product-lifecycle/past-migrations/instagram-connection-deprecation"},{"title":"Yahoo API Changes","href":"/docs/troubleshoot/product-lifecycle/past-migrations/yahoo-api-changes"},{"title":"Migrate from Google to Firebase Cloud Messaging","href":"/docs/troubleshoot/product-lifecycle/past-migrations/google-firebase-migration"},{"title":"Facebook Social Context Field Deprecation","href":"/docs/troubleshoot/product-lifecycle/past-migrations/facebook-social-context-field-deprecation"},{"title":"Facebook Graph API Changes","href":"/docs/troubleshoot/product-lifecycle/past-migrations/facebook-graph-api-changes"},{"title":"Migrate from Legacy Authentication Flows","href":"/docs/troubleshoot/product-lifecycle/past-migrations/migrate-from-legacy-auth-flows"},{"title":"Migrate to Tenant Log Search v3","href":"/docs/troubleshoot/product-lifecycle/past-migrations/migrate-to-tenant-log-search-v3"},{"title":"Migrate to 1-Hour Login Flows Expiration","href":"/docs/troubleshoot/product-lifecycle/past-migrations/migrate-to-1-hour-expiration"}]}]},{"url":"https://community.auth0.com/","title":"Auth0 Community","href":"/docs/troubleshoot/auth0-community"},{"url":"https://auth0.com/blog/","title":"Auth0 Blog","href":"/docs/troubleshoot/auth0-blog"}]}]}]},{"tab":"Quickstarts","pages":[{"title":"Quickstarts","href":"/docs/quickstarts"}]},{"tab":"API Reference","href":"https://auth0.com/docs/api"},{"tab":"SDKs","pages":[{"title":"SDKs","href":"/docs/libraries"}]}]},"basePath":"","title":"Authentication (B2B)","buildId":"dpl_8LJbrAiZvr1K98WQNZXCyY5AvT34","deploymentId":"dpl_8LJbrAiZvr1K98WQNZXCyY5AvT34","dynamics":[],"chunks":[]}
