Managing Auth0

Auth0 Management Skill

Safely read and audit Auth0 — the identity platform for application builders.

MANDATORY: Discovery-First Pattern

Always discover tenant configuration, applications, and connections before performing targeted queries. Never guess client IDs or connection names.

Phase 1: Discovery

#!/bin/bash

auth0_api() {
    local endpoint="$1"
    local method="${2:-GET}"
    curl -s -X "$method" \
         -H "Authorization: Bearer $AUTH0_MGMT_TOKEN" \
         -H "Content-Type: application/json" \
         "https://${AUTH0_DOMAIN}/api/v2/${endpoint}"
}

echo "=== Tenant Settings ==="
auth0_api "tenants/settings" | jq '{
    friendly_name: .friendly_name,
    support_email: .support_email,
    default_directory: .default_directory,
    enabled_locales: .enabled_locales,
    flags: {
        universal_login: .flags.universal_login,
        disable_clickjack_protection: .flags.disable_clickjack_protection_headers,
        enable_pipeline2: .flags.enable_pipeline2
    }
}'

echo ""
echo "=== Applications ==="
auth0_api "clients?fields=client_id,name,app_type,callbacks&include_fields=true" | jq -r '.[] | "\(.client_id)\t\(.name)\t\(.app_type)"' | column -t

echo ""
echo "=== Connections ==="
auth0_api "connections?fields=id,name,strategy,enabled_clients" | jq -r '.[] | "\(.id)\t\(.name)\t\(.strategy)\tClients: \(.enabled_clients | length)"' | column -t

echo ""
echo "=== APIs (Resource Servers) ==="
auth0_api "resource-servers" | jq -r '.[] | "\(.id)\t\(.name)\t\(.identifier)"' | column -t

Phase 1 outputs: Tenant config, client list, connections, APIs — only reference these in subsequent operations.

Anti-Hallucination Rules

• NEVER guess client IDs — always list clients in Phase 1
• NEVER assume connection names — always list connections first
• NEVER fabricate rule or action names — always list before querying
• ONLY read and list — never create, update, or delete without explicit request

Safety Rules

• READ-ONLY by default: GET requests only — clients, connections, users, logs, rules, actions
• MASK sensitive data: Redact client secrets, user passwords, and API keys in output
• FORBIDDEN without explicit request: POST/PUT/DELETE/PATCH to clients, connections, users; secret rotation
• NEVER print client secrets: Always use *** REDACTED *** for secret fields

Core Helper Functions

#!/bin/bash

auth0_api() {
    local endpoint="$1"
    local method="${2:-GET}"
    curl -s -X "$method" \
         -H "Authorization: Bearer $AUTH0_MGMT_TOKEN" \
         -H "Content-Type: application/json" \
         "https://${AUTH0_DOMAIN}/api/v2/${endpoint}"
}

# Paginated fetch with Auth0's page/per_page pattern
auth0_api_paginated() {
    local endpoint="$1"
    local max_pages="${2:-5}"
    local per_page=50
    local page=0

    while [ $page -lt $max_pages ]; do
        local separator="?"
        [[ "$endpoint" == *"?"* ]] && separator="&"
        result=$(auth0_api "${endpoint}${separator}page=${page}&per_page=${per_page}&include_totals=true")
        total=$(echo "$result" | jq -r '.total // 0')
        echo "$result" | jq '.users // .logs // .[] // empty'
        [ $((($page + 1) * $per_page)) -ge $total ] && break
        page=$((page + 1))
    done
}

Common Operations

Application Configuration Review

#!/bin/bash
CLIENT_ID="${1:?Client ID required — discover via Phase 1}"

echo "=== Application Details ==="
auth0_api "clients/${CLIENT_ID}" | jq '{
    name: .name,
    app_type: .app_type,
    client_id: .client_id,
    client_secret: "*** REDACTED ***",
    callbacks: .callbacks,
    allowed_origins: .allowed_origins,
    web_origins: .web_origins,
    allowed_logout_urls: .allowed_logout_urls,
    grant_types: .grant_types,
    token_endpoint_auth_method: .token_endpoint_auth_method,
    jwt_configuration: .jwt_configuration,
    is_first_party: .is_first_party
}'

echo ""
echo "=== Enabled Connections for App ==="
auth0_api "clients/${CLIENT_ID}/connections" | jq -r '.[] | "\(.connection)\t\(.strategy)\t\(.status)"' | column -t 2>/dev/null || \
    auth0_api "connections" | jq -r --arg cid "$CLIENT_ID" '.[] | select(.enabled_clients | index($cid)) | "\(.name)\t\(.strategy)"' | column -t

Connection Analysis

#!/bin/bash
echo "=== All Connections with Details ==="
auth0_api "connections" | jq -r '.[] | {
    id: .id,
    name: .name,
    strategy: .strategy,
    enabled_clients_count: (.enabled_clients | length),
    realms: .realms,
    is_domain_connection: .is_domain_connection
}'

echo ""
echo "=== Social Connections ==="
auth0_api "connections?strategy=google-oauth2,github,facebook,apple,linkedin,microsoft" | jq -r '.[] | "\(.name)\t\(.strategy)\tClients: \(.enabled_clients | length)"' | column -t

echo ""
echo "=== Enterprise Connections ==="
auth0_api "connections" | jq -r '.[] | select(.strategy | test("samlp|oidc|waad|adfs|ad|google-apps")) | "\(.name)\t\(.strategy)\tClients: \(.enabled_clients | length)"' | column -t

Rule & Action Review

#!/bin/bash
echo "=== Rules (Legacy) ==="
auth0_api "rules" | jq -r '.[] | "\(.id)\t\(.name)\t\(.stage)\t\(.enabled)\tOrder: \(.order)"' | column -t

echo ""
echo "=== Actions ==="
auth0_api "actions/actions?deployed=true" | jq -r '.actions[] | "\(.id)\t\(.name)\t\(.status)\tTrigger: \(.supported_triggers[0].id)"' | column -t

echo ""
echo "=== Action Flows (Triggers) ==="
for trigger in post-login credentials-exchange pre-user-registration post-user-registration post-change-password send-phone-message; do
    bindings=$(auth0_api "actions/triggers/${trigger}/bindings" | jq '.bindings | length')
    [ "$bindings" -gt 0 ] 2>/dev/null && echo "${trigger}: ${bindings} action(s) bound"
done

User Management & Search

#!/bin/bash
SEARCH="${1:?Search term required (email or name)}"

echo "=== User Search: $SEARCH ==="
auth0_api "users?q=email%3A*${SEARCH}*&search_engine=v3&fields=user_id,email,name,logins_count,last_login,created_at,blocked,identities" | jq -r '.[] | {
    user_id: .user_id,
    email: .email,
    name: .name,
    logins_count: .logins_count,
    last_login: .last_login,
    created_at: .created_at,
    blocked: .blocked,
    providers: [.identities[].provider]
}'

Log & Event Analysis

#!/bin/bash
echo "=== Recent Logs (last 50 events) ==="
auth0_api "logs?sort=date:-1&per_page=50" | jq -r '.[] | {
    date: .date,
    type: .type,
    description: .description,
    client_name: .client_name,
    user_name: .user_name,
    ip: .ip,
    location: "\(.location_info.city_name // "N/A"), \(.location_info.country_name // "N/A")"
}'

echo ""
echo "=== Failed Login Events ==="
auth0_api "logs?q=type%3Af*&sort=date:-1&per_page=20" | jq -r '.[] | "\(.date)\t\(.type)\t\(.user_name // "unknown")\t\(.ip)\t\(.description)"' | column -t

echo ""
echo "=== Event Type Summary ==="
auth0_api "logs?sort=date:-1&per_page=100" | jq -r '[.[] | .type] | group_by(.) | map({type: .[0], count: length}) | sort_by(-.count) | .[:10][] | "\(.type)\t\(.count)"' | column -t

Output Format

Present results as a structured report:

Managing Auth0 Report
═════════════════════
Resources discovered: [count]

Resource       Status    Key Metric    Issues
──────────────────────────────────────────────
[name]         [ok/warn] [value]       [findings]

Summary: [total] resources | [ok] healthy | [warn] warnings | [crit] critical
Action Items: [list of prioritized findings]

Target ≤50 lines of output. Use tables for multi-resource comparisons.

Counter-Rationalizations

Common Pitfalls

• Management API token expiry: Tokens are short-lived (24h default) — regenerate via client credentials grant to /oauth/token
• Rate limits: Management API has strict rate limits (varies by endpoint) — check X-RateLimit-Remaining header
• Search engine v3: User search requires search_engine=v3 parameter — v2 is deprecated and returns different results
• Rules vs Actions: Rules are legacy (single pipeline); Actions are the modern replacement — check both during audits
• Log event types: Auth0 uses short codes (s, f, fp, fu) — reference the Log Event Type Codes documentation
• Connection strategy names: waad = Azure AD, google-apps = Google Workspace, ad = Active Directory — names differ from marketing names
• Client secrets: Machine-to-machine apps need secrets; SPAs should use PKCE — mismatched auth methods cause silent failures
• Tenant log retention: Depends on plan tier (2-30 days) — export to external storage for long-term analysis