Auth0 Release Notes

We are thrilled to introduce the Limited Early Access release of Federated Logout for Okta and OIDC enterprise connections! Auth0 customers now have a straightforward solution to ensure that an end user is logged out of both Auth0 and OIDC IdP sessions via the Auth0 logout endpoint. This feature is built upon the [OpenID Connect RP-initiated federated logout specification](https://openid.net/specs/openid-connect-rpinitiated-1\_0.html), allowing customers to effectively mitigate security risks without the need to directly access IdP logout endpoints. Federated logout has already been supported for a some IdPs, [listed here](https://auth0.com/docs/authenticate/login/logout/log-users-out-of-idps), as well as through the dedicated Google and Microsoft Entra ID connectors. This features expands federated logout capabilities to all OIDC Identity Providers via the generic OIDC and Okta connectors. To enable the Federated Logout Limited Early Access release in your Auth0 tenant, please contact your Technical Account Manager to request access.

We are excited to announce the next Early Access release of Advanced Customizations for Universal Login! This release adds support for building custom versions of Universal Login’s Device Authorization screens, the MFA voice, phone, and recovery code screens, and their matching Reset Password Challenge factors all using the new ACUL SDK. Advanced Customizations for Universal Login enables you to build custom, client-rendered interfaces for Universal Login screens, allowing you to control every pixel of your Universal Login experience. This release allows you to building custom versions of the following screens: * Device Code Activation * Device Code Activation Allowed * Device Code Activation Denied * Device Code Confirmation * MFA Phone Challenge * MFA Phone Enrollment * MFA Voice Challenge * MFA Voice Enrollment * Reset Password MFA Phone Challenge * Reset Password MFA Voice Challenge * MFA Recovery Code Challenge * MFA Recovery Code Enrollment * Reset Password MFA Recovery Code Challenge * Redeem Ticket __DX Updates__ The latest versions of the ACUL SDK and our CDT tooling all include support for these new screens. * [Typescript SDK](https://github.com/auth0/universal-login/releases/tag/auth0-acul-js%400.1.0-beta.4) * [Auth0 CLI](https://github.com/auth0/auth0-cli/releases/tag/v1.12.0) * [Deploy CLI](https://github.com/auth0/auth0-deploy-cli/releases/tag/v8.8.1) * [Terraform Provider Auth0](https://github.com/auth0/terraform-provider-auth0/rel…

This feature gives developers real-time output from Action, Custom Database Scripts, and Custom Social Connections code when executing console.log and other similar commands. To use the feature, navigate to the *__Dashboard > Monitoring > Action Logs__*. What's new: - __Connection Status:__ New connectivity status indicator for easier visualization of connection state to server stream. - __Functionality:__ New functionalities for on demand connectivity, easier scrolling, and file downloading, which supplement the already existing ones. - __User Experience:__ Improved user experience regarding look and feel and performance. - __Docs:__ New docs section at: [https://auth0.com/docs/customize/actions/actions-real-time-logs\](https://auth0.com/docs/customize/actions/actions-real-time-logs "Actions Real-time Logs Docs")

We’re excited to introduce Token Vault, now available in Early Access. Token Vault enables your applications to securely access third-party APIs on behalf of your users—without requiring you to manage refresh tokens or create custom integrations for a broad range of external APIs and services. With Token Vault, Auth0 handles storing and refreshing access tokens from identity providers like Google, Github, Microsoft, and more. Your applications can then seamlessly call downstream APIs—such as Google Calendar, GitHub repositories, Microsoft Word, etc. This feature is currently only available for Public Cloud tenants. To enable the Early Access release for your Auth0 tenant, please connect with your Technical Account Manager. For complete setup instructions and more, refer to the [Token Vault documentation](https://auth0.com/docs/secure/tokens/token-vault). To learn about using Token Vault with Auth for GenAI, visit [Call Other's APIs on User's Behalf | Auth0](https://auth0.com/ai/docs/call-others-apis-on-users-behalf). Let the API access magic unfold!

We're super excited to announce the developer beta of Auth0 MCP Server to make tenant management conversational, intuitive, and incredibly efficient for developers. Recently, Model Context Protocol (MCP) has been growing at a rapid pace and has enabled AI agents to communicate with external tools, resources, or remote services on behalf of users. Auth0 MCP Server lets developers interface with Auth0 using natural language instead of complex APIs or dashboard navigation, dramatically simplifying tenant management workflows. For instance, developers could simply ask Claude to create a new Auth0 app, deploy a new Action, or perform any other supported management operation. __This initial release includes:__ - __Support for 20+ Auth0 Management operations:__ Create and manage applications, APIs, Actions, Logs, and Forms through simple, natural language conversations. - __Secure Authentication:__ Grant tenant access to your MCP clients via a secure auth flow with built-in support for scopes and session management. - __Multi-Step Management Workflows:__ Perform complex operations like "create an application with specific permissions and deploy a security Action" in a single conversation. - __Seamless Integrations:__ Native support for Claude Desktop, Windsurf, Cursor, and many other MCP clients. Get started with a simple command: `npx @auth0/auth0-mcp-server init` Learn more about the Auth0 MCP Server: [https://github.com/auth0/auth0-mcp-server/\](https://git…

We’re excited to announce the __Developer Preview__ of __Auth for GenAI__, a new offering purpose-built for AI-native, agent-based applications. __Auth for GenAI__ helps developers securely integrate authentication, API access, and fine-grained authorization into GenAI-powered apps using industry standards all wrapped in developer-friendly SDKs. This initial release includes: - __User Authentication__ via Universal Login (social, enterprise, passkeys, and more) with account linking - __Token Vault__ enabling AI agents to call APIs (Google, GitHub, Slack, etc.) on user's behalf - __Asynchronous Authorization__ to enable autonomous AI agents to asynchronously ask users for out-of-band authorization on sensitive actions via push notifications - __Authorization for RAG__ with resource-level access control powered by Auth0 FGA - SDK support for Next.js, Node.js, FastAPI, and popular AI frameworks like LangChain, Vercel AI SDK, and LlamaIndex - Sample apps, quickstarts, and ready-to-use templates Explore the Developer Preview at: [https://auth0.com/ai\](https://auth0.com/ai) Join the discussion at our community: [https://community.auth0.com/c/auth-gen-ai\](https://community.auth0.com/c/auth-gen-ai)

We’re excited to introduce __Tenant Access Control List (ACL)__, a powerful new security feature that allows you to control who can access your tenant. With the __Tenant ACL__, you can define custom rules to __allow, block, or redirect requests__ based on predefined signals, helping you secure and optimize your environment with precision. __Benefits__ ✔ __Reduce Attack Surface__ – Block malicious traffic before it reaches your tenant. ✔ __Enhance Security__ – Enforce custom access policies based on IPs, geolocation, user agents, and more. ✔ __Optimize Performance__ – Redirect traffic efficiently to improve user experience. __Early Access Availability:__ __Current Early Access:__ Available to all __Enterprise customers with the__ __Attack Protection add-on__ with the ability to create up to __10 access control list__. __Upcoming Limited Early Access:__ Rolling out to __all Enterprise customers__ in __Q2 2025__ with the ability to create up to one __access control list__. Please view our online documentation [here](https://auth0.com/docs/secure/tenant-access-control-list) for additional details and to learn how to enable **Tenant Access Control Lists**.

We’re excited to announce that the __Mobile Driver’s License Verification Service__ is now in __Limited Early Access__. Auth0’s Mobile Driver’s License (mDL) Verification Service enables customers to enrich user profiles with trusted information during signup and login flows as well as perform ad-hoc verification and validation checks. Additionally, utilizing a digital credential can streamline processes for businesses and financial institutions while allowing end-users more control over their information. With this feature, customers can perform ad-hoc mDL verification requests or integrate them into their existing authorization flows with our Forms widget. This Early Access release only supports the [ISO/IEC TS 18013-7:2024](https://www.iso.org/standard/82772.html) standard and the REST API, also known as Web API, protocol. To enable the Limited Early Access release in your Auth0 tenant, please review the available [documentation](https://auth0.com/docs/secure/mdl-verification) and if interested, please fill out [this](https://docs.google.com/forms/d/e/1FAIpQLScEZSizEo6prfnxg\_8YvU3Pv0s6rwryEpjEZt\_9X3vplQhXVQ/viewform) form to request access. We are limiting the number of customers for whom this will be enabled and will reach out to you with more details. If you have any feedback, give us a shout in our [community channel](https://community.auth0.com/)!

We’ve added Domain Verification to the Self-Service SSO workflow — making it easier and more secure for your customers to manage their SSO setup. __Simpified & Secure__ Your customers can now verify domains directly within the Self-Service SSO wizard, reducing manual steps and ensuring only trusted domains are used for Home Realm Discovery (HRD). This strengthens security and eliminates the need for external verification workflows. __Flexible Configuration Options__ As a tenant admin, you have control over how domain verification is enforced when creating Self-Service SSO tickets: - Off – Domain verification is hidden from the wizard - Optional – Customers can choose to skip verification and still enable connections - Required – A domain must be verified before enabling the connection This gives you the flexibility to balance user experience and security based on your customers' needs.  Learn more about Self-Service SSO in the [product documentation](https://auth0.com/docs/authenticate/enterprise-connections/self-service-SSO). By using Self-Service SSO Domain Verification, you agree to the applicable Free Trial terms in Okta’s Master Subscription Agreement and [Okta’s Privacy Policy](https://www.okta.com/privacy-policy/) during use of the Early Access feature. The Free Trial terms can be found within the Master Subscription Agre…

We are excited to announce that we are expanding our US public cloud offering with a brand new environment! prod-us-5 is a testament to our growth and provides a big capacity boost to onboard new Auth0 Public Cloud customers. This new public cloud environment supports all the standard Auth0 Authentication and Management capabilities in a highly secure, resilient, and scalable deployment infrastructure. All US Public Cloud customers who are using [IP allow list](https://auth0.com/docs/secure/security-guidance/data-security/allowlist "IP Allowlist") to permit outbound traffic from Auth0 are advised to update their firewall rules with the [latest info](https://auth0.com/docs/secure/security-guidance/data-security/allowlist#united-states "Latest US IP Allowlist") at their earliest convenience.

Auth0 is excited to announce new enhancements to the Self-Service SSO experience: __Self-Service SSO Ticket Creation in the Dashboard__ Tenant admins can now generate SSO tickets directly from the Manage Dashboard, removing the need for API access. This update simplifies the process for all teams and makes it easier to experiment, configure, and roll out federated SSO integrations. __Enhanced SAML Configuration Options__ Tenant admins can now configure whether IdP-Initiated SSO is allowed at the time of ticket creation. Additionally, in the wizard, IT admins have the option to choose whether authentication requests should be signed, offering more flexibility and control to meet varying security and compliance needs.  These updates enhance accessibility, security, and ease of use. Learn more about Self-Service SSO in the [product documentation](https://auth0.com/docs/authenticate/enterprise-connections/self-service-SSO).

We are excited to announce the next Early Access release of Advanced Customizations for Universal Login! This release adds support for building custom versions of Universal Login’s Organizations screens, the MFA TOTP screens, and the matching Reset Password Challenge factors all using the new ACUL SDK. Advanced Customizations for Universal Login enables you to build custom, client-rendered interfaces for Universal Login screens, allowing you to control every pixel of your Universal Login experience. This release allows you to building custom versions of the following screens: * Accept Invitation * Organization Selection * Organization Picker * MFA OTP Enrollment QR * MFA OTP Enrollment Code * MFA OTP Challenge * Reset Password MFA OTP Challenge * Reset Password MFA Email Challenge * Reset Password MFA Push Challenge Push * Reset Password MFA SMS Challenge **DX Updates** The latest versions of the ACUL SDK and our CDT tooling all include support for these new screens. * [Typescript SDK](https://github.com/auth0/universal-login/releases/tag/auth0-acul-js%400.1.0-beta.3) (includes a breaking change, see the [changelog](https://github.com/auth0/universal-login/blob/auth0-acul-js%400.1.0-beta.3/packages/auth0-acul-js/CHANGELOG.md#auth0-acul-js010-beta3-2024-03-28) for migration steps) * [Auth0 CLI](https://github.com/auth0/auth0-cli/releases/tag/v1.10.1) * [Deploy CLI](https://github.com/auth0/auth0-deploy-cli/releases/tag/v8.7.1) * [Terraform Provider A…

We’ve updated our bot detection model to improve accuracy and keep up with evolving traffic patterns. - __Improved detection__: The new model is more effective at identifying and stopping bot activity. - __More computationally efficient__: Updated architecture enables more efficient decision-making. - __Trained on fresh data__: Reflects the latest trends in traffic to better spot malicious behavior. This enhanced security capability is now available to all Enterprise customers with the __Attack Protection__ add-on. The rollout is currently underway and will be completed in the coming weeks, aligned with individual customer release schedules. For details on activation or to learn more, please refer to our [documentation](https://auth0.com/docs/secure/attack-protection/bot-detection) or reach out to your account team. We are here to support you in protecting your systems against evolving threats.

Auth0 Customers have historically struggled to easily discover changes to the User Lifecycle (user create, updated or deleted), by relying on suboptimal solutions such as Actions or Logs. Event Streams changes this: customers can now subscribe to [events](https://auth0.com/docs/deploy-monitor/events/event-types#user-event-types) that trigger each time there is a change in the User Lifecycle, regardless of the connection the customer was created, and route those events to either a [Webhook](https://auth0.com/docs/deploy-monitor/events/create-an-event-stream#webhooks) or [AWS EventBridge](https://auth0.com/docs/deploy-monitor/events/create-an-event-stream#aws-eventbridge). Auth0 is now accepting Beta Testers to this new feature. See the [Auth0 Docs](https://auth0.com/docs/deploy-monitor/events) for further instructions.

This feature gives developers better observability regarding Actions execution errors both at the Auth0 Dashboard and external Log Stream Platforms. Here's a summary of the key points: - __Execution Error Handling:__ The feature captures the unhandled Actions execution errors and facilitates them as Tenant logs. - __Event Log Type:__ There is a [new Event Log Type](https://auth0.com/docs/deploy-monitor/logs/log-event-type-codes "actions_execution_failed") regarding Actions execution errors that can be visualized at the Dashboard > Monitoring > Logs. - __Log Streams:__ The new event log type is also sent through Log Streams. - __Log Stream Filter:__ There is a [new Log Stream Filter](https://auth0.com/docs/customize/log-streams/event-filters#actions-event-filters "Action Execution - Failure") focused on Actions execution errors.