Auth0 Release Notes

Event Streams is now available for all customers in General Availablity. Customer can: - Subscribe to Auth0 User, Organizations, and Groups (Early Access Limited Release) Events - Deliver Events to AWS EventBridge, Auth0 Actions, and Webhooks (including to [Okta Workflows](https://help.okta.com/wf/en-us/content/topics/workflows/execute/flow-api-endpoint.htm "Okta Workflows") via Customer Header Auth) - Consume events via the Events API See the [Auth0 Docs](https://auth0.com/docs/deploy-monitor/events "Event Streams") and [Event Catalog](https://auth0.com/docs/events "Event Catalog") for further instructions.

__What is a Permissions Index?__ In relationship-based access control like FGA, checking for permissions requires traversing a complex graph of relationships to find a valid path between a user and an object. The [FGA Permissions Index](https://docs.fga.dev/permissions-index/fga-permissions-index) anticipates this time-consuming traversal by pre-calculating every possible permission path and storing them as direct, user-to-object relationships. Whenever an indexed relationship is added or revoked in FGA, an incremental compute engine cleverly remembers which parts of the graph are affected, quickly ‘flattens’ those relationships, and enables a simple, efficient lookup at query time, no real-time graph traversal necessary. This makes it easier to power traditionally diffucult authorization use cases such as [enterprise search](https://docs.fga.dev/integration/advanced/search-with-permissions) and AI retrieval (like RAG) over large datasets without repeatedly traversing the authorization graph every time. The Developer Preview of FGA Permissions Index is available to any existing FGA enterprise customer. [Get started](https://docs.fga.dev/permissions-index/getting-started) today! __Learn more__: - [What is a Permissions Index?](https://docs.fga.dev/permissions-index/fga-permissions-index#what-is-a-permissions-index) - [Permissions Index Best Practices](https://docs.fga.dev/permissions-index/best-practices) ![FGA Colocated Permisssions Index](//images.ctfasse…

We're excited to announce that **Enhanced Security Controls for Third-Party Applications** is now Generally Available for all Auth0 customers. As you open your APIs to AI agents, customers, partners, and external developers, you need strong security defaults for third-party applications. Enhanced security controls give third-party applications a secure-by-default posture, so Auth0 does the heavy lifting, and you stay in control of what external applications can access. **What's included:** * **Strict security mode** for third-party applications (`third_party_security_mode: 'strict'`) * **OAuth 2.1 alignment**: mandatory PKCE, restricted grant types * **Explicit API authorization**: third-party applications always require a client grant to access an API * **Default permissions for third-party applications**: configure default API permissions that apply automatically to all third-party applications, including those created via **Dynamic Client Registration** * **Open redirect protection**: configurable `redirection_policy` to prevent redirect-based attacks * **Reduced attack surface**: curated property allowlist and feature restrictions  **For existing customers using third-party applications**: Your existing applications continue to work exactly as they do today — no changes required. A 6-month mi…

We're thrilled to announce that __Organization Discovery by Domain is now in General Availability__! Automatically identify your customers' users and route them to the right identity provider based on their email domain — before they even reach the login screen. Key Advantages at a Glance: - Automatic routing: Direct users to their organization's IdP the moment they enter their email — no manual org selection required. - Multi-org support: When a single domain maps to multiple organizations, an org picker ensures users land in the right place. - Seamless B2B login: Eliminate the friction of Home Realm Discovery by adding full organization context to the pre-login flow. - Flexible configuration: Support email-based, org-name-based, or combined discovery to match your customers' login requirements. To dive deeper, please review our documentation [here](https://auth0.com/docs/manage-users/organizations/login-flows-for-organizations#organization-domain-discovery-optional).

We’re thrilled to announce that the __Self-Service Provisioning experience is now in General Availability__! Empower your customers' IT teams to handle user onboarding and offboarding themselves, which means less manual work and fewer support tickets for your team. __Key Advantages at a Glance__ - Automation: Allow your customer's admins to manage their own SCIM setup. - Interoperability: Ensure seamless integration with a wide variety of customer IdPs. - Consistency: Use a single, unified schema for easier support and debugging. - Flexibility: Retain the ability to override attribute mappings for specific protocols if needed.  To dive deeper, please review our updated documented on [Self-Service Enterprise Configuration](https://auth0.com/docs/authenticate/enterprise-connections/self-service-enterprise-config).

We're excited to announce that __Self-Service Domain Verification is now in General Availability__! Allow your customers' IT admins to verify their own email domains for HRD directly within the SSO setup assistant — no back-and-forth with your team required. Key Advantages at a Glance: - Proven ownership: IT admins verify domains via DNS TXT record. - Flexible requirements: Configure domain verification as off, optional, or required — per customer engagement. - Domain management: IT admins can now add, re-verify, and delete domains entirely through self-service. - Enterprise-ready controls: Pre-configure domains for your customers to verify, or pre-verify domains on their behalf — with verified domains automatically powering Organization Discovery when enabled. To dive deeper, please review our updated documentation on[ Self-Service Enterprise Configuration](https://auth0.com/docs/authenticate/enterprise-connections/self-service-enterprise-config).

We're excited to announce that Dry Run on Auth0 Deploy CLI is now Generally Available — giving developers full visibility into tenant changes before they're applied. __Key Benefits:__ - Preview changes before they hit your tenant. Run a0deploy import --dry-run to see exactly what resources will be created, updated, or deleted — then exit safely. No changes applied, no surprises in production. - CI/CD-native by default. Dry Run is now non-interactive out of the box, so it works in GitHub Actions, Jenkins, and any headless pipeline. Use --dry-run --apply to show the plan and deploy without prompting — full visibility, zero manual intervention. - Flexible review modes. Need manual control? --dry-run --interactive gives you the review menu to apply, export to JSON, or exit. Choose the workflow that fits: automated gates in CI, manual review locally. __What's new in GA (beyond EA):__ - --dry-run is now non-interactive by default (was interactive-only in EA) - --dry-run --apply: preview then deploy without prompting — built for CI pipelines - --dry-run --interactive: opt into the EA interactive menu when you want it - Backward-compatible Node module API (AUTH0_DRY_RUN: true still works) __Getting Started:__ - [Documentation](https://github.com/auth0/auth0-deploy-cli/blob/master/docs/using-dry-run.md) - [Official Repo](https://github.com/auth0/auth0-deploy-cli)

We are excited to announce the Actions TypeScript definitions are now available on GitHub and npm. - GitHub Repository: [https://github.com/auth0/auth0-actions\](https://github.com/auth0/auth0-actions) - NPM Package: [https://www.npmjs.com/package/@auth0/actions\](https://www.npmjs.com/package/@auth0/actions) These resources provide the official Actions TypeScript definitions, helping developers and AI agents write better code when building Actions outside of the Management Dashboard's editor. To learn more, check out the [Actions NPM Docs](https://auth0.com/docs/customize/actions/actions-npm "Actions Types Docs") and the [Actions Unit Test Docs](https://auth0.com/docs/customize/actions/actions-unit-test "Actions Unit Test Docs").

After May 11, 2026, Auth0 is ending the Free Trial for the [Mobile Driver’s License (mDL) Verification Service Early Access](https://auth0.com/docs/secure/mdl-verification) and will remove access to the mDL Verification Service for tenants that enrolled in Early Access. While we are not planning to move forward with mDL Verification Service capabilities as part of the Auth0 product, if you are still interested in capabilities related to verifiable digital credentials (VDCs) and want to learn how Okta is shaping the future with VDCs, visit [oktacredentials.dev](https://oktacredentials.dev) or read about the [Okta Digital ID Verification Beta](https://www.okta.com/blog/product-innovation/okta-digital-id-verification-beta/). To join the Beta and get involved, [fill out this short form](https://surveys.okta.com/jfe/form/SV\_6yDRiNg5bYVcttI) or email the team directly at `oktacredentials@okta.com`.

We are excited to announce the next phase of our __Google Workspace Directory Sync for Groups__ Early Access! Building on our initial Early Access [release](https://auth0.com/changelog#6WhEr0c0yB3K5oh7jiPADP), this update introduces __Partial Group Sync__, giving you exact control over which Enterprise Groups to import from your Google Workspace Directory into Auth0. __What's new:__ - Targeted Group Sync: Instead of syncing your entire directory, you can now choose to synchronize only a specific subset of your Google Workspace groups. Easily manage your selected groups through either the Management Dashboard or Management API. __How to join Early Access:__ To join the EA program, please complete the [EA Terms & Conditions form](https://forms.gle/9MK4hnQUW8AVfREZ9) and contact your Auth0 Account Team to request activation and supporting documentation.

__v4.8.1 — Custom Domain Hook__ Added support for a new [Custom Domain Hook](https://auth0.com/docs/customize/extensions/delegated-administration-extension/delegated-administration-hooks/delegated-administration-custom-domain-hook) in the Delegated Administration Extension. This hook allows you to customize behavior when [Multiple Custom Domains](https://auth0.com/docs/customize/custom-domains/multiple-custom-domains) are in use. __v4.8.3 — Compatibility fix for deprecation of enabled_clients on connections__ The extension has been updated to remove its dependency on the deprecated enabled_clients field on connections. If your tenant uses the Delegated Administration Extension, you may have been seeing deprecation warning errors in your tenant logs. This release resolves that. __Action recommended before July 15:__ Auth0 is deprecating legacy management of a connection's enabled clients. See the [deprecation notice](https://auth0.com/docs/troubleshoot/product-lifecycle/deprecations-and-migrations#legacy-management-of-connection's-enabled-clients) for full details. Updating to v4.8.3 ensures the extension is compatible with this change. __Upgrading__ Not on v4.8.x: Manually update the extension in your Auth0 tenant by navigating to Extensions → Installed Extensions, locating the Delegated Administration Extension, and clicking Update. Already on v4.8.x: No action required — the patch has been automatically applied.

Following the successful Early Access period that began on August 11, 2025, we are excited to announce that MRRT is now available to all customers with full production support. This is a powerful enhancement that simplifies token management and modernizes app architecture across both native and web platforms --- ### What's New in GA #### ✨ Auth0 Dashboard Support - **Configure MRRT policies directly in the Dashboard** — No more Management API-only configuration - **Visual refresh token policy editor** — Easily add, remove, and modify audience/scope policies for your applications - **Application settings integration** — MRRT configuration is now available under the Application > Settings page #### 🔒 Enhanced Security with Client Grants Integration - **Client Grants enforcement** — MRRT now respects Client Grants restrictions, ensuring applications can only request access tokens for APIs they are authorized to access - **Improved validation** — Better error messages when attempting to configure unauthorized audience/scope combinations #### 🐛 Bug Fixes and Improvements (based on EA feedback) - Fixed: Token exchange now properly validates scopes against both MRRT policy and Resource Server definitions - Fixed: Improved error handling when requesting access tokens for deleted or modified Resource Servers - Fixed: `org_id` claim is now correctly preserved in access tokens when using MRRT with Organizations - Fixed: Refresh token rotation works correctly whe…

Demonstrating Proof of Possession (DPoP) sender constraining for Enterprise Connections is now available in Early Access. Customers can now establish Okta and OIDC Enterprise Connections with DPoP enabled on those connections. This is available on all plans with Enterprise Connections. DPoP for Enterprise Connections enables Auth0 to generate DPoP proofs when performing token exchange and calling userinfo endpoints on upstream OIDC and/or Okta connections. DPoP is a core building block of FAPI2 and IPSIE (Identity Proofing and Secure Identity Exchange) ecosystems. It provides a lightweight, standards-based way to enforce proof-of-possession (of a private key) without the operational overhead of mTLS token binding. Please see [product documentation](https://auth0.com/docs/authenticate/enterprise-connections/enable-dpop-enterprise-connections) for details.

We are excited to announce the __Early Access (EA)__ release of the __My Organization API__ and a library of __Embeddable UI Components for Organization Detail and Identity Provider Management__. Every B2B product needs an admin console for customers to manage their own members and security. This new feature set empowers B2B SaaS developers to deliver robust self-service experience for admins in a matter of days, not months. The __My Organization API__ removes the need to build complex interfaces from scratch. With a secure governance layer that integrates seamlessly with your application, developers can easily deliver sophisticated, branded admin portals that meet the needs of even the largest customers without extra operational overhead. __Key Highlights:__ __My Organization System API__: A purpose-built API designed for secure, scalable delegated administration, allowing customers to manage organization details and identity providers directly. __Embeddable UI Components__: A library of white-label building blocks that can be dropped into any application to provide instant self-service management for SSO, domains, and members. __Security-First Primitives__: Built-in support for cryptographically bound tokens via DPoP and automatic step-up authentication that triggers inline MFA for privileged actions. __Intelligent Onboarding__: A new Dashboard-based onboarding wizard that simplifies configuration with safe defaults, automated entity setu…

__Auth0 Akamai Supplemental Signals is now GA__ and available across the full authentication lifecycle. This update allows developers to ingest risk scores and edge intelligence from Akamai Bot Manager and Account Protector into several new Action triggers: __Pre-User Registration__, __Post-User Registration__, __Post-Challenge__, and __Post-Change Password__. By integrating these signals directly into the Auth0 pipeline, organizations can stop automated bot signups before an account is created and enforce real-time security logic during critical events like password resets or MFA challenges. To learn more about __Akamai Supplemental Signals__ and how to set it up review our online documentation [here](https://auth0.com/docs/secure/attack-protection/configure-akamai-supplemental-signals)

Auth0 developers leveraging [Express Configuration with Okta](https://auth0.com/docs/authenticate/identity-providers/enterprise-identity-providers/okta/express-configuration) now have a more streamlined process for submitting their application to the Okta Integration Network. The Okta Integration Network (OIN) Wizard has been updated with a new section for Auth0 developers that automatically populates the required configuration fields for OpenID Connect (OIDC), System for Cross-domain Identity Management (SCIM), and Global Token Revocation (GTR) integrations, based on information sourced from the Auth0 Dashboard. To learn more about Express Configuration with Okta and the Okta Integration Network (OIN), [click here](https://auth0.com/docs/authenticate/identity-providers/enterprise-identity-providers/okta/express-configuration).

We’re excited to announce that __Multiple Custom Domains (MCD)__ is now __Generally Available__. With Multiple Custom Domains, Enterprise customers can support __multiple branded login experiences from a single Auth0 tenant__. This helps you deliver more tailored authentication experiences across __consumer applications__, __multi-brand businesses__, and __B2B SaaS use cases__. MCD GA includes support for: - Configuring __custom domains at scale__ within a single tenant - A __default domain__ for streamlined development and testing - __Passkey enrollment__ on custom domains - __B2B SaaS Self-Service SSO__ customizations - __Custom domain metadata__ in __Advanced Customizations for Universal Login (ACUL)__ - Support across __Management SDKs__, __Authentication SDKs__, and __Forms__ Visit [Auth0 docs](https://auth0.com/docs/customize/custom-domains/multiple-custom-domains) to get started.

We are excited to introduce __Developer Preview__, a new product release stage designed to get upcoming capabilities into your hands faster! Developer Preview serves as a new release phase for new Auth0 product introductions. We utilize this stage when a new product capability will eventually be a paid feature, but we want to grant you access before the official pricing is applied. Key Highlights: - __Free Production Access__: You can use Developer Preview features in your production environments for free during the preview period. - __Clear Expectations__: Participating in a Developer Preview provides a clear signal that the feature will include a paid component once it reaches General Availability (GA). - __Help Shape the Product__: Getting these features to you early allows us to collect valuable feedback to iterate on prior to the GA launch. To participate in an active Developer Preview, you will simply need to sign up and accept the specific opt-in requirements for that feature. To learn more about how Developer Preview fits into our overall release process, visit our updated [Product Release Stages documentation](https://auth0.com/docs/troubleshoot/product-lifecycle/product-release-stages).