Auth0 Release Notes

We’re pleased to announce that Express Configuration with Okta is now generally available for Auth0 applications in the [Okta Integration Network](https://www.okta.com/integrations/)! Express Configuration automates how your enterprise customers using Okta set up identity integrations with your Auth0 application. This includes configuring OpenID Connect (OIDC) for single sign-on, System for Cross-domain Identity Management (SCIM) for automated user onboarding and offboarding, and Global Token Revocation (GTR) for centralized session management with Universal Logout. To learn more about Express Configuration with Okta, click [here](https://auth0.com/docs/authenticate/identity-providers/enterprise-identity-providers/okta/express-configuration). This feature is available immediately in all public cloud environments, and will be rolled out to private cloud environments as per their release pipeline.

We are thrilled to announce a major milestone: the General Availability (GA) of **Auth0 for AI Agents!** [Auth0 for AI Agents](https://auth0.com/ai) is a suite of features to empower developers to build secure agentic applications and experiences. The solution suite includes updates to: **Token Vault** for secure token based access to third-party APIs and applications; and **Asynchronous Authorization** for user approvals to keep the human in the loop for sensitive agent actions. Here are some highlights of the latest updates to the solution suite: - A new connected accounts flow (with connection purpose) to easily establish federated connections, initiated by client applications. - Support for Microsoft Entra (Azure AD) and Google Workspace as enterprise connected accounts. - Support exchanging a first-party access token for a third-party access token at the Token Vault. - Send notifications for asynchronous authorization flows using email or the Guardian App, with client initiated backchannel authentication (CIBA). - Revamped Quickstarts and SDKs to delight developers. - Pricing and packaging for Essential, Professional, and Enterprise plans. You can read more about the solution suite and the component features in the [Auth0 for AI documentation](https://auth0.com/ai/docs).

We’ve refined the logic behind how Security Center metrics are calculated to provide more accurate and actionable insights. Metrics now reflect IP activity using the following logic: When an IP address triggers more than 10 relevant events for a given metric within a single hour, it will now be counted toward that metric. This update ensures greater consistency and reliability across event-based metrics within the Security Center. For more details on which metrics are affected and their updated definitions, see the [Security Center Metrics documentation](https://auth0.com/docs/secure/security-center/metrics)

Auth0 is thrilled to announce that __Auth for MCP__ is officially in Early Access! This release extends the power of Auth0’s standards-based authorization platform to the Model Context Protocol (MCP), securing your MCP servers, MCP clients, AI agents and the APIs they interact with. With Auth for MCP, Auth0 integrates OAuth 2.1 and OpenID Connect directly into the MCP ecosystem, ensuring consistent access control and auditability across every agentic interaction. Key capabilities include: - MCP Server Authorization: Protect your MCP Servers by leveraging Auth0’s Universal Login to authorize access. You can leverage social, enterprise, and custom identity providers with full support for MFA and advanced attack protection. - Standards-based discovery and registration: Allow MCP clients and servers to automatically discover authorization endpoints and dynamically register with Auth0. This removes manual setup and ensures consistent configuration across your environment. - Leveraging your Existing APIs: Enable MCP clients to securely call internal APIs on behalf of users using short-lived, purpose-scoped tokens. - Connecting to Third party APIs using Token Vault: Securely store, refresh, and revoke access tokens for third-party APIs. This lets your MCP applications act on behalf of users across external SaaS systems like Google, Microsoft, GitHub, and more. - Developer-ready integration: Explore quickstarts, guides, and sample apps to easily implement Auth for MCP. Auth0 prov…

We are thrilled to announce a significant expansion of capabilities within the Multiple Custom Domains (MCD) Early Access program for Enterprise customers. This update delivers powerful branding and white-labeling capabilities with improved flexibility to scale your identity solution from a single Auth0 tenant. - Search and filter custom domains via Management APIs and Dashboard to simplify administration. - Pixel-perfect branding using ACUL to associate unique asset bundles directly with individual custom domains. - Ensure brand consistency by customizing Email and Phone Templates based on the custom domain context. - Build tailored, conditional logic using the custom domain name and metadata directly within Actions. Please refer to Auth0 docs for details - [Multiple Custom Domains](https://auth0.com/docs/customize/custom-domains/multiple-custom-domains). These updates are available automatically to the current participants in MCD Early Access program. If you're interested in joining the MCD Early Access program, please send a request through the [Auth0 Support Center](https://support.auth0.com/center/s/) and contact your Technical Account Manager (TAM) or Auth0 Sales Executive.

Auth0 now provides Management API endpoints to manage Bot Detection configuration! __Key Capabilities:__ __Bot Detection Controls:__ Automate adjustments to the Bot Detection Level (low, medium, or high) and manage your trusted IP AllowList via API. __Challenge Policies:__ Programmatically control CAPTCHA enforcement for password, passwordless, and password reset flows (options: always, when risky, or never). __CAPTCHA Management:__ Fully manage your CAPTCHA provider selection and configuration, including Auth0’s native challenge or third-party solutions. To learn more about the new Bot Detection API endpoints check out our online documentation [here](https://auth0.com/docs/api/management/v2/attack-protection/get-bot-detection)

We are excited to announce that __Actions Types__ is now available at [__npmjs @auth0/actions__](https://www.npmjs.com/package/@auth0/actions "Actions NPM package"). This NPM library currently facilitates TypeScript definitions for Auth0 Actions. Developers can use this library for: - __IDE / Code Editor Assistance:__ By referencing this library, IDEs and code editors can help developers coding with autocompletion, object and functions definitions, and error checking. - __TypeScript Development:__ This library enables Actions development using TypeScript which then can be built and deployed to Actions as Common JS. - __Unit Testing Improvements:__ This library allows developers to follow best practices and to improve their Unit Testing based on TypeScript definitions. - __AI Actions Generation:__ Gives AI assisted IDEs the context they need to generate more accurate and secure Actions code. **Docs:** Learn more at [Actions NPM Docs](https://auth0.com/docs/customize/actions/actions-npm "Actions Types Docs") and [Actions Unit Test Docs](https://auth0.com/docs/customize/actions/actions-unit-test "Actions Unit Test Docs").

As part of Continuous Session Protection, you can now attach custom key–value data to a user’s session using Actions or the Auth0 Management API. This allows enterprise customers to persist contextual data (such as device name, organization ID, or custom flags) throughout the session lifecycle. **Session Metadata:** Enables storing and retrieving custom metadata directly within Auth0 sessions Can be set in Post-Login Actions using `api.session.setMetadata(key, value)` and accessed through `event.session.metadata` Is available via the Management API for reading, updating, or evicting metadata during the session’s lifetime Can be automatically included in OIDC Back-Channel Logout tokens, enabling downstream systems to receive the same metadata context This feature expands session extensibility, allowing richer integrations, stronger audit trails, and personalized session behavior across applications. **Availability:** Session Metadata is available to Enterprise tenants in Early Access. To enable this feature, reach out to your Technical Account Manager or open a Support Ticket. Learn more: [Session Metadata Documentation](https://auth0.com/docs/manage-users/sessions/session-metadata)

We’re excited to introduce Google Workspace User Directory Sync, now available as part of our Beta program. This feature allows organizations to automatically synchronize users from their Google Workspace directory into Auth0 - ensuring user data stays accurate and up to date without relying on login events. __What’s New:__ - __Automated user synchronization:__ Automatically sync user profiles from your Google Workspace Enterprise connection into Auth0. - __Flexible sync cadence:__ Choose between manual on-demand syncs or automatic syncs that run every 30 minutes. - __Custom attribute mapping:__ Map Google Workspace user attributes to Auth0 user profile fields for full control over data consistency. - __Management API support:__ Configure, update, retrieve, or delete your Directory Sync settings programmatically - with Postman collection templates included. __Why It Matters:__ This enhancement eliminates the need for users to log in before their profiles are updated in Auth0, reducing data drift and simplifying identity lifecycle management. __How to Get Started:__ To join the Beta program and access Google Workspace User Directory Sync, complete the Beta Terms & Conditions [form](https://forms.gle/aargNxY1cwmsQv4z5) and contact your Auth0 Account Team to request activation and supporting documentation.

Login flows initiated in the context of client applications associated with business users (`organization_usage=require`) and configured to prompt for the organization at the start of the login flow (`organization_require_behavior=pre_login_prompt`) will consider an existing authenticated session and allow single sign-on (SSO). The previous behavior where these flows disregarded SSO is deprecated. We have provided additional information and timelines for enforcing this change across tenants through a dashboard and [support center notification](https://support.auth0.com/notifications/6904f0f1b6ffc7703507bccf).

We've enhanced the [Auth0 FGA Write API](https://docs.fga.dev/api/service#/Relationship%20Tuples/Write) endpoint to help streamline imports and reduce errors. You can now use two new optional parameters: `on_duplicate: "ignore"`: This will gracefully skip any write operations for relationship tuples that already exist. `on_missing: "ignore"`: This will gracefully skip any delete operations for relationship tuples that do not exist. Previously, these common conditions would cause the entire Write request to fail. These new parameters prevent unnecessary failures, eliminating the need for complex client-side retry logic and improving import performance. This feature is available now via the API and our latest SDKs. Learn more about [Writing Tuples in FGA](https://docs.fga.dev/integration/update-tuples#05-ignoring-duplicate-or-missing-tuples) from our product documentation or [API Reference](https://docs.fga.dev/api/service#/Relationship%20Tuples/Write).

We’re excited to announce __Organization Discovery by Domain__, a new capability that makes enterprise login smarter and more seamless. Together with __Prompt for Organizations__, it automatically identifies a user’s Organization before authentication, using either their email or organization name — eliminating the need for guessing, manual routing, or dealing with misspellings. __Smarter Login Experience__: Users can now enter either their organization name or work email on the __Prompt for Organization__ screen. If the Organization has a verified domain, Auth0 detects the Organization instantly, loads the correct branded login, and routes the user to the right IdP. __Verified Domains__: Tenant admins can now associate one or more verified domains with each Organization using the new Domains tab. Verified domains power automatic organization detection and ensure HRD (Home Realm Discovery) runs only against that Organization’s enabled connections. __Unified Enterprise Login Flow__: This update enhances the __Prompt for Organization__ experience for both __Business__ and __Both__ (Business + Individual) *app types*, unifying login flows across personal and enterprise users. __Availability__: Rollout is happening now. No opt-in required, it’s ready as soon as it appears in your tenant. Learn more about [Organization Discovery by Domain](https://auth0.com/docs/manage-users/organizations/create-first-organization#configure-organization-…

Auth0 now supports Sign in with Shop, a new social login integration designed for Shopify merchants. This feature allows merchants to offer customers a familiar authentication option using their existing Shop accounts. This new integration provides: - Streamlined Experience: Customers can sign in using their existing Shop credentials, reducing friction and simplifying account access. - Consistent User Journey: Enables a unified sign-in experience for customers already accustomed to Shopify’s ecosystem. - Expanded Capabilities: Combines the trusted Shopify experience with Auth0’s advanced identity features — including enhanced security, single sign-on (SSO), customizable branding, and extensibility.  Get started today with our [quick start guide to connect your Shopify store](https://auth0.com/blog/how-to-connect-auth0-with-shopify-a-tech-quick-start-guide/) to Auth0 and our built-in [Sign in with Shop social integration](https://marketplace.auth0.com/integrations/shop).

We’ve improved our **machine learning (ML) model for signup** to deliver stronger protection against automated account creation while keeping friction low for legitimate users. > **Note:** This update applies **only to the signup flow**. There are **no changes** to the ML models used for bot detection in login or password reset flows. #### **Highlights of this update include** - **Expanded detection signals:** The model now leverages **user-agent–based signals**, such as operating system and browser version data, to more accurately distinguish between human and automated signup attempts. - **Smarter traffic classification:** An **updated labeling strategy** improves how the model differentiates between malicious and legitimate signup activity, helping it adapt more effectively to evolving attack patterns. - **Optimized sensitivity settings:** Adjusted detection thresholds capture a broader range of bot activity while maintaining a low false positive rate, ensuring a smooth experience for valid users. #### **What this means for you** These enhancements strengthen the signup protection capabilities of **Attack Protection**, enabling more effective detection of automated signup attempts without adding unnecessary friction for real users. The rollout is in progress for all **Enterprise customers with the Attack Protection add-on** and will complete over the coming weeks in line with individual release schedules. For configuratio…

To enhance security and mitigate risks of application impersonation and phishing attacks, we are **recommending the transition to HTTPS-based callbacks using [Android App Links](https://developer.android.com/training/app-links#android-app-links) and [Apple Universal Links](https://developer.apple.com/documentation/xcode/allowing-apps-and-websites-to-link-to-your-content) whenever possible**. In addition, we are introducing a **change in how the service handles custom URI schemes and loopback URI as callbacks**. More specifically, for authentication requests specifying a custom URI scheme or a loopback URI as the callback, we are introducing a **login confirmation prompt** used in scenarios that would previously return a response without requiring user interaction. For example, in a single sign-on (SSO) scenario, if authentication request requirements can be satisfied from an existing authenticated session, the service will display the new login confirmation prompt instead of seamlessly returning a response to the specified custom URI scheme / loopback URI callback. Additionally, authentication requests including `prompt=none` will be rejected when Applications use non-verifiable callback URIs and are configured to use the new login confirmation prompt. **Review the User Confirmation Prompt section of [Measures Against Application Impersonation](https://auth0.com/docs/secure/security-guidance/measures-against-app-impersonation) to learn more about the new…

As part of the [Early Access launch of Event Streams](https://auth0.com/changelog#4SmjmcbmVZgt1Zsn7JYF1V), there is now an Events Catalog explorer available in Auth0 Docs to better guide you on the details of each Event -- including examples. The Event Streams feature allows you to discover completed changes to Auth0 Users and Organizations as they happen. You can do this by: - Creating an Event Stream in the Manage Dashboard or the Management API - Configuring the Event Streams with the desired destination (Webhook or Amazon EventBridge) and selecting the events to receive View the new Event Catalog Explorer here: [https://auth0.com/docs/events/\](https://auth0.com/docs/events/) Learn more about Event Streams here: [https://auth0.com/docs/customize/events\](https://auth0.com/docs/customize/events)

__FGA Logging API Now Generally Available__ The Auth0 FGA Logging API is now Generally Available (GA). This dedicated endpoint provides a comprehensive audit trail for every interaction with the FGA system. You can now programmatically retrieve detailed logs for auditing, debugging, and monitoring. - __Strengthen Audit & Compliance__: Retrieve a complete audit trail for all public FGA APIs, including permission changes, access checks, and model updates, to verify who accessed resources and when. - __Accelerate Troubleshooting & Monitoring__: Gain granular insight into API operations to debug issues faster and proactively monitor for unusual activity. Use powerful Lucene query syntax to filter logs by user, IP address, status code, and more. - __Centralize Your Logs__: Easily export log data to your preferred SIEM, log management, or analytics tools to centralize your security and operational visibility. The FGA Logging API is available for all paid-tier customers. For more information, please read the [Auth0 FGA Logging API documentation](https://docs.fga.dev/fga-logging).

The first public beta of the Auth0 Nuxt SDK is now available for developers building web apps on the __Nuxt__ framework! ### Key Highlights - __Idiomatic Nuxt 3 Experience:__ Simple, composable functions (useAuth0) that feel native to Nuxt developers, dramatically reducing time-to-first-login. - __Advanced Security Out-of-the-Box:__ We've included support for the latest security standards from day one, including PAR, RAR, and Backchannel Logout. - __Powerful API Authentication:__ Seamlessly obtain tokens for backend APIs using the TokenVault integration. ### Resources Here are the helpful resources to explore the new Nuxt SDK and get started: - [Quickstart](https://auth0.mintlify.app/docs/quickstart/webapp/nuxt) - [Examples](https://github.com/auth0/auth0-nuxt/tree/main/examples) This SDK is still in Beta and we need your feedback! Please share any feedback, questions or comments on [GitHub](https://github.com/auth0/auth0-nuxt).