Important: This documentation covers Yarn 1 (Classic).
For Yarn 2+ docs and migration guide, see yarnpkg.com.

Package detail

auth0

auth02mMIT4.18.0TypeScript support: included

SDK for Auth0 API v2

auth0, api

readme

Node.js client library for Auth0

Release Codecov Downloads License

📚 Documentation - 🚀 Getting Started - 💻 API Reference - 💬 Feedback

Documentation

  • Docs Site - explore our docs site and learn more about Auth0

Getting Started

Requirements

This library supports the following tooling versions:

  • Node.js: >=18

Installation

Using npm in your project directory run the following command:

npm install auth0

Configure the SDK

Authentication API Client

This client can be used to access Auth0's Authentication API.

import { AuthenticationClient } from 'auth0';

const auth0 = new AuthenticationClient({
  domain: '{YOUR_TENANT_AND REGION}.auth0.com',
  clientId: '{OPTIONAL_CLIENT_ID}',
  clientSecret: '{OPTIONAL_CLIENT_SECRET}',
});

See more examples.

Management API Client

The Auth0 Management API is meant to be used by back-end servers or trusted parties performing administrative tasks. Generally speaking, anything that can be done through the Auth0 dashboard (and more) can also be done through this API.

Initialize your client class with a client ID, client secret and a domain.

import { ManagementClient } from 'auth0';

var management = new ManagementClient({
  domain: '{YOUR_TENANT_AND REGION}.auth0.com',
  clientId: '{YOUR_CLIENT_ID}',
  clientSecret: '{YOUR_CLIENT_SECRET}',
});

Or, initialize your client class with an API v2 token and a domain.

import { ManagementClient } from 'auth0';

var management = new ManagementClient({
  domain: '{YOUR_TENANT_AND REGION}.auth0.com',
  token: '{YOUR_API_V2_TOKEN}',
});

See more examples.

API Reference

Feedback

Contributing

We appreciate feedback and contribution to this repo! Before you get started, please see the following:

Raise an issue

To provide feedback or report a bug, please raise an issue on our issue tracker.

Vulnerability Reporting

Please do not report security vulnerabilities on the public GitHub issue tracker. The Responsible Disclosure Program details the procedure for disclosing security issues.

What is Auth0?

<picture> <source media="(prefers-color-scheme: dark)" srcset="https://cdn.auth0.com/website/sdks/logos/auth0_dark_mode.png" width="150"> <source media="(prefers-color-scheme: light)" srcset="https://cdn.auth0.com/website/sdks/logos/auth0_light_mode.png" width="150"> Auth0 Logo </picture>

Auth0 is an easy to implement, adaptable authentication and authorization platform. To learn more checkout Why Auth0?

This project is licensed under the MIT license. See the LICENSE file for more info.

changelog

Change Log

v4.18.0 (2025-01-28)

Full Changelog

Added

  • add optional organization parameter in ClientCredentialsGrantRequest of clientCredentialsGrant call of oauth of authenticationClient #1075 (tusharpandey13)
  • feature/customTokenExchange #1074 (tusharpandey13)

Removed

  • remove redundant client_ids parameter from getAll() methood of clientsManager #1076 (tusharpandey13)

v4.17.0 (2025-01-21)

Full Changelog

Changed

Fixed

v4.16.0 (2025-01-08)

Full Changelog

Added

Changed

v4.15.0 (2024-12-09)

Full Changelog

Added

v4.14.0 (2024-11-22)

Full Changelog

⚠️ BREAKING CHANGES

  • Self Service SSO GA release changes #1057 (tusharpandey13)
    • Please look at #1057 for detailed changes.
    • Method names for various methods in SelfServiceProfilesManager have been changed. The method names now follow standard REST names like create, get, getAll, update, delete.
    • Pagination has been added to response of getAll method of SelfServiceProfilesManager.

v4.13.0 (2024-11-12)

Full Changelog

Added

v4.12.0 (2024-11-07)

Full Changelog

Fixed

v4.11.0 (2024-11-05)

Full Changelog

Added

  • Fixed missing endpoints for feature Organizations for Client Credentials changes #1046 (tusharpandey13)
  • Creating RL workflow for node-auth0 repo #1044 (arpit-jn)

v4.10.0 (2024-09-10)

Full Changelog

Added

v4.9.0 (2024-08-26)

Full Changelog

Added

Changed

v4.8.0 (2024-08-02)

Full Changelog

Added

v4.7.0 (2024-07-08)

Full Changelog

Added

v4.6.0 (2024-06-20)

Full Changelog

Added

Fixed

  • Fixed bugs in the EXAMPLES.md's code snippets #994 (grjan7)

Security

v4.5.0 (2024-06-14)

Full Changelog

Changed

⚠️ BREAKING CHANGES

  • Changes to ResourceServer interfaces (ResourceServerTokenDialectEnum, ResourceServerCreateTokenDialectEnum and ResourceServerUpdateTokenDialectEnum). #1012 (nandan-bhat)
    • The key token is changed to access_token.
    • The key token_authz is changed to access_token_authz.

v4.4.1 (2024-06-11)

Full Changelog

Fixed

v4.4.0 (2024-05-07)

Full Changelog

Added

v4.3.1 (2024-02-09)

Full Changelog

Changed

v4.3.0 (2024-01-31)

Full Changelog

Added

v4.2.0 (2023-12-07)

Full Changelog

Added

v4.1.0 (2023-10-30)

Full Changelog

Added

v4.0.2 (2023-10-25)

Full Changelog

Changed

v4.0.1 (2023-09-15)

Full Changelog

Fixed

v4.0.0 (2023-09-14)

Full Changelog

This release brings a variety of exciting new features and improvements, including:

  • Rewritten from the ground up in TypeScript
  • Types for methods, request parameters, bodies, errors and responses
  • Customisable modern networking stack

This release also drops support for Node <18. See the Migration Guide for more information.

v4.0.0-beta.10 (2023-09-12)

Full Changelog

Fixed

v3.7.1 (2023-09-11)

Full Changelog

Fixed

  • fix: ManagementTokenProvider should also respect the keepAlive config option #927 (alaczi)

v4.0.0-beta.9 (2023-09-06)

Full Changelog

⚠️ BREAKING CHANGES

Fixed

v3.7.0 (2023-08-29)

Full Changelog

Added

  • feat: add configuration for using persistent connections #919 (alaczi)

v3.6.1 (2023-08-22)

Full Changelog

Changed

v4.0.0-beta.8 (2023-08-22)

Full Changelog

Fixed

v4.0.0-beta.7 (2023-08-16)

Full Changelog

⚠️ BREAKING CHANGES

Added

Fixed

v4.0.0-beta.6 (2023-07-19)

Full Changelog

Changed

Added

v3.6.0 (2023-07-18)

Full Changelog

Added

Changed

v4.0.0-beta.5 (2023-06-28)

Full Changelog

Fixed

v4.0.0-beta.4 (2023-06-28)

Full Changelog

Added

v3.5.0 (2023-06-26)

Full Changelog

Added

  • Add option to pass x-request-language header for passwordless #873 (adamjmcgrath)

v4.0.0-beta.3 (2023-05-19)

Full Changelog

Fixed

v4.0.0-beta.2 (2023-05-18)

Full Changelog

Fixed

v4.0.0-beta.1 (2023-05-15)

Full Changelog

  • Rewritten from the ground up in TypeScript
  • Full TypeScript coverage of methods, request paramters, bodies, errors and responses
  • Customisable modern networking stack

v3.4.0 (2023-05-05)

Full Changelog

Added

Fixed

v3.3.0 (2023-03-14)

Full Changelog

Added

v3.2.0 (2023-02-09)

Full Changelog

Added

v3.1.2 (2023-01-25)

Full Changelog

Fixed

v3.1.1 (2023-01-12)

Full Changelog

Fixed

v3.1.0 (2023-01-12)

Full Changelog

Added

v3.0.1 (2022-12-22)

Full Changelog

Fixed

v3.0.0 (2022-12-22)

Full Changelog

⚠️ BREAKING CHANGES

This release drops support for Node versions <14.

v2.44.1 (2022-12-09)

Full Changelog

Fixed

  • Prevent calling the callback more than once #759 (snocorp)

v2.44.0 (2022-10-11)

Full Changelog

Added

v2.43.0 (2022-10-10)

Full Changelog

Added

v2.42.0 (2022-05-23)

Full Changelog

Added

v2.41.0 (2022-05-20)

Full Changelog

Added

  • Added ClientsManager.rotateClientSecret method #721 (sbmelvin)

v2.40.0 (2022-02-11)

Full Changelog

Added

  • [CAUTH-1270]: feat(attack protection): add three features (bf, sipt, bpd) #705 (sdwvit)

v2.39.0 (2022-01-31)

Full Changelog

Added

v2.38.1 (2022-01-27)

Full Changelog

Fixed

  • Fix wrong property in assignRolestoUser #700 (adamjmcgrath)
  • signIn method should provide using audience prop in userData #699 (maxism)

v2.38.0 (2022-01-26)

Full Changelog

Changed

  • refactor to es6 syntax with classes #665 (hornta)

Fixed

  • [SDK-3030] Wrong url when doing assign users with a callback #686 (adamjmcgrath)

v2.37.0 (2021-10-14)

Full Changelog

Added

Fixed

  • Fix undefined tokenProvider when access token is provided. #642 (Gilighost)

v2.36.2 (2021-09-20)

Full Changelog

Security

  • [Snyk] Security upgrade rest-facade from 1.13.0 to 1.13.1 #653 (snyk-bot)
  • [Snyk] Security upgrade axios from 0.21.1 to 0.21.3 #649 (snyk-bot)

v2.36.1 (2021-07-28)

Fixed

Full Changelog

v2.36.0 (2021-07-23)

Added

  • [SDK-2666] Update endpoint methods to document allowance of 'from' and 'take' checkpoint pagination parameters #634 (evansims)

Full Changelog

v2.35.1 (2021-06-21)

Fixed

  • Update setUniversalLoginTemplate example to correctly reflect documentation #624 (mendhak)
  • Use id instead of action_id as per the mgmt api. #622 (stevezau)

Full Changelog

v2.35.0 (2021-05-17)

Added

  • Add method to verify OTP received via email #620 (alexesprit)
  • [actionsManager] Adding new Actions Managment APIs #570 (shushen)

Full Changelog

v2.34.2 (2021-04-12)

Fixed

Full Changelog

v2.34.1 (2021-04-01)

Fixed

Security

v2.34.0 (2021-03-24)

Added

Changed

Security

Full Changelog

v2.33.0 (2021-02-05)

Added

Full Changelog

v2.32.0 (2021-01-21)

Added

Full Changelog

v2.31.1 (2021-01-05)

Fixed

Security

Full Changelog

v2.31.0 (2020-12-08)

Added

Fixed

Full Changelog

v2.30.0 (2020-10-22)

Added

Changed

  • [SDK-1975] Use exponential backoff rather than rate limit headers #538 (adamjmcgrath)

Fixed

Full Changelog

v2.29.0 (2020-09-23)

Added

  • Adding support for prompts and custom texts #533 (davidpatrick)
  • Adding call to invalidate all remembered browsers. #528 (tandrup)
  • Adding docs for secondary and federated identity email verification #519 (jimmyjames)

Changed

Security

Full Changelog

v2.28.0 (2020-08-27)

Added

Removed

Security

Full Changelog

v2.27.1 (2020-07-23)

Changed

  • Use [REDACTED] instead of [SANITIZED] when cleaning errors #515 (jimmyjames)

Security

Full Changelog

v2.27.0 (2020-06-30)

Added

  • feat(migrations): adds migrations manager #503 (CriGoT)
  • Added deleteUserByEmail to ConnectionsManager #502 (MatthewBacalakis)
  • feat(guardian): support policies, selected-provider, message-types methods [MFA-310]#501 (pmalouin)

Fixed

Full Changelog

v2.26.0 (2020-06-05)

Added

Deprecated

Fixed

Security

Full Changelog

v2.25.1 (2020-05-03)

Fixed

Full Changelog

v2.25.0 (2020-04-29)

Changed

Fixed

Security

Full Changelog

v2.24.0 (2020-03-06)

Fixed

Full Changelog

v2.23.0 (2020-02-21)

Added

  • [DXEX-455] Allow custom headers to be set in Management/Auth Clients. #460 (seejee)

Changed

Fixed

Security

Full Changelog

v2.22.0 (2020-01-24)

Added

Full Changelog

v2.21.0 (2020-01-15)

Added

Changed

  • Add client secret to refreshToken and remove ID token validation #433 (joshcanhelp)

Security

Full Changelog

v2.20.0 (2019-09-17)

Added

Security

Full Changelog

v2.18.1 (2019-08-08)

Added

  • Implement auth0-forwarded-for header passing in Authentication Client #401 (kjarmicki)

Changed

  • Improve JobManager (get errors + parse error message when importing users) #407 (jbauth0)

Full Changelog

v2.18.0 (2019-07-23)

Changed

Full Changelog

v2.18.0 (2019-06-26)

Full Changelog

Added

  • Add Management API support for Branding and Prompts endpoints. #370 (chrisscott)

v2.17.1 (2019-05-22)

Full Changelog

Fixed

v2.17.0 (2019-04-15)

Full Changelog

Added

v2.16.0 (2019-03-18)

Full Changelog

Added

v2.15.0 (2019-03-11)

Full Changelog

Added

Fixed

  • Don't validate id_token when alg is HS256 and there is no clientSecret #330 (luisrudge)

v2.14.0 (2018-11-12)

Full Changelog

Added

Deprecated

  • Deprecate UsersManager.deleteAll and deleteAllUsers wrapper methods #309 (M-Zuber)

v2.13.0 (2018-09-28)

Full Changelog

Added

v2.12.0 (2018-08-09)

Full Changelog

Added

  • Added authorizationCodeGrant method to OAuthAuthenticator #290 (cwurtz)
  • Add Guardian Enrollments endpoints #278 (fmedinac)

v2.11.0 (2018-07-25)

Full Changelog

Added

  • Added Pagination Docs for a Client Grants, Resouce Servers and Rules #282 (cocojoe)
  • Added rules config methods #227 (dctoon)

Fixed

  • Get access token before importing users #267 (Floppy)

v2.10.0 (2018-05-29)

Full Changelog

Added

  • Adding pagination docs for clients/connections #268 (luisrudge)

Fixed

v2.9.3 (2018-03-01)

Full Changelog

Fixed

v2.9.2 (2018-01-16)

Full Changelog

Security

v2.9.1 (2017-12-08)

Full Changelog

Fixed

v2.9.0 (2017-12-07)

Full Changelog

Added

  • Added support for /users-by-email method. #218 (kopertop)
  • Add retry functionality for management api requests #215 (dctoon)

v2.8.0 (2017-09-30)

Full Changelog

Added

Fixed

  • Fix wrapPropertyMethod mistake for updateClientGrant #202 (danedmunds)

v2.7.1 (2017-09-30)

Full Changelog

Fixed

  • Fix auth/users.getInfo to return JSON (fixes #158) #192 (pilwon)

Security

  • Update request to address ReDoS vulnerability #206 (dancrumb)

v2.7.0 (2017-06-28)

Full Changelog

Added

Changed

  • Update packages and utilize error classes from rest-facade correctly (Fixes #154) #183 (charsleysa)

Fixed