Auth0

Universal Login now offers Early Access identifier controls on all plans, letting tenants choose type-specific login entry with "Continue with" buttons or keep the default unified field, configured via the theme API. Phone entry for login and signup adds country selection, regional formatting, and numeric keyboard and phone number suggestions on supported devices, with supported countries set through tenant-level include or exclude lists.

Tenant Access Control List rules can now be built through step-by-step prompts under Security > Access Control, reordered on an interactive visual canvas to set execution priority, and enabled or disabled with a single click.

Newly issued refresh tokens will exceed the current ~45-character baseline as Auth0 raises cryptographic entropy, which can break hardcoded length checks, fixed-width database columns such as VARCHAR(45), and regex patterns enforcing a maximum length. Existing sessions and refresh tokens remain valid until expired or revoked.

Actions Modules is now generally available, letting tenants create, manage, and share reusable code across Actions and triggers. Each module defines its own secrets and dependencies, and modules can be unit tested and typed via the @auth0/actions package.

Early access Member Management lets organization administrators invite members by email in bulk up to 10 per atomic request, assign or remove roles with permission guardrails, and list members with field projection and checkpoint pagination. A new none/readonly/limited/full access level model drives permission-aware embeddable UI components, and tenant log events cover all member, invitation, and role operations.

A pre-user-registration Action can now call api.user.setUserId() to assign a custom user_id to new database-connection users at signup, instead of Auth0's generated auth0| format. Supported for database connections, Universal Login sign-up, the Authentication API signup endpoint, and the Management API Create User endpoint, but not passwordless, social, or enterprise connections or bulk import; IDs must be unique within the connection.

Auth0 now streams connection.created, connection.updated, and connection.deleted events for enterprise connections including Azure AD, ADFS, Google Workspace, Active Directory, LDAP, and Ping, delivering CloudEvents-formatted JSON to a webhook or Amazon EventBridge. Connection events are additive, so Dashboard and Management API management of connections is unchanged.

B2B Connect is now in Early Access, adding real-time visibility into enterprise directory changes, automatic session termination when an enterprise IdP ends a session, email-domain-based resolution of an end user's enterprise connection, and support for applications without an external authorization server. Enterprise connection events can be streamed to a webhook, Amazon EventBridge, or a custom event pipeline.

Tenant ACL now supports a Deny All rule using the match_all: true attribute to reject all incoming traffic to the assigned scope, bypassing signal matching like IP or geolocation. With a high priority value, it acts as a fallback to secure the tenant against unauthorized requests.

Organization admins can now self-service configure third-party application access and Cross App Access (XAA) resource application roles for connections via the My Organization API and Embeddable UI Components, in Open Early Access. Each setting is independent, with guardrails you set upfront, and XAA requires the connection's identity provider to use a domain verified for the associated Organization.

Auth0's Dashboard Navigation & IA Refresh is now in Early Access, introducing a redesigned sidebar, improved information architecture, consistent breadcrumbs, and a modernized visual experience. It's an opt-in per-user feature, available to all public cloud customers, with private cloud environments rolling out in the coming months.

Advanced MFA Configurations are now generally available, letting you tailor enrollments to security needs. This expands remember-device lifetimes (1 hour to 90 days absolute vs. fixed 30 days), broadens OTP lengths for SMS and email factors (4 to 10 digits vs. fixed 6), and makes OTP lifetimes configurable.

Auth0 can now act as the requesting application in Cross-App Access flows, letting apps fetch third-party API tokens for enterprise users without requiring manual account connections. Built on Auth0 Token Vault with the ID-JAG protocol, it supports OIDC and Okta Workforce connections with org-aware connection resolution.

Early access: Auth0 customers can now self-configure custom rate limit policies — capping the rate of Authentication API OAuth requests per client or per app group (all third-party or CIMD apps). Enforcement can be set to block requests or to send non-blocking notifications, letting teams roll out limits gradually.

Auth0's Flexible Password Policy is now generally available, replacing legacy password configuration with a single options.password_options object covering composition, history, dictionary, and profile-data rules. As of July 2026, new database connections created without an explicit password configuration use the policy by default; existing connections are unchanged. On update, PATCH /api/v2/connections/{id} returns 400 invalid_body if a request contains both password_options and legacy password fields.

Custom signup and login fields and consent checkboxes in Universal Login now capture data on Social and Enterprise connections, matching database and passwordless behavior. No configuration changes are needed; existing Custom Prompts setups apply across all connection types.

Auth0 now supports session delegation via custom token exchange, letting an authorized actor establish a web session as another user. Both identities are preserved via sub and act claims, with short-lived sessions, no refresh tokens, skipped MFA/consent, and a dedicated audit trail. Available to Enterprise, B2B Professional, and B2C Professional plans.

Group and Group Membership support in Google Workspace Inbound Directory Sync is now generally available for all Auth0 customers, adding a paginated, searchable group browser in the Management Dashboard and self-service selective group sync through the assistant flow.