releases.shpreview
Auth0/Auth0 Changelog

Auth0 Changelog

$npx -y @buildinternet/releases show auth0-changelog
Mon
Wed
Fri
AprMayJunJulAugSepOctNovDecJanFebMarApr
Less
More
Releases224Avg69/moVersionsv202547 → v202614
Aug 11, 2025

We’re excited to announce the Early Access of Native to Web SSO is now available for all enterprise customers.

With this release, developers can:

  • Implement SSO from native iOS or Android apps to browser-based web apps.
  • Securely issue and consume Session Transfer Tokens.
  • Leverage device binding enforcement (IP or ASN) for additional security.
  • Access Session Transfer Token support in Auth0 Actions.
  • Use the feature across the Auth0 CLI SDK, Terraform Provider, Deploy CLI, and native mobile SDKs (iOS and Android).
  • Integrate with WS-FED and SAML clients, and invoke Post Login Actions during token consumption.

📘 To get started:

Read our documentation Read the Quickstart

We're introducing a new feature that gives your end-users the flexibility to choose how they log in. Using Universal Login Custom Prompts, you can now add custom buttons to your login pages. This empowers your users to easily switch between a traditional database (password-based) connection and a passwordless (OTP-based) connection.

This update allows you to create a seamless experience where users can select their preferred authentication method directly from the login challenge screen.

For full details on this new feature, check out our documentation. To learn more about how to use custom prompts, see the custom prompts documentation.

We’re excited to announce that Multi-Resource Refresh Tokens (MRRT) is now in Early Access for all customers.

This feature allows applications to use a single refresh token to request access tokens for multiple resource servers (APIs), each with its own audience and scopes. MRRT simplifies token lifecycle management, enhances developer experience, and improves session continuity across distributed API architectures.

What’s New?

  • Support for defining audience-specific refresh token policies per client
  • Use one refresh token to request tokens for multiple APIs — no re-authentication required
  • Compatible with rotating and expiring refresh tokens
  • First-party applications only
  • Management API support available today
  • iOS and Android SDKs support
  • Auth0 Deploy CLI and Terraform Support

Learn more

We’re excited to announce the Early Access of Native to Web SSO is now available for all enterprise customers.

With this release, developers can:

  • Implement SSO from native iOS or Android apps to browser-based web apps.
  • Securely issue and consume Session Transfer Tokens.
  • Leverage device binding enforcement (IP or ASN) for additional security.
  • Access Session Transfer Token support in Auth0 Actions.
  • Use the feature across the Auth0 CLI SDK, Terraform Provider, Deploy CLI, and native mobile SDKs (iOS and Android).
  • Integrate with WS-FED and SAML clients, and invoke Post Login Actions during token consumption.

📘 To get started:

Read our documentation Read the Quickstart

We're introducing a new feature that gives your end-users the flexibility to choose how they log in. Using Universal Login Custom Prompts, you can now add custom buttons to your login pages. This empowers your users to easily switch between a traditional database (password-based) connection and a passwordless (OTP-based) connection.

This update allows you to create a seamless experience where users can select their preferred authentication method directly from the login challenge screen.

For full details on this new feature, check out our documentation. To learn more about how to use custom prompts, see the custom prompts documentation.

We're introducing a new feature that gives your end-users the flexibility to choose how they log in. Using Universal Login Custom Prompts, you can now add custom buttons to your login pages. This empowers your users to easily switch between a traditional database (password-based) connection and a passwordless (OTP-based) connection.

This update allows you to create a seamless experience where users can select their preferred authentication method directly from the login challenge screen.

For full details on this new feature, check out our documentation. To learn more about how to use custom prompts, see the custom prompts documentation.

We’re excited to announce that Multi-Resource Refresh Tokens (MRRT) is now in Early Access for all customers.

This feature allows applications to use a single refresh token to request access tokens for multiple resource servers (APIs), each with its own audience and scopes. MRRT simplifies token lifecycle management, enhances developer experience, and improves session continuity across distributed API architectures.

What’s New?

  • Support for defining audience-specific refresh token policies per client
  • Use one refresh token to request tokens for multiple APIs — no re-authentication required
  • Compatible with rotating and expiring refresh tokens
  • First-party applications only
  • Management API support available today
  • iOS and Android SDKs support
  • Auth0 Deploy CLI and Terraform Support

Learn more

We’re excited to announce the Early Access of Native to Web SSO is now available for all enterprise customers.

With this release, developers can:

  • Implement SSO from native iOS or Android apps to browser-based web apps.
  • Securely issue and consume Session Transfer Tokens.
  • Leverage device binding enforcement (IP or ASN) for additional security.
  • Access Session Transfer Token support in Auth0 Actions.
  • Use the feature across the Auth0 CLI SDK, Terraform Provider, Deploy CLI, and native mobile SDKs (iOS and Android).
  • Integrate with WS-FED and SAML clients, and invoke Post Login Actions during token consumption.

📘 To get started:

Read our documentation Read the Quickstart

Aug 7, 2025

What changed: When the user's email is available, Auth0 will now send an email notification for brute‑force blocks in all identifier scenarios (e.g., phone, username), supplementing existing delivery rules.

Why it matters: Ensures users receive blocking notifications consistently even when logging in via phone or username, improving visibility and response.

To learn more about Brute Force Protection read on online documentation here

We’ve improved our bot detection model to strike a better balance between security and user experience, with specific gains for tenants whose users frequently access resources via VPN.

Highlights of this update include:

  • Reduced false positives for VPN users: The model now more effectively distinguishes between legitimate users and bots, even when traffic originates from shared IPs or anonymized networks.

  • Improved user experience without compromising security: These updates are designed to reduce unnecessary friction for valid users while maintaining strong defenses against automated threats.

This enhanced security capability is now available to all Enterprise customers with the Attack Protection add-on. The rollout is currently underway and will be completed over the coming weeks in alignment with individual customer release schedules.

For activation details or to learn more about protecting your applications, please refer to our documentation or contact your account team. We're committed to helping you stay secure in an evolving threat landscape.

We’ve improved our bot detection model to strike a better balance between security and user experience, with specific gains for tenants whose users frequently access resources via VPN.

Highlights of this update include:

  • Reduced false positives for VPN users: The model now more effectively distinguishes between legitimate users and bots, even when traffic originates from shared IPs or anonymized networks.

  • Improved user experience without compromising security: These updates are designed to reduce unnecessary friction for valid users while maintaining strong defenses against automated threats.

This enhanced security capability is now available to all Enterprise customers with the Attack Protection add-on. The rollout is currently underway and will be completed over the coming weeks in alignment with individual customer release schedules.

For activation details or to learn more about protecting your applications, please refer to our documentation or contact your account team. We're committed to helping you stay secure in an evolving threat landscape.

What changed: When the user's email is available, Auth0 will now send an email notification for brute‑force blocks in all identifier scenarios (e.g., phone, username), supplementing existing delivery rules.

Why it matters: Ensures users receive blocking notifications consistently even when logging in via phone or username, improving visibility and response.

To learn more about Brute Force Protection read on online documentation here

We’ve improved our bot detection model to strike a better balance between security and user experience, with specific gains for tenants whose users frequently access resources via VPN.

Highlights of this update include:

  • Reduced false positives for VPN users: The model now more effectively distinguishes between legitimate users and bots, even when traffic originates from shared IPs or anonymized networks.

  • Improved user experience without compromising security: These updates are designed to reduce unnecessary friction for valid users while maintaining strong defenses against automated threats.

This enhanced security capability is now available to all Enterprise customers with the Attack Protection add-on. The rollout is currently underway and will be completed over the coming weeks in alignment with individual customer release schedules.

For activation details or to learn more about protecting your applications, please refer to our documentation or contact your account team. We're committed to helping you stay secure in an evolving threat landscape.

What changed: When the user's email is available, Auth0 will now send an email notification for brute‑force blocks in all identifier scenarios (e.g., phone, username), supplementing existing delivery rules.

Why it matters: Ensures users receive blocking notifications consistently even when logging in via phone or username, improving visibility and response.

To learn more about Brute Force Protection read on online documentation here

We’ve improved our bot detection model to strike a better balance between security and user experience, with specific gains for tenants whose users frequently access resources via VPN.

Highlights of this update include:

  • Reduced false positives for VPN users: The model now more effectively distinguishes between legitimate users and bots, even when traffic originates from shared IPs or anonymized networks.

  • Improved user experience without compromising security: These updates are designed to reduce unnecessary friction for valid users while maintaining strong defenses against automated threats.

This enhanced security capability is now available to all Enterprise customers with the Attack Protection add-on. The rollout is currently underway and will be completed over the coming weeks in alignment with individual customer release schedules.

For activation details or to learn more about protecting your applications, please refer to our documentation or contact your account team. We're committed to helping you stay secure in an evolving threat landscape.

What changed: When the user's email is available, Auth0 will now send an email notification for brute‑force blocks in all identifier scenarios (e.g., phone, username), supplementing existing delivery rules.

Why it matters: Ensures users receive blocking notifications consistently even when logging in via phone or username, improving visibility and response.

To learn more about Brute Force Protection read on online documentation here

We’ve improved our bot detection model to strike a better balance between security and user experience, with specific gains for tenants whose users frequently access resources via VPN.

Highlights of this update include:

  • Reduced false positives for VPN users: The model now more effectively distinguishes between legitimate users and bots, even when traffic originates from shared IPs or anonymized networks.

  • Improved user experience without compromising security: These updates are designed to reduce unnecessary friction for valid users while maintaining strong defenses against automated threats.

This enhanced security capability is now available to all Enterprise customers with the Attack Protection add-on. The rollout is currently underway and will be completed over the coming weeks in alignment with individual customer release schedules.

For activation details or to learn more about protecting your applications, please refer to our documentation or contact your account team. We're committed to helping you stay secure in an evolving threat landscape.

What changed: When the user's email is available, Auth0 will now send an email notification for brute‑force blocks in all identifier scenarios (e.g., phone, username), supplementing existing delivery rules.

Why it matters: Ensures users receive blocking notifications consistently even when logging in via phone or username, improving visibility and response.

To learn more about Brute Force Protection read on online documentation here

Jul 31, 2025

Introducing a new capability for log streaming: PII Masking.

This feature allows customers to obfuscate (hash or mask) sensitive personal identifiable information (e.g., email address, phone number, username, etc.) within their log streams. This enhancement improves security and compliance for customers who stream their logs to data lakes or third-party tools.

Key Features:

  • Customizable PII Masking: Customers can select specific PII data to be masked in their log streams.
  • Enhanced Security and Compliance: This capability helps customers meet stricter compliance requirements by providing greater control over sensitive data in their logs.
  • Broad Applicability: PII masking will be available for both new and existing log streams.

This update aligns with Auth0's commitment to improving customer data security and providing more customization in log stream outputs

For more information - Log Streams

Introducing a new capability for log streaming: PII Masking.

This feature allows customers to obfuscate (hash or mask) sensitive personal identifiable information (e.g., email address, phone number, username, etc.) within their log streams. This enhancement improves security and compliance for customers who stream their logs to data lakes or third-party tools.

Key Features:

  • Customizable PII Masking: Customers can select specific PII data to be masked in their log streams.
  • Enhanced Security and Compliance: This capability helps customers meet stricter compliance requirements by providing greater control over sensitive data in their logs.
  • Broad Applicability: PII masking will be available for both new and existing log streams.

This update aligns with Auth0's commitment to improving customer data security and providing more customization in log stream outputs

For more information - Log Streams

Latest
Apr 17, 2026
Tracking Since
Sep 25, 2024
Last fetched Apr 18, 2026