releases.shpreview
Auth0/Auth0 Changelog

Auth0 Changelog

$npx -y @buildinternet/releases show auth0-changelog
Mon
Wed
Fri
AprMayJunJulAugSepOctNovDecJanFebMarApr
Less
More
Releases384Avg118/moVersionsv202547 → v202614
Aug 12, 2025

We are excited to announce that Actions Transaction Metadata is now available in Early Access.

This feature allows you to set, share, and access, custom data between Actions run in the same post-login execution.

Early Access functionality includes:

  • Accessing Transaction Metadata: A new event.transaction.metadata object within post-login Actions that contains the custom key/value pairs, which can be accessed through key.
  • Setting Transaction Metadata: A new api.transaction.setMetadata function within post-login Actions that serves as interface to set the custom key/value pairs.
  • Immediate Access: Values are available immediately after being set in the calling Action and subsequent Actions.
  • Values Types: Values can be boolean, number, string, or string serialization of object and array.
  • Docs:

Starting on September 11, 2025, we will be deprecating and removing the legacy, undocumented Management API Swagger Specification.

What is changing?

On September 11 2025, the endpoint path /api/v2/api-docs/ will be removed. After this date, any requests made to this path will result in a 404 Not Found error.

Why are we making this change?

Please note that this endpoint and the Swagger specification it provides were never officially documented or intended for public use. The current Swagger specification available at this endpoint is unmaintained, undocumented, and does not reflect the full capabilities of our Management API. As part of our commitment to providing robust and reliable tools, we are removing this legacy specification to prevent confusion and potential issues.

We strongly encourage all users to migrate to our officially supported OpenAPI 3.1 Specification for the Management API, which is currently in Beta. This new specification is actively maintained and provides a more accurate and comprehensive development experience.

What do you need to do?

If any of your processes are calling the /api/v2/api-docs/ endpoints, take the following steps before September 11, 2025 to ensure your applications and services continue to function without interruption:

  1. Identify any systems, scripts, or CI/CD processes that access https://[your-tenant.yourdomain.com]/api/v2/api-docs/.
  2. Update these systems to use our new, officially supported OpenAPI 3.1 specification. It can be accessed here:
  3. Ensure your applications are resilient to a 404 Not Found response from the old endpoint path.

If the above does not address your needs or you have additional questions, contact us using the Auth0 by Okta Support Center or Auth0 by Okta Community.

We are excited to announce that Actions Transaction Metadata is now available in Early Access.

This feature allows you to set, share, and access, custom data between Actions run in the same post-login execution.

Early Access functionality includes:

  • Accessing Transaction Metadata: A new event.transaction.metadata object within post-login Actions that contains the custom key/value pairs, which can be accessed through key.
  • Setting Transaction Metadata: A new api.transaction.setMetadata function within post-login Actions that serves as interface to set the custom key/value pairs.
  • Immediate Access: Values are available immediately after being set in the calling Action and subsequent Actions.
  • Values Types: Values can be boolean, number, string, or string serialization of object and array.
  • Docs:

Starting on September 11, 2025, we will be deprecating and removing the legacy, undocumented Management API Swagger Specification.

What is changing?

On September 11 2025, the endpoint path /api/v2/api-docs/ will be removed. After this date, any requests made to this path will result in a 404 Not Found error.

Why are we making this change?

Please note that this endpoint and the Swagger specification it provides were never officially documented or intended for public use. The current Swagger specification available at this endpoint is unmaintained, undocumented, and does not reflect the full capabilities of our Management API. As part of our commitment to providing robust and reliable tools, we are removing this legacy specification to prevent confusion and potential issues.

We strongly encourage all users to migrate to our officially supported OpenAPI 3.1 Specification for the Management API, which is currently in Beta. This new specification is actively maintained and provides a more accurate and comprehensive development experience.

What do you need to do?

If any of your processes are calling the /api/v2/api-docs/ endpoints, take the following steps before September 11, 2025 to ensure your applications and services continue to function without interruption:

  1. Identify any systems, scripts, or CI/CD processes that access https://[your-tenant.yourdomain.com]/api/v2/api-docs/.
  2. Update these systems to use our new, officially supported OpenAPI 3.1 specification. It can be accessed here:
  3. Ensure your applications are resilient to a 404 Not Found response from the old endpoint path.

If the above does not address your needs or you have additional questions, contact us using the Auth0 by Okta Support Center or Auth0 by Okta Community.

We are excited to announce that Actions Transaction Metadata is now available in Early Access.

This feature allows you to set, share, and access, custom data between Actions run in the same post-login execution.

Early Access functionality includes:

  • Accessing Transaction Metadata: A new event.transaction.metadata object within post-login Actions that contains the custom key/value pairs, which can be accessed through key.
  • Setting Transaction Metadata: A new api.transaction.setMetadata function within post-login Actions that serves as interface to set the custom key/value pairs.
  • Immediate Access: Values are available immediately after being set in the calling Action and subsequent Actions.
  • Values Types: Values can be boolean, number, string, or string serialization of object and array.
  • Docs:

Starting on September 11, 2025, we will be deprecating and removing the legacy, undocumented Management API Swagger Specification.

What is changing?

On September 11 2025, the endpoint path /api/v2/api-docs/ will be removed. After this date, any requests made to this path will result in a 404 Not Found error.

Why are we making this change?

Please note that this endpoint and the Swagger specification it provides were never officially documented or intended for public use. The current Swagger specification available at this endpoint is unmaintained, undocumented, and does not reflect the full capabilities of our Management API. As part of our commitment to providing robust and reliable tools, we are removing this legacy specification to prevent confusion and potential issues.

We strongly encourage all users to migrate to our officially supported OpenAPI 3.1 Specification for the Management API, which is currently in Beta. This new specification is actively maintained and provides a more accurate and comprehensive development experience.

What do you need to do?

If any of your processes are calling the /api/v2/api-docs/ endpoints, take the following steps before September 11, 2025 to ensure your applications and services continue to function without interruption:

  1. Identify any systems, scripts, or CI/CD processes that access https://[your-tenant.yourdomain.com]/api/v2/api-docs/.
  2. Update these systems to use our new, officially supported OpenAPI 3.1 specification. It can be accessed here:
  3. Ensure your applications are resilient to a 404 Not Found response from the old endpoint path.

If the above does not address your needs or you have additional questions, contact us using the Auth0 by Okta Support Center or Auth0 by Okta Community.

Aug 11, 2025

We’re excited to announce that Multi-Resource Refresh Tokens (MRRT) is now in Early Access for all customers.

This feature allows applications to use a single refresh token to request access tokens for multiple resource servers (APIs), each with its own audience and scopes. MRRT simplifies token lifecycle management, enhances developer experience, and improves session continuity across distributed API architectures.

What’s New?

  • Support for defining audience-specific refresh token policies per client
  • Use one refresh token to request tokens for multiple APIs — no re-authentication required
  • Compatible with rotating and expiring refresh tokens
  • First-party applications only
  • Management API support available today
  • iOS and Android SDKs support
  • Auth0 Deploy CLI and Terraform Support

Learn more

We're introducing a new feature that gives your end-users the flexibility to choose how they log in. Using Universal Login Custom Prompts, you can now add custom buttons to your login pages. This empowers your users to easily switch between a traditional database (password-based) connection and a passwordless (OTP-based) connection.

This update allows you to create a seamless experience where users can select their preferred authentication method directly from the login challenge screen.

For full details on this new feature, check out our documentation. To learn more about how to use custom prompts, see the custom prompts documentation.

We’re excited to announce the Early Access of Native to Web SSO is now available for all enterprise customers.

With this release, developers can:

  • Implement SSO from native iOS or Android apps to browser-based web apps.
  • Securely issue and consume Session Transfer Tokens.
  • Leverage device binding enforcement (IP or ASN) for additional security.
  • Access Session Transfer Token support in Auth0 Actions.
  • Use the feature across the Auth0 CLI SDK, Terraform Provider, Deploy CLI, and native mobile SDKs (iOS and Android).
  • Integrate with WS-FED and SAML clients, and invoke Post Login Actions during token consumption.

📘 To get started:

Read our documentation Read the Quickstart

We’re excited to announce that Multi-Resource Refresh Tokens (MRRT) is now in Early Access for all customers.

This feature allows applications to use a single refresh token to request access tokens for multiple resource servers (APIs), each with its own audience and scopes. MRRT simplifies token lifecycle management, enhances developer experience, and improves session continuity across distributed API architectures.

What’s New?

  • Support for defining audience-specific refresh token policies per client
  • Use one refresh token to request tokens for multiple APIs — no re-authentication required
  • Compatible with rotating and expiring refresh tokens
  • First-party applications only
  • Management API support available today
  • iOS and Android SDKs support
  • Auth0 Deploy CLI and Terraform Support

Learn more

We’re excited to announce the Early Access of Native to Web SSO is now available for all enterprise customers.

With this release, developers can:

  • Implement SSO from native iOS or Android apps to browser-based web apps.
  • Securely issue and consume Session Transfer Tokens.
  • Leverage device binding enforcement (IP or ASN) for additional security.
  • Access Session Transfer Token support in Auth0 Actions.
  • Use the feature across the Auth0 CLI SDK, Terraform Provider, Deploy CLI, and native mobile SDKs (iOS and Android).
  • Integrate with WS-FED and SAML clients, and invoke Post Login Actions during token consumption.

📘 To get started:

Read our documentation Read the Quickstart

We're introducing a new feature that gives your end-users the flexibility to choose how they log in. Using Universal Login Custom Prompts, you can now add custom buttons to your login pages. This empowers your users to easily switch between a traditional database (password-based) connection and a passwordless (OTP-based) connection.

This update allows you to create a seamless experience where users can select their preferred authentication method directly from the login challenge screen.

For full details on this new feature, check out our documentation. To learn more about how to use custom prompts, see the custom prompts documentation.

We’re excited to announce that Multi-Resource Refresh Tokens (MRRT) is now in Early Access for all customers.

This feature allows applications to use a single refresh token to request access tokens for multiple resource servers (APIs), each with its own audience and scopes. MRRT simplifies token lifecycle management, enhances developer experience, and improves session continuity across distributed API architectures.

What’s New?

  • Support for defining audience-specific refresh token policies per client
  • Use one refresh token to request tokens for multiple APIs — no re-authentication required
  • Compatible with rotating and expiring refresh tokens
  • First-party applications only
  • Management API support available today
  • iOS and Android SDKs support
  • Auth0 Deploy CLI and Terraform Support

Learn more

We’re excited to announce the Early Access of Native to Web SSO is now available for all enterprise customers.

With this release, developers can:

  • Implement SSO from native iOS or Android apps to browser-based web apps.
  • Securely issue and consume Session Transfer Tokens.
  • Leverage device binding enforcement (IP or ASN) for additional security.
  • Access Session Transfer Token support in Auth0 Actions.
  • Use the feature across the Auth0 CLI SDK, Terraform Provider, Deploy CLI, and native mobile SDKs (iOS and Android).
  • Integrate with WS-FED and SAML clients, and invoke Post Login Actions during token consumption.

📘 To get started:

Read our documentation Read the Quickstart

We're introducing a new feature that gives your end-users the flexibility to choose how they log in. Using Universal Login Custom Prompts, you can now add custom buttons to your login pages. This empowers your users to easily switch between a traditional database (password-based) connection and a passwordless (OTP-based) connection.

This update allows you to create a seamless experience where users can select their preferred authentication method directly from the login challenge screen.

For full details on this new feature, check out our documentation. To learn more about how to use custom prompts, see the custom prompts documentation.

We’re excited to announce that Multi-Resource Refresh Tokens (MRRT) is now in Early Access for all customers.

This feature allows applications to use a single refresh token to request access tokens for multiple resource servers (APIs), each with its own audience and scopes. MRRT simplifies token lifecycle management, enhances developer experience, and improves session continuity across distributed API architectures.

What’s New?

  • Support for defining audience-specific refresh token policies per client
  • Use one refresh token to request tokens for multiple APIs — no re-authentication required
  • Compatible with rotating and expiring refresh tokens
  • First-party applications only
  • Management API support available today
  • iOS and Android SDKs support
  • Auth0 Deploy CLI and Terraform Support

Learn more

We're introducing a new feature that gives your end-users the flexibility to choose how they log in. Using Universal Login Custom Prompts, you can now add custom buttons to your login pages. This empowers your users to easily switch between a traditional database (password-based) connection and a passwordless (OTP-based) connection.

This update allows you to create a seamless experience where users can select their preferred authentication method directly from the login challenge screen.

For full details on this new feature, check out our documentation. To learn more about how to use custom prompts, see the custom prompts documentation.

We’re excited to announce the Early Access of Native to Web SSO is now available for all enterprise customers.

With this release, developers can:

  • Implement SSO from native iOS or Android apps to browser-based web apps.
  • Securely issue and consume Session Transfer Tokens.
  • Leverage device binding enforcement (IP or ASN) for additional security.
  • Access Session Transfer Token support in Auth0 Actions.
  • Use the feature across the Auth0 CLI SDK, Terraform Provider, Deploy CLI, and native mobile SDKs (iOS and Android).
  • Integrate with WS-FED and SAML clients, and invoke Post Login Actions during token consumption.

📘 To get started:

Read our documentation Read the Quickstart

We’re excited to announce that Multi-Resource Refresh Tokens (MRRT) is now in Early Access for all customers.

This feature allows applications to use a single refresh token to request access tokens for multiple resource servers (APIs), each with its own audience and scopes. MRRT simplifies token lifecycle management, enhances developer experience, and improves session continuity across distributed API architectures.

What’s New?

  • Support for defining audience-specific refresh token policies per client
  • Use one refresh token to request tokens for multiple APIs — no re-authentication required
  • Compatible with rotating and expiring refresh tokens
  • First-party applications only
  • Management API support available today
  • iOS and Android SDKs support
  • Auth0 Deploy CLI and Terraform Support

Learn more

We're introducing a new feature that gives your end-users the flexibility to choose how they log in. Using Universal Login Custom Prompts, you can now add custom buttons to your login pages. This empowers your users to easily switch between a traditional database (password-based) connection and a passwordless (OTP-based) connection.

This update allows you to create a seamless experience where users can select their preferred authentication method directly from the login challenge screen.

For full details on this new feature, check out our documentation. To learn more about how to use custom prompts, see the custom prompts documentation.

Latest
Apr 21, 2026
Tracking Since
Sep 25, 2024
Last checked Apr 22, 2026