We’re excited to announce that we added Flows Auth0 Send SMS and Auth0 Make Call Actions!
This new feature allows you to send phone messages from Flows using the customized Phone Provider at your Auth0 Tenant.
What's new:
We’re excited to announce that we added Flows Auth0 Send SMS and Auth0 Make Call Actions!
This new feature allows you to send phone messages from Flows using the customized Phone Provider at your Auth0 Tenant.
What's new:
Session Metadata allows you to attach custom key–value data to a user's session using Actions or the Auth0 Management API. This enables you to persist contextual data throughout the session lifecycle, powering richer integrations, stronger audit trails, and personalized session behavior.
api.session.setMetadata(key, value) and event.session.metadataGET and PATCH on /api/v2/sessions/{id}api.session.deleteMetadata(key) or evict all metadata with api.session.evictMetadata()exports.onExecutePostLogin = async (event, api) => {
api.session.setMetadata("deviceName", event.request.user_agent);
api.session.setMetadata("loginRegion", event.request.geoip?.countryCode);
api.session.setMetadata("orgContext", event.organization?.id);
};
Session Metadata is now Generally Available for all Enterprise tenants.
No API or behavior changes from Early Access.
Session Metadata allows you to attach custom key–value data to a user's session using Actions or the Auth0 Management API. This enables you to persist contextual data throughout the session lifecycle, powering richer integrations, stronger audit trails, and personalized session behavior.
api.session.setMetadata(key, value) and event.session.metadataGET and PATCH on /api/v2/sessions/{id}api.session.deleteMetadata(key) or evict all metadata with api.session.evictMetadata()exports.onExecutePostLogin = async (event, api) => {
api.session.setMetadata("deviceName", event.request.user_agent);
api.session.setMetadata("loginRegion", event.request.geoip?.countryCode);
api.session.setMetadata("orgContext", event.organization?.id);
};
Session Metadata is now Generally Available for all Enterprise tenants.
No API or behavior changes from Early Access.
Session Metadata allows you to attach custom key–value data to a user's session using Actions or the Auth0 Management API. This enables you to persist contextual data throughout the session lifecycle, powering richer integrations, stronger audit trails, and personalized session behavior.
api.session.setMetadata(key, value) and event.session.metadataGET and PATCH on /api/v2/sessions/{id}api.session.deleteMetadata(key) or evict all metadata with api.session.evictMetadata()exports.onExecutePostLogin = async (event, api) => {
api.session.setMetadata("deviceName", event.request.user_agent);
api.session.setMetadata("loginRegion", event.request.geoip?.countryCode);
api.session.setMetadata("orgContext", event.organization?.id);
};
Session Metadata is now Generally Available for all Enterprise tenants.
No API or behavior changes from Early Access.
Session Metadata allows you to attach custom key–value data to a user's session using Actions or the Auth0 Management API. This enables you to persist contextual data throughout the session lifecycle, powering richer integrations, stronger audit trails, and personalized session behavior.
api.session.setMetadata(key, value) and event.session.metadataGET and PATCH on /api/v2/sessions/{id}api.session.deleteMetadata(key) or evict all metadata with api.session.evictMetadata()exports.onExecutePostLogin = async (event, api) => {
api.session.setMetadata("deviceName", event.request.user_agent);
api.session.setMetadata("loginRegion", event.request.geoip?.countryCode);
api.session.setMetadata("orgContext", event.organization?.id);
};
Session Metadata is now Generally Available for all Enterprise tenants.
No API or behavior changes from Early Access.
Session Metadata allows you to attach custom key–value data to a user's session using Actions or the Auth0 Management API. This enables you to persist contextual data throughout the session lifecycle, powering richer integrations, stronger audit trails, and personalized session behavior.
api.session.setMetadata(key, value) and event.session.metadataGET and PATCH on /api/v2/sessions/{id}api.session.deleteMetadata(key) or evict all metadata with api.session.evictMetadata()exports.onExecutePostLogin = async (event, api) => {
api.session.setMetadata("deviceName", event.request.user_agent);
api.session.setMetadata("loginRegion", event.request.geoip?.countryCode);
api.session.setMetadata("orgContext", event.organization?.id);
};
Session Metadata is now Generally Available for all Enterprise tenants.
No API or behavior changes from Early Access.
Added Flows Auth0 Send SMS and Auth0 Make Call Actions, allowing you to send phone messages from Flows using customized Phone Providers at your Auth0 Tenant.
What's new:
We're introducing Auth0 Agent Skills Beta- structured guidance that teaches AI coding assistants how to implement Auth0 authentication correctly across any framework.
Agent Skills are AI-native instructions that work with popular coding assistants like Claude Code, Codex, Gemini CLI, etc... They provide production-ready code patterns, security best practices, and step-by-step implementation flows directly within your development workflow.
Key Features
Getting Started
npx skills add auth0/agent-skillsLearn More
We're excited to announce that Refresh Token Metadata is now available in Early Access for Enterprise customers.
Refresh Token Metadata allows you to attach custom key-value pairs to refresh tokens, enabling richer context storage and more personalized authentication experiences.
Store Custom Data on Refresh Tokens
You can now attach up to 25 custom key-value pairs to each refresh token. This metadata persists throughout the token's lifecycle and can be accessed or modified via the Management API.
// In Post-Login Action
exports.onExecutePostLogin = async (event, api) => {
api.refreshToken.setMetadata('deviceName', event.request.user_agent);
api.refreshToken.setMetadata('loginRegion', event.request.geoip?.countryCode);
api.refreshToken.setMetadata('orgContext', event.organization?.id);
};Management API Support
Access and manage refresh token metadata programmatically:
GET /api/v2/refresh-tokens/{id} - Retrieve token with metadataPATCH /api/v2/refresh-tokens/{id} - Update token metadataDELETE /api/v2/refresh-tokens/{id} - Revoke tokenLearn more about Refresh Token Metadata in our documentation
To strengthen defenses across the identity surface, we have added millions of breached phone credentials to our detection capabilities within Credential Guard
This enhancement allows organizations using Phone as an Identifier to proactively identify compromised credentials and trigger automated security responses, such as login blocks or password resets.
This expansion ensures that phone-based authentication is as secure as traditional email-based methods without impacting system performance.
For more information on Credential Guard, check out our online documentation.
We're introducing Auth0 Agent Skills Beta- structured guidance that teaches AI coding assistants how to implement Auth0 authentication correctly across any framework.
Agent Skills are AI-native instructions that work with popular coding assistants like Claude Code, Codex, Gemini CLI, etc... They provide production-ready code patterns, security best practices, and step-by-step implementation flows directly within your development workflow.
Key Features
Getting Started
npx skills add auth0/agent-skillsLearn More
We're excited to announce that Refresh Token Metadata is now available in Early Access for Enterprise customers.
Refresh Token Metadata allows you to attach custom key-value pairs to refresh tokens, enabling richer context storage and more personalized authentication experiences.
Store Custom Data on Refresh Tokens
You can now attach up to 25 custom key-value pairs to each refresh token. This metadata persists throughout the token's lifecycle and can be accessed or modified via the Management API.
// In Post-Login Action
exports.onExecutePostLogin = async (event, api) => {
api.refreshToken.setMetadata('deviceName', event.request.user_agent);
api.refreshToken.setMetadata('loginRegion', event.request.geoip?.countryCode);
api.refreshToken.setMetadata('orgContext', event.organization?.id);
};Management API Support
Access and manage refresh token metadata programmatically:
GET /api/v2/refresh-tokens/{id} - Retrieve token with metadataPATCH /api/v2/refresh-tokens/{id} - Update token metadataDELETE /api/v2/refresh-tokens/{id} - Revoke tokenLearn more about Refresh Token Metadata in our documentation
To strengthen defenses across the identity surface, we have added millions of breached phone credentials to our detection capabilities within Credential Guard
This enhancement allows organizations using Phone as an Identifier to proactively identify compromised credentials and trigger automated security responses, such as login blocks or password resets.
This expansion ensures that phone-based authentication is as secure as traditional email-based methods without impacting system performance.
For more information on Credential Guard, check out our online documentation.
We're introducing Auth0 Agent Skills Beta- structured guidance that teaches AI coding assistants how to implement Auth0 authentication correctly across any framework.
Agent Skills are AI-native instructions that work with popular coding assistants like Claude Code, Codex, Gemini CLI, etc... They provide production-ready code patterns, security best practices, and step-by-step implementation flows directly within your development workflow.
Key Features
Getting Started
npx skills add auth0/agent-skillsLearn More
We're excited to announce that Refresh Token Metadata is now available in Early Access for Enterprise customers.
Refresh Token Metadata allows you to attach custom key-value pairs to refresh tokens, enabling richer context storage and more personalized authentication experiences.
Store Custom Data on Refresh Tokens
You can now attach up to 25 custom key-value pairs to each refresh token. This metadata persists throughout the token's lifecycle and can be accessed or modified via the Management API.
// In Post-Login Action
exports.onExecutePostLogin = async (event, api) => {
api.refreshToken.setMetadata('deviceName', event.request.user_agent);
api.refreshToken.setMetadata('loginRegion', event.request.geoip?.countryCode);
api.refreshToken.setMetadata('orgContext', event.organization?.id);
};Management API Support
Access and manage refresh token metadata programmatically:
GET /api/v2/refresh-tokens/{id} - Retrieve token with metadataPATCH /api/v2/refresh-tokens/{id} - Update token metadataDELETE /api/v2/refresh-tokens/{id} - Revoke tokenLearn more about Refresh Token Metadata in our documentation
To strengthen defenses across the identity surface, we have added millions of breached phone credentials to our detection capabilities within Credential Guard
This enhancement allows organizations using Phone as an Identifier to proactively identify compromised credentials and trigger automated security responses, such as login blocks or password resets.
This expansion ensures that phone-based authentication is as secure as traditional email-based methods without impacting system performance.
For more information on Credential Guard, check out our online documentation.
We're introducing Auth0 Agent Skills Beta- structured guidance that teaches AI coding assistants how to implement Auth0 authentication correctly across any framework.
Agent Skills are AI-native instructions that work with popular coding assistants like Claude Code, Codex, Gemini CLI, etc... They provide production-ready code patterns, security best practices, and step-by-step implementation flows directly within your development workflow.
Key Features
Getting Started
npx skills add auth0/agent-skillsLearn More
We're excited to announce that Refresh Token Metadata is now available in Early Access for Enterprise customers.
Refresh Token Metadata allows you to attach custom key-value pairs to refresh tokens, enabling richer context storage and more personalized authentication experiences.
Store Custom Data on Refresh Tokens
You can now attach up to 25 custom key-value pairs to each refresh token. This metadata persists throughout the token's lifecycle and can be accessed or modified via the Management API.
// In Post-Login Action
exports.onExecutePostLogin = async (event, api) => {
api.refreshToken.setMetadata('deviceName', event.request.user_agent);
api.refreshToken.setMetadata('loginRegion', event.request.geoip?.countryCode);
api.refreshToken.setMetadata('orgContext', event.organization?.id);
};Management API Support
Access and manage refresh token metadata programmatically:
GET /api/v2/refresh-tokens/{id} - Retrieve token with metadataPATCH /api/v2/refresh-tokens/{id} - Update token metadataDELETE /api/v2/refresh-tokens/{id} - Revoke tokenLearn more about Refresh Token Metadata in our documentation
To strengthen defenses across the identity surface, we have added millions of breached phone credentials to our detection capabilities within Credential Guard
This enhancement allows organizations using Phone as an Identifier to proactively identify compromised credentials and trigger automated security responses, such as login blocks or password resets.
This expansion ensures that phone-based authentication is as secure as traditional email-based methods without impacting system performance.
For more information on Credential Guard, check out our online documentation.