Auth0

Recently shipped Actions Modules GA, access token scope customization GA, and self-service member management for B2B org admins.

Refresh tokens are getting longer. Auth0 is raising refresh-token entropy, so newly issued tokens exceed the current ~45-character baseline. Lengths and formats were always non-deterministic, but anything validating by length needs to relax — treat this as a breaking change for clients, APIs, and storage.

The Actions platform grew up.

• Modules reached GA: write reusable code once and import it into any Action, across triggers, with independent secrets, dependencies, and unit-testing helpers.
• Access Token Scope Customization reached GA and now covers Post Login Actions alongside Credentials Exchange. Actions can add, remove, set, or clear target scopes; removals always apply, additions only when the user and application are authorized.

B2B org admins run their own member management. Member Management (EA) covers the My Organization API and Embeddable UI Components. Organization Admins can:

• Invite members by email, pre-assign roles, and route invitees through a specific IdP or user store; bulk invitations cap at 10 per atomic request.
• List members with field projection and checkpoint-based pagination.

Enterprise identity layers onto existing authorization servers. B2B Connect Enterprise (EA) adds Auth0 SSO and SCIM without migrating users, and ends app sessions when the enterprise IdP ends theirs. Connection events (connection.created, connection.updated, connection.deleted) stream to webhooks or EventBridge as CloudEvents JSON, so polling the Management API is optional.

Custom user IDs at signup. A pre-user-registration Action can call api.user.setUserId() to assign UUIDs or legacy-compatible IDs to database-connection users, replacing self-hosted signup pages and bulk import workarounds.