Agent identities, self-serve SSO, and org-scoped controls

Agent identities and token retrieval

Auth0 kicked off the week with two major early access releases that reshape how AI agents authenticate. Agents as Principal gives every agent its own unique identity, credentials, and audit trail in Auth0, distinct from both human users and shared client IDs. The delegation chain from user to agent to app is now encoded in tokens and fully auditable end-to-end. Complementing that, Privileged Worker lets background agents authenticate with Private Key JWT or mTLS to pull a user's third-party tokens from Token Vault without requiring a signed-in user session — critical for agents running on schedules, in CI, or at 2am with no one logged in.

Self-serve OIDC and organization controls

Clerk made self-serve OIDC SSO configuration generally available for all Organization customers, letting IT admins configure custom OpenID Connect connections from the Security tab in <OrganizationProfile /> alongside existing SAML support. The experimental.oidcSelfServe option is now a no-op and can be removed from ClerkProvider and Clerk.load(). Several SDK packages — including the JavaScript SDK, UI, and shared — shipped the enablement in lockstep. Meanwhile, the @clerk/nuxt v3.0.0 drops support for Nuxt 3 (which reaches end-of-life on July 31) and requires Nuxt 4 with Node.js ^20.19.0 or >=22.12.0.

Auth0 also expanded its organization toolkit with three early access releases: organization-level roles let you create, update, and delete roles scoped to individual organizations without metadata workarounds; Organization-to-Application Entitlement controls which apps org members can access natively, without custom code; and Enterprise Connect lets Auth0 serve as a modular B2B identity layer by federating existing SAML or OIDC authorization servers.

Development tooling and security hardening

WorkOS released @workos/emulate, an open-source local API server for testing WorkOS integrations in CI/CD without hitting a live environment — it supports seeding users, organizations, RBAC, and SSO connections, including end-to-end AuthKit flows. WorkOS also added API key authentication for Pipes providers that don't offer OAuth.

Auth0 shipped Curated Blocklists for Tenant ACLs, integrating threat intelligence feeds that cover low-reputation IPs, TOR exit nodes, proxies, VPNs, and iCloud Private Relay — configured via the auth0_managed array in the Network ACLs Management API. The Global Search Beta brings entity search for Applications, APIs, Organizations, and Users to the Auth0 Dashboard Cmd+K command palette.

Clerk fixed a Safari ITP cookie refresh issue on sign-out that was treating returning users as new devices after 7 days, and the Expo SDK added an experimental useSSO() hook and native navigation support. The iOS SDK added hosted authentication, and the Electron SDK now forwards OAuth deep-link callbacks on Windows and Linux.