canonical: https://jentic.com/apis/auth0.com/auth0

# Auth0 Authentication API

Jentic maintains a curated, agent-optimized OpenAPI specification for the Auth0 Authentication API, kept validated and agent-ready alongside the OpenAPI document Auth0 publishes in its own public documentation repository. Exposes identity functionality across OpenID Connect, OAuth 2.0, and SAML protocols with 21 endpoints covering token retrieval, user signup, passwordless login, and multi-factor authentication challenges. Supports tenant-scoped deployments with JWT-based bearer tokens for secure machine-to-machine and user-facing authentication flows.

## For AI agents

Authenticate users via OAuth 2.0 and OpenID Connect, initiate passwordless login flows, and handle MFA challenges across Auth0 tenants.

## Scope

Does not handle user directory management, role assignments, or application configuration - use for authentication and token issuance only.

## Capabilities

- Issue OAuth 2.0 access tokens and refresh tokens for applications and APIs
- Initiate passwordless login via email or SMS one-time codes
- Challenge and verify multi-factor authentication enrollments
- Sign up new users to database connections with password credentials
- Retrieve user profile information from authenticated sessions via /userinfo
- Revoke issued tokens to terminate active sessions programmatically
- Request device authorization codes for input-constrained devices

## Use cases

### AI Agent Authentication Integration

AI agents authenticate users and obtain scoped access tokens through Auth0's OAuth 2.0 token endpoint. Agents search for the token retrieval operation via Jentic, load the required schema (client_id, client_secret, grant_type, audience), and execute the /oauth/token call to receive a JWT access token. The entire flow completes in under a minute without manual credential configuration.

Example prompt: Request an access token using client_credentials grant type with audience set to the target API identifier and verify the returned JWT contains the expected scopes

### Passwordless Email Login

Implement passwordless authentication by sending users a one-time code or magic link via email. Auth0's /passwordless/start endpoint initiates the flow and /passwordless/verify completes it. Supports customizable email templates and works across web and mobile clients without requiring users to remember passwords.

Example prompt: Call /passwordless/start with connection 'email' and send 'code' to a user's email address, then verify the code via /passwordless/verify

### Multi-Factor Authentication Enrollment

Add a second authentication factor to user accounts by enrolling authenticator apps, SMS, or push notification methods. The /mfa/associate endpoint links a new factor to the user, and /mfa/challenge triggers verification during login. Supports TOTP, SMS, and Auth0 Guardian push notifications.

Example prompt: Associate a TOTP authenticator with a user via /mfa/associate and then issue a challenge via /mfa/challenge to verify the enrollment

### User Signup and Password Management

Register new users to Auth0 database connections via /dbconnections/signup with email, password, and optional metadata. Trigger password reset flows via /dbconnections/change_password that send reset emails to users. Both endpoints work with Auth0's universal login or can be embedded directly in custom applications.

Example prompt: Create a new user via /dbconnections/signup with email, password, and connection name, then trigger a password change email via /dbconnections/change_password

### Token Lifecycle Management

Control active sessions by revoking refresh tokens via /oauth/revoke and retrieving token metadata through the introspection flow. Agents can terminate compromised sessions immediately and verify token validity before granting resource access. Supports both application-level and per-user token revocation.

Example prompt: Revoke a specific refresh token via POST /oauth/revoke with the token value and client credentials, then confirm the token is no longer valid

## Key endpoints

| Method | Path | Description |
| --- | --- | --- |
| POST | /oauth/token | Exchange credentials for access and refresh tokens |
| GET | /authorize | Initiate OAuth 2.0 authorization flow |
| POST | /dbconnections/signup | Register a new user to a database connection |
| POST | /passwordless/start | Start a passwordless login via email or SMS |
| POST | /mfa/challenge | Trigger an MFA challenge for verification |
| POST | /oauth/revoke | Revoke an issued refresh token |
| GET | /userinfo | Retrieve authenticated user profile |
| GET | /.well-known/jwks.json | Fetch public keys for JWT verification |

## Key resources

- **OAuth Tokens** — Issue, refresh, and revoke access tokens using multiple grant types
- **Database Connections** — User signup and password management for username/password authentication
- **Passwordless** — Initiate and verify passwordless login via email or SMS codes
- **MFA** — Challenge, associate, and list multi-factor authentication methods
- **SAML/WS-Federation** — Enterprise SSO metadata and assertion endpoints

## Why Jentic

- **Setup:** Wiring the Auth0 Authentication API by hand means learning its bearer auth, resolving your per-tenant host (https://{tenant}.auth0.com), and coordinating token issuance, revocation, and JWKS verification yourself. Through Jentic you install once, import the Auth0 Authentication API from the API Directory, store the token once, and your agent calls it.
- **Permission scoping:** Auth0 targets travel in the request body and query, not as resource ids in the URL path, so scope your agent to the operations it needs, such as starting passwordless sign-in or fetching userinfo. Because you choose the allowed operations, token issuance at /oauth/token or revocation at /oauth/revoke is not included unless you add it.
- **Credential handling:** Your Auth0 client_id and client_secret are stored once, encrypted, by your own Jentic One instance and injected at execution time. They never enter the agent's prompt, logs, or context.
- **Discovery method:** Agents search Jentic by intent such as 'authenticate a user with passwordless email' or 'fetch user profile info', and Jentic returns the matching Auth0 operation with its input schema so the agent calls the right endpoint without browsing the reference docs.

## Related APIs

- **Okta Admin Management API** — Full identity platform with user lifecycle, directory, and policy management beyond authentication
- **FusionAuth API** — Self-hosted identity platform with similar OAuth/SAML support and no per-user pricing
- **Clerk Backend API** — Developer-first auth with pre-built UI components and session management for modern web apps
- **Stytch API** — API-first authentication with passwordless methods and fraud prevention built in

## FAQ

### Which OpenAPI specification does this Auth0 Authentication API page describe?

A curated, agent-optimized Jentic specification covering 21 Auth0 Authentication API operations. Auth0 also publishes its own OpenAPI document in its public documentation repository, auth0/docs-v2, at https://raw.githubusercontent.com/auth0/docs-v2/main/main/docs/oas/authentication/authentication-api-oas.json, and that document is the canonical source: it is OpenAPI 3.1.0 and broader, at 31 paths and 31 operations. The Jentic variant covers a subset of the same authentication surface, validated and normalized for agent execution. Get started with Jentic One, the self-hosted execution layer.

### What authentication does the Auth0 Authentication API use?

The Auth0 Authentication API uses JWT bearer tokens obtained from the /oauth/token endpoint. You provide client_id and client_secret (for machine-to-machine) or authorization codes (for user flows) to receive a signed JWT. Through Jentic, these credentials are stored in your Jentic One instance and agents receive scoped tokens without handling raw secrets.

### Can I initiate passwordless login with the Auth0 Authentication API?

Yes. POST to /passwordless/start with your client_id, connection set to 'email' or 'sms', and the recipient address. Auth0 sends a one-time code or magic link. Verify completion with /passwordless/verify by submitting the code. Through Jentic, search for 'start passwordless login' to load the operation schema and execute directly.

### What are the rate limits for the Auth0 Authentication API?

Auth0 enforces per-tenant rate limits: the /oauth/token endpoint allows up to 300 requests per minute on free plans and higher on paid tiers. The /passwordless/start endpoint is limited to 50 emails per hour per IP. Exceeding limits returns HTTP 429 with a Retry-After header indicating when to retry.

### How do I enroll MFA authenticators through the Auth0 Authentication API via Jentic?

Search Jentic for 'enroll mfa authenticator' to find the /mfa/associate operation. The schema requires an access token with the enroll scope, an authenticator_types array (e.g. ['otp']), and returns a secret and barcode_uri for TOTP setup. After enrollment, trigger /mfa/challenge during login to prompt the user for their code.

### Does the Auth0 Authentication API support device authorization flow?

Yes. POST to /oauth/device/code with your client_id and scope to receive a device_code and user_code. Display the user_code to the user on the input-constrained device, then poll /oauth/token with grant_type 'urn:ietf:params:oauth:grant-type:device_code' until the user approves and a token is issued.

### Can I retrieve SAML metadata from the Auth0 Authentication API?

Yes. GET /samlp/metadata/{client_id} returns the SAML 2.0 SP metadata XML for a specific application. This includes the entity ID, assertion consumer service URL, and signing certificate. Use this to configure SAML federation with enterprise identity providers without manual XML construction.

### Can I limit what my agent is allowed to do with the Auth0 Authentication API?

Yes. Because Jentic One runs self-hosted, your own rules decide which Auth0 operations and credentials the agent may use, so you allow only the calls it needs, such as starting passwordless sign-in or fetching userinfo. Since Auth0 targets travel in the request body and query rather than as resource ids in the URL path, you scope by operation rather than by path parameter. Sensitive calls like token issuance at /oauth/token or token revocation at /oauth/revoke stay out of reach unless you explicitly add them.