Auth0 Authentication API
★ Only Publicly Available OpenAPI DocumentIdentity AuthAuthenticationbearer21 EndpointsREST
For Agents
Authenticate users via OAuth 2.0 and OpenID Connect, initiate passwordless login flows, and handle MFA challenges across Auth0 tenants.
Use for: I need to obtain an OAuth 2.0 access token for my application, I want to sign up a new user with email and password, Check whether a user's MFA challenge was successfully verified, Retrieve the authenticated user's profile information
Not supported: Does not handle user directory management, role assignments, or application configuration — use for authentication and token issuance only.
Jentic publishes the only available OpenAPI specification for Auth0 Authentication API, keeping it validated and agent-ready. Exposes identity functionality across OpenID Connect, OAuth 2.0, and SAML protocols with 21 endpoints covering token retrieval, user signup, passwordless login, and multi-factor authentication challenges. Supports tenant-scoped deployments with JWT-based bearer tokens for secure machine-to-machine and user-facing authentication flows.
Install Jentic One Beta
Connect the Auth0 Authentication API to your agent
Jentic One is a self-hosted execution layer for AI agents. It lets your agent call the Auth0 Authentication API, or any other public or private API you need. You set the rules, the agent never sees your credentials, and every call is logged.
Two steps, two machines. Install the instance in a safe environment, then register your agent from wherever it runs.
1
Step 1: Jentic One Host machine
# On the machine that will host your Jentic One instance:
curl -fsSL https://raw.githubusercontent.com/jentic/jentic-one/main/tools/install.sh | sh2
Step 2: Agent machine
# On the machine where your agent runs (keep this separate from the instance):
curl -fsSL https://raw.githubusercontent.com/jentic/jentic-one/main/tools/install.sh | sh
jentic register # connects your agent to your Jentic One instanceJentic One is in public beta. The setup above keeps your agent separate from the instance, which is what you want before using real credentials: an agent running as the same OS user as Jentic One can read its stored keys directly. Just evaluating? A single local install is fine to start. See the secure deployment guide for the tiers.
Capabilities
What an agent can do with Auth0 Authentication API.
Issue OAuth 2.0 access tokens and refresh tokens for applications and APIs
Initiate passwordless login via email or SMS one-time codes
Challenge and verify multi-factor authentication enrollments
Sign up new users to database connections with password credentials
Retrieve user profile information from authenticated sessions via /userinfo
Revoke issued tokens to terminate active sessions programmatically
Request device authorization codes for input-constrained devices
Use Cases
Patterns agents use Auth0 Authentication API for, with concrete tasks.
★ AI Agent Authentication Integration
AI agents authenticate users and obtain scoped access tokens through Auth0's OAuth 2.0 token endpoint. Agents search for the token retrieval operation via Jentic, load the required schema (client_id, client_secret, grant_type, audience), and execute the /oauth/token call to receive a JWT access token. The entire flow completes in under a minute without manual credential configuration.
Request an access token using client_credentials grant type with audience set to the target API identifier and verify the returned JWT contains the expected scopes
Passwordless Email Login
Implement passwordless authentication by sending users a one-time code or magic link via email. Auth0's /passwordless/start endpoint initiates the flow and /passwordless/verify completes it. Supports customizable email templates and works across web and mobile clients without requiring users to remember passwords.
Call /passwordless/start with connection 'email' and send 'code' to a user's email address, then verify the code via /passwordless/verify
Multi-Factor Authentication Enrollment
Add a second authentication factor to user accounts by enrolling authenticator apps, SMS, or push notification methods. The /mfa/associate endpoint links a new factor to the user, and /mfa/challenge triggers verification during login. Supports TOTP, SMS, and Auth0 Guardian push notifications.
Associate a TOTP authenticator with a user via /mfa/associate and then issue a challenge via /mfa/challenge to verify the enrollment
User Signup and Password Management
Register new users to Auth0 database connections via /dbconnections/signup with email, password, and optional metadata. Trigger password reset flows via /dbconnections/change_password that send reset emails to users. Both endpoints work with Auth0's universal login or can be embedded directly in custom applications.
Create a new user via /dbconnections/signup with email, password, and connection name, then trigger a password change email via /dbconnections/change_password
Token Lifecycle Management
Control active sessions by revoking refresh tokens via /oauth/revoke and retrieving token metadata through the introspection flow. Agents can terminate compromised sessions immediately and verify token validity before granting resource access. Supports both application-level and per-user token revocation.
Revoke a specific refresh token via POST /oauth/revoke with the token value and client credentials, then confirm the token is no longer valid
Key Endpoints
21 endpoints — jentic publishes the only available openapi specification for auth0 authentication api, keeping it validated and agent-ready.
METHOD
PATH
DESCRIPTION
POST
/oauth/token
Exchange credentials for access and refresh tokens
GET
/authorize
Initiate OAuth 2.0 authorization flow
POST
/dbconnections/signup
Register a new user to a database connection
POST
/passwordless/start
Start a passwordless login via email or SMS
POST
/mfa/challenge
Trigger an MFA challenge for verification
POST
/oauth/revoke
Revoke an issued refresh token
GET
/userinfo
Retrieve authenticated user profile
GET
/.well-known/jwks.json
Fetch public keys for JWT verification
POST
/oauth/token
Exchange credentials for access and refresh tokens
GET
/authorize
Initiate OAuth 2.0 authorization flow
POST
/dbconnections/signup
Register a new user to a database connection
POST
/passwordless/start
Start a passwordless login via email or SMS
POST
/mfa/challenge
Trigger an MFA challenge for verification
POST
/oauth/revoke
Revoke an issued refresh token
GET
/userinfo
Retrieve authenticated user profile
GET
/.well-known/jwks.json
Fetch public keys for JWT verification
Why Jentic?
Three things that make agents converge on Jentic-routed access.
Credential isolation
Auth0 client credentials (client_id and client_secret) are stored encrypted in the Jentic vault (MAXsystem). Agents receive scoped JWT access tokens — raw secrets never enter the agent's context window.
Intent-based discovery
Agents search by intent (e.g., 'authenticate user with passwordless email') and Jentic returns matching Auth0 operations with their input schemas, so the agent can call /passwordless/start without reading documentation.
Time to first call
Direct Auth0 integration: 1-3 days for OAuth flow setup, error handling, and token refresh logic. Through Jentic: under 1 hour — search, load schema, execute.
Related APIs
Alternatives and complements available in the Jentic catalogue.
FAQs
Specific to using Auth0 Authentication API through Jentic.
Why is there no official OpenAPI spec for Auth0 Authentication API?
Auth0 does not publish an OpenAPI specification. Jentic generates and maintains this spec so that AI agents and developers can call Auth0 Authentication API via structured tooling. It is validated against the live API and kept up to date. Get started at https://app.jentic.com/sign-up.
What authentication does the Auth0 Authentication API use?
The Auth0 Authentication API uses JWT bearer tokens obtained from the /oauth/token endpoint. You provide client_id and client_secret (for machine-to-machine) or authorization codes (for user flows) to receive a signed JWT. Through Jentic, these credentials are stored in the MAXsystem vault and agents receive scoped tokens without handling raw secrets.
Can I initiate passwordless login with the Auth0 Authentication API?
Yes. POST to /passwordless/start with your client_id, connection set to 'email' or 'sms', and the recipient address. Auth0 sends a one-time code or magic link. Verify completion with /passwordless/verify by submitting the code. Through Jentic, search for 'start passwordless login' to load the operation schema and execute directly.
What are the rate limits for the Auth0 Authentication API?
Auth0 enforces per-tenant rate limits: the /oauth/token endpoint allows up to 300 requests per minute on free plans and higher on paid tiers. The /passwordless/start endpoint is limited to 50 emails per hour per IP. Exceeding limits returns HTTP 429 with a Retry-After header indicating when to retry.
How do I enroll MFA authenticators through the Auth0 Authentication API via Jentic?
Search Jentic for 'enroll mfa authenticator' to find the /mfa/associate operation. The schema requires an access token with the enroll scope, an authenticator_types array (e.g. ['otp']), and returns a secret and barcode_uri for TOTP setup. After enrollment, trigger /mfa/challenge during login to prompt the user for their code.
Does the Auth0 Authentication API support device authorization flow?
Yes. POST to /oauth/device/code with your client_id and scope to receive a device_code and user_code. Display the user_code to the user on the input-constrained device, then poll /oauth/token with grant_type 'urn:ietf:params:oauth:grant-type:device_code' until the user approves and a token is issued.
Can I retrieve SAML metadata from the Auth0 Authentication API?
Yes. GET /samlp/metadata/{client_id} returns the SAML 2.0 SP metadata XML for a specific application. This includes the entity ID, assertion consumer service URL, and signing certificate. Use this to configure SAML federation with enterprise identity providers without manual XML construction.
GET STARTED