--- title: "auth0/agent-skills" description: "Auth0 Agent Skills" source: https://github.com/auth0/agent-skills ref: main license: Apache-2.0 licenseName: "Apache License 2.0" canonical: https://skillsdocs.com/auth0/agent-skills base: https://github.com/auth0/agent-skills/blob/main/ chapters: 2 inlined: 2 withheld: 0 words: 2246 updated: 2026-08-11T09:25:00Z generator: "Skills Docs" --- > **auth0/agent-skills** — every Agent Skill in this repository, inlined verbatim. > > Canonical HTML: https://skillsdocs.com/auth0/agent-skills > Per-chapter Markdown: https://skillsdocs.com/auth0/agent-skills/.md > Machine manifest: https://skillsdocs.com/auth0/agent-skills/.well-known/agent-skills/index.json > JSON: https://skillsdocs.com/api/v1/books/auth0/agent-skills > Install: `npx skills add auth0/agent-skills` > Upstream: https://github.com/auth0/agent-skills @ `main` > Licence: Apache-2.0 > > Content is mirrored from GitHub and © its authors, served unmodified. Takedown: https://github.com/DreambaseAI/skillsdocs/issues/new?labels=takedown&title=Takedown+request # auth0/agent-skills Auth0 Agent Skills - **Chapters:** 2 - **Inlined:** 2 (licence detected) - **Words:** 2,246 - **Reading time:** 10 min - **Stars:** 41 ## Table of contents 1. [author-auth0-skill](https://skillsdocs.com/auth0/agent-skills/author-auth0-skill.md) — Use when adding or editing Auth0 guidance in this repo's single auth0 skill — a new framework, feature, tooling, or pattern reference — to get the file structu… 2. [auth0](https://skillsdocs.com/auth0/agent-skills/auth0.md) — Use when adding, fixing, or improving how an app authenticates users or protects an API, or when using or configuring any Auth0 feature — signing users in and… ## Front matter _The repository README, verbatim except that relative links are resolved against https://github.com/auth0/agent-skills/blob/main/._ ![Auth0 Agent Skills](https://cdn.auth0.com/website/sdks/banners/agent-skills.png) # Auth0 Agent Skills [![License](https://img.shields.io/:license-apache-blue.svg?style=flat)](https://opensource.org/licenses/Apache-2.0) AI agent skills that help coding assistants implement Auth0 authentication correctly. Works with [Claude Code](https://claude.ai/code), [Cursor](https://cursor.com), [Codex](https://openai.com/codex/), [GitHub Copilot](https://github.com/features/copilot), and [40+ other agents](https://agentskills.io/clients) that support the [Agent Skills](https://agentskills.io) format. [Documentation](https://auth0.com/docs/quickstart/agent-skills) · [Getting Started](#prerequisites) · [Feedback](#feedback) ## Prerequisites - An [Auth0 account](https://auth0.com/signup) (free) - An AI coding assistant (Claude Code, Cursor, Codex, GitHub Copilot, or any [Agent Skills-compatible](https://agentskills.io/clients) tool) ## Install ### Claude Code Auth0 is on the official Claude Code plugins marketplace: ``` /plugin install auth0@claude-plugins-official ``` Or type `/plugin` in a session, go to **Discover**, and search "Auth0". From the terminal (no session needed): ```bash claude plugin install auth0@claude-plugins-official ``` ### Cursor Auth0 is on the [Cursor marketplace](https://cursor.com/marketplace/auth0). Open the listing and click **Add** to install. You can also install via `Cursor Settings → Rules → Add Rule → Remote Rule (GitHub)` and enter this repository URL. ```bash npx skills add auth0/agent-skills --agent github-copilot ``` ### Codex / ChatGPT plugins The repository includes an OpenAI-compatible skills-only plugin. Add this repository's marketplace from `.agents/plugins/marketplace.json`, then install **Auth0** from the Plugins UI. It tracks the published `main` snapshot. For public availability, Auth0 must submit the plugin through the [OpenAI plugin submission portal](https://platform.openai.com/plugins). Approval is required before it appears in the universal ChatGPT and Codex directory. ### Any Agent (Skills CLI) The [Skills CLI](https://github.com/vercel-labs/skills) works with Claude Code, Cursor, Copilot, Codex, and [40+ other agents](https://agentskills.io/clients): ```bash npx skills add auth0/agent-skills ``` Target specific agents with `--agent`: ```bash npx skills add auth0/agent-skills --agent claude-code cursor ``` ### ClawHub Marketplace Install the Auth0 skill from [ClawHub.ai](https://clawhub.ai/search?q=auth0): ```bash npx clawhub install auth0 ``` Or browse and install from the [ClawHub web UI](https://clawhub.ai) — search for "auth0". ## What happens after install When you ask your AI assistant something like "add Auth0 login to my app," the assistant: 1. Loads the single `auth0` skill, whose **router** reads your project files (`package.json`, `requirements.txt`, `build.gradle`, etc.) 2. Detects your framework and loads the matching reference files (e.g., the Next.js reference for a Next.js project) 3. Follows the step-by-step instructions to install the right SDK, create auth routes, configure environment variables, and wire up login/logout You don't pick anything manually — framework detection handles it. ### Forcing the skill with `/auth0` Auto-detection is reliable on capable models. If you're on a smaller/faster model in a session with **many** other skills installed, the assistant can occasionally miss the trigger — most often on open-ended *questions* ("how do I…?") rather than direct instructions. When that happens, invoke the skill explicitly: ``` /auth0 how do I configure brand colors in Auth0? ``` Naming the skill removes the selection step entirely, so it always activates. ## Migrating from the individual skills Earlier versions shipped one skill per SDK/framework (`auth0-react`, `auth0-nextjs`, `express-oauth2-jwt-bearer`, …). These are now **consolidated into the single `auth0` skill** above, which routes to the same guidance by detecting your framework. - **Plugin / marketplace installs (Claude Code, Cursor):** nothing to do — your next update swaps in the consolidated skill automatically. - **ClawHub installs:** existing installs keep working; `npx clawhub install auth0` gets you the consolidated skill. - **If you referenced an old skill by name** — in your `CLAUDE.md`, another skill's `requires.skills`, or any instruction file — those names (`auth0-react`, etc.) no longer exist and the reference will dangle. Replace them with `auth0`. ## Coverage A single `auth0` skill covers web, mobile, desktop, and API authentication across all of the frameworks below. You install one skill; its router detects your framework and loads the matching guidance — you don't choose a per-framework skill. | Area | SDK | Frameworks | |-------|-----|------------| | **Quickstart Router** | — | Detects your framework and loads the right reference files | | **Migration** | — | Migrate from Firebase, Cognito, Supabase, Clerk, or custom auth | | **MFA** | — | TOTP, SMS, email, push, WebAuthn | | **ACUL Screen Generation** | [`@auth0/auth0-acul-react`](https://github.com/auth0/universal-login) | Custom Universal Login screens and theming | | **React** | [`@auth0/auth0-react`](https://github.com/auth0/auth0-react) | React SPAs (Vite, CRA) | | **Vue** | [`@auth0/auth0-vue`](https://github.com/auth0/auth0-vue) | Vue 3 | | **Angular** | [`@auth0/auth0-angular`](https://github.com/auth0/auth0-angular) | Angular 13+ | | **Vanilla JS** | [`@auth0/auth0-spa-js`](https://github.com/auth0/auth0-spa-js) | Any SPA (also Svelte, SolidJS) | | **Next.js** | [`@auth0/nextjs-auth0`](https://github.com/auth0/nextjs-auth0) | Next.js 13+ (App Router & Pages Router) | | **Nuxt** | [`@auth0/auth0-nuxt`](https://github.com/auth0/auth0-nuxt) | Nuxt 3/4 | | **Express** | [`express-openid-connect`](https://github.com/auth0/express-openid-connect) | Express.js | | **Flask** | [`auth0-server-python`](https://github.com/auth0/auth0-server-python) | Flask | | **Fastify** | [`@auth0/auth0-fastify`](https://github.com/auth0/auth0-fastify) | Fastify | | **Java Servlet** | [`mvc-auth-commons`](https://github.com/auth0/auth0-java-mvc-common) | Java Servlet | | **Express API** | [`express-oauth2-jwt-bearer`](https://github.com/auth0/node-oauth2-jwt-bearer) | Node.js/Express APIs | | **Fastify API** | [`@auth0/auth0-fastify`](https://github.com/auth0/auth0-fastify) | Fastify APIs | | **FastAPI** | [`auth0-fastapi-api`](https://github.com/auth0/auth0-fastapi-api) | Python FastAPI | | **Spring Boot API** | [`auth0-springboot-api`](https://github.com/auth0/auth0-auth-java) | Spring Boot | | **ASP.NET Core** | [`Auth0.AspNetCore.Authentication`](https://github.com/auth0/auth0-aspnetcore-authentication) | ASP.NET Core MVC, Razor Pages, Blazor Server | | **ASP.NET Core API** | [`Auth0.AspNetCore.Authentication`](https://github.com/auth0/auth0-aspnetcore-authentication) | ASP.NET Core | | **Ionic Angular** | [`@auth0/auth0-angular`](https://github.com/auth0/auth0-angular) + Capacitor | Ionic Angular + Capacitor (iOS/Android) | | **Ionic Vue** | [`@auth0/auth0-vue`](https://github.com/auth0/auth0-vue) | Ionic Vue + Capacitor (iOS/Android) | | **Ionic React** | [`@auth0/auth0-react`](https://github.com/auth0/auth0-react) + Capacitor | Ionic React + Capacitor (iOS/Android) | | **React Native** | [`react-native-auth0`](https://github.com/auth0/react-native-auth0) | React Native CLI (bare workflow) | | **Expo** | [`react-native-auth0`](https://github.com/auth0/react-native-auth0) | Expo (managed workflow) | | **Android** | [`Auth0.Android`](https://github.com/auth0/Auth0.Android) | Android (Kotlin/Java) | | **iOS/macOS** | [`Auth0.swift`](https://github.com/auth0/Auth0.swift) | Swift (iOS, macOS, tvOS, watchOS, visionOS) | | **Flutter** | [`auth0_flutter`](https://github.com/auth0/auth0-flutter) | Flutter mobile (iOS/Android, Dart) | | **Flutter Web** | [`auth0_flutter`](https://github.com/auth0/auth0-flutter) | Flutter Web (Dart) | | **.NET MAUI** | [`Auth0.OidcClient.MAUI`](https://github.com/auth0/auth0-oidc-client-net) | .NET MAUI (iOS, Android, macOS, Windows) | | **.NET Android** | [`Auth0.OidcClient.AndroidX`](https://github.com/auth0/auth0-oidc-client-net) | .NET Android (Xamarin) | | **.NET iOS** | [`Auth0.OidcClient.iOS`](https://github.com/auth0/auth0-oidc-client-net) | .NET iOS (Xamarin) | | **.NET Winforms** | [`Auth0.OidcClient.WinForms`](https://github.com/auth0/auth0-oidc-client-net) | .NET WinForms applications | | **WPF** | [`Auth0.OidcClient.WPF`](https://github.com/auth0/Auth0.OidcClient.WPF) | .NET WPF | | **iOS/macOS Migration** | [`Auth0.swift`](https://github.com/auth0/Auth0.swift) | Upgrade to the latest major version of Auth0.swift | ## Example prompts ``` Add Auth0 authentication to my app ``` ``` Set up Auth0 in my Next.js project with protected routes ``` ``` Add multi-factor authentication with TOTP ``` ``` Migrate from Firebase Auth to Auth0 ``` ``` Secure my Express API with Auth0 JWT validation ``` ## Feedback - [Open an issue](https://github.com/auth0/agent-skills/issues) to report bugs or request new skills - See [contribution guidelines](https://github.com/auth0/open-source-template/blob/master/GENERAL-CONTRIBUTING.md) and [code of conduct](https://github.com/auth0/open-source-template/blob/master/CODE-OF-CONDUCT.md) - Security vulnerabilities: [Responsible Disclosure Program](https://auth0.com/responsible-disclosure-policy) ---

Auth0 Logo

Auth0 is an easy to implement, adaptable authentication and authorization platform.
To learn more checkout Why Auth0?

This project is licensed under the Apache 2.0 license. See the LICENSE file for more info.

--- ## 1. author-auth0-skill - **Source:** https://github.com/auth0/agent-skills/blob/main/.claude/skills/author-auth0-skill/SKILL.md - **Raw:** https://raw.githubusercontent.com/auth0/agent-skills/main/.claude/skills/author-auth0-skill/SKILL.md - **Markdown:** https://skillsdocs.com/auth0/agent-skills/author-auth0-skill.md - **Licence:** Apache-2.0 — https://spdx.org/licenses/Apache-2.0.html --- name: author-auth0-skill description: > Use when adding or editing Auth0 guidance in this repo's single auth0 skill — a new framework, feature, tooling, or pattern reference — to get the file structure, router wiring, and validation right the first time. Use even if the request just says "add a reference" or "document X in the skill" without naming the router. license: Apache-2.0 metadata: author: Auth0 --- # Authoring an Auth0 skill reference Add or edit guidance in the single `auth0` skill (`plugins/auth0/skills/auth0/`). This walks you through structure + router wiring so the change passes CI on the first try. Source of truth (read, don't duplicate): [`CONTRIBUTING.md`](../../../CONTRIBUTING.md) and [`docs/architecture.md`](../../../docs/architecture.md). ## Critical rules (get these wrong and CI fails) - **Depth-3 tree + reachability:** every reference is a directory `/` containing an `index.md`, and that directory name MUST be named in a `SKILL.md` router table. Start **index-only** (the whole reference lives in `index.md`, no leaves — one hop from the router). `index.md` MUST NOT exceed 1000 lines — once it passes ~500 lines, consider splitting it into a **leaf group** (`index.md` becomes a hub — shared prerequisites + an intent→leaf dispatch table — over document-section leaves), but only if the content actually separates into distinct sections; don't split a reference that's long but cohesive. An index-only `index.md`, and any leaf inside a leaf group, MUST NOT link to any other `.md` file — they are sinks. The only second hop allowed is a leaf-group hub dispatching to leaves in its **own** directory; cross-group links are forbidden. Both are stated in full under [`CONTRIBUTING.md` → "Make it routable"](../../../CONTRIBUTING.md#make-it-routable-required--ci-enforces-this) and [`CONTRIBUTING.md` → "Adding a reference"](../../../CONTRIBUTING.md#adding-a-reference); the paths below tell you which table to edit. - **Strict mode:** avoid vague quality adverbs that assert an outcome without showing it — state the concrete behavior instead (what happens, to what, when); give a positive alternative for every prohibition; hoist MUST/NEVER directives near the top of the file. ## Step 0 — Classify the contribution | What you're adding | Prefix | Router edits | |---|---|---| | A single SDK/framework integration | `framework-/` | Step 2 all 3 tiers (+ variant row if web/API split) | | A capability spanning frameworks | `feature-/` | Step 1 intent row + Step 4 load block | | A provisioning tool | `tooling-/` | Step 3 tooling table | | Cross-cutting guidance | `pattern-/` | Step 4 load block(s) referencing it | | Editing an existing reference | (n/a) | Usually none — re-check the depth-3 tree rules | Then follow the matching path below. ## Path A — New framework reference 1. Create `plugins/auth0/skills/auth0/references/framework-/index.md` (kebab-case directory). Start **index-only**: the whole reference lives in `index.md`, following the split used by peers (`## Setup`, `## Integration`, `## API` sections); self-contained (no `.md` links). Only split into a **leaf group** once it's large — see "Splitting into a leaf group" below. 2. Wire detection into **all three tiers** of Step 2 in `plugins/auth0/skills/auth0/SKILL.md`: - Tier 1 — the Auth0 SDK package row (e.g. `@auth0/auth0-remix` → `remix`). Put it above less-specific rows. - Tier 2 — the non-Auth0 workspace dependency row (e.g. `@remix-run/react` in `package.json` → `remix`). - Tier 3 — the prompt-keyword row (e.g. "Remix" → `remix`). 3. If the framework has a web-app vs API split, add a row to **Variant disambiguation**. 4. No separate list to update: the reachability checker derives routable slugs from the backticked value column of these tables, so naming `` in a table makes `framework-/index.md` reachable. 5. The `integrate` load block in Step 4 already reads `references/framework-{framework}/index.md` — no Step 4 edit needed. ## Path B — New feature reference 1. Create `plugins/auth0/skills/auth0/references/feature-/index.md` (index-only, self-contained — see "Splitting into a leaf group" below for when to add leaves). 2. Add an **intent row** to the Step 1 table. The `Intent` value is a lookup key reused verbatim as a Step 4 heading. Describe the goal in plain language, not just the Auth0 term. Example row: `| Let users sign in without a password ... *Auth0: passwordless.* | **feature:passwordless** |` 3. Add a matching **load block** in Step 4 whose heading is that intent. The heading is Markdown (`### feature:passwordless`); the `Read:` lines sit inside a fenced block beneath it, matching the existing Step 4 blocks: ~~~ ### feature:passwordless ``` Read: references/feature-passwordless/index.md Read: references/tooling-{tooling}/index.md If framework detected: Read references/framework-{framework}/index.md ``` ~~~ ## Path C — New tooling or pattern reference - **Tooling:** create `plugins/auth0/skills/auth0/references/tooling-/index.md`, then add a row to the Step 3 table. Backtick the value exactly as the existing rows do (`` | | `tooling-/index.md` | ``) — reachability picks up tooling references only via their backticked group name, so an unbackticked value leaves the reference unreachable. Note `validate-skill.sh` hardcodes `cli mcp terraform` — a genuinely new tooling reference also needs that list extended. - **Pattern:** create `plugins/auth0/skills/auth0/references/pattern-/index.md`, then reference it from the relevant Step 4 load block(s) (patterns are pulled in conditionally, e.g. `pattern-multi-tenant/index.md` under `guidance`). `validate-skill.sh` hardcodes `security token-handling multi-tenant rate-limiting common-errors` — extend that list for a new pattern reference. ## Path D — Editing an existing reference Usually no router edit. Before finishing: confirm you introduced no link to another `.md` file from an index-only `index.md` or a leaf, and that any new prohibition has a positive alternative and any weak language is reworded. If you're editing a leaf group's hub, confirm any new `Read:` dispatch still points only at a leaf in its own directory. ## Step 5 — Splitting into a leaf group (only for large references) Skip this step for an index-only reference. Past ~500 lines (the 1000-line cap is in "Critical rules" above), consider splitting into a leaf group so the router pulls just the slice a task needs — but only if the content actually separates into distinct sections; a long but cohesive reference stays index-only: ``` references/framework-/ ├── index.md # hub: shared prerequisites + intent→leaf dispatch table ├── integrate.md # document-section leaves (one per section, not per intent) ├── api-reference.md ├── patterns.md ├── setup.md └── migration.md # only if the SDK has a major-version migration ``` - **Leaves are document sections**, not intents (`integrate`, `api-reference`, `patterns`, `setup`, `migration`, …). - **`index.md` becomes a lean hub:** shared setup every leaf needs, then a dispatch table with one row per router intent, each an imperative `` `Read: references//.md` `` pointing at that intent's primary leaf. Intent strings must match Step 1 **exactly** (`feature:mfa`, not `mfa`). A "Then, if the task requires it" list of `Read:` bullets makes secondary leaves reachable. Every leaf must appear in at least one `Read:` line or it's an orphan. - **Lossless + self-contained:** every line of the original `index.md` lands in exactly one destination; leaves repeat shared context inline rather than linking to the hub or each other. If two sections cross-reference too heavily to separate, merge them into one leaf instead of adding a link. - You don't edit `SKILL.md`'s routing tables — the router always emits `Read: references/{framework}/index.md` regardless of whether the target is index-only or a leaf group; a global Step 4 note tells the agent to follow the hub's dispatch table to a leaf if it has one. ## Step 6 — Add a routing eval Add a case to `evals/routing-cases.json` (repo root, not inside the skill) so the new intent/framework is asserted. Replace the `remix` placeholder below with your own slug — `expect_refs` must name references that already exist under `references/` (as `/index.md`, or `/.md` for a leaf group), or `check_routing_evals.py` rejects the case: ```json { "id": "integrate-remix", "intent": "integrate", "framework": "remix", "tooling": "cli", "expect_refs": ["framework-remix/index.md", "tooling-cli/index.md"] } ``` ## Step 7 — Validate (the gate) Run all four, in order. The change is not done until every one passes: ```bash bash plugins/auth0/skills/auth0/scripts/validate-skill.sh python3 scripts/check_router_reachability.py plugins/auth0/skills/auth0 python3 scripts/check_routing_evals.py plugins/auth0/skills/auth0 uvx skillsaw --strict ``` What each catches: - unreachable reference, orphaned leaf, or a link that breaks the depth-3 tree (sideways/cross-group/second-hop-from-a-sink) → `check_router_reachability.py` - a routing decision that doesn't match `evals/routing-cases.json` → `check_routing_evals.py` - weak language or missing frontmatter fields (license, author, openclaw) → `skillsaw --strict` - description length, required sections, expected file presence → `validate-skill.sh` Also update `plugins/auth0/README.md` when the change adds visible coverage — the linter enforces README documentation. --- ## 2. auth0 - **Source:** https://github.com/auth0/agent-skills/blob/main/plugins/auth0/skills/auth0/SKILL.md - **Raw:** https://raw.githubusercontent.com/auth0/agent-skills/main/plugins/auth0/skills/auth0/SKILL.md - **Markdown:** https://skillsdocs.com/auth0/agent-skills/auth0.md - **Licence:** Apache-2.0 — https://spdx.org/licenses/Apache-2.0.html Bundled files (70), referenced from this skill's directory: - `assets/acul/js-templates/login-id.js` — https://raw.githubusercontent.com/auth0/agent-skills/main/plugins/auth0/skills/auth0/assets/acul/js-templates/login-id.js - `assets/acul/js-templates/login-password.js` — https://raw.githubusercontent.com/auth0/agent-skills/main/plugins/auth0/skills/auth0/assets/acul/js-templates/login-password.js - `assets/acul/react-templates/login-id.tsx` — https://raw.githubusercontent.com/auth0/agent-skills/main/plugins/auth0/skills/auth0/assets/acul/react-templates/login-id.tsx - `assets/acul/react-templates/login-password.tsx` — https://raw.githubusercontent.com/auth0/agent-skills/main/plugins/auth0/skills/auth0/assets/acul/react-templates/login-password.tsx - `assets/acul/theme-templates/globals.css` — https://raw.githubusercontent.com/auth0/agent-skills/main/plugins/auth0/skills/auth0/assets/acul/theme-templates/globals.css - `assets/acul/theme-templates/tailwind.config.ts` — https://raw.githubusercontent.com/auth0/agent-skills/main/plugins/auth0/skills/auth0/assets/acul/theme-templates/tailwind.config.ts - `assets/acul/theme-templates/theme-provider.ts` — https://raw.githubusercontent.com/auth0/agent-skills/main/plugins/auth0/skills/auth0/assets/acul/theme-templates/theme-provider.ts - `assets/acul/theme-templates/tokens.css` — https://raw.githubusercontent.com/auth0/agent-skills/main/plugins/auth0/skills/auth0/assets/acul/theme-templates/tokens.css - `assets/audit/report-template.html` — https://raw.githubusercontent.com/auth0/agent-skills/main/plugins/auth0/skills/auth0/assets/audit/report-template.html - `assets/audit/report-template.md` — https://raw.githubusercontent.com/auth0/agent-skills/main/plugins/auth0/skills/auth0/assets/audit/report-template.md - `assets/healthcheck/report-template.html` — https://raw.githubusercontent.com/auth0/agent-skills/main/plugins/auth0/skills/auth0/assets/healthcheck/report-template.html - `assets/healthcheck/report-template.md` — https://raw.githubusercontent.com/auth0/agent-skills/main/plugins/auth0/skills/auth0/assets/healthcheck/report-template.md - `references/feature-acul/index.md` — https://raw.githubusercontent.com/auth0/agent-skills/main/plugins/auth0/skills/auth0/references/feature-acul/index.md - `references/feature-audit-pricing/index.md` — https://raw.githubusercontent.com/auth0/agent-skills/main/plugins/auth0/skills/auth0/references/feature-audit-pricing/index.md - `references/feature-audit-remediation/index.md` — https://raw.githubusercontent.com/auth0/agent-skills/main/plugins/auth0/skills/auth0/references/feature-audit-remediation/index.md - `references/feature-audit/index.md` — https://raw.githubusercontent.com/auth0/agent-skills/main/plugins/auth0/skills/auth0/references/feature-audit/index.md - `references/feature-branding/index.md` — https://raw.githubusercontent.com/auth0/agent-skills/main/plugins/auth0/skills/auth0/references/feature-branding/index.md - `references/feature-custom-domains/index.md` — https://raw.githubusercontent.com/auth0/agent-skills/main/plugins/auth0/skills/auth0/references/feature-custom-domains/index.md - `references/feature-dpop/index.md` — https://raw.githubusercontent.com/auth0/agent-skills/main/plugins/auth0/skills/auth0/references/feature-dpop/index.md - `references/feature-healthcheck/index.md` — https://raw.githubusercontent.com/auth0/agent-skills/main/plugins/auth0/skills/auth0/references/feature-healthcheck/index.md - `references/feature-mfa/index.md` — https://raw.githubusercontent.com/auth0/agent-skills/main/plugins/auth0/skills/auth0/references/feature-mfa/index.md - `references/feature-migration/index.md` — https://raw.githubusercontent.com/auth0/agent-skills/main/plugins/auth0/skills/auth0/references/feature-migration/index.md - `references/feature-organizations/index.md` — https://raw.githubusercontent.com/auth0/agent-skills/main/plugins/auth0/skills/auth0/references/feature-organizations/index.md - `references/feature-universal-portals/index.md` — https://raw.githubusercontent.com/auth0/agent-skills/main/plugins/auth0/skills/auth0/references/feature-universal-portals/index.md - …and 46 more, listed in https://skillsdocs.com/api/v1/books/auth0/agent-skills/skills/auth0 --- name: auth0 description: Use when adding, fixing, or improving how an app authenticates users or protects an API, or when using or configuring any Auth0 feature — signing users in and out, sessions and tokens, guarding routes and endpoints, MFA, SSO, Organizations, RBAC, custom domains, Universal Portals for hosted account and organization self-service, or Universal Login branding. Also use to audit a tenant's health, security, and plan fit (CheckMate), to debug why an auth flow fails, to migrate from another auth provider, or to set up the Vercel native integration. Covers any web, mobile, or backend framework and every Auth0 SDK, tool, and API. Use even if the user never mentions Auth0. license: Apache-2.0 metadata: author: Auth0 version: '2.1.0' openclaw: emoji: "\U0001F510" homepage: https://github.com/auth0/agent-skills requires: bins: - auth0 os: - darwin - linux install: - id: brew kind: brew formula: auth0/auth0-cli/auth0 bins: [auth0] label: 'Install Auth0 CLI (brew)' --- # Auth0 Detect intent → detect framework → detect tooling → load 2–3 reference files. --- ## Step 1: Detect intent Match the request against the **What the developer wants** column — it describes the goal in plain language, not just the Auth0 term (someone who says *"make users confirm with a code from their phone"* lands on `feature:mfa`). The **Intent** you pick is a lookup key: in **Step 4** it appears verbatim as a section heading (`### feature:mfa`) listing which reference files to load. | What the developer wants (plain language + Auth0 term) | Intent | |---|---| | Add login, signup, sign-in, or "let users log in / create accounts" to an app | **integrate** | | Require a second step after the password — a one-time code, SMS or email code, authenticator app, passkey, fingerprint/face (biometric), or security key; or re-confirm identity before a sensitive action. *Auth0: multi-factor authentication (MFA), two-factor (2FA), two-step verification, step-up authentication.* | **feature:mfa** | | Let separate companies, teams, workspaces, or tenants each have their own users, members, roles, and login — typically a product sold to businesses. *Auth0: Organizations, multi-org, B2B SaaS.* | **feature:organizations** | | Deploy a hosted self-service portal for profile, passkeys, MFA, or organization details instead of building a “My Account” or “My Organization” UI. *Auth0: Universal Portals, My Account portal, My Organization portal.* | **feature:universal-portals** | | Serve the login page from your own web address (e.g. `login.example.com`, `auth.company.com`) instead of the default Auth0 URL. *Auth0: custom domain.* | **feature:custom-domains** | | Build fully custom login/signup screens with your own code or framework, beyond what theme settings allow. *Auth0: Advanced Customization for Universal Login (ACUL).* | **feature:acul** | | Change how the login page looks — logo, colors, fonts, background, overall theme. *Auth0: branding, Universal Login customization.* | **feature:branding** | | Bind tokens to the client so a stolen or leaked token can't be reused/replayed from another machine. *Auth0: DPoP (Demonstrating Proof-of-Possession), sender-constrained tokens.* | **feature:dpop** | | Audit a tenant for security/config issues, report, then optionally fix findings. *Auth0: tenant audit, CheckMate.* | **audit** | | Check if a tenant is healthy and on the right plan — two scores + a recommendation. *Auth0: health check.* | **healthcheck** | | Ask for best practices, "is this secure?", how to handle tokens safely, "how should I do X". *Auth0: guidance / security.* | **guidance** | | Hit an error: 401 Unauthorized, 403 Forbidden, CORS, callback URL mismatch, redirect loop. *Auth0: debugging.* | **debug** | | Hit rate limiting: 429 Too Many Requests, quota exceeded. *Auth0: rate limits.* | **debug:rate-limit** | | Move an existing app off Clerk, NextAuth.js, Firebase, Cognito, Okta, Supabase, Passport.js, or another auth provider. *Auth0: provider migration.* | **migrate** | | Upgrade the Auth0 SDK itself to a new major version (e.g. Auth0.swift v2→v3, Auth0.Android v3→v4) — breaking changes, deprecated APIs, "update to the latest SDK". *Auth0: SDK major-version upgrade.* | **upgrade-sdk** | | Install Auth0's Vercel Marketplace integration, connect Auth0 to a Vercel project, or sync Auth0 configuration into a Vercel-hosted Next.js app. *Auth0: Vercel native integration.* | **integrate** | | Use the Auth0 CLI directly — "create an app/API with the `auth0` CLI", script tenant setup, or automate Auth0 config in CI — with no application framework in play. *Auth0: CLI / tooling-only.* | **tooling** | --- ## Step 2: Detect framework > **Skip this step for the `tooling` intent** — a CLI-first request has no > framework. Go to Step 3, load the tooling reference; only ask about a > framework if the developer later pivots to integrating auth into an app. Work top-down. **Stop at the first tier that yields a framework.** ### Tier 1 — Auth0 SDK already installed (strongest signal) ### Node.js / JavaScript / TypeScript — check `package.json` → `dependencies` Rows are most-specific first: an Ionic/Capacitor project also carries the base SDK, so check the `@capacitor/browser` rows before it. | Package | Framework | |---|---| | `@capacitor/browser` + `@auth0/auth0-angular` | `ionic-angular` | | `@capacitor/browser` + `@auth0/auth0-react` | `ionic-react` | | `@capacitor/browser` + `@auth0/auth0-vue` | `ionic-vue` | | `@auth0/nextjs-auth0` | `nextjs` | | `@auth0/auth0-nuxt` | `nuxt` | | `@auth0/auth0-react` | `react` | | `@auth0/auth0-vue` | `vue` | | `@auth0/auth0-angular` | `angular` | | `@auth0/auth0-spa-js` | `spa-js` | | `express-openid-connect` | `express` | | `@auth0/auth0-fastify` | `fastify` | | `@auth0/auth0-fastify-api` | `fastify-api` | | `express-oauth2-jwt-bearer` | `express-jwt` | | `react-native-auth0` + `app.json` or `app.config.js` present | `expo` | | `react-native-auth0` (no Expo files) | `react-native` | ### Python — check `requirements.txt` or `pyproject.toml` | Package | Framework | |---|---| | `auth0-server-python` | `flask` | | `auth0-fastapi-api` | `fastapi-api` | ### Java / Kotlin — check `build.gradle` or `pom.xml` | Dependency | Framework | |---|---| | `mvc-auth-commons` (`com.auth0:mvc-auth-commons`) | `java-mvc` | | `spring-security-oauth2-resource-server` | `springboot-api` | ### .NET — check `*.csproj` or `NuGet.Config` | Package | Framework | |---|---| | `Auth0.AspNetCore.Authentication` (no `.Api` suffix) | `aspnetcore-auth` | | `Auth0.AspNetCore.Authentication.Api` | `aspnetcore-api` | | `Auth0.OidcClient.MAUI` | `maui` | | `Auth0.OidcClient.AndroidX` | `net-android` | | `Auth0.OidcClient.iOS` | `net-ios` | | `Auth0.OidcClient.WinForms` | `winforms` | | `Auth0.OidcClient.WPF` | `wpf` | ### PHP — check `composer.json` `auth0/auth0-php` powers both PHP web apps and APIs via `SdkConfiguration`'s `strategy`. The `STRATEGY_API` row is more specific — check it first. | Package | Framework | |---|---| | `auth0/auth0-php` + `SdkConfiguration::STRATEGY_API` (or `strategy: 'api'`) | `php-api` | | `auth0/auth0-php` (no `STRATEGY_API` / `STRATEGY_REGULAR` or `strategy: 'webapp'`) | `php` | | `auth0/login` (laravel, no `AuthorizationGuard`) | `laravel` | | `auth0/login` + `AuthorizationGuard` | `laravel-api` | > If `auth0/auth0-php` is installed but no `SdkConfiguration` strategy is set > yet (fresh project), fall through to variant disambiguation below. ### Go — check `go.mod` | Module | Framework | |---|---| | `github.com/auth0/go-jwt-middleware` | `go` | ### Mobile (native) | Signal | Framework | |---|---| | `Package.swift` or `.xcodeproj` + Auth0.swift | `swift` | | `build.gradle` + `com.auth0.android:auth0` | `android` | | `pubspec.yaml` + `auth0_flutter` + `flutter.web: false` | `flutter-native` | | `pubspec.yaml` + `auth0_flutter` + web enabled | `flutter-web` | ### Tier 2 — Framework from non-Auth0 workspace dependencies If no Auth0 SDK matched, detect the framework from ordinary (non-Auth0) dependencies. **Stop at the first match.** This picks the base; any web-vs-API variant is resolved in "Variant disambiguation" below. As in Tier 1, check the `@ionic/*` rows before their base framework. | Signal | Base framework | |---|---| | `next` in `package.json` | `nextjs` | | `nuxt` in `package.json` | `nuxt` | | `@ionic/*` + `@angular/core` | `ionic-angular` | | `@ionic/*` + `react` | `ionic-react` | | `@ionic/*` + `vue` | `ionic-vue` | | `@angular/core` in `package.json` | `angular` | | `vue` in `package.json` (no `nuxt`) | `vue` | | `expo` in `package.json` | `expo` | | `react-native` (no `expo`) | `react-native` | | `react` (no meta-framework above) | `react` (SPA) — see note | | `express` in `package.json` | `express` (variant below) | | `fastify` in `package.json` | `fastify` (variant below) | | `flask` in `requirements.txt`/`pyproject.toml` | `flask` | | `fastapi` in `requirements.txt`/`pyproject.toml` | `fastapi-api` | | `spring-boot` in `pom.xml`/`build.gradle` | `springboot-api` | | `laravel/framework` in `composer.json` | `laravel` (variant below) | | `composer.json` present (no Laravel) | `php` (variant below) | | `go.mod` present + HTTP server/router | `go` | | `Package.swift` or `.xcodeproj` | `swift` | | `pubspec.yaml` (Flutter, web disabled) | `flutter-native` | | `pubspec.yaml` (Flutter, web enabled) | `flutter-web` | | `*.csproj` referencing MAUI | `maui` | | `*.csproj` (WinForms) | `winforms` | | `*.csproj` (WPF) | `wpf` | | `*.csproj` ASP.NET (web app or API) | `aspnetcore` (variant below) | > **`react` note:** a plain React project maps to `react` for an SPA using the > React SDK, or `spa-js` if the app is framework-agnostic vanilla JS. If unclear, > ask before loading. ### Tier 3 — Framework from the prompt If no workspace signal matched, map the framework or language named in the request. **Stop at the first match.** | Developer mentions... | Framework | |---|---| | Next.js / `next` | `nextjs` | | Nuxt | `nuxt` | | Angular (not Ionic) | `angular` | | Vue (not Nuxt/Ionic) | `vue` | | React SPA (not Next.js) | `react` | | vanilla JS / plain JS / no framework SPA | `spa-js` | | Express (web app / server-rendered) | `express` | | Express API / protect API routes | `express-jwt` | | Fastify (web) / Fastify API | `fastify` / `fastify-api` | | Flask | `flask` | | FastAPI | `fastapi-api` | | Spring Boot | `springboot-api` | | Java MVC / servlet | `java-mvc` | | ASP.NET Core web app / API | `aspnetcore-auth` / `aspnetcore-api` | | MAUI / WinForms / WPF | `maui` / `winforms` / `wpf` | | PHP web app / PHP API | `php` / `php-api` | | Laravel web app / Laravel API | `laravel` / `laravel-api` | | Go / Golang API | `go` | | Swift / iOS | `swift` | | Android / Kotlin | `android` | | Flutter (native / web) | `flutter-native` / `flutter-web` | | React Native / Expo | `react-native` / `expo` | | Ionic (Angular/React/Vue) | `ionic-angular` / `ionic-react` / `ionic-vue` | ### Variant disambiguation (web app vs API) Some frameworks have separate web-app and API references. When Tier 1 did not pin the variant, choose **intent-first**: | Base | Web-app variant | API variant | Choose API when… | |---|---|---|---| | express | `express` | `express-jwt` | protecting API routes / validating JWTs, no server-rendered UI | | fastify | `fastify` | `fastify-api` | resource server / JWT validation only | | php | `php` | `php-api` | building/protecting a PHP API, no web UI | | laravel | `laravel` | `laravel-api` | API-only (token guard), no Blade UI | | aspnetcore | `aspnetcore-auth` | `aspnetcore-api` | Web API / JWT bearer, no cookie login UI | If intent is still ambiguous (both a UI and protected endpoints, or unclear), **state what you detected and ask the developer** web app vs API before loading. ### If nothing matched Ask the developer what framework/language they are using. Do not guess. ### Conflicts If Tier 2 (workspace) and Tier 3 (prompt) disagree materially (e.g. the prompt says "Next.js" but `package.json` has no `next`), **state the conflict and ask** rather than silently picking. Workspace signals outrank the prompt when both are present and consistent. --- ## Step 3: Detect tooling Read the project file tree and the request — a project-context decision, not a product preference. | Project has... | Load | |---|---| | `terraform/` directory OR any `*.tf` files | `tooling-terraform/index.md` | | Auth0 MCP server active in this agent session | `tooling-mcp/index.md` | | A request for the Auth0 Vercel Marketplace/native integration, or to connect Auth0 to a Vercel project | `tooling-vercel/index.md` | | Anything else (default) | `tooling-cli/index.md` | --- ## Step 4: Load reference files Find the section below whose heading matches the **Intent** you picked in Step 1, then read the reference files it lists. ### integrate ``` Read: references/framework-{framework}/index.md Read: references/tooling-{tooling}/index.md Follow the integration workflow in references/framework-{framework}/index.md. Use references/tooling-{tooling}/index.md for all Auth0 tenant configuration steps. ``` ### feature:mfa ``` Read: references/feature-mfa/index.md Read: references/tooling-{tooling}/index.md If framework detected: Read references/framework-{framework}/index.md (for SDK-side step-up trigger) ``` ### feature:organizations ``` Read: references/feature-organizations/index.md Read: references/tooling-{tooling}/index.md If framework detected: Read references/framework-{framework}/index.md If multi-tenant architecture / B2B SaaS design question: also Read references/pattern-multi-tenant/index.md ``` ### feature:universal-portals ``` Read: references/feature-universal-portals/index.md Read: references/tooling-{tooling}/index.md ``` ### feature:custom-domains ``` Read: references/feature-custom-domains/index.md Read: references/tooling-{tooling}/index.md ``` ### feature:acul ``` Read: references/feature-acul/index.md Read: references/tooling-{tooling}/index.md ``` ### feature:branding ``` Read: references/feature-branding/index.md Read: references/tooling-{tooling}/index.md ``` ### feature:dpop ``` Read: references/feature-dpop/index.md Read: references/tooling-{tooling}/index.md If a SPA framework is detected (vue/react/angular/spa-js): Read references/framework-{framework}/index.md DPoP is SPA-only (no SSR: Next.js/Nuxt) — feature-dpop/index.md states the exclusion. ``` ### guidance ``` Read: references/pattern-security/index.md If framework detected: Read references/framework-{framework}/index.md (for SDK-specific guidance — token storage, session handling, route protection) If token handling / JWT vs opaque / storage: Read references/pattern-token-handling/index.md If multi-tenant / B2B architecture: Read references/pattern-multi-tenant/index.md + references/feature-organizations/index.md ``` ### debug ``` Read: references/pattern-common-errors/index.md If framework detected: Read references/framework-{framework}/index.md ``` ### debug:rate-limit ``` Read: references/pattern-rate-limiting/index.md ``` ### migrate ``` Read: references/feature-migration/index.md Read: references/tooling-{tooling}/index.md If framework detected: Read references/framework-{framework}/index.md ``` ### audit ``` Read: references/feature-audit/index.md Read: references/feature-audit-pricing/index.md Read: references/feature-audit-remediation/index.md Read: references/tooling-{tooling}/index.md Apply findings only with per-command confirmation; verify each change by re-fetch. ``` ### healthcheck ``` Read: references/feature-healthcheck/index.md Read: references/feature-audit/index.md Read: references/feature-audit-pricing/index.md Read: references/feature-audit-remediation/index.md Read: references/tooling-{tooling}/index.md If a scan can run, do the audit workflow first, then score and recommend a plan. If not, score capability fit and recommend anyway. Never quote Enterprise pricing. ``` ### upgrade-sdk ``` Read: references/framework-{framework}/index.md Follow its "Major Version Migration" section (e.g. Auth0.swift v3, Auth0.Android v4). This is an Auth0 SDK version bump — NOT a provider migration. Do not load feature-migration/index.md. If no framework is detected: ask which Auth0 SDK the developer is upgrading. ``` ### tooling ``` Read: references/tooling-{tooling}/index.md No framework file — this is a CLI/tooling-only task (create apps/APIs, script tenant setup, automate config in CI). If the developer then wants to integrate auth into an app, return to Step 1 with the integrate intent. ```