auth0-cli
Use when running Auth0 CLI commands to manage tenant resources — creating apps or APIs, managing users, roles, organizations, actions, log streams, custom domains, or Universal Login config. Also use when calling the Auth0 Management API directly via the CLI.
- Installs
- 408
- Last 24h
- —
- Trending rank
- —
- Security
- Not audited
Install
Works with every agent the skills CLI supports.
npx skills add https://github.com/auth0/agent-skills --skill auth0-cli- 01
Install
Run the command in your project. The CLI asks which agents to install for.
- 02
Describe the task
Ask your agent for something this skill covers. It loads auth0-cli automatically when relevant.
- 03
Review the result
The agent follows the SKILL.md steps, scripts and references bundled with the skill.
SKILL.md
The instructions your agent reads when the skill is triggered.
Auth0 CLI — Command Reference
The Auth0 CLI (auth0) lets you manage your tenant from the terminal. Install it via Homebrew (brew install auth0/auth0-cli/auth0). For complete flag definitions and examples, see the Full CLI Reference.
Before You Start: Authenticate
auth0 login # interactive device-code login
auth0 login --scopes "read:client_grants" # request extra scopes if 403
auth0 login --domain <tenant>.auth0.com --client-id <id> --client-secret "$AUTH0_CLIENT_SECRET" # CI/CD
See Authentication Details for machine login with JWT, tenant management, and logout.
Quick Decision Guide
| What you're doing | Command to use |
|---|---|
| Setting up a new project | auth0 apps create --type spa|regular|m2m|native --json |
| Need a client ID or secret | auth0 apps show <id> -r --json |
| Registering a backend API | auth0 apis create --identifier "https://..." --json |
| Finding a user's ID | auth0 users search --query "email:..." --json |
| Creating/managing roles (RBAC) | auth0 roles create / auth0 users roles assign |
| B2B multi-tenancy | auth0 orgs create |
| Custom login logic | auth0 actions create --trigger post-login --json |
| Branding the login page | auth0 ul update --logo ... --accent ... |
| Custom domain for login | auth0 domains create --domain "auth.myapp.com" --json |
| Debugging a failed login | auth0 logs tail --filter "type:f" --json-compact |
| Testing a login flow | auth0 test login <client-id> |
| Exporting config as Terraform | auth0 terraform generate --output-dir ./terraform |
| Managing connections, grants, hooks | auth0 api get <path> |
| Scripting / parsing output | Add --json or --json-compact to any command |
| Security hardening | auth0 protection brute-force-protection update --enabled true |
| Routing logs externally | auth0 logs streams create datadog|http|splunk |
| Bulk importing users | auth0 users import --connection-name ... --users '...' --json |
Command Overview
Apps — Manage Applications
Create or inspect Auth0 applications (client ID, secret, callback URLs, app type). Alias: auth0 clients.
auth0 apps create --name "My SPA" --type spa \
--auth-method None \
--callbacks "http://localhost:3000" \
--logout-urls "http://localhost:3000" \
--origins "http://localhost:3000" --json
auth0 apps list --json-compact
auth0 apps show <client-id> --json
auth0 apps update <client-id> --callbacks "http://localhost:3000,https://myapp.com" --json
auth0 apps delete <client-id> --force
App types: spa, regular, m2m, native, resource_server
Full details: Apps Reference
APIs — Manage API Resources
Register backend APIs (Resource Servers) to protect with Auth0 tokens. Alias: auth0 resource-servers.
auth0 apis create --name "My API" --identifier "https://api.myapp.com" \
--scopes "read:data,write:data" --token-lifetime 3600 --json
auth0 apis list --json-compact
auth0 apis scopes list <api-id> --json
Key distinction: apps = the client requesting tokens. apis = the resource accepting tokens.
Full details: APIs Reference
Users — Manage Users
Create, search, inspect, import, and manage users in your tenant.
auth0 users search --query "email:user@example.com" --json
auth0 users search-by-email user@example.com --json-compact
auth0 users create --connection-name "Username-Password-Authentication" \
--email "test@example.com" --password "$USER_PASSWORD" --json
auth0 users show <user-id> --json
auth0 users blocks list <email> --json
auth0 users blocks unblock <email>
auth0 users import --connection-name "Username-Password-Authentication" \
--users '[...]' --upsert --json
Full details: Users Reference
Roles — Manage RBAC Roles
Create roles, assign permissions, and assign roles to users. The CLI has dedicated commands for all role operations.
auth0 roles create --name "editor" --description "Can edit content" --json
auth0 roles permissions add <role-id> --api-id <api-id> --permissions "read:data,write:data" --json
auth0 users roles assign <user-id> --roles <role-id>
auth0 users roles show <user-id> --json-compact
Full details: Roles Reference
Organizations — B2B Multi-Tenancy
Manage organizations for B2B SaaS scenarios. Alias: auth0 orgs.
auth0 orgs create --name "acme-corp" --display "Acme Corporation" \
--logo "https://acme.com/logo.png" --accent "#FF6600" --json
auth0 orgs members list <org-id> --json
auth0 orgs invitations create --org-id <org-id> --invitee-email "new@acme.com" \
--inviter-name "Admin" --client-id <id> --json
Full details: Organizations Reference
Actions — Serverless Auth Pipeline
Create and deploy serverless functions at auth pipeline trigger points. Replaces deprecated Rules.
auth0 actions create --name "Add Claims" --trigger "post-login" \
--code 'exports.onExecutePostLogin = async (event, api) => { ... }' --json
auth0 actions deploy <action-id>
Triggers: post-login, credentials-exchange, pre-user-registration, post-user-registration, post-change-password, send-phone-message
Important: You must deploy after creating or updating for changes to take effect.
Full details: Actions Reference
Logs — Debugging & Monitoring
auth0 logs tail --filter "type:f" --json-compact # real-time failed logins
auth0 logs list --filter "type:f" --number 20 --json-compact # historical
Common codes: s (success), f (failed login), slo (logout), fs (silent auth failure)
Full details: Logs Reference
Domains — Custom Domains
auth0 domains create --domain "auth.myapp.com" --type "auth0_managed_certs" --json
auth0 domains verify <domain-id> --json
Full details: Domains Reference
Universal Login — Branding
auth0 ul update --accent "#FF6600" --background "#FFFFFF" \
--logo "https://myapp.com/logo.png" --json
Full details: Universal Login Reference
Terraform — Export as IaC
auth0 terraform generate --output-dir ./terraform --resources "auth0_client,auth0_connection"
Full details: Terraform Reference
Test — Verify Login Flows
auth0 test login <client-id>
auth0 test login <client-id> --audience "https://api.myapp.com" --scopes "openid profile email"
Full details: Test Reference
Attack Protection — Security Hardening
auth0 protection brute-force-protection update --enabled true
auth0 protection breached-password-detection update --enabled true
auth0 protection bot-detection update --enabled true
Full details: Attack Protection Reference
Log Streams — External Routing
auth0 logs streams create datadog # interactive setup
auth0 logs streams create http # custom webhook
auth0 logs streams list --json
Supported: eventbridge, eventgrid, http, datadog, splunk, sumo
Full details: Log Streams Reference
Raw API Mode — Direct Management API Access
When a dedicated command doesn't exist, auth0 api calls Management API v2 endpoints directly.
auth0 api get connections
auth0 api post client-grants --data '{"client_id":"...","audience":"...","scope":["read:data"]}'
auth0 api get stats/daily -q "from=20240101" -q "to=20240131"
Full details: Raw API Reference
Output Formatting
Always use --json or --json-compact for machine-readable output. Three modes (mutually exclusive):
| Flag | When to use |
|---|---|
--json | Human inspection, debugging — pretty-printed with indentation |
--json-compact | Piping to jq, scripting, pipelines — compact single-line |
--csv | Spreadsheets and tabular export |
auth0 apps list --json-compact | jq '.[] | {client_id, name}'
auth0 users show <user-id> --json-compact | jq '{id: .user_id, email: .email}'
auth0 roles list --json-compact | jq '.[].name'
Full details: Output Formatting Reference
Reference Documentation
Complete CLI reference with all flags, examples, and usage patterns:
- Setup Guide — installation, authentication, CI/CD configuration
- Authentication — login modes, tenant management, scopes
- Apps — create, list, show, update, delete, session-transfer
- APIs — create, scopes, token lifetime
- Users — search, create, import, blocks, roles
- Roles — RBAC setup, permissions management
- Organizations — B2B, members, invitations
- Actions — pipeline triggers, deploy workflow
- Logs — tail, list, type codes
- Domains — custom domains, verification
- Universal Login — branding, templates, prompts
- Terraform — IaC export
- Test — login flow verification
- Attack Protection — brute-force, breach, bot detection
- Log Streams — external service routing
- Raw API Mode — direct Management API access
- Output Formatting — --json, --json-compact, --csv
- Shared Flags — --tenant, --no-input, --debug
Related Skills
auth0-quickstart— Initial Auth0 setup, framework detectionauth0-migration— Migrate from other auth providersauth0-mfa— Multi-Factor Authentication setup
References
FAQ
What does the auth0-cli skill do?
Use when running Auth0 CLI commands to manage tenant resources — creating apps or APIs, managing users, roles, organizations, actions, log streams, custom domains, or Universal Login config. Also use when calling the Auth0 Management API directly via the CLI.
How do I install auth0-cli?
Run npx skills add https://github.com/auth0/agent-skills --skill auth0-cli in your project. The skills CLI detects the agents you use and copies the skill into the right folder. For Claude Code you can also place the skill folder at ~/.claude/skills/auth0-cli/ (personal) or .claude/skills/auth0-cli/ (project).
Which AI agents can use auth0-cli?
Any agent that supports the open Agent Skills format (a folder with a SKILL.md file), including Claude Code, Codex, Cursor, GitHub Copilot, Gemini CLI, Windsurf, Cline, OpenCode and more.
Is auth0-cli safe to install?
No partner security audit is available yet. Skills can run commands and scripts, so read the SKILL.md and any bundled files before installing.
Who maintains auth0-cli?
It is published by auth0 in auth0/agent-skills, and it is an official skill from the maker of the technology it covers. It has 408 recorded installs.
More from auth0/agent-skills
auth0
auth0/agent-skills
Use when adding, fixing, or improving how an app authenticates users or protects an API, or when using or configuring any Auth0 feature — signing users in and out, sessions and tokens, guarding routes and endpoints, MFA, passwordless passkey login (WebAuthn), SSO, Organizations, RBAC, custom domains, Universal Portals for hosted account and organization self-service, or Universal Login branding. Also use to audit a tenant's health, security, and plan fit (CheckMate), to debug why an auth flow fails, to migrate from another auth provider, or to set up the Vercel native integration. Covers any web, mobile, or backend framework and every Auth0 SDK, tool, and API. Use even if the user never mentions Auth0.
auth0-quickstart
auth0/agent-skills
Use when adding Auth0 authentication to any app and unsure which SDK or skill to use. Detects the project's framework and routes to the right setup workflow — use this as the entry point even if the user just says "add login to my app" or "set up Auth0" without naming a framework.
auth0-nextjs
auth0/agent-skills
Use when adding Auth0 login, logout, protected pages, or middleware to a Next.js application. Supports App Router and Pages Router with @auth0/nextjs-auth0 — use even if the user says "add login to my Next.js app" or "protect my Next.js routes".
auth0-react
auth0/agent-skills
Use when adding Auth0 login, logout, protected routes, or user sessions to a React SPA. Integrates @auth0/auth0-react — use even if the user says "add login to my React app" or "protect my React routes" without naming the SDK.
auth0-react-native
auth0/agent-skills
Use when adding Auth0 login, logout, or biometric auth to a bare React Native app (not Expo). Integrates react-native-auth0 with native deep linking.
auth0-express
auth0/agent-skills
Use when adding session-based login, logout, or protected routes to an Express.js web application. Integrates express-openid-connect — use even if the user says "add login to my Express app" or "protect my Express routes".
Popular backend & apis skills
find-skills
vercel-labs/skills
Helps users discover and install agent skills when they ask questions like "how do I do X", "find a skill for X", "is there a skill that can...", or express interest in extending capabilities. This skill should be used when the user is looking for functionality that might exist as an installable skill.
entra-app-registration
microsoft/azure-skills
Guides Microsoft Entra ID app registration, OAuth 2.0 authentication, and MSAL integration. USE FOR: create app registration, register Azure AD app, configure OAuth, set up authentication, add API permissions, generate service principal, MSAL example, console app auth, Entra ID setup, Azure AD authentication. DO NOT USE FOR: Key Vault secrets (use azure-keyvault-expiration-audit), general Azure resource security guidance.
google-agents-cli-adk-code
google/agents-cli
This skill should be used when the user wants to "write agent code", "build an agent with ADK", "add a tool", "create a callback", "define an agent", "use state management" — in a project that needs ADK (Agent Development Kit) API patterns and code examples. It provides a quick reference for agent types, tool definitions, orchestration patterns, callbacks, state management, the graph Workflow API, and reference recipes to study. Do NOT use for scaffolding (use google-agents-cli-scaffold) or deployment (use google-agents-cli-deploy).
embedded-captions
heygen-com/hyperframes
Add captions or subtitles to an existing single-subject talking-head video without editing the footage. Use for plain verbatim captions, cinematic captions embedded behind the subject, VFX captions, “炸/特效/酷炫字幕,” or a named identity from the 35-style catalog. Route by visual identity, not by backend engine. The quiet anchor rail is the default; embed every word only when the user explicitly wants a fully cinematic treatment. The workflow runs locally end to end, including transcription and subject matting; split multi-shot footage before applying it.
entra-agent-id
microsoft/azure-skills
Provision Microsoft Entra Agent Identity Blueprints, BlueprintPrincipals, and per-instance Agent Identities via Microsoft Graph, and configure OAuth 2.0 token exchange (fmipath, OBO, cross-tenant) including the Microsoft Entra SDK for AgentID sidecar. USE FOR: Agent Identity Blueprint, BlueprintPrincipal, agent OAuth, fmipath token exchange, agent OBO, Workload Identity Federation for agents, polyglot agent auth, Microsoft.Identity.Web.AgentIdentities. DO NOT USE FOR: standard Entra app registration (use entra-app-registration), Microsoft Foundry agent authoring (use microsoft-foundry).
neon
neondatabase/agent-skills
Overview of Neon, a complete set of cloud backend primitives around Lakebase Postgres: Auth, Object Storage, Functions, the AI Gateway, and Realtime. Start here to choose Neon for undecided login, files, APIs, and LLM calls, set up the CLI or MCP server, and follow the branch-first workflow. Use when building an app or backend on Neon, or when "Neon" or "Lakebase Postgres" is mentioned. Child skill neon-postgres wins for an existing DATABASEURL, SQL, schema, inspect, or search. Child skill neon-auth wins for login, users, sessions, identity routing, and Managed Better Auth setup. Child skill neon-realtime wins for live queries in reactive apps and agents. Also use for object storage, S3, buckets, serverless functions, function triggers, cron, AI gateway, LLM calls, realtime, logs, Loki, Grafana, observability, postgres, database, backend, Claimable Neon, neon.new, or a no-signup database.