Auth0 setup

ConfigView reads your Auth0 tenant through the Auth0 Management API, using a Machine-to-Machine application that an Auth0 admin creates and authorizes for read-only access. The application has a client ID and a client secret. ConfigView exchanges them for a token and asks only for read scopes. You will end up with 3 required secrets (AUTH0_DOMAIN, AUTH0_CLIENT_ID, AUTH0_CLIENT_SECRET) and 1 optional secret (AUTH0_API_AUDIENCE) in ConfigView when setup is complete.

Scope of this integration today. Auth0 is a customer-identity platform, so the people in it are mostly your customers, not your employees. ConfigView therefore focuses on how the tenant is configured and who can change it: applications and their grant types and callback URLs, connections (database, social, enterprise), APIs and which application may call which API with which scopes, roles and permissions, organizations, Actions and legacy Rules, MFA and attack-protection settings, log streams, custom domains, tenant settings, and the tenant log (admin changes, failed logins). It also collects the user directory, capped for very large tenants. It never reads user or app metadata, provider tokens, application secrets, connection credentials or Action and Rule source code. ConfigView only reads. It never creates, changes or deletes anything in Auth0.

Dashboard admins cannot be listed. Auth0’s Management API has no endpoint for the people who sign in to the Auth0 Dashboard (tenant members). ConfigView shows admin activity from the tenant log instead: every admin API call and who or which application made it. Roles in Auth0’s own RBAC (the ones you assign to users of your apps) are collected in full.

What you need

An Auth0 admin account, to create an application and authorize it for the Management API
Your tenant domain, for example acme.us.auth0.com. It is shown under Settings → General and as the Domain on any application
The Management API is available on every Auth0 plan. Some areas depend on your plan or on what you use: Organizations, custom domains, attack-protection features and log retention differ by plan. If an area is not on your plan, that collector skips itself and its table stays empty. That does not count as a failure.

Step 1: Open the Auth0 page in ConfigView

Open ConfigView in a second browser tab and leave it open: https://{companyname}.configview.com/admin/integrations/auth0 Paste the client secret straight into ConfigView instead of keeping it in a notes file.

Step 2: Create a Machine-to-Machine application

Sign in to the Auth0 Dashboard as an admin
Open Applications → Applications → Create Application
Name it ConfigView, choose Machine to Machine Applications and click Create
When asked to pick an API, choose Auth0 Management API
Select the scopes below, and only these, then click Authorize:

read:clients, read:client_grants, read:connections, read:resource_servers, read:roles, read:users, read:organizations, read:organization_members, read:actions, read:rules, read:logs, read:log_streams, read:custom_domains, read:tenant_settings, read:attack_protection, read:guardian_factors, read:mfa_policies Every scope is optional: a collector whose scope you leave out skips itself. Leave out read:users if you do not want the user directory in ConfigView.

Open the application’s Settings tab. Copy the Domain, Client ID and Client Secret
Switch to the ConfigView tab and paste them into AUTH0_DOMAIN, AUTH0_CLIENT_ID and AUTH0_CLIENT_SECRET under Credentials, then click the save icon for each

Do not grant any create:, update: or delete: scope. ConfigView doesn’t need one, and the health check flags any it finds.

Custom domains

Enter the tenant’s own domain (acme.us.auth0.com), not your custom domain, in AUTH0_DOMAIN. If the first verify fails with an audience error, paste https://YOUR-TENANT.REGION.auth0.com/api/v2/ into the optional AUTH0_API_AUDIENCE.

Token limits

Auth0 counts Machine-to-Machine tokens per month, and free plans have a hard cap. ConfigView’s collectors share one token for 24 hours, so they ask for about one a day in total.

Step 3: Connect and verify

Back on https://{companyname}.configview.com/admin/integrations/auth0, confirm the credentials show as saved
Click Connect. ConfigView creates its tables and schedules every collector at your default run time. Stop any you don’t want under Collectors:

Script	Notes
Applications	Every application: type, grant types, callback and logout URLs, token endpoint authentication, refresh-token rotation, first-party flag, organization usage.
Connections	Database, social, enterprise and passwordless connections, with sign-up and password policy, brute-force protection and MFA of database connections.
Connection Applications	Which applications each connection is enabled for.
APIs	The APIs (resource servers) you protect, with audience, signing algorithm, token lifetimes and scopes.
Client Grants	Which application may call which API, with which scopes.
Roles, Role Permissions, Role Members	RBAC roles, what each grants, and who holds each role. Role Members is capped per run.
Organizations, Organization Members	Your B2B organizations and who belongs to each. Members are capped per run.
Actions, Action Flows	Actions (custom code in login and token flows), whether each is deployed, and which run in which flow, in order.
Rules (legacy)	Legacy Rules still in the tenant, which Auth0 is retiring in favor of Actions.
Tenant Settings	Session lifetimes, default audience and directory, sandbox version and security-relevant flags.
MFA Factors	Each MFA method and whether it is on, plus whether the tenant requires MFA for all applications.
Attack Protection	Breached-password detection, brute-force protection, suspicious-IP throttling and bot detection.
Log Streams	Where the tenant sends its logs. Destination credentials are not read.
Custom Domains	Your custom domains and their verification status.
Users	The user directory, with connection, last login, login count, blocked flag and MFA enrollment. Capped for very large tenants.
Tenant Logs	Admin API activity, failed logins, blocked IPs and breached-password events, kept as a permanent archive.

Click Verify now. The health check reads the three secrets, gets (or reuses) a token, reads one application, lists the scopes the token carries and warns if any can write, then tries one record from each of the other areas.

If a check fails:

Token fails with “not authorized”. The application isn’t authorized for the Auth0 Management API. Open Applications → APIs → Auth0 Management API → Machine to Machine Applications and authorize it.
Token fails with 401 or 403. The domain, client ID or client secret is wrong, or the secret was rotated. Copy them again from the application’s Settings.
Token fails with an audience error. You use a custom domain. See Custom domains above.
Token fails with 429. Auth0 is limiting token requests or your monthly Machine-to-Machine quota is used up.
An area shows as skipped. Auth0 answered “forbidden” or “not found”: the scope isn’t granted, or the feature isn’t on your plan. Grant the scope if you want it.
A warning about write scopes. Remove the create:, update: and delete: scopes from the application’s Management API grant.

Data Tables

Once the scripts run, these tables are created in your database. Each table has a run_at column and a raw_json column, which holds the record as Auth0 returned it, minus anything listed under What isn’t collected. The snapshot tables keep only the newest run. auth0_logs keeps every event ever collected.

Table	Source	Key Columns
`auth0_applications`	`GET /api/v2/clients`	client_id, name, app_type, is_first_party, grant_types, uses_implicit_grant, uses_password_grant, callbacks, callbacks_wildcard, callbacks_http_or_localhost, token_endpoint_auth_method, refresh_token_rotation, organization_usage
`auth0_connections`	`GET /api/v2/connections`	connection_id, name, strategy, enabled_client_count, password_policy, password_min_length, brute_force_protection, mfa_active, tenant_domain
`auth0_connection_clients`	`GET /api/v2/connections` and `/connections/{id}/clients`	connection_id, connection_name, strategy, client_id
`auth0_apis`	`GET /api/v2/resource-servers`	api_id, name, audience, is_system, signing_alg, token_lifetime_seconds, enforce_policies, scopes
`auth0_client_grants`	`GET /api/v2/client-grants`	grant_id, client_id, audience, scopes, scope_count, organization_usage
`auth0_roles`	`GET /api/v2/roles`	role_id, name, description
`auth0_role_permissions`	`GET /api/v2/roles/{id}/permissions`	role_id, role_name, permission_name, api_audience
`auth0_role_users`	`GET /api/v2/roles/{id}/users`	role_id, role_name, user_id, email, name
`auth0_organizations`	`GET /api/v2/organizations`	organization_id, name, display_name, metadata_keys
`auth0_organization_members`	`GET /api/v2/organizations/{id}/members`	organization_id, organization_name, user_id, email, name
`auth0_actions`	`GET /api/v2/actions/actions`	action_id, name, trigger_ids, is_deployed, all_changes_deployed, runtime, dependency_count, updated_at
`auth0_action_bindings`	`GET /api/v2/actions/triggers/{id}/bindings`	trigger_id, flow_position, action_id, action_name
`auth0_rules`	`GET /api/v2/rules`	rule_id, name, is_enabled, stage, run_order
`auth0_tenant_settings`	`GET /api/v2/tenants/settings`	friendly_name, session_lifetime_hours, idle_session_lifetime_hours, default_audience, enable_public_signup_user_exists_error, enable_dynamic_client_registration
`auth0_mfa_factors`	`GET /api/v2/guardian/factors` and `/guardian/policies`	factor_name, is_enabled, mfa_policy
`auth0_attack_protection`	`GET /api/v2/attack-protection/{feature}`	feature, is_enabled, shields, max_attempts, allowlist_count, bot_detection_level
`auth0_log_streams`	`GET /api/v2/log-streams`	stream_id, name, stream_type, stream_status
`auth0_custom_domains`	`GET /api/v2/custom-domains`	domain, certificate_type, domain_status, tls_policy, is_primary
`auth0_users`	`GET /api/v2/users`	user_id, email, connection, provider, created_at, last_login_at, logins_count, is_blocked, mfa_enrolled
`auth0_logs`	`GET /api/v2/logs`	log_id, event_at, event_type, is_failure, is_admin_activity, user_name, client_name, ip, api_method, api_path, api_status
`auth0_log_checkpoint`	(internal)	last_log_id, last_event_at

Things worth knowing

Users are mostly customers. auth0_users is your customer directory. ConfigView reads it so a person who is both a staff member and a user can be found, and so you can see counts by connection, dormant accounts and MFA enrollment. A tenant with millions of users is capped at 100,000 rows per run (AUTH0_MAX_USERS). Auth0’s user search stops at 1,000 results, so ConfigView reads users in date windows and splits any window that is too big. Admin activity comes from the tenant log. Events of type sapi are admin API calls that worked and fapi are ones that failed. They name the person (or the application, such as a Terraform provider) that made the change, the HTTP method, the path and the result. Request and response bodies are removed before storing, because they can carry secrets. The first log run reads history, later runs follow a checkpoint. The first run stores admin and security events from the last 90 days (Auth0’s search stops at 1,000 results). After that, ConfigView follows Auth0’s checkpoint paging from where it left off, so nothing is read twice and nothing is missed while collectors are down, as long as the gap is shorter than your plan’s log retention (from two days on free plans to a month on paid ones). Past that, ConfigView starts over from what Auth0 still holds. Routine successful logins are not stored. In a customer tenant, successful logins and token exchanges are the bulk of the log. ConfigView reads past them but does not store them. A user’s last_login_at and logins_count cover “who signed in”. To keep everything, set AUTH0_LOG_SKIP_TYPES to none; to skip other types, list them separated by commas. Client grants are the access map. auth0_client_grants.audience matches auth0_apis.audience, and client_id matches auth0_applications.client_id. A grant whose audience ends in /api/v2/ is a grant to the Auth0 Management API itself. Rate limit. Management API limits depend on your plan: about 2 requests a second on free and development tenants, about 15 on paid ones. Each ConfigView collector paces itself at 45 requests a minute and waits when Auth0 answers 429.

What isn’t collected

Application client secrets, signing keys and encryption keys
Connection options (client secrets, bind credentials, custom database scripts) and user identities, which hold provider access tokens
User metadata, app metadata, profile pictures and phone numbers
Action and Rule source code and Action secrets
Log stream destinations (endpoints, tokens and keys), and API signing secrets
Request and response bodies of admin API log events
Dashboard administrators (Auth0 does not expose them), branding, email templates and Universal Login pages

Platform

Integrations

What you need

Step 1: Open the Auth0 page in ConfigView

Step 2: Create a Machine-to-Machine application

Custom domains

Token limits

Step 3: Connect and verify

Data Tables

Things worth knowing

What isn’t collected

​What you need

​Step 1: Open the Auth0 page in ConfigView

​Step 2: Create a Machine-to-Machine application

​Custom domains

​Token limits

​Step 3: Connect and verify

​Data Tables

​Things worth knowing

​What isn’t collected

What you need

Step 1: Open the Auth0 page in ConfigView

Step 2: Create a Machine-to-Machine application

Custom domains

Token limits

Step 3: Connect and verify

Data Tables

Things worth knowing

What isn’t collected