> ## Documentation Index > Fetch the complete documentation index at: https://support.configview.com/llms.txt > Use this file to discover all available pages before exploring further. # Auth0 setup ConfigView reads your Auth0 tenant through the Auth0 Management API, using a **Machine-to-Machine application** that an Auth0 admin creates and authorizes for read-only access. The application has a client ID and a client secret. ConfigView exchanges them for a token and asks only for read scopes. You will end up with **3 required secrets** (`AUTH0_DOMAIN`, `AUTH0_CLIENT_ID`, `AUTH0_CLIENT_SECRET`) and **1 optional secret** (`AUTH0_API_AUDIENCE`) in ConfigView when setup is complete. > **Scope of this integration today.** Auth0 is a customer-identity platform, so the people in it are mostly your *customers*, not your employees. ConfigView therefore focuses on how the tenant is configured and who can change it: applications and their grant types and callback URLs, connections (database, social, enterprise), APIs and which application may call which API with which scopes, roles and permissions, organizations, Actions and legacy Rules, MFA and attack-protection settings, log streams, custom domains, tenant settings, and the tenant log (admin changes, failed logins). It also collects the user directory, capped for very large tenants. It never reads user or app metadata, provider tokens, application secrets, connection credentials or Action and Rule source code. ConfigView only reads. It never creates, changes or deletes anything in Auth0. > **Dashboard admins cannot be listed.** Auth0's Management API has no endpoint for the people who sign in to the Auth0 Dashboard (tenant members). ConfigView shows admin activity from the tenant log instead: every admin API call and who or which application made it. Roles in Auth0's own RBAC (the ones you assign to users of your apps) are collected in full. *** ## What you need * An Auth0 **admin** account, to create an application and authorize it for the Management API * Your tenant domain, for example `acme.us.auth0.com`. It is shown under **Settings → General** and as the Domain on any application * The Management API is available on every Auth0 plan. Some areas depend on your plan or on what you use: Organizations, custom domains, attack-protection features and log retention differ by plan. If an area is not on your plan, that collector skips itself and its table stays empty. That does not count as a failure. *** ## Step 1: Open the Auth0 page in ConfigView Open ConfigView in a second browser tab and leave it open: `https://{companyname}.configview.com/admin/integrations/auth0` Paste the client secret straight into ConfigView instead of keeping it in a notes file. *** ## Step 2: Create a Machine-to-Machine application 1. Sign in to the Auth0 Dashboard as an admin 2. Open **Applications → Applications → Create Application** 3. Name it `ConfigView`, choose **Machine to Machine Applications** and click **Create** 4. When asked to pick an API, choose **Auth0 Management API** 5. Select the scopes below, and **only** these, then click **Authorize**: `read:clients`, `read:client_grants`, `read:connections`, `read:resource_servers`, `read:roles`, `read:users`, `read:organizations`, `read:organization_members`, `read:actions`, `read:rules`, `read:logs`, `read:log_streams`, `read:custom_domains`, `read:tenant_settings`, `read:attack_protection`, `read:guardian_factors`, `read:mfa_policies` Every scope is optional: a collector whose scope you leave out skips itself. Leave out `read:users` if you do not want the user directory in ConfigView. 6. Open the application's **Settings** tab. Copy the **Domain**, **Client ID** and **Client Secret** 7. Switch to the ConfigView tab and paste them into `AUTH0_DOMAIN`, `AUTH0_CLIENT_ID` and `AUTH0_CLIENT_SECRET` under **Credentials**, then click the save icon for each Do not grant any `create:`, `update:` or `delete:` scope. ConfigView doesn't need one, and the health check flags any it finds. ### Custom domains Enter the tenant's own domain (`acme.us.auth0.com`), not your custom domain, in `AUTH0_DOMAIN`. If the first verify fails with an audience error, paste `https://YOUR-TENANT.REGION.auth0.com/api/v2/` into the optional `AUTH0_API_AUDIENCE`. ### Token limits Auth0 counts Machine-to-Machine tokens per month, and free plans have a hard cap. ConfigView's collectors share one token for 24 hours, so they ask for about one a day in total. *** ## Step 3: Connect and verify 1. Back on `https://{companyname}.configview.com/admin/integrations/auth0`, confirm the credentials show as saved 2. Click **Connect**. ConfigView creates its tables and schedules every collector at your default run time. Stop any you don't want under **Collectors**: | Script | Notes | | - | - | | **Applications** | Every application: type, grant types, callback and logout URLs, token endpoint authentication, refresh-token rotation, first-party flag, organization usage. | | **Connections** | Database, social, enterprise and passwordless connections, with sign-up and password policy, brute-force protection and MFA of database connections. | | **Connection Applications** | Which applications each connection is enabled for. | | **APIs** | The APIs (resource servers) you protect, with audience, signing algorithm, token lifetimes and scopes. | | **Client Grants** | Which application may call which API, with which scopes. | | **Roles**, **Role Permissions**, **Role Members** | RBAC roles, what each grants, and who holds each role. Role Members is capped per run. | | **Organizations**, **Organization Members** | Your B2B organizations and who belongs to each. Members are capped per run. | | **Actions**, **Action Flows** | Actions (custom code in login and token flows), whether each is deployed, and which run in which flow, in order. | | **Rules (legacy)** | Legacy Rules still in the tenant, which Auth0 is retiring in favor of Actions. | | **Tenant Settings** | Session lifetimes, default audience and directory, sandbox version and security-relevant flags. | | **MFA Factors** | Each MFA method and whether it is on, plus whether the tenant requires MFA for all applications. | | **Attack Protection** | Breached-password detection, brute-force protection, suspicious-IP throttling and bot detection. | | **Log Streams** | Where the tenant sends its logs. Destination credentials are not read. | | **Custom Domains** | Your custom domains and their verification status. | | **Users** | The user directory, with connection, last login, login count, blocked flag and MFA enrollment. Capped for very large tenants. | | **Tenant Logs** | Admin API activity, failed logins, blocked IPs and breached-password events, kept as a permanent archive. | 3. Click **Verify now**. The health check reads the three secrets, gets (or reuses) a token, reads one application, lists the scopes the token carries and warns if any can write, then tries one record from each of the other areas. If a check fails: * **Token fails with "not authorized".** The application isn't authorized for the Auth0 Management API. Open **Applications → APIs → Auth0 Management API → Machine to Machine Applications** and authorize it. * **Token fails with 401 or 403.** The domain, client ID or client secret is wrong, or the secret was rotated. Copy them again from the application's Settings. * **Token fails with an audience error.** You use a custom domain. See *Custom domains* above. * **Token fails with 429.** Auth0 is limiting token requests or your monthly Machine-to-Machine quota is used up. * **An area shows as skipped.** Auth0 answered "forbidden" or "not found": the scope isn't granted, or the feature isn't on your plan. Grant the scope if you want it. * **A warning about write scopes.** Remove the `create:`, `update:` and `delete:` scopes from the application's Management API grant. *** ## Data Tables Once the scripts run, these tables are created in your database. Each table has a `run_at` column and a `raw_json` column, which holds the record as Auth0 returned it, minus anything listed under *What isn't collected*. The snapshot tables keep only the newest run. `auth0_logs` keeps every event ever collected. | Table | Source | Key Columns | | - | - | - | | `auth0_applications` | `GET /api/v2/clients` | client\_id, name, app\_type, is\_first\_party, grant\_types, uses\_implicit\_grant, uses\_password\_grant, callbacks, callbacks\_wildcard, callbacks\_http\_or\_localhost, token\_endpoint\_auth\_method, refresh\_token\_rotation, organization\_usage | | `auth0_connections` | `GET /api/v2/connections` | connection\_id, name, strategy, enabled\_client\_count, password\_policy, password\_min\_length, brute\_force\_protection, mfa\_active, tenant\_domain | | `auth0_connection_clients` | `GET /api/v2/connections` and `/connections/{id}/clients` | connection\_id, connection\_name, strategy, client\_id | | `auth0_apis` | `GET /api/v2/resource-servers` | api\_id, name, audience, is\_system, signing\_alg, token\_lifetime\_seconds, enforce\_policies, scopes | | `auth0_client_grants` | `GET /api/v2/client-grants` | grant\_id, client\_id, audience, scopes, scope\_count, organization\_usage | | `auth0_roles` | `GET /api/v2/roles` | role\_id, name, description | | `auth0_role_permissions` | `GET /api/v2/roles/{id}/permissions` | role\_id, role\_name, permission\_name, api\_audience | | `auth0_role_users` | `GET /api/v2/roles/{id}/users` | role\_id, role\_name, user\_id, email, name | | `auth0_organizations` | `GET /api/v2/organizations` | organization\_id, name, display\_name, metadata\_keys | | `auth0_organization_members` | `GET /api/v2/organizations/{id}/members` | organization\_id, organization\_name, user\_id, email, name | | `auth0_actions` | `GET /api/v2/actions/actions` | action\_id, name, trigger\_ids, is\_deployed, all\_changes\_deployed, runtime, dependency\_count, updated\_at | | `auth0_action_bindings` | `GET /api/v2/actions/triggers/{id}/bindings` | trigger\_id, flow\_position, action\_id, action\_name | | `auth0_rules` | `GET /api/v2/rules` | rule\_id, name, is\_enabled, stage, run\_order | | `auth0_tenant_settings` | `GET /api/v2/tenants/settings` | friendly\_name, session\_lifetime\_hours, idle\_session\_lifetime\_hours, default\_audience, enable\_public\_signup\_user\_exists\_error, enable\_dynamic\_client\_registration | | `auth0_mfa_factors` | `GET /api/v2/guardian/factors` and `/guardian/policies` | factor\_name, is\_enabled, mfa\_policy | | `auth0_attack_protection` | `GET /api/v2/attack-protection/{feature}` | feature, is\_enabled, shields, max\_attempts, allowlist\_count, bot\_detection\_level | | `auth0_log_streams` | `GET /api/v2/log-streams` | stream\_id, name, stream\_type, stream\_status | | `auth0_custom_domains` | `GET /api/v2/custom-domains` | domain, certificate\_type, domain\_status, tls\_policy, is\_primary | | `auth0_users` | `GET /api/v2/users` | user\_id, email, connection, provider, created\_at, last\_login\_at, logins\_count, is\_blocked, mfa\_enrolled | | `auth0_logs` | `GET /api/v2/logs` | log\_id, event\_at, event\_type, is\_failure, is\_admin\_activity, user\_name, client\_name, ip, api\_method, api\_path, api\_status | | `auth0_log_checkpoint` | (internal) | last\_log\_id, last\_event\_at | *** ## Things worth knowing **Users are mostly customers.** `auth0_users` is your customer directory. ConfigView reads it so a person who is both a staff member and a user can be found, and so you can see counts by connection, dormant accounts and MFA enrollment. A tenant with millions of users is capped at 100,000 rows per run (`AUTH0_MAX_USERS`). Auth0's user search stops at 1,000 results, so ConfigView reads users in date windows and splits any window that is too big. **Admin activity comes from the tenant log.** Events of type `sapi` are admin API calls that worked and `fapi` are ones that failed. They name the person (or the application, such as a Terraform provider) that made the change, the HTTP method, the path and the result. Request and response bodies are removed before storing, because they can carry secrets. **The first log run reads history, later runs follow a checkpoint.** The first run stores admin and security events from the last 90 days (Auth0's search stops at 1,000 results). After that, ConfigView follows Auth0's checkpoint paging from where it left off, so nothing is read twice and nothing is missed while collectors are down, as long as the gap is shorter than your plan's log retention (from two days on free plans to a month on paid ones). Past that, ConfigView starts over from what Auth0 still holds. **Routine successful logins are not stored.** In a customer tenant, successful logins and token exchanges are the bulk of the log. ConfigView reads past them but does not store them. A user's `last_login_at` and `logins_count` cover "who signed in". To keep everything, set `AUTH0_LOG_SKIP_TYPES` to `none`; to skip other types, list them separated by commas. **Client grants are the access map.** `auth0_client_grants.audience` matches `auth0_apis.audience`, and `client_id` matches `auth0_applications.client_id`. A grant whose audience ends in `/api/v2/` is a grant to the Auth0 Management API itself. **Rate limit.** Management API limits depend on your plan: about 2 requests a second on free and development tenants, about 15 on paid ones. Each ConfigView collector paces itself at 45 requests a minute and waits when Auth0 answers 429. ## What isn't collected * Application client secrets, signing keys and encryption keys * Connection options (client secrets, bind credentials, custom database scripts) and user identities, which hold provider access tokens * User metadata, app metadata, profile pictures and phone numbers * Action and Rule source code and Action secrets * Log stream destinations (endpoints, tokens and keys), and API signing secrets * Request and response bodies of admin API log events * Dashboard administrators (Auth0 does not expose them), branding, email templates and Universal Login pages This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.