Auth0

auth0Auth32 lines

Hosted identity with enterprise SSO, MFA and fine-grained rules.

Current — as published in v1.3.2. Written by hand for Auth0, not generated.

The rule

Tokens

  • Always request an `audience`. Without it Auth0 returns an opaque token your API cannot verify — the single most common integration failure.
  • The API verifies signature and aud and iss. A correctly signed token issued for a different API is still not for you.
  • Never send an ID token to an API. ID tokens describe the user; access tokens authorise the call.

Secrets

  • The client secret is server-side only. Browser and mobile apps use PKCE and hold no secret.
  • Never log a token.

Claims

  • Custom claims must be namespaced with a URL, or they are silently dropped.
  • Roles are not in the token by default; add them with an Action.

Sessions

  • offline_access in the scope, or sessions end when the access token expires and users are logged out at apparently random moments.
  • Clear cached user-scoped state on logout.

Never

  • Never authorise from a client-held user id; use the verified sub claim.
  • Never share one tenant across environments.

As each tool receives it

The same guidance, in the shape each editor reads. Cursor and Claude Code are written separately by hand; the rest are derived from the Cursor rule.

→ .cursor/rules/auth0.mdchand-written for this tool
.cursor/rules/auth0.mdc
---
description: Auth0 conventions
globs: ["src/features/auth/**", "src/services/**", "app/api/auth/**"]
alwaysApply: false
---

# Auth0

## Tokens

- **Always request an `audience`.** Without it Auth0 returns an opaque token
  your API cannot verify — the single most common integration failure.
- The API verifies signature **and** `aud` **and** `iss`. A correctly signed
  token issued for a different API is still not for you.
- Never send an ID token to an API. ID tokens describe the user; access tokens
  authorise the call.

## Secrets

- The client secret is server-side only. Browser and mobile apps use PKCE and
  hold no secret.
- Never log a token.

## Claims

- Custom claims must be namespaced with a URL, or they are silently dropped.
- Roles are not in the token by default; add them with an Action.

## Sessions

- `offline_access` in the scope, or sessions end when the access token expires
  and users are logged out at apparently random moments.
- Clear cached user-scoped state on logout.

## Never

- Never authorise from a client-held user id; use the verified `sub` claim.
- Never share one tenant across environments.

What else this module writes

Selecting Auth0 contributes more than a rule file — all of it merged with every other module you pick, with conflicts resolved rather than duplicated.

Environment
AUTH0_DOMAINrequiredTenant domain.
AUTH0_CLIENT_IDrequiredApplication client id. Public.
AUTH0_AUDIENCErequiredAPI identifier. Omitting it returns an opaque token your API cannot verify.
AUTH0_CLIENT_SECREToptionalServer-rendered apps only. Never in a SPA or mobile bundle.
AUTH0_SECREToptionalEncrypts the session cookie in server-rendered apps.
Dependencies
@auth0/nextjs-auth0^4.26.0
Folders
src/features/auth/screens/src/hooks/auth/

Related

conflicts withClerkconflicts withSupabase Auth
Put this in your repo

Adds Auth0 to a project this tool generated, without starting over. Files you have hand-edited are left alone.