Setting Up the Auth0 Management API

The Auth0 Management API allows you to interact with your Auth0 account programmatically, enabling you to manage users, roles, permissions, and other resources. To use the Management API, you need to set up your Auth0 account and application correctly.

Below is a comprehensive guide on how to set up the Auth0 Management API for your application, including where to find all necessary credentials (client ID, client secret, and the Management API’s audience).

---

1. Create or Locate Your Machine-to-Machine Application

1. Go to the Auth0 Dashboard

   • Log in to your Auth0 account and navigate to the Auth0 Dashboard.

2. Create or Use an Existing Machine-to-Machine App

   • In the left navigation menu, go to Applications → Applications.
   • Look for an application of type “M2M” or “Machine to Machine.” If you need a new one, click the Create Application button and select Machine to Machine when prompted for the application type.

3. Configure the Machine-to-Machine App

   • Once the application is created, open it to view its Settings tab.
   • Here you’ll see your Client ID.
   • Your Client Secret might be hidden by default. To reveal it, click Reveal or Show.

---

2. Enable Access to the Auth0 Management API

1. Navigate to the APIs Section

   • In the left navigation menu, go to Applications → APIs.
   • Look for the built-in Auth0 Management API (it’s usually created by default by Auth0).

2. Grant Permissions

   • Select the Auth0 Management API and click on the Machine to Machine Applications tab.
   • Find the M2M application you just created (or plan to use) in the list.
   • Click the toggle to enable access for this M2M application to the Management API.
   • Select the scopes or permissions your application needs (e.g., read:users, update:users, etc.).
   • Click Update to save.

---

3. Identify Your Management API Audience

1. Open the Management API Settings

   • Still in Applications → APIs, select Auth0 Management API from the list.
   • Go to the Settings tab.

2. Find the Identifier

   • Under Settings, the Identifier field is your Management API audience.

   • Typically, this is https://YOUR_AUTH0_DOMAIN/api/v2/. For example, if your domain is my-tenant.eu.auth0.com, the audience would be:

     https://my-tenant.us.auth0.com/api/v2/
     

   • Use this string as the value of auth0.management.audience (for example, in a Spring Boot application).

---

4. Obtain an Access Token

To call the Management API, you must obtain a valid access token. You can do this by sending a request to your Auth0 domain’s /oauth/token endpoint. For example:

POST https://YOUR_AUTH0_DOMAIN/oauth/token
Content-Type: application/json
 
{
  "grant_type": "client_credentials",
  "client_id": "<YOUR_CLIENT_ID>",
  "client_secret": "<YOUR_CLIENT_SECRET>",
  "audience": "https://YOUR_AUTH0_DOMAIN/api/v2/"
}