Cloud Parts

Auth0

A hosted login and user-management service: your app redirects to Auth0, which signs users in with passwords, social accounts, passkeys or enterprise SSO and hands back tokens.

What it is
Authentication
Type
Commercial product
Made by
Okta, Inc.
License
Proprietary (SDKs MIT)
Facts checked
6 October 2026
Website

What it is

Auth0 runs the authorization server so your app doesn’t have to. With Universal Login, the app redirects users to login pages hosted by Auth0, which handle passwords, passwordless email or SMS, social logins, multi-factor authentication and enterprise connections, then send the user back with OpenID Connect tokens. Because the pages live on Auth0, new login methods can be switched on in the dashboard without changing the app.

Custom logic runs in Actions: versioned Node.js functions that fire at triggers such as post-login (after the user is authenticated but before tokens are issued), pre-registration or machine-to-machine token requests, and can deny access, add claims to tokens or redirect the user mid-login. Organizations model a B2B app’s business customers in one tenant, each with its own members, roles, branding and login connections. The free plan covers up to 25,000 monthly active users with unlimited social connections, 5 Organizations and 1 enterprise connection; paid plans start at $35 a month for 500 users on the consumer Essentials plan.

Why teams pick it

  • Broad coverage out of the box: social, passwordless, MFA, passkeys, SAML and OIDC enterprise connections, machine-to-machine tokens
  • Hosted Universal Login keeps passwords out of your app and lets login methods change without a redeploy
  • Actions give code-level hooks into login, registration and token issuance, with npm packages and version history
  • Generous free tier (25,000 monthly active users) and SDKs for most languages and frameworks

Watch out for

  • Paid tiers are priced per monthly active user and by feature tier, so costs climb as you grow or need enterprise connections
  • A hosted, closed-source service: your users’ identities live in Okta’s cloud, and moving away means migrating users and every login flow
  • Legacy Rules and Hooks reach end of life on November 18, 2026; older tenants must move that logic to Actions
  • Many knobs (tenants, connections, Actions, Organizations) make the configuration itself something to version and review

Alternatives

What all authentication have in common →
WorkOSCommercialAPIs that make a SaaS app “enterprise-ready”: SSO over SAML and OIDC, SCIM directory sync, a hosted login (AuthKit), audit logs and authorization.

How it fits with other technologies

A post-login Action that adds a role claim and blocks unverified emails · js

exports.onExecutePostLogin = async (event, api) => {
  if (!event.user.email_verified) {
    api.access.deny('Please verify your email first.');
    return;
  }
  const roles = event.authorization?.roles ?? [];
  api.idToken.setCustomClaim('https://example.com/roles', roles);
  api.accessToken.setCustomClaim('https://example.com/roles', roles);
};

See it in a real stack

No architecture uses Auth0 yet. Drop it into the playground and wire it up yourself.Open playground →
Where it came from2013–2026

Eugenio Pace and Matias Woloski founded Auth0 in early 2013 while living 7,000 miles apart. Pace’s launch post in February 2013 promised identity management that “just works”: one API for connecting apps to Office 365, Google Apps, Active Directory and social logins such as Facebook and Twitter, with single sign-on, user lookup and auditing.

Auth0 grew by selling to developers first, with a free tier and extensibility through Rules, small JavaScript functions that ran after login. In 2020 it introduced Actions to replace Rules and Hooks with versioned functions and an editor, later made them generally available, and in 2021 added Organizations for B2B apps. Pace became chief executive in December 2017.

In March 2021 Okta agreed to buy Auth0 in a stock deal valued at about $6.5 billion, and completed the acquisition on May 3, 2021. Auth0 kept its brand and platform as an independent business unit led by Pace; Okta’s announcement described it as “built by developers for developers”, next to Okta’s enterprise identity products.

Why it’s built this way

Hosted login pages instead of an embedded widget
With Universal Login the credentials are typed into Auth0’s domain, not the app’s, and new methods such as passwordless or MFA can be enabled without changing application code.
Extensibility through code, not just settings
Every customer’s login had some special case. Rules, and later Actions, let developers run their own JavaScript inside the login pipeline instead of waiting for a checkbox.
Replace Rules and Hooks with Actions
Rules and Hooks had no version history and separate models. Actions unified them with triggers, an api object for side effects, npm packages and drafts that can be tested before deploying.

Timeline

  1. 2013

    Founded by Eugenio Pace and Matias Woloski; launch post in February

  2. 2017

    Co-founder Eugenio Pace becomes CEO

  3. 2020

    Actions introduced as the successor to Rules and Hooks

  4. 2021

    Okta completes its acquisition of Auth0 (about $6.5B) on May 3; Organizations introduced

  5. 2023

    Rules and Hooks no longer available to new tenants (October 16)

  6. 2026

    Rules and Hooks end of life on November 18

Sources10 · facts checked 6 October 2026

Improve this page on GitHub