Auth0 Authentication API

What authentication does the Auth0 Authentication API use?

The Auth0 Authentication API uses JWT bearer tokens obtained from the /oauth/token endpoint. You provide client_id and client_secret (for machine-to-machine) or authorization codes (for user flows) to receive a signed JWT. Through Jentic, these credentials are stored in your Jentic One instance and agents receive scoped tokens without handling raw secrets.

Can I initiate passwordless login with the Auth0 Authentication API?

Yes. POST to /passwordless/start with your client_id, connection set to 'email' or 'sms', and the recipient address. Auth0 sends a one-time code or magic link. Verify completion with /passwordless/verify by submitting the code. Through Jentic, search for 'start passwordless login' to load the operation schema and execute directly.

What are the rate limits for the Auth0 Authentication API?

Auth0 enforces per-tenant rate limits: the /oauth/token endpoint allows up to 300 requests per minute on free plans and higher on paid tiers. The /passwordless/start endpoint is limited to 50 emails per hour per IP. Exceeding limits returns HTTP 429 with a Retry-After header indicating when to retry.

How do I enroll MFA authenticators through the Auth0 Authentication API via Jentic?

Search Jentic for 'enroll mfa authenticator' to find the /mfa/associate operation. The schema requires an access token with the enroll scope, an authenticator_types array (e.g. ['otp']), and returns a secret and barcode_uri for TOTP setup. After enrollment, trigger /mfa/challenge during login to prompt the user for their code.

Does the Auth0 Authentication API support device authorization flow?

Yes. POST to /oauth/device/code with your client_id and scope to receive a device_code and user_code. Display the user_code to the user on the input-constrained device, then poll /oauth/token with grant_type 'urn:ietf:params:oauth:grant-type:device_code' until the user approves and a token is issued.

Can I retrieve SAML metadata from the Auth0 Authentication API?

Yes. GET /samlp/metadata/{client_id} returns the SAML 2.0 SP metadata XML for a specific application. This includes the entity ID, assertion consumer service URL, and signing certificate. Use this to configure SAML federation with enterprise identity providers without manual XML construction.

Can I limit what my agent is allowed to do with the Auth0 Authentication API?

Yes. Because Jentic One runs self-hosted, your own rules decide which Auth0 operations and credentials the agent may use, so you allow only the calls it needs, such as starting passwordless sign-in or fetching userinfo. Since Auth0 targets travel in the request body and query rather than as resource ids in the URL path, you scope by operation rather than by path parameter. Sensitive calls like token issuance at /oauth/token or token revocation at /oauth/revoke stay out of reach unless you explicitly add them.