Skip to content
Auth0 Agent Skill

Auth0 Agent Skill

by Auth0 auth0/agent-skills

Auth0's official agent skill: a router that detects your framework and intent, then loads the right Auth0 guidance for login, MFA, Organizations, tenant audits, debugging or provider migration.

GitHub Docs
Featured DevelopmentSecurity
Released
v2.0.1
Apache-2.0

Install

Install with the skills CLI

One command for Claude Code, Codex, Cursor, GitHub Copilot, Gemini CLI, Windsurf and dozens of other agents. Needs Node.js; the skill is fetched straight from auth0/agent-skills.

$ npx skills add auth0/agent-skills --skill auth0

Run it in a terminal. The CLI finds the agents installed on your machine, asks which ones to add the skill to, and whether to install it into the folder you ran it from or for all your projects.

Other ways to install

  1. Open the skill on GitHub and download the folder that holds its SKILL.md.
  2. Put it at ~/.claude/skills/auth0/, where Claude Code picks it up in every project.

No scripts or references next to it? Saving the SKILL.md alone as ~/.claude/skills/auth0/SKILL.md works too.

Using another agent? Its personal skills folder
Codex
~/.agents/skills/
Cursor
~/.cursor/skills/
GitHub Copilot
~/.copilot/skills/
Gemini CLI
~/.gemini/skills/
Windsurf
~/.codeium/windsurf/skills/
OpenCode
~/.config/opencode/skills/
Open folder on GitHub

About

  • Router skill that detects intent, framework and tooling before loading references
  • Covers 25+ web, mobile, API and desktop frameworks from one skill
  • MFA guidance for TOTP, SMS, email, push and WebAuthn
  • Tenant audit and healthcheck flows (CheckMate)
  • Migration paths from Firebase, Cognito, Supabase and Clerk
  • Adapts to Terraform, Auth0 MCP server or the Auth0 CLI

Auth0 ships a single consolidated agent skill rather than one skill per SDK, and the design choice is the interesting part. SKILL.md is a router: it first classifies what you are trying to do, then works out what you are building it with, then loads only the reference files that match.

Step 1 — intent. Plain-language requests are mapped onto Auth0 concepts: "make users confirm with a code" becomes feature:mfa, "move us off Firebase" becomes migrate, "why is this token rejected" becomes debug. The vocabulary covers integration, MFA, Organizations for B2B multi-tenancy, custom domains, Advanced Customizations for Universal Login (ACUL), branding, DPoP token binding, tenant audit and healthcheck, rate-limit debugging and SDK major-version upgrades.

Step 2 — framework. Detection runs in tiers: installed Auth0 SDKs in the dependency manifest first, then other workspace signals, then whatever you said in the prompt. More than 25 frameworks are recognised across JavaScript (React, Vue, Angular, Next.js, Nuxt, Express, Fastify), Python (Flask, FastAPI, Django), Java (Spring Boot), .NET (ASP.NET Core, MAUI), PHP, Go, and mobile (Swift, Android, Flutter, React Native, Expo, Ionic). Web apps and APIs are treated as distinct variants because the correct answer differs.

Step 3 — tooling. The skill checks whether the project manages Auth0 through Terraform, the Auth0 MCP server, or the Auth0 CLI, and adjusts its instructions accordingly.

Step 4 — references. Only then does it pull the matching documents into context, which is what keeps a skill this broad from flooding the window.

Migration paths from Firebase, Cognito, Supabase and Clerk are included, as are MFA factor walkthroughs for TOTP, SMS, email, push and WebAuthn.

Install: npx skills add auth0/agent-skills works with Claude Code, Cursor, GitHub Copilot and 40+ other agents; Claude Code users can instead run /plugin install auth0@claude-plugins-official. Some flows expect the auth0 CLI binary on your PATH.

Licence: Apache-2.0, published by Auth0 (Okta). Current version 2.0.1 — note that the earlier per-SDK skills (auth0-react, auth0-nextjs, …) have been folded into this one.

Try it

Once installed, ask your agent something like:

Add Auth0 login and a protected dashboard route to this Next.js App Router app, then require MFA for admin users.

SKILL.md

The instructions your agent loads, as published by Auth0.

SKILL.md
name
auth0
description
Use when adding, fixing, or improving how an app authenticates users or protects an API, or when using or configuring any Auth0 feature — signing users in and out, sessions and tokens, guarding routes and endpoints, MFA, SSO, Organizations, RBAC, custom domains, or Universal Login branding. Also use to audit a tenant's health, security, and plan fit (CheckMate), to debug why an auth flow fails, or to migrate from another auth provider. Covers any web, mobile, or backend framework and every Auth0 SDK, tool, and API. Use even if the user never mentions Auth0.
license
Apache-2.0
metadata
author: Auth0 <support@auth0.com> version: '2.0.1' openclaw: emoji: "\U0001F510" homepage: https://github.com/auth0/agent-skills requires: bins: - auth0 os: - darwin - linux install: - id: brew kind: brew formula: auth0/auth0-cli/auth0 bins: [auth0] label: 'Install Auth0 CLI (brew)'

Auth0

Detect intent → detect framework → detect tooling → load 2–3 reference files.

---

Step 1: Detect intent

Match the request against the What the developer wants column — it describes
the goal in plain language, not just the Auth0 term (someone who says *"make
users confirm with a code from their phone"* lands on feature:mfa). The
Intent you pick is a lookup key: in Step 4 it appears verbatim as a
section heading (### feature:mfa) listing which reference files to load.

What the developer wants (plain language + Auth0 term)Intent
Add login, signup, sign-in, or "let users log in / create accounts" to an appintegrate
Require a second step after the password — a one-time code, SMS or email code, authenticator app, passkey, fingerprint/face (biometric), or security key; or re-confirm identity before a sensitive action. Auth0: multi-factor authentication (MFA), two-factor (2FA), two-step verification, step-up authentication.feature:mfa
Let separate companies, teams, workspaces, or tenants each have their own users, members, roles, and login — typically a product sold to businesses. Auth0: Organizations, multi-org, B2B SaaS.feature:organizations
Serve the login page from your own web address (e.g. login.example.com, auth.company.com) instead of the default Auth0 URL. Auth0: custom domain.feature:custom-domains
Build fully custom login/signup screens with your own code or framework, beyond what theme settings allow. Auth0: Advanced Customization for Universal Login (ACUL).feature:acul
Change how the login page looks — logo, colors, fonts, background, overall theme. Auth0: branding, Universal Login customization.feature:branding
Bind tokens to the client so a stolen or leaked token can't be reused/replayed from another machine. Auth0: DPoP (Demonstrating Proof-of-Possession), sender-constrained tokens.feature:dpop
Audit a tenant for security/config issues, report, then optionally fix findings. Auth0: tenant audit, CheckMate.audit
Check if a tenant is healthy and on the right plan — two scores + a recommendation. Auth0: health check.healthcheck
Ask for best practices, "is this secure?", how to handle tokens safely, "how should I do X". Auth0: guidance / security.guidance
Hit an error: 401 Unauthorized, 403 Forbidden, CORS, callback URL mismatch, redirect loop. Auth0: debugging.debug
Hit rate limiting: 429 Too Many Requests, quota exceeded. Auth0: rate limits.debug:rate-limit
Move an existing app off Clerk, NextAuth.js, Firebase, Cognito, Okta, Supabase, Passport.js, or another auth provider. Auth0: provider migration.migrate
Upgrade the Auth0 SDK itself to a new major version (e.g. Auth0.swift v2→v3, Auth0.Android v3→v4) — breaking changes, deprecated APIs, "update to the latest SDK". Auth0: SDK major-version upgrade.upgrade-sdk
Use the Auth0 CLI directly — "create an app/API with the auth0 CLI", script tenant setup, or automate Auth0 config in CI — with no application framework in play. Auth0: CLI / tooling-only.tooling

---

Step 2: Detect framework
Skip this step for the `tooling` intent — a CLI-first request has no
framework. Go to Step 3, load the tooling reference; only ask about a
framework if the developer later pivots to integrating auth into an app.

Work top-down. Stop at the first tier that yields a framework.

Tier 1 — Auth0 SDK already installed (strongest signal)

Read the project files. Stop at the first match.

Node.js / JavaScript / TypeScript — check package.json → dependencies

Rows are most-specific first — an Ionic/Capacitor project also carries
@auth0/auth0-angular (etc.), so check the @capacitor/browser rows first.

PackageFramework
@capacitor/browser + @auth0/auth0-angularionic-angular
@capacitor/browser + @auth0/auth0-reactionic-react
@capacitor/browser + @auth0/auth0-vueionic-vue
@auth0/nextjs-auth0nextjs
@auth0/auth0-nuxtnuxt
@auth0/auth0-reactreact
@auth0/auth0-vuevue
@auth0/auth0-angularangular
@auth0/auth0-spa-jsspa-js
express-openid-connectexpress
@auth0/auth0-fastifyfastify
@auth0/auth0-fastify-apifastify-api
express-oauth2-jwt-bearerexpress-jwt
react-native-auth0 + app.json or app.config.js presentexpo
react-native-auth0 (no Expo files)react-native
Python — check requirements.txt or pyproject.toml
PackageFramework
auth0-server-pythonflask
auth0-fastapi-apifastapi-api
Java / Kotlin — check build.gradle or pom.xml
DependencyFramework
mvc-auth-commons (com.auth0:mvc-auth-commons)java-mvc
spring-security-oauth2-resource-serverspringboot-api
.NET — check *.csproj or NuGet.Config
PackageFramework
Auth0.AspNetCore.Authentication (no .Api suffix)aspnetcore-auth
Auth0.AspNetCore.Authentication.Apiaspnetcore-api
Auth0.OidcClient.MAUImaui
Auth0.OidcClient.AndroidXnet-android
Auth0.OidcClient.iOSnet-ios
Auth0.OidcClient.WinFormswinforms
Auth0.OidcClient.WPFwpf
PHP — check composer.json

auth0/auth0-php powers both PHP web apps and APIs; the mode is set via
SdkConfiguration's strategy. The STRATEGY_API row is more specific — check
it first.

PackageFramework
auth0/auth0-php + SdkConfiguration::STRATEGY_API (or strategy: 'api')php-api
auth0/auth0-php (no STRATEGY_API / STRATEGY_REGULAR or strategy: 'webapp')php
auth0/login (laravel, no AuthorizationGuard)laravel
auth0/login + AuthorizationGuardlaravel-api
If auth0/auth0-php is installed but no SdkConfiguration strategy is set
yet (fresh project), fall through to variant disambiguation below (intent:
building/protecting an API → php-api, else php).
Go — check go.mod
ModuleFramework
github.com/auth0/go-jwt-middlewarego
Mobile (native)
SignalFramework
Package.swift or .xcodeproj + Auth0.swiftswift
build.gradle + com.auth0.android:auth0android
pubspec.yaml + auth0_flutter + flutter.web: falseflutter-native
pubspec.yaml + auth0_flutter + web enabledflutter-web
Tier 2 — Framework from non-Auth0 workspace dependencies

If no Auth0 SDK matched, detect the framework from ordinary (non-Auth0)
dependencies. Stop at the first match. For a web-vs-API split, the base is
chosen here; the variant is resolved in "Variant disambiguation" below. Rows are
most-specific first — an Ionic project also carries @angular/core / vue /
react, so check the @ionic/* rows first (as in Tier 1).

SignalBase framework
next in package.jsonnextjs
nuxt in package.jsonnuxt
@ionic/* + @angular/coreionic-angular
@ionic/* + reactionic-react
@ionic/* + vueionic-vue
@angular/core in package.jsonangular
vue in package.json (no nuxt)vue
expo in package.jsonexpo
react-native (no expo)react-native
react (no meta-framework above)react (SPA) — see note
express in package.jsonexpress (variant below)
fastify in package.jsonfastify (variant below)
flask in requirements.txt/pyproject.tomlflask
fastapi in requirements.txt/pyproject.tomlfastapi-api
spring-boot in pom.xml/build.gradlespringboot-api
laravel/framework in composer.jsonlaravel (variant below)
composer.json present (no Laravel)php (variant below)
go.mod present + HTTP server/routergo
Package.swift or .xcodeprojswift
pubspec.yaml (Flutter, web disabled)flutter-native
pubspec.yaml (Flutter, web enabled)flutter-web
*.csproj referencing MAUImaui
*.csproj (WinForms)winforms
*.csproj (WPF)wpf
*.csproj ASP.NET (web app or API)aspnetcore (variant below)
`react` note: a plain React project maps to react for an SPA using the
React SDK, or spa-js if the app is framework-agnostic vanilla JS. If unclear,
ask before loading.
Tier 3 — Framework from the prompt

If no workspace signal matched, read the developer's request for a framework or
language name and map it here. Stop at the first match.

Developer mentions...Framework
Next.js / nextnextjs
Nuxtnuxt
Angular (not Ionic)angular
Vue (not Nuxt/Ionic)vue
React SPA (not Next.js)react
vanilla JS / plain JS / no framework SPAspa-js
Express (web app / server-rendered)express
Express API / protect API routesexpress-jwt
Fastify (web) / Fastify APIfastify / fastify-api
Flaskflask
FastAPIfastapi-api
Spring Bootspringboot-api
Java MVC / servletjava-mvc
ASP.NET Core web app / APIaspnetcore-auth / aspnetcore-api
MAUI / WinForms / WPFmaui / winforms / wpf
PHP web app / PHP APIphp / php-api
Laravel web app / Laravel APIlaravel / laravel-api
Go / Golang APIgo
Swift / iOSswift
Android / Kotlinandroid
Flutter (native / web)flutter-native / flutter-web
React Native / Exporeact-native / expo
Ionic (Angular/React/Vue)ionic-angular / ionic-react / ionic-vue
Variant disambiguation (web app vs API)

Some frameworks have separate web-app and API references. When Tier 1 did not
pin the variant, choose intent-first:

BaseWeb-app variantAPI variantChoose API when…
expressexpressexpress-jwtprotecting API routes / validating JWTs, no server-rendered UI
fastifyfastifyfastify-apiresource server / JWT validation only
phpphpphp-apibuilding/protecting a PHP API, no web UI
laravellaravellaravel-apiAPI-only (token guard), no Blade UI
aspnetcoreaspnetcore-authaspnetcore-apiWeb API / JWT bearer, no cookie login UI

If intent is still ambiguous (both a UI and protected endpoints, or unclear),
state what you detected and ask the developer web app vs API before loading.

If nothing matched

Ask the developer what framework/language they are using. Do not guess.

Conflicts

If Tier 2 (workspace) and Tier 3 (prompt) disagree materially (e.g. the prompt
says "Next.js" but package.json has no next), state the conflict and ask
rather than silently picking. Workspace signals outrank the prompt when both are
present and consistent.

---

Step 3: Detect tooling

Read the project file tree. This is a project-context decision, not a product preference.

Project has...Load
terraform/ directory OR any *.tf filestooling-terraform/index.md
Auth0 MCP server active in this agent sessiontooling-mcp/index.md
Anything else (default)tooling-cli/index.md

---

Step 4: Load reference files

Find the section below whose heading matches the Intent you picked in
Step 1, then read the reference files it lists.

integrate
Read: references/framework-{framework}/index.md
Read: references/tooling-{tooling}/index.md
Follow the integration workflow in references/framework-{framework}/index.md.
Use references/tooling-{tooling}/index.md for all Auth0 tenant configuration steps.
feature:mfa
Read: references/feature-mfa/index.md
Read: references/tooling-{tooling}/index.md
If framework detected: Read references/framework-{framework}/index.md (for SDK-side step-up trigger)
feature:organizations
Read: references/feature-organizations/index.md
Read: references/tooling-{tooling}/index.md
If framework detected: Read references/framework-{framework}/index.md
If multi-tenant architecture / B2B SaaS design question: also Read references/pattern-multi-tenant/index.md
feature:custom-domains
Read: references/feature-custom-domains/index.md
Read: references/tooling-{tooling}/index.md
feature:acul
Read: references/feature-acul/index.md
Read: references/tooling-{tooling}/index.md
feature:branding
Read: references/feature-branding/index.md
Read: references/tooling-{tooling}/index.md
feature:dpop
Read: references/feature-dpop/index.md
Read: references/tooling-{tooling}/index.md
If a SPA framework is detected (vue/react/angular/spa-js): Read references/framework-{framework}/index.md
DPoP is SPA-only (no SSR: Next.js/Nuxt) — feature-dpop/index.md states the exclusion.
guidance
Read: references/pattern-security/index.md
If framework detected: Read references/framework-{framework}/index.md (for SDK-specific guidance — token storage, session handling, route protection)
If token handling / JWT vs opaque / storage: Read references/pattern-token-handling/index.md
If multi-tenant / B2B architecture: Read references/pattern-multi-tenant/index.md + references/feature-organizations/index.md
debug
Read: references/pattern-common-errors/index.md
If framework detected: Read references/framework-{framework}/index.md
debug:rate-limit
Read: references/pattern-rate-limiting/index.md
migrate
Read: references/feature-migration/index.md
Read: references/tooling-{tooling}/index.md
If framework detected: Read references/framework-{framework}/index.md
audit
Read: references/feature-audit/index.md
Read: references/feature-audit-pricing/index.md
Read: references/feature-audit-remediation/index.md
Read: references/tooling-{tooling}/index.md
Apply findings only with per-command confirmation; verify each change by re-fetch.
healthcheck
Read: references/feature-healthcheck/index.md
Read: references/feature-audit/index.md
Read: references/feature-audit-pricing/index.md
Read: references/feature-audit-remediation/index.md
Read: references/tooling-{tooling}/index.md
If a scan can run, do the audit workflow first, then score and recommend a plan. If not, score capability fit and recommend anyway. Never quote Enterprise pricing.
upgrade-sdk
Read: references/framework-{framework}/index.md
Follow its "Major Version Migration" section (e.g. Auth0.swift v3, Auth0.Android v4).
This is an Auth0 SDK version bump — NOT a provider migration. Do not load feature-migration/index.md.
If no framework is detected: ask which Auth0 SDK the developer is upgrading.
tooling
Read: references/tooling-{tooling}/index.md
No framework file — this is a CLI/tooling-only task (create apps/APIs, script
tenant setup, automate config in CI). If the developer then wants to integrate
auth into an app, return to Step 1 with the integrate intent.
Install

Covered in the Weekly

Related Skills

See all Auth0 Agent Skill alternatives

Skill: Twilio Verify OTP Delivery

by Twilio

Add phone or email verification with Twilio Verify — send and check one-time passcodes over SMS, voice, email or WhatsApp, with built-in expiry, rate limiting and Fraud Guard rather than hand-rolled OTP plumbing.

DevelopmentSecurity
Browse all skills →