Skip to main content
Rules will reach end of life (EOL) on January 31, 2028.
  • As of October 16, 2023, Rules are no longer available in newly created tenants.
  • As of November 18, 2024, Rules are read-only. Active Rules still run, and you can enable or disable them and change their configuration values and secrets. You can’t edit their code in the Dashboard, the Management API, or tools that use it, such as the Auth0 CLI, Deploy CLI, Terraform, and Agent Skills.
  • After January 31, 2028, Rules stop running and are removed.
Use Actions to extend Auth0:
You can build your own rule(s) to support your specific functionality requirements. You can modify a pre-existing rule template or choose to start from scratch using one of our samples. Auth0 provides a number of pre-existing rules and rule templates to help you achieve your goal(s). To see a list, visit our rules repository on GitHub.

​
How rules work

Rules are JavaScript functions that execute when a user authenticates to your application. They run once the authentication process is complete, and you can use them to customize and extend Auth0’s capabilities. For security reasons, your rules code executes isolated from the code of other Auth0 tenants in a sandbox. Rules also run during the token refresh flow. To learn more, read Refresh Tokens. In Auth0, the authentication transaction flow works as follows when you use rules:
Rules in the Authentication Flow diagram
  1. An app initiates an authentication request to Auth0.
  2. Auth0 routes the request to an identity provider through a configured connection.
  3. The user authenticates successfully.
  4. The ID token and/or access token is passed through the rules pipeline, then sent to the application.

​
Prerequisite

If you plan to use global variables in your rule, be sure to configure your rules variables first. To learn more, read Configure Global Variables for Rules.

​
Use the Dashboard

  1. Go to Dashboard > Auth Pipeline > Rules and click Create.
    Dashboard - Auth Pipeline - Rules
  2. Select a rule template.
    Dashboard - Auth Pipeline - Rules - Template
  3. Name the rule, modify the script to suit your needs, and click Save changes.
    Dashboard - Auth Pipeline - Rules - Edit Rule

​
Use the Management API

Make a POST call to the Create Rule endpoint. Be sure to replace MGMT_API_ACCESS_TOKEN, RULE_NAME, RULE_SCRIPT, RULE_ORDER, and RULE_ENABLED placeholder values with your , rule name, rule script, rule order number, and rule enabled value, respectively.
Using the Auth0 CLI? If you haven’t already, set up and authenticate your CLI session before running this command.
We expose IPv6 addresses in our public endpoints (e.g., travel0.us.auth0.com). If a request arrives from a machine that supports IPv6, then the context.request.ip property will contain an IPv6 address. If you perform manual IP address manipulation, we suggest you use the ipaddr.js@1.9.0 library.

​
Manage rate limits

For rules that call Auth0 APIs, you should always handle rate limiting by checking the X-RateLimit-Remaining header and acting appropriately when the number returned nears 0. You should also add logic to handle cases in which you exceed the provided rate limits and receive the HTTP Status Code 429 (Too Many Requests); in this case, if a retry is needed, it is best to allow for a back-off to avoid going into an infinite retry loop. To learn more about rate limits, read Rate Limit Policy For Auth0 APIs.

​
Available modules

Rules run in a JavaScript sandbox configured for a specific Node.js version. The sandbox supports all versions of the JavaScript language (and associated syntax) for the configured Node.js version, and a large number of Node.js modules. For a list of supported sandbox modules, check out Can I require: Auth0 Extensibility.

​
Learn more