You can extend Auth0 capabilities using organization metadata and Actions, or use our APIs and SDKs to build organization administration dashboards for your users.

Availability varies by Auth0 plan

Your Auth0 plan or custom agreement affects whether this feature is available. To learn more, read Pricing.

​
Extensibility

Organizations support our extensibility points, so you can define properties within organization metadata and expose that data to Actions. This allows you to customize capabilities for individual customers or applications; for example, you can execute custom logic in Actions for certain customers based on their subscription plan by storing that information in organization metadata.

​
Actions event object

The Action event object stores contextual information about the current authentication transaction, such as the user’s IP address, application, or location. If you change token content using the event object within an Action, your changes will be available in tokens after all Actions have finished running.

​
SDKs

To allow members to self-manage their organizations, you can assign roles to members, and use our API and SDKs to build dashboards in your products. Administrators can configure (SSO), invite users to organizations, assign members to organizations, assign roles to members, and so on. Example tasks you may want to perform with organizations using the SDKs are outlined below.
The examples below reference the org_id claim available by default in ID and access tokens. However, you can configure your tenant to also support the use of organization names in the Authentication API. This results in tokens containing both the org_id and org_name claims. If present, validate the org_name claim in addition to org_id to ensure the received values correspond to a trusted entity.In general, using organization IDs is the preferred method for validating tokens. However, organization names can be used if they are more appropriate for your use case. To understand the potential implications of using organization names to validate tokens, review Use Organization Names in Authentication API.

​
I want users to log in to a specified organization

When defining a new client, pass the organization ID into an organization parameter. Then on callback, ensure that the organization returned in the is the same one that was sent in the /authorize request by validating the org_id claim in the same way that other claims like exp and nonce are validated. To learn more, read:

​
From my application, I want to get the organization to which the authenticated user logged in

If the user was authenticated using an organization, the organization ID will appear in the org_id claim in the ID token. Using the Auth0 SPA SDK, this can be retrieved as follows: const { org_id } = await client.getIdTokenClaims();

​
From my API, I want to get the organization with which the access token was issued

If the user was authenticated using an organization and an was specified, the will be a and will contain the org_id claim with the ID of the organization to which the user logged in. This can be validated along with the other claims on the backend, as in the following example for Ruby: 
class JsonWebToken
  def self.verify(token)
    decoded = JWT.decode(token, nil,
               true, # Verify the signature of this token
               algorithms: 'RS256',
               iss: 'https://YOUR_DOMAIN/',
               verify_iss: true,
               aud: Rails.application.secrets.auth0_api_audience,
               verify_aud: true) do |header|
      jwks_hash[header['kid']]
    end

    // Retrieve the organization ID value from the decoded token
    org = decoded[0]['org_id']
  end
end
Find Your Auth0 DomainIf your Auth0 domain is your tenant name, your regional subdomain (unless your tenant is in the US region and was created before June 2020), plus .auth0.com. For example, if your tenant name were travel0, your Auth0 domain name would be travel0.us.auth0.com. (If your tenant were in the US and created before June 2020, then your domain name would be https://travel0.auth0.com.)If you are using custom domains, this should be your custom domain name.

​
Learn more