Understand How Metadata Works in User Profiles

Auth0 uses three types of metadata to store specific kinds of information:

Metadata Type	Field Name	Description
User Information	`user_metadata`	Stores user attributes such as preferences that do not impact a user’s core functionality. This data can be edited by logged in users if you build a form using the Management API and should not be used as a secure data store.
Access Information	`app_metadata`	Stores information such as permissions, Auth0 plan, and external IDs that can impact user access to features. This data cannot be edited by users and there are restrictions for what can be stored in this field.
Application Information	`client_metadata` in the `Client` object, `context.clientMetadata` in Rules, and `event.client.metadata` in post-login Actions.	Stores information about an application (or client in OIDC OAuth2 terminology). For example, the URL for the application home page (any value that Auth0 doesn’t set in the application settings).

You can use metadata to:

Store application-specific data in the user profile.
Record whether or not specific operations have occurred for a user.
Cache the results of expensive operations on the user profile so they can be re-used in future logins.
Store information that does not originate from an or that overrides what an identity provider supplies.
Store information that you want to use to customize Auth0 emails. For example, use user_metadata.lang if you want the user to be able to change the field’s value, then use the information to customize the language for an email.

The metadata can be modified as part of a user’s login flow.