Skip to main content

​
After this article

You’ll be able to connect Auth0 to Lumos to sync users and roles. This integration is read-only.

​
Capabilities

​
Required plan and roles

  • Auth0 application: you need to create a Machine to Machine application in Auth0 and authorize it against the Auth0 Management API.
  • API scopes required to sync users and roles:
    • read:users
    • read:roles
Older versions of this article also listed read:current_user and read:user_idp_tokens. The integration doesn’t use them, so you can leave them unselected or remove them from an existing application.

​
Instructions

Phase 1: Create a Machine to Machine application in Auth0
  1. Log in to Auth0 at https://auth0.com/.
  2. In Applications, click Create Application.
  3. Name it (for example, Lumos integration) and set its type to Machine to Machine Application.
  4. Authorize the application with the Auth0 Management API and select these permissions: read:users, read:roles.
  5. In the Settings tab, copy the Domain, Client ID, and Client Secret.
  6. In the Organizations tab, select all organizations you want to connect with Lumos.
Phase 2: Gather the Management API Audience
  1. Go to the APIs tab and toggle Auth0 Management API to Authorized.
  2. Copy the API Identifier to use as your Auth0 Management API audience. The audience should be in the format https://<domain>/api/v2/.
Phase 3: Connect in Lumos
  1. Click the Auth0 card in your Lumos integrations (reconnect or add new).
  2. Provide the Client ID, Client Secret, Domain, and Management API Audience.
  3. Click the Connect button.

​
API Endpoints Used

​
Troubleshooting

Not all users or roles are appearing. The Auth0 integration connects at the tenant/domain level, so make sure you selected the in-scope organizations in the Organizations tab and that all required API scopes were granted. Scoping is tenant-level and read-only, not per-client. Authentication errors after connecting. Confirm the Management API Audience is in the format https://<domain>/api/v2/, and that the Client ID, Client Secret, and Domain were copied fully from the application’s Settings tab.