# Auth0

> auth0.com | Developer services; 1 record: free tier, limits, identity cost and evidence.

HTML https://fshy.ajam.dev/p/auth0/ | JSON https://fshy.ajam.dev/api/v1/entity/auth0.json | how to read a record: https://fshy.ajam.dev/llms-full.txt

## Auth0

- `dev-services/auth0` | qualifies-with-caveat | evidence documented | binding request-rate | category hosted authentication and authorization (OAuth 2.0, OIDC, social, passwordless and enterprise login) | tier Free
- needs card no, phone unknown, ID no, institution no | verified 2026-11-02T00:37:55.407Z (live) | stale on 2026-12-03
- url https://auth0.com/pricing
- free tier: Free plan: up to 25,000 monthly active users, unlimited social connections, 5 organizations, 1 enterprise connection, 1,000 machine-to-machine authentications, 1 tenant and 3 admins; no credit card needed to sign up | unit: users | metered on: identity-count | read on: 2026-10-30 | source: [1] | note: An MAU is a non-internal user that authenticated during a month for a given tenant. The Free plan is the same for B2C and B2B. It includes 1 custom domain, which needs credit card verification, and 5 Actions + Forms. Pro MFA factors and role management are not available on Free. Each account holds one free tenant at a time.
- per-object cap: Auth0 states a user profile size limit of 10 KB, and writes over it succeed for now but may start to fail; user_metadata set through the Authentication API Signup endpoint takes at most 10 string fields of at most 500 characters each | source: [2] | note: The Management API List and Search Users endpoints index, query and return at most 1 MB of data per user.
- retention: Tenant logs are kept 1 day on Free; a Free tenant with no admin login, user login or API call for 150 days is deleted with all its data and cannot be recovered | days: 1 | source: [1] | note: Paid plans keep logs 5, 10 or 30 days. The inactivity rule is on the Auth0 support article and the data processing page.
- egress: not applicable: an authentication API; no traffic allowance or egress term is published | metered: no | source: [1]
- identity: email | detail: The sign-up page asks for an email address, or a GitHub, Google or Microsoft sign-in, and states no credit card is required. After registration a profile page asks for an Account Type when the email domain is not a corporate one or for a Role when it is, and the user is asked to create a tenant, which takes a tenant name and a region. A custom domain needs credit card verification. Whether a later step asks for a phone number is unverified: behind a sign-up.
- interface: rest
- limits:
  - volume-quota: 25,000 monthly active users [1]
  - request-rate (binding): Authentication API: 300 burst, 300 requests per minute sustained [3]
  - request-rate (binding): Management API: 2 burst, 2 requests per second sustained [3]
  - request-rate (binding): Get Token (/oauth/token): 30 requests per second [3]
  - retention-clamped: logs kept 1 day; a tenant inactive for 150 days is deleted [4]
  - write-gated: the custom domain needs credit card verification [1]
  - per-object-cap: user profile 10 KB (a soft limit: writes over it succeed for now but may start to fail) [2]
- binding note: The Management API takes 2 requests a second on Free, so any bulk user administration is slow; sign-ins share the Authentication API's 300 requests a minute.
- interface detail: Authentication API (OAuth 2.0 and OIDC endpoints such as /oauth/token and /userinfo) and Management API v2 at https://{tenant}/api/v2/ with a Bearer token; both are served on the tenant's own domain.
- endpoint: part of interface detail
- tooling: Any HTTP client or OAuth 2.0 / OIDC library against the tenant's Authentication API and Management API v2.
- composes with: An OIDC identity provider in front of apps on free compute; user import is included on Free, so users can be moved in through the Management API.
- reliability: A Free tenant inactive for 150 days is deleted and cannot be recovered; Free support is community only.
- notes: Essentials starts at USD 35 a month for 500 MAUs (B2C); paid plans add role management, MFA factors and longer log retention.
- evidence note: Every limit is quoted from the first-party pricing page, rate-limit policy, data processing page, support article and sign-up page. No probe was run, because the API is served on a per-tenant domain. A token request on a Free tenant would move it to measured.
- evidence:
  - [1] 2026-10-30: the Free plan is USD 0 with up to 25,000 MAUs | capture: sha256:fa4f71fd41fdbc5f40015d48951e580fbeb73c152e5ede8914fdf9ad43330670 | quote: | Free | $0/month | $0/month | Up to 25,000 |
  - [1] 2026-10-30: the Free plan needs no credit card to sign up | capture: sha256:fa4f71fd41fdbc5f40015d48951e580fbeb73c152e5ede8914fdf9ad43330670 | quote: No credit card needed to sign up.
  - [1] 2026-10-30: an MAU is a non-internal user that authenticated in a month for a tenant | capture: sha256:fa4f71fd41fdbc5f40015d48951e580fbeb73c152e5ede8914fdf9ad43330670 | quote: - Monthly Active Users (MAUs): Any non-internal (non-employee) user that authenticated during a given month for a given tenant.
  - [1] 2026-10-30: the Free plan is the same for B2C and B2B, 25,000 MAUs, no card | capture: sha256:fa4f71fd41fdbc5f40015d48951e580fbeb73c152e5ede8914fdf9ad43330670 | quote: - The Free plan is identical for B2C and B2B: up to 25,000 MAUs, no credit card required
  - [1] 2026-10-30: Free includes 1,000 machine-to-machine authentications | capture: sha256:fa4f71fd41fdbc5f40015d48951e580fbeb73c152e5ede8914fdf9ad43330670 | quote: | Machine-to-Machine Authentication | 1,000 | 1,000 | 5,000 | 5,000 |
  - [1] 2026-10-30: Free includes 5 organizations | capture: sha256:fa4f71fd41fdbc5f40015d48951e580fbeb73c152e5ede8914fdf9ad43330670 | quote: | Organizations | 5 | 10 | 10 | Custom Tiers |
  - [1] 2026-10-30: Free includes 1 enterprise connection | capture: sha256:fa4f71fd41fdbc5f40015d48951e580fbeb73c152e5ede8914fdf9ad43330670 | quote: | Enterprise Connections | 1 | Not available | Not available | Custom Tiers |
  - [1] 2026-10-30: Free has unlimited social connections | capture: sha256:fa4f71fd41fdbc5f40015d48951e580fbeb73c152e5ede8914fdf9ad43330670 | quote: | Social Connections | Unlimited** | Unlimited** | Unlimited** | Unlimited** |
  - [1] 2026-10-30: Free includes 1 tenant | capture: sha256:fa4f71fd41fdbc5f40015d48951e580fbeb73c152e5ede8914fdf9ad43330670 | quote: | Number of Tenants Included | 1 | 3 | 12 | Unlimited** |
  - [1] 2026-10-30: Free has 3 admins | capture: sha256:fa4f71fd41fdbc5f40015d48951e580fbeb73c152e5ede8914fdf9ad43330670 | quote: | Number of Admin/Contributors | 3 | Unlimited** | Unlimited** | Unlimited** |
  - [1] 2026-10-30: Free keeps logs 1 day | capture: sha256:fa4f71fd41fdbc5f40015d48951e580fbeb73c152e5ede8914fdf9ad43330670 | quote: | Log Retention | 1 Day | 5 Days | 10 Days | 30 Days |
  - [1] 2026-10-30: a custom domain needs credit card verification | capture: sha256:fa4f71fd41fdbc5f40015d48951e580fbeb73c152e5ede8914fdf9ad43330670 | quote: - * Custom domains require credit card verification
  - [1] 2026-10-30: Free includes 5 Actions + Forms | capture: sha256:fa4f71fd41fdbc5f40015d48951e580fbeb73c152e5ede8914fdf9ad43330670 | quote: | Actions + Forms | 5 | 10 | 15 | 30 + ADD-ON |
  - [1] 2026-10-30: Pro MFA factors are not available on Free | capture: sha256:fa4f71fd41fdbc5f40015d48951e580fbeb73c152e5ede8914fdf9ad43330670 | quote: | Pro MFA Factors | Not available | Included | Included | Included |
  - [1] 2026-10-30: role management is not available on Free | capture: sha256:fa4f71fd41fdbc5f40015d48951e580fbeb73c152e5ede8914fdf9ad43330670 | quote: | Role Management | Not available | Included | Included | Included |
  - [1] 2026-10-30: user import is included on Free | capture: sha256:fa4f71fd41fdbc5f40015d48951e580fbeb73c152e5ede8914fdf9ad43330670 | quote: | User Import | Included | Included | Included | Included |
  - [1] 2026-10-30: standard support is not available on Free | capture: sha256:fa4f71fd41fdbc5f40015d48951e580fbeb73c152e5ede8914fdf9ad43330670 | quote: | Standard Support | Not available | Included | Included | Included |
  - [1] 2026-10-30: Essentials starts at USD 35 a month for 500 MAUs | capture: sha256:fa4f71fd41fdbc5f40015d48951e580fbeb73c152e5ede8914fdf9ad43330670 | quote: | Essentials | $35/month | $150/month | 500 MAUs |
  - [3] 2026-10-30: the Authentication API allows a 300 burst and 300 a minute on Free | capture: sha256:0d43b90596b6d82d12356cc6dce43bdd55af5190df2f0e4a497aa4ce826514ac | quote: > | Authentication API | 300 | 300/minute |
  - [3] 2026-10-30: the Management API allows 2 a second on Free | capture: sha256:0d43b90596b6d82d12356cc6dce43bdd55af5190df2f0e4a497aa4ce826514ac | quote: > | Management | 2 | 2/second |
  - [3] 2026-10-30: the token endpoint allows 30 a second | capture: sha256:0d43b90596b6d82d12356cc6dce43bdd55af5190df2f0e4a497aa4ce826514ac | quote: > | Get Token | POST | `/oauth/token` | 30 | 30 per/sec | Any request |
  - [4] 2026-10-30: free tenants inactive for 150 days are deleted | capture: sha256:97641425d15433cee1522d6ac9060ed25eaad4cfc936c2de8e0bdb2a27542a4c | quote: Auth0 deletes free plan tenants that remain inactive for a continuous period of 150 days.
  - [4] 2026-10-30: a deleted tenant cannot be recovered | capture: sha256:97641425d15433cee1522d6ac9060ed25eaad4cfc936c2de8e0bdb2a27542a4c | quote: Once Auth0 deletes a tenant through this process, administrators cannot recover the tenant.
  - [4] 2026-10-30: one free tenant per account at a time | capture: sha256:97641425d15433cee1522d6ac9060ed25eaad4cfc936c2de8e0bdb2a27542a4c | quote: NOTE: Auth0 limits each account to one free tenant at a time.
  - [5] 2026-10-30: inactive Free customers' tenants and data are scheduled for deletion after 150 days | capture: sha256:6a64dbef089c146f1187d778566be2067c1eec3883a183f59f5701146ebac5df | quote: After 150 days of inactivity, the system schedules the inactive Customer
  - [6] 2026-10-31: the sign-up page states no credit card is required | capture: sha256:4580dfcb2f24f6297ee71c163c137cbc7aa35d801cb1e46184f4a83ce4213aba | quote: # Start building with your free plan ## No credit card required.
  - [6] 2026-10-31: the sign-up asks for an email address | capture: sha256:4580dfcb2f24f6297ee71c163c137cbc7aa35d801cb1e46184f4a83ce4213aba | quote: ## Sign up Email
  - [6] 2026-10-31: the sign-up offers GitHub sign-in | capture: sha256:4580dfcb2f24f6297ee71c163c137cbc7aa35d801cb1e46184f4a83ce4213aba | quote: Continue with GitHub
  - [6] 2026-10-31: the sign-up offers Google sign-in | capture: sha256:4580dfcb2f24f6297ee71c163c137cbc7aa35d801cb1e46184f4a83ce4213aba | quote: Continue with Google
  - [6] 2026-10-31: the sign-up offers Microsoft sign-in | capture: sha256:4580dfcb2f24f6297ee71c163c137cbc7aa35d801cb1e46184f4a83ce4213aba | quote: Continue with Microsoft
  - [7] 2026-10-31: the Management API is served at /api/v2 on the tenant domain with a Bearer token | capture: sha256:dc58bdbd35bd35214ec3ace5109f0b6e2986fda59d000b657089656839b1b9f1 | quote: > curl -H "Authorization: Bearer eyJhb..." https://@@TENANT@@/api/v2/users
  - [2] 2026-11-01: Auth0 states a 10 KB user profile size limit, and writes over it succeed for now but may start to fail | capture: sha256:3ee98c7c967ff7c0bb4d9d456afd5d782db2bd2a44cca0ae9398ed11a35be8ee | quote: Auth0 user profiles have a size limit of 10 KB. Writes that cause profiles to exceed this size limit succeed for now, but may start to fail.
  - [2] 2026-11-01: the Management API List and Search Users endpoints index, query and return at most 1 MB of data per user | capture: sha256:3ee98c7c967ff7c0bb4d9d456afd5d782db2bd2a44cca0ae9398ed11a35be8ee | quote: there is a 1 MB per-user limit on user data that can be indexed, queried, and returned when using the Management API's List or Search Users endpoint.
  - [8] 2026-11-01: after registration the profile page prompts for an Account Type when the email domain is not corporate | capture: sha256:0bdab712e6aef0abe5f531e45e880d5ccf3b44377a0c37d50205cbc48907fccd | quote: Non-corporate users: If Auth0 does not recognize the email domain as a corporate domain (for example, free email providers like Gmail), the page prompts for the Account Type.
  - [8] 2026-11-01: after registration the profile page prompts for a Role when the email domain is corporate | capture: sha256:0bdab712e6aef0abe5f531e45e880d5ccf3b44377a0c37d50205cbc48907fccd | quote: Corporate users: If Auth0 recognizes the email domain as corporate, the page prompts for the Role.
  - [9] 2026-11-01: after the account is created the user is asked to create a tenant | capture: sha256:c84d2f4570d3e6f1d42c96ca5f10bc8584692a5d50d6ee8d6f0f7bc0c178dfc4 | quote: Once you create your account you will be asked to create a tenant.
  - [9] 2026-11-01: a tenant takes a name and a region | capture: sha256:c84d2f4570d3e6f1d42c96ca5f10bc8584692a5d50d6ee8d6f0f7bc0c178dfc4 | quote: In our example, Example-Co chose the name `example-co` and AU as their region.
  - [2] 2026-11-01: user_metadata set through the Authentication API Signup endpoint takes at most 10 string fields of at most 500 characters each | capture: sha256:3ee98c7c967ff7c0bb4d9d456afd5d782db2bd2a44cca0ae9398ed11a35be8ee | quote: you can include a maximum of 10 string fields whose values do not exceed 500 characters each
  - [10] 2026-11-01: the Authentication API supports the OpenID Connect and OAuth 2.0 identity protocols | capture: sha256:d62e87b0126d391dee960c684d402fd839320cf930738b1bb3ad1a5ebd3692cb | quote: The API supports various identity protocols, like [OpenID Connect](https://auth0.com/docs/authenticate/protocols/openid-connect-protocol.md), [OAuth 2.0](https://auth0.com/docs/authenticate/protocols/oauth.md)
  - [6] 2026-11-01: the sign-up page asks for an email address first, with GitHub, Google and Microsoft sign-in as alternatives | capture: sha256:4580dfcb2f24f6297ee71c163c137cbc7aa35d801cb1e46184f4a83ce4213aba | quote: ## Sign up Email
- sources:
  - [1] https://auth0.com/pricing
  - [2] https://auth0.com/docs/manage-users/user-accounts/metadata/metadata-fields-data
  - [3] https://auth0.com/docs/troubleshoot/customer-support/operational-policies/rate-limit-policy/rate-limit-configurations/free-public
  - [4] https://support.auth0.com/center/s/article/tenant-unban-request
  - [5] https://auth0.com/docs/secure/data-privacy-and-compliance/data-processing
  - [6] https://auth0.com/signup
  - [7] https://auth0.com/docs/api/management/v2
  - [8] https://support.auth0.com/center/s/article/auth0-prompts-for-account-type-or-role-upon-first-login
  - [9] https://auth0.com/docs/get-started/auth0-overview/create-tenants
  - [10] https://auth0.com/docs/api/authentication