Custom Development with Organizations
You can extend Auth0 capabilities using organization metadata and Actions, or use our APIs and SDKs to build organization administration dashboards for your users.
Availability varies by Auth0 plan
Your Auth0 plan or custom agreement affects whether this feature is available. To learn more, read Pricing.
Extensibility
Organizations support our extensibility points, so you can define properties within organization metadata and expose that data to Actions. This allows you to customize capabilities for individual customers or applications; for example, you can execute custom logic in Actions for certain customers based on their subscription plan by storing that information in organization metadata.
Actions event object
The Action event object stores contextual information about the current authentication transaction, such as the user's IP address, application, or location.
If you change token content using the event
object within an Action, your changes will be available in tokens after all Actions have finished running.
SDKs
To allow members to self-manage their organizations, you can assign roles to members, and use our API and SDKs to build dashboards in your products. Administrators can configure Single Sign-On (SSO), invite users to organizations, assign members to organizations, assign roles to members, and so on.
Example tasks you may want to perform with organizations using the SDKs are outlined below.
I want users to log in to a specified organization
When defining a new client, pass the organization ID into an organization parameter. Then on callback, ensure that the organization returned in the ID token is the same one that was sent in the /authorize
request by validating the org_id
claim in the same way that other claims like exp
and nonce
are validated.
To learn more, read:
From my application, I want to get the organization to which the authenticated user logged in
If the user was authenticated using an organization, the organization ID will appear in the org_id
claim in the ID token. Using the Auth0 SPA SDK, this can be retrieved as follows:
const { org_id } = await client.getIdTokenClaims();
From my API, I want to get the organization with which the access token was issued
If the user was authenticated using an organization and an audience was specified, the access token will be a JWT and will contain the org_id
claim with the ID of the organization to which the user logged in.
This can be validated along with the other claims on the backend, as in the following example for Ruby:
class JsonWebToken
def self.verify(token)
decoded = JWT.decode(token, nil,
true, # Verify the signature of this token
algorithms: 'RS256',
iss: 'https://YOUR_DOMAIN/',
verify_iss: true,
aud: Rails.application.secrets.auth0_api_audience,
verify_aud: true) do |header|
jwks_hash[header['kid']]
end
// Retrieve the organization ID value from the decoded token
org = decoded[0]['org_id']
end
end
Was this helpful?