Auth0 Getting Started: Account Creation & First API Call (2026)

Getting started overview

This guide provides a focused path for developers to initiate their work with Auth0. It covers the essential steps from creating an account and configuring an application to making an initial authenticated request. The objective is to establish a functional setup that can be expanded upon for more complex identity management scenarios. Auth0 provides various quickstart guides for specific technologies.

Auth0's core functionality revolves around managing user identities and access. It supports standard OAuth 2.0 and OpenID Connect (OIDC) protocols, which are fundamental for securing web, mobile, and legacy applications. Understanding these protocols is beneficial for advanced configurations, but Auth0's SDKs abstract much of the complexity for initial setup.

The process typically involves:

1. Signing up for an Auth0 account.
2. Creating a new application in the Auth0 Dashboard.
3. Configuring application settings, including callback URLs and allowed origins.
4. Retrieving application credentials (Domain, Client ID, Client Secret).
5. Integrating an Auth0 SDK into your application or making a direct API call.
6. Testing the authentication flow.

This guide will focus on the first five steps, culminating in a successful API interaction using your new credentials.

Create an account and get keys

To begin using Auth0, you must first establish an account and then create an application within the Auth0 management dashboard. This process generates the necessary credentials for your application to interact with Auth0's authentication services.

1. Sign up for an Auth0 Account

Navigate to the Auth0 signup page. You can register using an email address, a Google account, or a GitHub account. The free tier includes 25,000 monthly active users (MAUs), 5 organizations, and 1 social connection, which is sufficient for initial development and testing. Upon successful signup, you will be redirected to your Auth0 Dashboard.

2. Create a New Application

From your Auth0 Dashboard, select Applications > Applications in the left-hand navigation. Click the Create Application button. You will be prompted to choose an application type:

• Native: For mobile apps (iOS, Android, React Native).
• Single Page Web Application: For frontend web apps (React, Angular, Vue).
• Regular Web Application: For traditional server-side web apps (Node.js, Python, Java).
• Machine to Machine Application: For backend services or APIs that need to authenticate with Auth0 to access other APIs.

For most initial development involving a user interface, a Single Page Web Application or Regular Web Application is appropriate. For a backend service that needs to secure its own API or access other APIs, choose Machine to Machine Application. Give your application a descriptive name and click Create.

3. Configure Application Settings

After creating the application, you will be directed to its settings page. Key fields to configure include:

• Allowed Callback URLs: These are the URLs to which Auth0 can redirect users after authentication. For local development, this is often http://localhost:3000/callback or similar. Add all URLs your application might use for callbacks, one per line.
• Allowed Logout URLs: URLs to which Auth0 can redirect users after logout.
• Allowed Web Origins: URLs from which your application will make requests to Auth0 (e.g., for silent authentication).

Ensure these URLs are correctly configured to prevent security errors during authentication flows. For a simple test, http://localhost:3000 or http://localhost:8080 are common origins and callback URLs.

4. Retrieve Application Credentials

On the application's settings page, locate the following crucial credentials:

• Domain: Your Auth0 tenant domain (e.g., dev-yourtenant.us.auth0.com).
• Client ID: A unique identifier for your application.
• Client Secret: A confidential key used by regular web applications and machine-to-machine applications. Single-page applications and native applications typically rely on PKCE (Proof Key for Code Exchange) and do not use a client secret directly in client-side code.

These values will be used to configure your application's Auth0 SDK or to make direct API calls.

Your first request

For a basic demonstration of obtaining an access token, we will use the Client Credentials Flow. This flow is suitable for Machine to Machine (M2M) applications where a backend service needs to authenticate with Auth0 to access a protected API without a user's direct involvement. If you created a Single Page Web Application or Regular Web Application, you would typically integrate an Auth0 SDK for a more complete user authentication flow, which is beyond the scope of a single API request demonstration.

Prerequisites:

• You have created a Machine to Machine Application in Auth0.
• You have your Auth0 Domain, Client ID, and Client Secret.

Obtain an Access Token (Client Credentials Flow)

The Client Credentials flow allows your application to request an access token directly from Auth0's authorization server by presenting its Client ID and Client Secret. This token can then be used to call a protected API.

Use a tool like curl to make a POST request to your Auth0 tenant's /oauth/token endpoint. Replace YOUR_AUTH0_DOMAIN, YOUR_CLIENT_ID, and YOUR_CLIENT_SECRET with your actual credentials.

curl --request POST \
  --url 'https://YOUR_AUTH0_DOMAIN/oauth/token' \
  --header 'content-type: application/x-www-form-urlencoded' \
  --data grant_type=client_credentials \
  --data client_id=YOUR_CLIENT_ID \
  --data client_secret=YOUR_CLIENT_SECRET \
  --data audience=YOUR_API_AUDIENCE

Note on audience: The audience parameter should be the identifier of the API you intend to call. If you haven't defined an API in Auth0 yet, you can create one under Applications > APIs in your Auth0 Dashboard. The API identifier is usually a URL (e.g., https://your-api.example.com). If you only want an access token for Auth0's Management API, the audience would be https://YOUR_AUTH0_DOMAIN/api/v2/. You can find more details on setting up APIs with Auth0 in their documentation.

A successful response will return a JSON object containing an access_token, its token_type (usually Bearer), and expires_in (the token's validity duration in seconds).

{
  "access_token": "eyJ...",
  "expires_in": 86400,
  "token_type": "Bearer"
}

This access_token can now be included in the Authorization header of subsequent requests to your protected API (e.g., Authorization: Bearer eyJ...).

Common next steps

After successfully obtaining an access token, you can proceed with further integration based on your application type and requirements:

1. Integrate an Auth0 SDK: For web or mobile applications, using an official Auth0 SDK simplifies the implementation of login, logout, and token management. Auth0 provides SDKs for various platforms and frameworks, including React, Angular, Vue, Node.js, Python, Java, and mobile platforms like Android and Swift. These SDKs handle the complexities of OAuth 2.0 and OIDC flows, such as the Authorization Code Flow with PKCE.
2. Implement User Authentication (Login/Logout): For applications requiring user interaction, implement the login and logout functionality using Auth0's Universal Login. This provides a customizable, hosted login page that handles user registration, password resets, and multi-factor authentication. Refer to the Auth0 Universal Login documentation for setup details.
3. Secure Your Own API: If your application exposes its own API that needs to be protected, integrate Auth0 to validate incoming access tokens. This involves configuring your API to trust tokens issued by your Auth0 tenant and to verify their signature and claims. Auth0 offers quickstarts for securing APIs in various backend technologies.
4. Add Social Connections: Enable users to log in with their existing social accounts (e.g., Google, Facebook, GitHub). This is configured under Authentication > Social in the Auth0 Dashboard. Auth0 supports over 40 social identity providers.
5. Implement Multi-Factor Authentication (MFA): Enhance security by enabling MFA for your users. Auth0 supports various MFA factors, including SMS, push notifications, and authenticator apps. Details are available in the Auth0 MFA configuration guide.
6. Explore Auth0 Actions: For advanced customization of authentication and authorization flows, use Auth0 Actions. These are serverless functions that allow you to execute custom Node.js code at specific points in the authentication pipeline, such as after a user logs in or before a token is issued. Learn more about Auth0 Actions.

Troubleshooting the first call

When making your first API call to Auth0, several common issues can arise. Here's how to diagnose and resolve them:

• Incorrect Domain:
  • Symptom: 404 Not Found or DNS resolution errors.
  • Resolution: Double-check that your Auth0 Domain in the curl command matches the Domain listed in your Auth0 Application settings (e.g., dev-yourtenant.us.auth0.com). Ensure there are no typos and no trailing slashes.
• Invalid Client ID or Client Secret:
  • Symptom: 401 Unauthorized or invalid_client error in the response body.
  • Resolution: Verify that the client_id and client_secret in your request exactly match those from your Auth0 Application settings. Copy and paste them directly to avoid transcription errors. Remember that the Client Secret is only used for Regular Web Applications and Machine-to-Machine Applications.
• Missing or Incorrect audience:
  • Symptom: invalid_scope or invalid_request error, or an access token is returned but cannot be used with your target API.
  • Resolution: The audience parameter specifies the API for which the access token is intended. Ensure it is set to the identifier of an API configured in your Auth0 Dashboard (e.g., https://your-api.example.com or https://YOUR_AUTH0_DOMAIN/api/v2/ for the Management API). If you haven't defined an API, create one under Applications > APIs.
• Incorrect grant_type:
  • Symptom: unsupported_grant_type error.
  • Resolution: For the Client Credentials Flow, the grant_type must be client_credentials. Ensure this is spelled correctly in your request.
• Content Type Header:
  • Symptom: Request body not parsed correctly, leading to various errors.
  • Resolution: Ensure the Content-Type header is set to application/x-www-form-urlencoded for the /oauth/token endpoint when using form data, as shown in the curl example.
• Network Issues or Firewall:
  • Symptom: Request timeouts or connection refused errors.
  • Resolution: Verify your internet connection. If you are behind a corporate firewall, ensure that connections to Auth0 domains (e.g., *.auth0.com) are permitted.
• Review Auth0 Logs:
  • Symptom: Unclear error messages.
  • Resolution: The Auth0 Dashboard provides detailed logs of authentication attempts and API calls. Navigate to Monitoring > Logs to see specific error messages and context for failed requests, which can help pinpoint the exact problem.