Auth0 (Edge)

Last updated on Sep 25, 2026

Auth0 is an identity and access management (IAM) platform that provides authentication and authorization services for web, mobile, and legacy applications. It enables businesses to manage user identities, secure APIs, implement single sign-on (SSO) and multi-factor authentication (MFA), and build custom login and access control experiences for their applications without having to build and maintain this infrastructure themselves.

Hevo uses the Auth0 Management API to replicate data to the Destination of your choice. To authenticate, Hevo uses Client Credentials for a Machine-to-Machine (M2M) application authorized for the Management API. You must provide Hevo with the credentials of this M2M application created in your Auth0 account.

Supported Features

Feature Name	Supported
Capture deletes	Yes
History mode	No
Custom data (user-configured tables & fields)	No
Data blocking (skip objects and fields)	Yes
Resync (objects and Pipelines)	Yes
API configurable	No

Getting Started

Setup

Data Sync

Prerequisites

An active Auth0 account from which data is to be ingested.
You have Admin access to the Auth0 account to create a Machine-to-Machine (M2M) application and authorize it for the Auth0 Management API.
The required credentials are available to provide Hevo access to your Auth0 account.

Obtain the Auth0 Credentials

To connect Hevo to your Auth0 account, you must create a Machine-to-Machine application in your Auth0 account and authorize it to access the Auth0 Management API.

Perform the following steps to obtain the credentials:

Log in to your Auth0 dashboard as a user with Admin access.
In the left navigation pane, under Applications, click Applications.
On the Applications page, click + Create Application.
In the Create application pop-up window, specify a name for the application, select Machine to Machine Application as the application type, and click Create.
In the Authorize Machine to Machine Application screen, select the Auth0 Management API from the Select an API drop-down.
Select the following permissions required to replicate the objects supported by Hevo, and then click Authorize:
- read:tenant_settings
- read:users
- read:logs
- read:clients
- read:client_keys
- read:connections
- read:connections_options
- read:roles
- read:organizations
- read:organization_members
- read:organization_member_roles
- read:actions
- read:client_grants
- read:grants
- read:resource_servers
- read:log_streams
- read:event_streams
- read:stats
Click the Settings tab, then click the copy icon to copy the values for the Domain, Client ID, and Client Secret, and save them securely like any other password.
Click the API Access tab and then click the copy icon under Auth0 Management API to copy the API Audience value.

Use these credentials when configuring your Auth0 Source in Hevo. If the Client Secret configured in the Pipeline is revoked manually from your Auth0 account, Hevo cannot authenticate with the Source. As a result, all active jobs for the Pipeline fail, and no data is replicated. To resume data replication, modify the Source configuration in the Pipeline with a valid Client Secret. Once the updated key is saved, Hevo re-authenticates the Source, and data ingestion resumes from the last saved offset.

Configure Auth0 as a Source in your Pipeline

Perform the following steps to configure your Auth0 Source:

Click Pipelines in the Navigation Bar.
Click + Create Pipeline in the Pipelines List View.
On the Select Source Type page, select Auth0.
On the Select Destination Type page, select the type of Destination you want to use.
In the Configure Source screen, specify the following:
- Source Name: A unique name for your Source, not exceeding 255 characters. For example, Auth0 Source.
- In the Connect to your Auth0 account section, specify the following:
  - Domain: The domain of the Machine-to-Machine App in your Auth0 account. For example, your_domain.us.auth0.com.
  - Client ID: The client ID of the Machine-to-Machine App in your Auth0 account.
  - Client Secret: The secret key associated with the client ID.
  - API Audience: The API identifier for the Machine-to-Machine App in your Auth0 account. For example, https://your_domain/api/v2/.
Click Test & Continue to test the connection to your Auth0 Source. Once the test is successful, you can proceed to set up your Destination.

Data Replication

Hevo replicates data for all the objects selected on the Configure Objects page during Pipeline creation. By default, all supported objects and their available fields are selected. However, you can modify this selection while creating or editing the Pipeline.

Hevo ingests the following types of data from your Source objects:

Historical Data: The first run of the Pipeline ingests all available historical data for the selected objects and loads it into the Destination.
Incremental Data: Once the historical load is complete, new and updated records for objects are ingested as per the sync frequency.

For the following objects, Hevo ingests only the incremental data in subsequent Pipeline runs:

Logs
Log Detail Accessed Secret
Stats Daily
Users
User Identities
User App Metadata
User Metadata
User Profile Data

Hevo also re-fetches data for the Stats Daily object every 7 days. This captures any updates made to previously ingested data and keeps your Destination up to date.

For all other objects, Hevo re-fetches the entire data during each Pipeline run:

Auth0 enforces a rate limit on the number of calls that can be made to its Management API in a given time period. The rate limits vary by Auth0 plan and deployment type and may include both sustained and burst limits. If this limit is exceeded, a rate limit exception occurs. To understand how Hevo handles such scenarios, read Handling Rate Limit Exceptions.

Note: You can create a Pipeline with this Source only using the Merge load mode. The Append mode is not supported for this Source.

Schema and Primary Keys

Hevo uses the following schema to upload the records to the Destination. For a detailed view of the objects, fields, and relationships, click the ERD.

Click to view ERD

Data Model

The following is the list of tables (objects) that are created at the Destination when you run the Pipeline:

Object	Description
Action	Contains custom actions configured in Auth0, including when they run, their deployment status, runtime environment, and currently deployed version. It includes the following child objects: - Action Secret - Action Dependency - Action Supported Trigger - Action Integration
Action Trigger	Contains the triggers available for Actions, such as post-login or pre-user-registration, along with their binding policy and default runtime. It includes the following child objects: - Action Trigger Compatible - Action Trigger Runtime
Client	Contains configuration details of the applications registered in the Auth0 account, such as application type, allowed origins, JSON Web Token (JWT) settings, and Open Authorization (OAuth) and OpenID Connect (OIDC) settings. It includes the following child objects: - Client Callback - Client Metadata - Client Grant Type
Client Grant	Contains the permissions that define which APIs an application is allowed to request access tokens for. It includes a child object, Client Grant Scope.
Connection	Contains configuration details for the identity providers used to authenticate users, such as provider types, display settings, and sign-in options. It includes the following child objects: - Connection Metadata - Connection Realm - Connection Enabled Client
Event Stream	Contains the configuration of event streams that send Auth0 events to external destinations, such as webhooks or Amazon EventBridge.
Grants	Contains the permissions users have granted to applications to access specific APIs on their behalf. It includes a child object, Grant Scope.
Logs	Contains records of account activity, such as sign-ins, sign-outs, sign-ups, and errors, along with related details, including the application, identity provider, IP address, and location for each record. It includes a child object, Log Detail Accessed Secret. Note: Auth0 retains log data for a limited period based on your subscription plan and deletes it after that period. As a result, historical data for this object is limited to your plan’s retention window. For retention periods by plan, read Log Data Retention.
Log Stream	Contains configuration details for sending account activity records to external destinations, such as HTTP endpoints, Datadog, or Splunk, along with the current status of each setup. It includes a child object, Log Stream Sink.
Organization	Contains organization details, such as name, display name, branding, and associated application configuration, used for B2B access management. It includes the following child objects: - Organization Metadata - Organization Member - Organization Member Role
Resource Server	Contains configuration details for APIs protected by Auth0, such as unique identifiers, signing algorithms, token lifetimes, and token settings. It includes a child object, Resource Server Scopes.
Role	Contains roles configured in Auth0, including their names, descriptions, and associated permissions. It includes a child object, Role Permission.
Stats Daily	Contains account activity totals for each day, such as the number of sign-ins, sign-ups, and leaked passwords detected.
Users	Contains user profile information, such as email, name, login activity, multifactor authentication status, and account status. It includes the following child objects: - User Identities - User App Metadata - User Metadata - User Profile Data

Additional Information

Read the detailed Hevo documentation for the following related topics:

Handling of Deletes

Handling of Deletes

Hevo uses a full data refresh approach to capture delete actions for parent objects. During each Pipeline run, Hevo compares the data fetched from the Source object with the data present in the Destination table. If a record exists in the Destination but is no longer returned by the Source, the record is marked as deleted by setting the value of the metadata column __hevo__marked_deleted to True. This applies to the following objects:

Client
Client Callback
Client Metadata
_lient Grant Type
Connection
Connection Metadata
Connection Realm
Connection Enabled Client
Role
Role Permission
Organization
Organization Metadata
Organization Member
Organization Member Role
Action
Action Secret
Action Dependency
Action Supported Trigger
Action Integration
Action Trigger
Action Trigger Compatible
Action Trigger Runtime
Client Grant
Client Grant Scope
Grants
Grant Scope
Resource Server
Resource Server Scopes
Log Stream
Log Stream Sink
Event Stream
Stats Daily

For all other objects, Hevo does not support capturing deletes.

Revision History

Refer to the following table for the list of key updates made to this page:

Date	Release	Description of Change
Sep-25-2026	NA	New document.