# Auth0

![brand_evolution_logo_Auth0_black.png](https://assets.relyanceuat.xyz/images/docs/5693049824269/5686507256845.png)
Auth0 is a flexible, drop-in solution to add authentication and authorization services to your applications. Typically used by SaaS companies, it helps organizations avoid the cost, time, and risk that comes with building their own solution.

In order to connect Relyance AI with Auth0, you'll need to set up a **Two Legged Oauth2** connection. This requires an **Auth0 Subdomain**, **Client ID**, **Client Secret**, **Two letter Region**, and **Audience API**.

*There may be a number of ways to connect to Auth0 using pre-existing API's or Applications, in this example we're creating an application specifically for Relyance AI.*

#### In Auth0:

![Auth0-1.png](https://assets.relyanceuat.xyz/images/docs/5693049824269/5692623178125.png)
1. Login to your Auth0 account.
2. Navigate to **Applications** folder in the left-hand menu.
3. Click on the **Applications** sub-node.
4. Click on '**Create Application**'.

5. Name the Application 'Relyance AI' for easy identification and select 'Machine to Machine' Applications.

![Auth0-2.png](https://assets.relyanceuat.xyz/images/docs/5693049824269/5692672280205.png)

6. You should be asked at this point to Authorize a Machine to Machine application. Select a pre-configured API in the drop-box.

![Auth0-3.png](https://assets.relyanceuat.xyz/images/docs/5693049824269/5692902206861.png)

7. You'll get a permissions dialog in the next step. Put '**read**' into the filter permissions and click on '**All**' to select only read permissions; remove any unneeded permissions.

![Auth0-4.png](https://assets.relyanceuat.xyz/images/docs/5693049824269/5692915221517.png)

8. Click '**Authorize**'.
9. This will bring you to the Quick Start guide for your newly created Application.
10. Go into the **Settings** tab and find the Basic Information section.

![Auth0-5.png](https://assets.relyanceuat.xyz/images/docs/5693049824269/5692960474765.png)

In this section, you'll have the **Auth0 Subdomain**, **Two Letter Region**, **Client ID**, and **Client Secret**.

The first section in the **Domain** field is the **Auth0 Subdomain** (in this case '*dev-763x99ap*'). The second section in the **Domain** field is the **Two Letter Region** (in this case '*us*'). Copy these values with the **Client ID** and **Client Secret** to be used in Relyance AI.
11. Click on the API's tab and you'll see the **API identifier** which is the **Audience API**.

![Auth0-6.png](https://assets.relyanceuat.xyz/images/docs/5693049824269/5693002473997.png)

12. Once you have these values we can use them in the Relyance AI integration.

#### In the Relyance AI application:

1. Login to your Relyance account.
2. Navigate to the **Settings** Menu in the bottom left-hand side.
3. Select **Integrations**.
4. Click on the **Vendors and Data Stores** filter.
5. Find the **Auth0** integration card and click it to open its connections.
6. On the **Authentication** step, pick the method under **Authentication Method**.
7. Choose **Two Legged 0auth2** under **Authentication Method**.
8. Paste the **Auth0 Subdomain**, **Client ID**, **Client Secret**, **Two letter Region**, and **Audience API** values from the Auth0 application into their respective fields.
9. Click **Authenticate**.
10. At this point, you should see the following result on the Vendor Integrations page:
11. Congratulations, you are now connected to **Auth0**.

![Auth0-7.png](https://assets.relyanceuat.xyz/images/docs/5693049824269/5693486863629.png)

![Auth0-8.png](https://assets.relyanceuat.xyz/images/docs/5693049824269/5693538821005.png)

<!-- failure-modes:begin (generated from the integration catalog; do not hand-edit) -->

## If the connection reports Connected but returns nothing

These are the ways this integration comes back empty without reporting an error. Generated from the integration catalog, so it tracks what the connection actually asks for.

1. **Authorised, then empty.** The connection carries an authorisation, not a password: it stops returning data if the account that granted it loses access, its own permissions narrow, or the grant is revoked at the vendor. None of that reports an error here -- the connection keeps its last status until the next scan.
2. **A credential rotated at the vendor is not picked up here.** **Client Secret**, **Two Letter Region (Eg: us)** and **Audience API** are stored when you save the connection, so regenerating the value at the vendor breaks the next scan until it is re-pasted here. Recording the expiry on the connection means Relyance warns you before it lapses.
3. **Check the address fields before suspecting the credentials.** **Auth0 Subdomain** and **Two Letter Region (Eg: us)** identify which tenant, region or host to talk to. A wrong value there fails authentication and looks exactly like a bad secret.

<!-- failure-modes:end -->

<!-- terraform-examples:begin (generated from the integration catalog; do not hand-edit) -->

## Manage this integration with Terraform

Connections for this integration can be managed as code with the [Relyance Terraform provider](https://registry.terraform.io/providers/Relyance/relyance/latest). Non-secret fields go in `auth.params`; secret fields go in `auth.secrets_wo`, which is write-only — never stored in Terraform state. Rotate secrets by bumping `auth.secrets_wo_version`.

```hcl
resource "relyance_integration_connection" "auth0" {
  vendor = "auth0"
  name   = "<your connection name>"

  auth = {
    method = "oauth-client-credentials"
    params = {
      subdomain = "<subdomain>"
      client_id = "<client_id>"
      data_storage_location = "us"
    }
    # Secret fields are write-only: sent to Relyance, never stored in state.
    secrets_wo = {
      client_secret = var.auth0_client_secret
      region = var.auth0_region
      audience = var.auth0_audience
    }
    secrets_wo_version = 1
  }

  scans = { "property-inspection" = { enabled = true } }
}
```

<!-- terraform-examples:end -->