Skip to main content
We are actively migrating customers to new behaviors for all deprecations listed below. Please review these carefully to ensure you’ve taken any necessary steps to avoid service disruption. You can also search tenant logs for any errors caused by using deprecated features. If you have any questions, visit the Community or create a ticket in our Support Center. To learn more, you can also read Migration Process.

​
Uncapped User Profile Data

Deprecated: August 4, 2026 End of life: March 4, 2027 Auth0 is introducing a 10KB limit on user profile data. User profiles above that limit are deprecated. To minimize the functional impact of the newly introduced limit, it includes an extended size allowance. Operations performed on user profiles that breach the 10KB limit but remain within the extended allowance will continue to succeed, but will issue warnings in the tenant logs. To prepare for this change, review Migrate Oversized User Profiles to verify your affected status, review non-compliant user profiles, and opt out of the deprecated behavior.

​
Enhanced Security for Third-Party Applications

Deprecated: April 23, 2026 End of life: October 23, 2026 Auth0 is introducing enhanced security controls for third-party applications that align with OAuth 2.1 best practices. Starting on the end-of-life date, when you create a new third-party application via POST /api/v2/clients without specifying a third_party_security_mode, Auth0 will apply enhanced security controls (strict) automatically. This change only affects tenants that were using third-party applications before April 23, 2026, and only impacts newly created applications. Your existing third-party applications will continue to work as they do today with no changes required. Enhanced controls provide explicit API authorization, mandatory use of PKCE, and a focused feature set aligned with OAuth 2.1 and security best practices. To prepare for this change, review Migrate to Enhanced Security for Third-Party Applications to verify your affected status, configure default API permissions, and choose your migration path.

​
Legacy Management of Connection’s Enabled Clients

Deprecated: January 13, 2026 End of life: July 13, 2026 The enabled_clients field, within the Management API connection object, is deprecated in the following scenarios: As an alternative to the deprecated functionality, two new Management API endpoints are available: To prepare for this change and ensure your integrations continue to function smoothly, review Migrate Enabled Client Management to Dedicated Connection Endpoints to verify your affected status and migrate to the new endpoints.

​
Weak TLS 1.2 Cipher Suites

Deprecated: December 10, 2025 End of life: June 10, 2026 After the end-of-life date, we will require the use of modern ciphers when connecting to Auth0 service endpoints and web applications. We will remove support for TLS 1.2 cipher suites that no longer provide sufficient security to protect network communications. More specifically, the change to supported cipher suites applies to:
  • Public and private cloud tenants’ default domains; for example, [tenant_name].eu.auth0.com.
  • Public and private cloud tenants’ custom domains.
  • Service-related web applications, such as the Dashboard (manage.auth0.com) or the Marketplace (marketplace.auth0.com).
  • The Auth0 Content Delivery Network (CDN). To learn more, read Auth0 Public Cloud Service Endpoints.
The list of discontinued cipher suites is available below. The list contains the unique hex code that identifies each cipher alongside its IANA name; for the corresponding OpenSSL names, follow the links to ciphersuite.info. TLS 1.2 ciphers scheduled for removal:

​
Audience Validation for Private Key JWT Authentication

Deprecated: October 6, 2025 End of life: April 8, 2025 When validating JWT assertions used for client application authentication, Auth0 will impose stricter requirements and accept only a tenant’s issuer identifier as a single JSON string value in the aud (audience) claim. The possibility of providing an aud claim with either one of the approaches listed below is deprecated, and the service will stop supporting them after the end-of-life date:
  • A JSON array of strings, provided that one of the entries contains a valid issuer identifier or endpoint URL for the respective tenant and endpoint the client authenticates against.
  • A single JSON string representing a valid endpoint URL for the respective tenant and endpoint the client authenticates against.
Ahead of the end-of-life date, OIDC enterprise connections configured to use Private Key JWT in authenticated requests to the upstream identity provider will receive the capability to allow the use of the applicable issuer identifier represented as a JSON string in the “aud” claim included in JWT assertions.

​
Remove Access to Specific Event Request Properties in Actions

Deprecated: June 18, 2025 End of life: September 16, 2025 Auth0 will restrict access to additional property names within the event.request.query and event.request.body objects when executing Actions for the post-login and credentials-exchange triggers. Only tenants identified as using Actions to reference request properties planned for restriction will maintain access until September 16, 2025. The service will restrict the following property names in the request-related objects:
  • auth_session
  • authn_response
  • client_secret
  • client_assertion
  • refresh_token

​
Node.js 12 and 16 Extensibility Runtimes

Deprecated: February 10, 2025 End of life: August 15, 2025 Node.js 12 and 16 extensibility runtimes will gradually become unavailable across Auth0 tenants. Once removed, all extensibility integrations, such as Actions, Rules, Hooks, Custom Database Connections, and Custom Social Connections, will be forced to run on Node 22. For technical resources relevant to migrating to Node 22, read Migrate from Node 12 and 16 to Node 18 and Migrate from Node 18 to Node 22.

​
New Management API Scopes Required for Connection Options

Deprecated: October 24, 2024 End of life: July 8, 2025 Requests to the following Management API endpoints will require the read:connections_options scope to view the options field: Requests to the following Management API endpoints will require the update:connections_options to modify the options field:

​
Rules and Hooks Deprecations

Deprecated: May 16, 2023 Read-only transition: November 18, 2024 End-of-life: November 18, 2026 After November 18, 2026, Rules and Hooks will stop being executed and removed. On November 18, 2024, active Rules and Hooks will continue to execute, but will degrade to read-only mode. Auth0 has delayed the removal of Rules and Hooks functionality to a future date. Read-only Rules and Hooks can be turned on and off and their respective configuration values or secrets can be modified, but their source code cannot be edited via the Dashboard or Management API, including CI/CD tooling like Terraform and Auth0 Deploy CLI. If you will be unable to migrate to Actions ahead of the read-only transition, ensure that any automated CI/CD flow you have configured to deploy tenant configuration changes does not attempt to perform unsupported management operations on Rules and Hooks. For more information, read Migrate from Rules to Actions and Migrate from Hooks to Actions.

​
Opt-in to WCAG 2.2 AA Compliant UI for Universal Login

Deprecated: August 23, 2024 End of Life: July 31, 2025 Auth0 will remove the ability to use the legacy, non-compliant UI for . The new WCAG compliant version ensures that end users, including those who rely on assistive technology, can access and engage with a customer’s product or service. Read our Universal Login Accessibility documentation for more information.

​
Learn more