Connectors · Identity & security

Auth0 Management API MCP server for AI agents.

actionlake is an MCP gateway: one remote MCP server that connects Claude and other MCP clients to Auth0 Management API and the rest of your systems. It gives your agent 480 Auth0 Management API actions (206 reads, 185 writes and 89 that wait for a confirmation) and holds the Auth0 Management API credential itself, so the agent never does. It paces Auth0 Management API's limits and records every call.

Connect Auth0 Management API free See pricing

100,000 free calls a month. No card, no email, no password: press Start a free sandbox on the next screen and keep the key it shows you.

claude mcp add --transport http actionlake https://connect.actionlake.com/mcp

480actionsin one signed file
206readlook, never change
185writecreate and update
89wait for a yesdestructive, confirmed first

Set up

Connect Auth0 Management API in three steps.

01
Add actionlake to Claude.
Run the command once in Claude Code; its consent page can create a free sandbox: 100,000 calls a month, no card. In the Claude app, add a custom connector with the URL below and paste your key on the consent page. Creating a new sandbox from the Claude app is not yet tested by us.
https://connect.actionlake.com/mcp
02
Connect Auth0 Management API.
OAuth 2.0, client credentials. Paste the app's client id and secret; actionlake fetches and renews the token, and nobody has to sign in. actionlake stores what you paste write-only, sealed under your tenant's key.
- client_idClient ID of an Auth0 Machine-to-Machine application authorized for the Auth0 Management API (Dashboard >…
- client_secretClient secret of that Machine-to-Machine application (Applications > the app > Settings)
- tenant_hostWhere your Auth0 Management API lives: your tenant host
```
account { op: "connections.requirements", service: "auth0_management" }
# free: exactly what to paste, and what is found for you
```

Make the first call. Check before a write.

Ask in plain words; Claude picks the action. Before anything changes, check validates the call and prices it, for free.

do    { action: "auth0_management.users.list" }# list or search users · read · 1 upstream callcheck { action: "auth0_management.users.create", input: { … } }# free: inputs, permissions, cost and confirmations, nothing sent

Auth0 Management API at a glance

Sign-in: OAuth 2.0, client credentials. Paste the app's client id and secret; actionlake fetches and renews the token, and nobody has to sign in.
You provide: client_idclient_secret
Setup fields: tenant_host
Limits we pace to: 15 calls a second, per connection
API covered: Auth0 Management API v2 (OpenAPI 3.1.0), at your Auth0 Management API instance's API base URL, which you enter when connecting (path /api/v2)
Built from: Auth0 Management API's documentation, read 22 October 2026auth0.com auth0.com
Service file: Version 1.0.0, signed (Ed25519)
Cached reads: 190 of 206 reads, for up to 5 minutes; a write clears what it affects
Shared entities: 4, so ask can line Auth0 Management API up with your other systems
Data: Processed and stored in Sydney, Australia. No US region yet

Capabilities

What an AI agent can do in Auth0 Management API.

480 actions in 195 areas. Every one carries its effect, so a key can allow the reads and hold the rest.

206readlook, never change
185writecreate and update
89destructivewait for a confirmation

User authentication methods
7
2 read · 3 write · 2 destructive
Creates an authentication method for a given user · Get a list of authentication methods · Get an authentication method by ID · Update all authentication methods by replacing them with the given ones
Network acls
6
2 read · 3 write · 1 destructive
Create Access Control List · Get all access control list entries for a tenant · Get a specific access control list entry for a tenant · Update Access Control List
Actions
5
2 read · 2 write · 1 destructive
Create an action · Get actions · Get an action · Update an action
Actions modules
5
2 read · 2 write · 1 destructive
Create a new Actions Module · List Actions Modules · Get a specific Actions Module by ID · Update a specific Actions Module
Agents
5
2 read · 2 write · 1 destructive
Create an agent · Get agents · Get an agent · Update an agent
Branding phone providers
5
2 read · 2 write · 1 destructive
Configure the phone provider · Get a list of phone providers · Get a phone provider · Update the phone provider
Branding phone templates
5
2 read · 2 write · 1 destructive
Create a phone notification template · Get a list of phone notification templates · Get a phone notification template · Update a phone notification template
Client credentials
5
2 read · 2 write · 1 destructive
Create a client credential · Get client credentials · Get client credential details · Update a client credential

187 more areas · 437 actions

Client grants 5
Client profiles 5
Clients 5
Connection profiles 5
Connections 5
Custom domains 5
Encryption keys 5
Event streams 5
Experimentation experiments 5
Experimentation feature flag variations 5
Experimentation feature flags 5
Experimentation segments 5
Flows 5
Flows vault connections 5
Forms 5
Hooks 5
Log streams 5
Organization clients 5
Organization connections 5
Organization discovery domains 5
Organization enabled connections 5
Organizations 5
Rate limit policies 5
Resource servers 5
Roles 5
Rules 5
Self service profiles 5
Token exchange profiles 5
User attribute profiles 5
Users 5
Verifiable credentials verification templates 5
Branding themes 4
Connection directory provisioning 4
Connection directory provisioning synchronized groups 4
Connection scim configuration 4
Email templates 4
Emails provider 4
Hook secrets 4
Network acl keys 4
Organization invitations 4
Refresh tokens 4
User blocks 4
Actions module versions 3
Branding templates universal login 3
Connection scim configuration tokens 3
Custom signing keys 3
Device credentials 3
Flow executions 3
Grants 3
Group roles 3
Groups 3
Guardian factors duo settings 3
Guardian factors push notification providers apns 3
Guardian factors push notification providers SNS 3
Organization client grants 3
Organization group roles 3
Organization member roles 3
Organization members 3
Role groups 3
Role permissions 3
Rules configs 3
Sessions 3
User permissions 3
User roles 3
Action versions 2
Actions trigger bindings 2
Anomaly blocks ips 2
Attack protection bot detection 2
Attack protection breached password detection 2
Attack protection brute force protection 2
Attack protection captcha 2
Attack protection phone provider protection 2
Attack protection suspicious ip throttling 2
Branding 2
Connection clients 2
Connection keys 2
Connection profiles templates 2
Custom domains default 2
Event stream deliveries 2
Event stream redeliver 2
Guardian enrollments 2
Guardian factors 2
Guardian factors email settings 2
Guardian factors phone message types 2
Guardian factors phone providers twilio 2
Guardian factors phone selected provider 2
Guardian factors phone settings 2
Guardian factors phone templates 2
Guardian factors push notification providers FCM 2
Guardian factors push notification providers fcmv1 2
Guardian factors push notification selected provider 2
Guardian factors SMS providers twilio 2
Guardian factors SMS selected provider 2
Guardian factors SMS templates 2
Guardian policies 2
Guardian settings 2
Logs 2
Prompt custom text 2
Prompt partials 2
Prompt screen rendering 2
Prompts 2
Prompts rendering 2
Risk assessments settings 2
Risk assessments settings new device 2
Role users 2
Self service profile custom text 2
Signing keys 2
Supplemental signals 2
Tenants settings 2
User attribute profiles templates 2
User identities 2
User refresh tokens 2
User sessions 2
Action deploy 1
Action test 1
Action version deploy 1
Actions executions 1
Actions module actions 1
Actions module rollback 1
Actions triggers 1
Branding phone provider try 1
Branding phone template reset 1
Branding phone template try 1
Branding themes default 1
Client connections 1
Client grant organizations 1
Client grants search 1
Client rotate secret 1
Clients cimd preview 1
Clients cimd register 1
Clients search 1
Connection directory provisioning default mapping 1
Connection directory provisioning synchronizations 1
Connection keys rotate 1
Connection scim configuration default mapping 1
Connection status 1
Connection users 1
Connections directory provisionings 1
Connections scim configurations 1
Custom domain test 1
Custom domain verify 1
Encryption keys rekey 1
Encryption keys wrapping key 1
Event stream test 1
Experimentation experiment advance ramp 1
Experimentation experiment validate 1
Group members 1
Guardian enrollments ticket 1
Job errors 1
Jobs 1
Jobs users exports 1
Jobs verification email 1
Organization discovery domains name 1
Organization groups 1
Organization member effective roles 1
Organization member effective roles sources groups 1
Organization role groups 1
Organization role members 1
Organizations name 1
Organizations search 1
Refresh tokens revoke 1
Resource servers search 1
Self service profile SSO ticket 1
Self service profile SSO ticket revoke 1
Session revoke 1
Signing keys revoke 1
Signing keys rotate 1
Stats active users 1
Stats daily 1
Tickets email verification 1
Tickets password change 1
User authenticators 1
User connected accounts 1
User effective permissions 1
User effective permissions sources effective roles 1
User effective roles 1
User effective roles sources groups 1
User enrollments 1
User groups 1
User logs 1
User multifactor 1
User multifactor actions invalidate remember browser 1
User organizations 1
User recovery code regeneration 1
User revoke access 1
User risk assessments clear 1
Users by email 1

Top actions

The Auth0 Management API API, shaped for agents.

The ids your agent types, what each does, and the one name it shares with other systems. 42 of Auth0 Management API's 42 action names are shared with at least one other connector, so an agent learns them once.

Action	What it does	Effect	Same name in
`auth0_management.users.list`List or Search Users	List or Search Users.	read	`identity.user.list`474 connectors
`auth0_management.groups.list`Get all Groups	Get all Groups.	read	`identity.group.list`262 connectors
`auth0_management.roles.list`Get roles	Get roles.	read	`identity.role.list`184 connectors
`auth0_management.users.create`Create a User	Create a User.	write	`identity.user.create`262 connectors
`auth0_management.clients.list`Get clients	Get clients.	read	`identity.application.list`37 connectors
`auth0_management.roles.create`Create a role	Create a role.	write	`identity.role.create`105 connectors
`auth0_management.groups.get`Get a Group	Get a Group.	read	`identity.group.get`212 connectors
`auth0_management.users.delete`Delete a User	Delete a User.	destructive	`identity.user.delete`253 connectors
`auth0_management.clients.create`Create a client	Create a client.	write	`identity.application.create`27 connectors
`auth0_management.group_members.list`Get Group Members	Get Group Members.	read	`identity.group_member.list`103 connectors
`auth0_management.logs.list`Search log events	Search log events.	read	`identity.audit_event.list`51 connectors
`auth0_management.organization_invitations.create`Create invitations to an organization	Create invitations to an organization.	write	`identity.invitation.create`41 connectors

Try it

Prompts to paste into Claude.

Each one names the Auth0 Management API actions it will call, so you know what it reads and what it changes before you send it.

Readread
Who has access in Auth0 Management API? List every user and their role.
callsauth0_management.users.list
Writewrite
Create a User in Auth0 Management API. Show me exactly what you will send before you save it.
callsauth0_management.users.create

Governance for Auth0 Management API

Destructive actions wait for a yes.

89 Auth0 Management API actions are destructive. The first 10:

Delete a Userauth0_management.users.delete
Delete a Groupauth0_management.groups.delete
Delete a roleauth0_management.roles.delete
Delete a clientauth0_management.clients.delete
Delete an invitation to an Organizationauth0_management.organization_invitations.delete
Delete a connectionauth0_management.connections.delete
Delete custom domain configurationauth0_management.custom_domains.delete
Delete a resource serverauth0_management.resource_servers.delete
Delete a flowauth0_management.flows.delete
Delete a formauth0_management.forms.delete

A destructive action runs only with confirm: true. Under the human policy the agent cannot confirm for itself: the run stops until a named person approves, in the console or from a signed link in an email. The cap on a key is refused before the call is sent, never after.

doauth0_management.users.deleteconfirm_policy: human

Delete a User?

intent: the user asked me to delete a User

run suspended · waiting for a named person · key auth0-management-agent cannot confirm itself

In the console, or from an emailed signed link.

a key for this connector

account {  op: "keys.create", name: "auth0-management-agent",  allowed_actions: ["auth0_management.*"], cap_calls: 2000,  confirm_policy: "human_for_writes",  approval_rules: [    { match: "auth0_management.users.delete", approver: "[email protected]" },    { match: "auth0_management.groups.delete", approver: "[email protected]" },    { match: "auth0_management.roles.delete", approver: "[email protected]" }  ]}

Illustrative. Scoped to Auth0 Management API only, capped at 2,000 upstream calls, every write confirmed, and the destructive ones approved by a named person.

Cost

What Auth0 Management API costs on actionlake.

Every Auth0 Management API action is one upstream call, the only thing actionlake bills. Searching, check, cost, account and any call Auth0 Management API refused with 401, 403, 429 or a 5xx are free. Paid plans start at US$49 a month for 250,000 calls, with overage from US$0.30 down to US$0.18 per 1,000.

1upstream call per actionall 480 Auth0 Management API actions
480actions pageeach page of a long list is one call
190reads can be cacheda cache hit costs nothing
100,000calls a month, freepaid plans from US$49 a month for 250,000

See pricing

Action index

Every Auth0 Management API action.

480 actions by area: the id your agent calls, what it does, and its effect.

User authentication methods7

auth0_management.user_authentication_methods.createCreates an authentication method for a given userwrite
auth0_management.user_authentication_methods.getGet an authentication method by IDread
and 5 more in this area

Network acls6

auth0_management.network_acls.createCreate Access Control Listwrite
auth0_management.network_acls.getGet a specific access control list entry for a tenantread
and 4 more in this area

Actions5

auth0_management.actions.createCreate an actionwrite
auth0_management.actions.getGet an actionread
and 3 more in this area

Actions modules5

auth0_management.actions_modules.createCreate a new Actions Modulewrite
auth0_management.actions_modules.getGet a specific Actions Module by IDread
and 3 more in this area

Agents5

auth0_management.agents.createCreate an agentwrite
auth0_management.agents.getGet an agentread
and 3 more in this area

Branding phone providers5

auth0_management.branding_phone_providers.createConfigure the phone providerwrite
auth0_management.branding_phone_providers.getGet a phone providerread
and 3 more in this area

Branding phone templates5

auth0_management.branding_phone_templates.createCreate a phone notification templatewrite
auth0_management.branding_phone_templates.getGet a phone notification templateread
and 3 more in this area

Client credentials5

auth0_management.client_credentials.createCreate a client credentialwrite
auth0_management.client_credentials.getGet client credential detailsread
and 3 more in this area

Client grants5

auth0_management.client_grants.createCreate client grantwrite
auth0_management.client_grants.getGet client grantread
and 3 more in this area

Client profiles5

auth0_management.client_profiles.createCreate a client profilewrite
auth0_management.client_profiles.getGet a client profileread
and 3 more in this area

Clients5

auth0_management.clients.createCreate a clientwrite
auth0_management.clients.getGet client by IDread
and 3 more in this area

Connection profiles5

auth0_management.connection_profiles.createCreate a connection profilewrite
auth0_management.connection_profiles.getGet Connection Profileread
and 3 more in this area

Connections5

auth0_management.connections.createCreate a connectionwrite
auth0_management.connections.getGet a connectionread
and 3 more in this area

Custom domains5

auth0_management.custom_domains.createConfigure a new custom domainwrite
auth0_management.custom_domains.getGet custom domain configurationread
and 3 more in this area

Encryption keys5

auth0_management.encryption_keys.createCreate the new encryption keywrite
auth0_management.encryption_keys.getGet the encryption key by its key idread
and 3 more in this area

Event streams5

auth0_management.event_streams.createCreate an event streamwrite
auth0_management.event_streams.getGet an event stream by IDread
and 3 more in this area

Experimentation experiments5

auth0_management.experimentation_experiments.createCreate an experiment for the Experiment Center.write
auth0_management.experimentation_experiments.getGet an experiment by ID.read
and 3 more in this area

Experimentation feature flag variations5

auth0_management.experimentation_feature_flag_variations.createCreate a variation for a feature flag.write
auth0_management.experimentation_feature_flag_variations.getGet a variation by ID.read
and 3 more in this area

Experimentation feature flags5

auth0_management.experimentation_feature_flags.createCreate a feature flag for the Experiment Center.write
auth0_management.experimentation_feature_flags.getGet a feature flag by ID.read
and 3 more in this area

Experimentation segments5

auth0_management.experimentation_segments.createCreate a segment for the Experiment Center.write
auth0_management.experimentation_segments.getGet a segment by ID.read
and 3 more in this area

Flows5

auth0_management.flows.createCreate a flowwrite
auth0_management.flows.getGet a flowread
and 3 more in this area

Flows vault connections5

auth0_management.flows_vault_connections.createCreate a Flows Vault connectionwrite
auth0_management.flows_vault_connections.getGet a Flows Vault connectionread
and 3 more in this area

Forms5

auth0_management.forms.createCreate a formwrite
auth0_management.forms.getGet a formread
and 3 more in this area

Hooks5

auth0_management.hooks.createCreate a hookwrite
auth0_management.hooks.getGet a hookread
and 3 more in this area

Log streams5

auth0_management.log_streams.createCreate a log streamwrite
auth0_management.log_streams.getGet log stream by IDread
and 3 more in this area

Organization clients5

auth0_management.organization_clients.createAssociate clients with an organizationwrite
auth0_management.organization_clients.getGet an organization client associationread
and 3 more in this area

Organization connections5

auth0_management.organization_connections.createAdd a connection to an organizationwrite
auth0_management.organization_connections.getGet a specific connection associated with an organizationread
and 3 more in this area

Organization discovery domains5

auth0_management.organization_discovery_domains.createCreate an organization discovery domainwrite
auth0_management.organization_discovery_domains.getRetrieve an organization discovery domain by IDread
and 3 more in this area

Organization enabled connections5

auth0_management.organization_enabled_connections.createAdd connections to an organizationwrite
auth0_management.organization_enabled_connections.getGet an enabled connection for an organizationread
and 3 more in this area

Organizations5

auth0_management.organizations.createCreate an Organizationwrite
auth0_management.organizations.getGet organizationread
and 3 more in this area

Rate limit policies 5Resource servers 5Roles 5Rules 5Self service profiles 5Token exchange profiles 5User attribute profiles 5Users 5Verifiable credentials verification templates 5Branding themes 4Connection directory provisioning 4Connection directory provisioning synchronized groups 4Connection scim configuration 4Email templates 4Emails provider 4Hook secrets 4Network acl keys 4Organization invitations 4Refresh tokens 4User blocks 4Actions module versions 3Branding templates universal login 3Connection scim configuration tokens 3Custom signing keys 3Device credentials 3Flow executions 3Grants 3Group roles 3Groups 3Guardian factors duo settings 3Guardian factors push notification providers apns 3Guardian factors push notification providers SNS 3Organization client grants 3Organization group roles 3Organization member roles 3Organization members 3Role groups 3Role permissions 3Rules configs 3Sessions 3User permissions 3User roles 3Action versions 2Actions trigger bindings 2Anomaly blocks ips 2Attack protection bot detection 2Attack protection breached password detection 2Attack protection brute force protection 2Attack protection captcha 2Attack protection phone provider protection 2Attack protection suspicious ip throttling 2Branding 2Connection clients 2Connection keys 2Connection profiles templates 2Custom domains default 2Event stream deliveries 2Event stream redeliver 2Guardian enrollments 2Guardian factors 2Guardian factors email settings 2Guardian factors phone message types 2Guardian factors phone providers twilio 2Guardian factors phone selected provider 2Guardian factors phone settings 2Guardian factors phone templates 2Guardian factors push notification providers FCM 2Guardian factors push notification providers fcmv1 2Guardian factors push notification selected provider 2Guardian factors SMS providers twilio 2Guardian factors SMS selected provider 2Guardian factors SMS templates 2Guardian policies 2Guardian settings 2Logs 2Prompt custom text 2Prompt partials 2Prompt screen rendering 2Prompts 2Prompts rendering 2Risk assessments settings 2Risk assessments settings new device 2Role users 2Self service profile custom text 2Signing keys 2Supplemental signals 2Tenants settings 2User attribute profiles templates 2User identities 2User refresh tokens 2User sessions 2Action deploy 1Action test 1Action version deploy 1Actions executions 1Actions module actions 1Actions module rollback 1Actions triggers 1Branding phone provider try 1Branding phone template reset 1Branding phone template try 1Branding themes default 1Client connections 1Client grant organizations 1Client grants search 1Client rotate secret 1Clients cimd preview 1Clients cimd register 1Clients search 1Connection directory provisioning default mapping 1Connection directory provisioning synchronizations 1Connection keys rotate 1Connection scim configuration default mapping 1Connection status 1Connection users 1Connections directory provisionings 1Connections scim configurations 1Custom domain test 1Custom domain verify 1Encryption keys rekey 1Encryption keys wrapping key 1Event stream test 1Experimentation experiment advance ramp 1Experimentation experiment validate 1Group members 1Guardian enrollments ticket 1Job errors 1Jobs 1Jobs users exports 1Jobs verification email 1Organization discovery domains name 1Organization groups 1Organization member effective roles 1Organization member effective roles sources groups 1Organization role groups 1Organization role members 1Organizations name 1Organizations search 1Refresh tokens revoke 1Resource servers search 1Self service profile SSO ticket 1Self service profile SSO ticket revoke 1Session revoke 1Signing keys revoke 1Signing keys rotate 1Stats active users 1Stats daily 1Tickets email verification 1Tickets password change 1User authenticators 1User connected accounts 1User effective permissions 1User effective permissions sources effective roles 1User effective roles 1User effective roles sources groups 1User enrollments 1User groups 1User logs 1User multifactor 1User multifactor actions invalidate remember browser 1User organizations 1User recovery code regeneration 1User revoke access 1User risk assessments clear 1Users by email 1

This index shows a sample of each area. All 480 actions, with their inputs and prices, are in the catalogue, which a free sandbox key can search.

Questions

The Auth0 Management API MCP server, answered.

Is there an Auth0 Management API MCP server for Claude?

Yes. actionlake is an MCP gateway: a remote MCP server that gives Claude, or another MCP client, 480 Auth0 Management API actions across user authentication methods, network acls, actions and actions modules, through the same eight tools it uses for every other connector. actionlake is independent; it is not made or endorsed by Auth0 Management API.

What do I need to connect Auth0 Management API?

Client ID of an Auth0 Machine-to-Machine application authorized for the Auth0 Management API (Dashboard >… and Client secret of that Machine-to-Machine application (Applications > the app > Settings). Plus your tenant host. The free call account { op: "connections.requirements", service: "auth0_management" } lists exactly what to paste.

Can an AI agent delete or change things in Auth0 Management API?

Only if its key allows it, and only with an explicit confirmation. 89 Auth0 Management API actions are destructive, including delete a User, delete a Group and delete a role. Each runs only with confirm: true. Under the human confirm policy, or an approval rule on the key, the run waits until a named person approves it.

Will an AI agent use up my Auth0 Management API API limit?

actionlake paces every call to the limits in the Auth0 Management API service file: 15 calls a second per connection. Repeated reads are answered from cache (190 Auth0 Management API actions can be), which never reaches Auth0 Management API.

What does an Auth0 Management API action cost?

One upstream call, the only unit actionlake bills. A list that pages bills one call per page (480 Auth0 Management API actions page). Cache hits, searches, dry runs and calls Auth0 Management API refused with 401, 403, 429 or a 5xx are free. The Free plan includes 100,000 calls a month with no card. Paid plans start at US$49 a month for 250,000 calls, with overage from US$0.30 down to US$0.18 per 1,000.

Which Auth0 Management API API does it cover?

The Auth0 Management API v2 (OpenAPI 3.1.0) at your Auth0 Management API instance's API base URL, which you enter when connecting (path /api/v2). It is built from Auth0 Management API's documentation as read on 22 October 2026. 480 actions in 195 areas, each one in the signed service file (version 1.0.0).

Does actionlake keep my Auth0 Management API data, and where?

actionlake processes and stores data in Sydney, Australia; there is no US region yet. Reads may be cached for up to 5 minutes, and a write clears the reads it affects. Each run's request and response is kept, sealed, for your plan's trace window: 1 day on Free, 3 days on Starter, 7 days on Pro, 14 days on Team, 30 days on Business and 30 days on Enterprise. Your Auth0 Management API credential is sealed under your tenant's key, never logged and never returned. Your traffic is not used to train models.

Which AI clients can use it?

Claude Code, tested by us end to end, and the Claude app as a custom connector, tested by us with an existing key. Other MCP clients that support remote servers over Streamable HTTP (MCP revisions 2025-06-18 and 2025-11-25) and OAuth dynamic client registration, or a bearer header, should connect the same way; we have not tested them. Or plain REST, under the same action names.

Give your agent Auth0 Management API today.

Connect Auth0 Management API free See pricing

Start free - 100,000 calls/month, no card. No signup. Hard caps on every key. Cached answers are free.

Auth0 Management API MCP server for AI agents.

Connect Auth0 Management API in three steps.

Add actionlake to Claude.

Connect Auth0 Management API.

Make the first call. Check before a write.

What an AI agent can do in Auth0 Management API.

User authentication methods

Network acls

Actions

Actions modules

Agents

Branding phone providers

Branding phone templates

Client credentials