Add AgentID to Auth0

Auth0’s connection form will ask for a client id and secret, so start here. Register a client in the AgentID console with your app name and redirect URI, then copy the generated client id and secret before you close the dialog: the secret is shown once. Scope selection happens in Auth0 in step 3.

The redirect URI is your Auth0 domain, from Settings → Custom Domains. Without a custom domain it is https://your-tenant.your-region.auth0.com/login/callback; with one, https://your-custom-domain/login/callback.

The console applies Auth0’s required client_secret_post authentication method automatically when you use this guide.

Authentication → Social → + Create Connection, then Create Custom at the bottom of the gallery.

Pick Authentication.

Purpose                        Authentication
Name                           agentid
Authorization URL              https://auth.agentid.com/v0/authorize
Token URL                      https://auth.agentid.com/v0/token
Scope                          openid email profile
Separate scopes using a space  on
Client ID                      <client_id from step 1>
Client Secret                  <client_secret from step 1>

Watch out. This is the only scope choice you need to make. Add owner_email and owner_profile only if your app needs the human owner’s identity. The screenshot shows that optional pair. When requested, the agent’s signing credential must still permit those claims.

Fetch User Profile Script ships returning {}, leaving Auth0 no subject to key a user on. This connection never reads the id_token, so /v0/userinfo is the only source of claims. Paste this, then create.

function(accessToken, ctx, cb) {
  request.get(
    {
      url: 'https://auth.agentid.com/v0/userinfo',
      headers: { Authorization: 'Bearer ' + accessToken }
    },
    function(err, resp, body) {
      if (err) return cb(err);
      if (resp.statusCode !== 200) return cb(new Error(body));
      var u = JSON.parse(body);
      cb(null, {
        user_id: u.sub,
        email: u.email,
        email_verified: u.email_verified,
        name: u.name,
        org: u.org,
        owner_name: u.owner_name,
        owner_email: u.owner_email
      });
    }
  );
}

This step is required. Auth0’s OAuth2 strategy does not validate an OIDC nonce, so PKCE is what binds the authorization code to the browser session. The same call sets the button’s name and mark. Token from Applications → APIs → Auth0 Management API → API Explorer.

export AUTH0_DOMAIN=your-tenant.us.auth0.com
export AUTH0_TOKEN=<management api token>

CONNECTION_ID=$(curl -s -G "https://$AUTH0_DOMAIN/api/v2/connections" \
  -H "Authorization: Bearer $AUTH0_TOKEN" \
  --data-urlencode 'name=agentid' | jq -r '.[0].id // empty')
echo "connection: ${CONNECTION_ID:-NOT FOUND, check the Name from step 3}"

curl -s "https://$AUTH0_DOMAIN/api/v2/connections/$CONNECTION_ID" \
  -H "Authorization: Bearer $AUTH0_TOKEN" \
  | jq '{
      display_name: "AgentID",
      options: (.options + {
        pkce_enabled: true,
        icon_url: "https://auth.agentid.com/brand/icon-black.svg"
      })
    }' \
  | curl -s -X PATCH "https://$AUTH0_DOMAIN/api/v2/connections/$CONNECTION_ID" \
      -H "Authorization: Bearer $AUTH0_TOKEN" \
      -H 'Content-Type: application/json' \
      --data-binary @- \
  | jq '{display_name, pkce: .options.pkce_enabled, icon: .options.icon_url}'

A run that worked ends in "pkce": true and the two button fields.

Watch out. It reads before writing on purpose: PATCH replaces options wholesale, so a body with only pkce_enabled drops your credentials and scope. Dark tenant: icon-white.svg.

Creating it lands you on the Applications view. Switch it on for your app. Continue with AgentID then appears on Universal Login. The agent approves out of band, so the browser waits: approving a sign-in.

Watch out. org, owner_name and owner_email reach the Auth0 user record and stop there: Auth0 silently drops unnamespaced custom claims from the token it mints for your app. An Action carries them through. sub, email, email_verified and name arrive untouched.