Auth0 Terraform Provider

The auth0_tenant resource allows you to manage the configuration of an existing Auth0 tenant. You can use it to set logos, support contact information, error pages, and default tenant behaviors like session lifetimes and enabled locales.

Important Limitation: You cannot create new tenants using this resource. It can only manage settings for a tenant that has already been created via the Auth0 dashboard.

resource "auth0_tenant" "my_tenant" {
  friendly_name           = "Tenant Name"
  picture_url             = "http://example.com/logo.png"
  support_email           = "support@example.com"
  support_url             = "http://example.com/support"
  allowed_logout_urls     = ["http://example.com/logout"]
  session_lifetime        = 8760
  sandbox_version         = "22"
  enabled_locales         = ["en"]
  default_redirection_uri = "https://example.com/login"

  flags {
    disable_clickjack_protection_headers   = true
    enable_public_signup_user_exists_error = true
    use_scope_descriptions_for_consent     = true
    no_disclose_enterprise_connections     = false
    disable_management_api_sms_obfuscation = false
    disable_fields_map_fix                 = false
  }

  session_cookie {
    mode = "non-persistent"
  }

  sessions {
    oidc_logout_prompt_enabled = false

    # Anonymous Sessions is an Early Access feature.
    anonymous {
      lifetime_in_minutes = 43200
      activate_cookie     = true
    }
  }

  error_page {
    html          = "<html></html>"
    show_log_link = false
    url           = "https://example.com/error"
  }

  # Requires the country codes feature flag to be enabled on the tenant.
  # Remove this block entirely to disable filtering.
  country_codes {
    list = ["US", "CA"]
    mode = "allow"
  }
}

When managing secrets for an Auth0 action, you have two options. For better security, use secrets_wo instead of secrets.

secrets_wo (Write-Only Secrets)

secrets_wo allows you to provide secret values that are not stored in your Terraform state. This prevents sensitive information from being persisted in plain text.

• Behavior: Adding, renaming, or removing an entry is applied automatically.
• Updating Values: Because values are not tracked in state, changing only the value of an existing secret will not be detected by Terraform. To push a value-only change, you must increment the secrets_wo_version attribute.
• Removal: To remove all secrets, delete the secrets_wo blocks and the secrets_wo_version attribute.
• Ordering: This is an ordered list; reordering blocks is treated as a change.
• Conflict: secrets_wo conflicts with the standard secrets block.

secrets (Standard Secrets)

• Warning: Secret values are persisted in Terraform state as plain text.
• Behavior: Partial management is not supported. If the secret block is edited, the entire object is re-provisioned.

The auto-generation process cannot export sensitive values such as secrets, keys, or API keys. In the generated auth0_generated.tf file, these properties will be set to null and marked with a # sensitive comment.

If you intend to apply this configuration to a different tenant, you must manually replace these null values with the appropriate credentials for the target environment.

Example of sensitive fields in auth0_generated.tf:

resource "auth0_email_provider" "email_provider" {
  default_from_address = "mailing-daemon@travel0.com"
  enabled              = true
  name                 = "smtp"
  credentials {
    access_key_id              = null # sensitive
    api_key                    = null # sensitive
  }
}

# __generated__ by Terraform from "52745e4d-278c-4b6b-8cac-a27e457215d6"
resource "auth0_email_provider" "email_provider" {
  default_from_address = "mailing-daemon@travel0.com"
  enabled              = true
  name                 = "smtp"
  credentials {
    access_key_id              = null # sensitive
    api_key                    = null # sensitive
  }
}

The provider uses an automated pipeline to generate its reference documentation in the docs/ directory. Documentation is derived from the source code schema and HCL examples.

Key components of the generation process:

• Schema Descriptions: The Description fields within the resource/data-source schema files (e.g., internal/auth0/<name>/resource.go) are used as the primary source for documentation text. Markdown is supported within these fields.
• Usage Examples: The HCL files located in examples/resources/<name>/resource.tf or examples/data-sources/<name>/data-source.tf are embedded into the generated documentation as usage examples.
• Structural Overrides: Optional structural overrides can be applied using templates located in templates/resources/<name>.md.tmpl.

Important: Never edit files in the docs/ directory manually, as they are auto-generated and will be overwritten by the pipeline.

The auth0_connection resource supports various social identity providers. Common strategies include:

• Google OAuth2: strategy = "google-oauth2". Requires client_id and client_secret.
• Facebook: strategy = "facebook". Requires client_id and client_secret.
• Apple: strategy = "apple". Requires client_id, client_secret, team_id, and key_id.
• LinkedIn: strategy = "linkedin". Requires client_id and client_secret.
• GitHub: strategy = "github". Requires client_id and client_secret.
• Twitter: strategy = "twitter" (via OAuth2).

Most social connections allow setting set_user_root_attributes (e.g., on_each_login or on_first_login) and non_persistent_attrs to manage how user profile data is stored.

# Example: Google OAuth2
resource "auth0_connection" "google_oauth2" {
  name     = "Google-OAuth2-Connection"
  strategy = "google-oauth2"

  options {
    client_id                = "<client-id>"
    client_secret            = "<client-secret>"
    allowed_audiences        = ["example.com", "api.example.com"]
    scopes                   = ["email", "profile", "gmail", "youtube"]
    set_user_root_attributes = "on_each_login"
    non_persistent_attrs     = ["ethnicity", "gender"]
  }
}

# Example: GitHub
resource "auth0_connection" "github" {
  name     = "GitHub-Connection"
  strategy = "github"

  options {
    client_id     = "<client-id>"
    client_secret = "<client-secret>"
    scopes = [
      "public_profile",
      "email",
      "groups_access_member_info",
      "user_birthday"
    ]
    set_user_root_attributes = "on_each_login"
    non_persistent_attrs     = ["ethnicity", "gender"]
  }
}