Planned maintenance: Tue Dec 8, 11:30pm–12:30am ET (8:30–9:30pm PT / Wed 5:30–6:30am CET). Brief downtime possible (up to 15 minutes).

Status page
Skip to main content

How can we help?

Need help? Check out our documentation or contact support

Search

Set up SSO with Auth0

  • Updated

Create an Auth0 Regular Web Application, whitelist Bevy’s Auth0 callback URLs, set token endpoint authentication to POST, and send Domain, Client ID, and Client Secret to Bevy over a secure channel.

Bevy can use Auth0 as the identity provider (IdP) for single sign-on (SSO). Auth0 authenticates the member; Bevy then creates or signs in their community account from the Auth0 profile.

Note: This page is for technical admins who configure Auth0 SSO. For what SSO changes on the login page, see Introduction to single sign-on. Members who need sign-in steps should follow Sign-in with single sign-on (SSO).

Tip: If you still need to choose among providers or confirm which profile fields Auth0 must send, start with Choose an SSO provider and map Bevy fields. Use this article only when Auth0 is your IdP — not a separate custom OAuth 2.0 or OpenID Connect app for the same tenant (Set up SSO with OAuth 2.0, Set up SSO with OpenID Connect, Set up SSO with Okta).

Create the Auth0 application

  1. Sign in to your Auth0 tenant.
  2. Create a new application and choose Regular Web Application.
  3. Give the application a clear name (for example, your Bevy community name).

Tip: If Auth0 asks for Token Endpoint Authentication Method, select POST (the application sends the client ID and secret as HTTP POST parameters).

Whitelist callback URLs

In the application’s settings, add Bevy’s redirect (callback) URLs under Allowed Callback URLs. Bevy typically asks for three environments:

Environment Callback URL pattern
Bevy test / staging sandbox https://<instance-id>-staging.bevylabs.com/accounts/auth0/login/callback/
Onboarding instance https://<instance-id>.bevylabs.com/accounts/auth0/login/callback/
Production community domain https://<your-community-domain>/accounts/auth0/login/callback/

<instance-id> is the same ID used in your *.bevylabs.com subdomain. If you are unsure what it is, ask your Bevy contact or Bevy Support. <your-community-domain> is the final hostname members use when the community is live.

Tip: Match the path exactly, including the trailing slash: /accounts/auth0/login/callback/. A missing slash or a different provider path (for example /accounts/oauth/… or /accounts/oidc/…) will fail the redirect.

What to share with Bevy

Save the Auth0 application, then copy these values and send them over a secure channel to your Bevy onboarding contact or Bevy Support:

Item Required? What Bevy uses it for
Domain Required Your Auth0 tenant domain (for example your-tenant.auth0.com or a custom Auth0 domain). Bevy uses it as the Auth0 base URL for authorize, token, and user info.
Client ID Required Identifies the Bevy Regular Web Application in Auth0.
Client secret Required Authenticates the Bevy application to Auth0. Share only over a secure channel.
Custom claim paths If not using defaults If email or name fields live under custom claims (for example user_metadata), tell Bevy the exact paths before go-live.

Important: Bevy configures Auth0 on the community side. Admins do not paste the client secret into a public community settings screen.

Service provider–initiated login URL

To start SSO from Bevy (service provider–initiated), use:

https://<your-community-domain>/accounts/auth0/login/

Example: https://example.community.com/accounts/auth0/login/

Members can also use the SSO button on your community login page after Bevy enables Auth0.

Profile fields from Auth0

By default, Bevy reads standard Auth0 profile claims:

  • ID — sub (required; must stay stable for that person)
  • Email — email (required)
  • First name — given_name (optional)
  • Last name — family_name (optional)
  • Full name — name (optional)
  • Picture — picture (optional)

Bevy also requests the openid, profile, and email scopes so Auth0 returns those claims.

Note: If your Auth0 Actions or Rules put email or names under custom paths (for example user_metadata.firstName), share those paths with Bevy before go-live. The shared field map and provider notes are on Choose an SSO provider and map Bevy fields.