Integrations / Auth0

Auth0 + minidauth keep your login, add keys nobody holds

Auth0 keeps the login. minidauth adds a key that no single server holds and roles that only a quorum of your admins can grant. The Auth0 token never carries a role.

Open the Auth0 example Quick start

Run end to end

What stays and what moves

Stays with Auth0
Accounts, sessions, passwords and the sign-in screen. Nothing about how your users log in changes.
Moves to the network
The key that encrypts and signs, which exists only as shares that 14 of 20 independent nodes have to cooperate to use, and the decision about who holds a role, which takes several of your admins approving it.

Adding it to a Auth0 app

  1. Store the link in app_metadata.tide_vuid

    App metadata rather than user metadata, because the user must not be able to edit the link.

  2. Add one callback route

    The user links their Tide identity in a page served by the Tide network, which neither your app nor minidauth can see into. The shared link.js drop-in adds the routes; you tell it who is signed in and where to store the vuid.

  3. Read roles from minidauth, not from Auth0

    An Auth0 Action can copy app_metadata into a token. A role that arrives in a token your tenant can mint is a role your tenant can grant itself, so the example leaves roles out of Auth0 entirely and reads them from minidauth on every request.

Writing app_metadata

Saving the link needs the application authorised for the Management API with the update:users scope. In Auth0's API Access tab that lives under Client Access (machine to machine), not User-delegated Access, and it is the step most likely to be missed.

Users without a Tide account

The Auth0 example also mounts a /tideless page. There, the signed-in Auth0 user encrypts and decrypts with no Tide account at all: their Auth0 user id is the subject, a role the quorum granted that id is the gate, and the browser never holds a credential. It needs a public, voucher-gated decrypt policy, which the setup guide covers.

Run the example

Recorded against a real Auth0 tenant and the public Tide network.

# Auth0: a Regular Web Application, callback http://localhost:3002/callback,
# authorised for the Management API with update:users

MINIDAUTH_OPS_TOKEN=<ops token> APP_URL=http://localhost:3002 \
  node ../shared/register-callback.js

npm install
export AUTH0_DOMAIN=your-tenant.au.auth0.com
export AUTH0_CLIENT_ID=...
export AUTH0_CLIENT_SECRET=...
export MINIDAUTH_TOKEN=dev-sample-app-token
npm start                                   # http://localhost:3002

minidauth itself has to be running first, with a vendor key created and its policies deployed. The quick start is two Docker commands.

Stuck on the Auth0 side? Join the Discord and I'll help you get it running.

Also works with: Clerk · Supabase · Amazon Cognito · Better Auth