---
title: "Auth0"
description: "Integrate Auth0 authentication with AINative Studio APIs and ZeroDB"
canonical: "https://docs.ainative.studio/docs/integrations/auth0"
last-updated: "2026-10-22T17:48:46.689Z"
---

# Auth0

Source: https://docs.ainative.studio/docs/integrations/auth0

> Integrate Auth0 authentication with AINative Studio APIs and ZeroDB

## Auth0 Integration

Use Auth0 as your identity provider with AINative Studio. This guide walks through connecting your Auth0 tenant so your users can authenticate with Auth0 JWTs and access AINative APIs, ZeroDB, and ZeroMemory.

---

## Prerequisites

- An [Auth0 account](https://auth0.com) with a tenant
- An [AINative Studio account](https://ainative.studio) with a project and API key
- Your AINative project ID (found in the dashboard under **Settings**)

---

## Step 1: Create an Application in Auth0

1. Log in to the [Auth0 Dashboard](https://manage.auth0.com)
2. Navigate to **Applications > Applications > Create Application**
3. Choose the application type that matches your use case:
   - **Single Page Application** for React, Vue, or Svelte frontends
   - **Regular Web Application** for Next.js or server-rendered apps
   - **Machine to Machine** for backend services and agents
4. Note your **Domain**, **Client ID**, and **Client Secret** (if applicable)

Your Auth0 domain follows the pattern `{tenant}.us.auth0.com`.

---

## Step 2: Configure Redirect URIs and Allowed Origins

In your Auth0 application settings, configure:

| Field | Value |
|-------|-------|
| **Allowed Callback URLs** | `https://your-app.com/callback`, `http://localhost:3000/callback` |
| **Allowed Logout URLs** | `https://your-app.com`, `http://localhost:3000` |
| **Allowed Web Origins** | `https://your-app.com`, `http://localhost:3000` |

### Create an API (Resource Server)

1. Go to **Applications > APIs > Create API**
2. Set the **Identifier (Audience)** to your AINative API URL, e.g. `https://api.ainative.studio`
3. Set the **Signing Algorithm** to `RS256`
4. Note the **audience** value -- you will need it when requesting tokens

---

## Step 3: Register Auth0 as an Identity Provider in AINative

Call the AINative API to register your Auth0 tenant as a trusted identity provider:

```bash
curl -X POST https://api.ainative.studio/api/v1/auth/providers \
  -H "Authorization: Bearer $AINATIVE_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "provider": "auth0",
    "domain": "YOUR_TENANT.us.auth0.com",
    "client_id": "YOUR_AUTH0_CLIENT_ID",
    "audience": "https://api.ainative.studio",
    "jwks_uri": "https://YOUR_TENANT.us.auth0.com/.well-known/jwks.json",
    "issuer": "https://YOUR_TENANT.us.auth0.com/",
    "claim_mapping": {
      "user_id": "sub",
      "email": "email",
      "tenant": "org_id"
    }
  }'
```

### Claim Mapping

Auth0 JWTs include these claims that AINative maps automatically:

| Auth0 Claim | AINative Field | Description |
|-------------|----------------|-------------|
| `sub` | `user_id` | Unique user identifier (e.g. `auth0\|abc123`) |
| `email` | `email` | User email address |
| `org_id` | `tenant` | Auth0 Organization ID (for multi-tenant apps) |

---

## Step 4: Test the Connection

Obtain a test token from Auth0 and verify it works with AINative:

```bash
## Get a token from Auth0
TOKEN=$(curl -s -X POST https://YOUR_TENANT.us.auth0.com/oauth/token \
  -H "Content-Type: application/json" \
  -d '{
    "client_id": "YOUR_AUTH0_CLIENT_ID",
    "client_secret": "YOUR_AUTH0_CLIENT_SECRET",
    "audience": "https://api.ainative.studio",
    "grant_type": "client_credentials"
  }' | jq -r '.access_token')

## Verify the provider JWT against AINative
## PROVIDER_ID is the id returned when you registered the provider in Step 3.
curl -s -X POST https://api.ainative.studio/api/v1/public/auth-providers/PROVIDER_ID/verify \
  -H "Authorization: Bearer $AINATIVE_API_KEY" \
  -H "Content-Type: application/json" \
  -d "{\"token\": \"$TOKEN\"}"
```

A successful response returns the decoded claims:

```json
{
  "valid": true,
  "user_id": "auth0|abc123",
  "email": "user@example.com",
  "claims": { "sub": "auth0|abc123", "email": "user@example.com" }
}
```

---

## Step 5: Use Auth0 JWTs with AINative APIs

Once the provider is registered, your users can authenticate with their Auth0 tokens across all AINative services.

### Chat Completions

```bash
curl -X POST https://api.ainative.studio/api/v1/chat/completions \
  -H "Authorization: Bearer AUTH0_USER_JWT" \
  -H "Content-Type: application/json" \
  -d '{
    "model": "llama-3.3-70b",
    "messages": [
      {"role": "user", "content": "Hello from Auth0!"}
    ]
  }'
```

### ZeroDB Vector Search

```bash
curl -X POST https://api.ainative.studio/api/v1/public/YOUR_PROJECT_ID/embeddings/search \
  -H "Authorization: Bearer AUTH0_USER_JWT" \
  -H "Content-Type: application/json" \
  -d '{
    "query": "authentication best practices",
    "limit": 5
  }'
```

### ZeroMemory Store

```bash
curl -X POST https://api.ainative.studio/api/v1/public/memory/v2/remember \
  -H "Authorization: Bearer AUTH0_USER_JWT" \
  -H "Content-Type: application/json" \
  -d '{
    "content": "User prefers dark mode",
    "entity_name": "user_preferences"
  }'
```

---

## Step 6: Enable Row-Level Security for ZeroDB (Optional)

Row-Level Security (RLS) ensures that each user can only access their own data in ZeroDB. When enabled, the `user_id` claim from the Auth0 JWT is automatically applied as a filter on all queries.

```bash
curl -X POST https://api.ainative.studio/api/v1/zerodb/projects/YOUR_PROJECT_ID/rls \
  -H "Authorization: Bearer $AINATIVE_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "enabled": true,
    "user_id_claim": "sub",
    "policy": "strict"
  }'
```

With RLS enabled:
- **Vectors**: Automatically filtered by the `user_id` extracted from the JWT `sub` claim
- **Tables**: Row-level filtering applied on reads and writes
- **Files**: Users can only access files they uploaded
- **Memory**: Each user gets isolated memory namespaces

---

## Auth0 Organizations (Multi-Tenant)

If you use [Auth0 Organizations](https://auth0.com/docs/manage-users/organizations) for multi-tenancy, the `org_id` claim is mapped to AINative's `tenant` field. This enables tenant-scoped data isolation across ZeroDB and ZeroMemory.

```bash
## Request a token scoped to an organization
curl -X POST https://YOUR_TENANT.us.auth0.com/oauth/token \
  -H "Content-Type: application/json" \
  -d '{
    "client_id": "YOUR_AUTH0_CLIENT_ID",
    "client_secret": "YOUR_AUTH0_CLIENT_SECRET",
    "audience": "https://api.ainative.studio",
    "grant_type": "client_credentials",
    "organization": "org_TENANT_ID"
  }'
```

---

## Troubleshooting

| Issue | Cause | Fix |
|-------|-------|-----|
| `401 Unauthorized` | Token expired or audience mismatch | Verify the `audience` parameter matches what you registered |
| `403 Forbidden` | RLS blocking access | Check that the `sub` claim in the JWT matches the data owner |
| `invalid_token` error | JWKS URI unreachable | Confirm your Auth0 domain is correct and accessible |
| Missing `email` claim | Scopes not requested | Add `openid email profile` to your authorization request scopes |
| Missing `org_id` claim | Not using Auth0 Organizations | Only available when authenticating through an Auth0 Organization |

---

## Next Steps

- [ZeroMemory Guide](/docs/zeromemory/overview) -- Add persistent memory to your Auth0-authenticated agents
- [API Reference](/docs/api/overview) -- Full API documentation
- [SDK Quick Start](/docs/sdks/overview) -- Client SDKs for React, Next.js, Vue, Svelte, and Python