> ## Documentation Index
> Fetch the complete documentation index at: https://docs.mcp-use.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Auth0 Provider

> Configure Auth0 Dynamic Client Registration authentication for an MCP server.

Use `oauthAuth0Provider` when Auth0 is the authorization server. MCP clients register directly with Auth0, and mcp-use verifies Auth0 access tokens against the resolved MCP resource.

## Configure Auth0

In the [Auth0 Dashboard](https://manage.auth0.com):

1. Enable the Resource Parameter Compatibility Profile.
2. Promote the login connections MCP clients may use to domain-level connections.
3. Create an API whose identifier is the canonical MCP resource, such as `https://mcp.example.com/mcp`.
4. Use the `rfc9068_profile_authz` token dialect if tools need Auth0 permissions in access tokens.

The API identifier must match the resource that mcp-use resolves for token verification. Auth0 provider options do not include a separate `audience`.

## Configure the server

Treat the environment variable as application configuration and pass `domain` explicitly.

```bash theme={null}
AUTH0_DOMAIN=https://your-tenant.us.auth0.com
MCP_URL=https://mcp.example.com
```

```typescript theme={null}
import { MCPServer } from "mcp-use";
import { oauthAuth0Provider } from "mcp-use/oauth/auth0";

const domain = process.env.AUTH0_DOMAIN;
if (!domain) throw new Error("AUTH0_DOMAIN is required");

const server = new MCPServer({
  name: "auth0-server",
  version: "1.0.0",
  oauth: oauthAuth0Provider({ domain }),
});

export default server;
```

## Use Auth0 identity and permissions

Auth0 normalizes the subject to `ctx.auth.user.id`. It also maps optional `email`, `name`, `nickname`, `picture`, `emailVerified`, and `updatedAt` fields plus `roles`. Token permissions are available at top-level `ctx.auth.permissions`.

```typescript theme={null}
import { z } from "zod";

server.tool(
  {
    name: "delete_document",
    description: "Delete a document with the Auth0 permission.",
    inputSchema: z.object({ documentId: z.string() }),
  },
  async ({ documentId }, ctx) => {
    if (!ctx.auth.permissions.includes("delete:documents")) {
      return {
        isError: true,
        content: [{ type: "text", text: "Forbidden" }],
      };
    }

    await db.documents.delete({ id: documentId });
    return {
      content: [{ type: "text", text: `Deleted for ${ctx.auth.user.id}` }],
    };
  },
);
```

## Verify the setup

Confirm that the client registers with Auth0, the token audience is the resolved MCP resource, invalid tokens are rejected, and permission-protected tools reject callers without the required permission.

<CardGroup cols={2}>
  <Card title="Runnable Auth0 example" icon="github" href="https://github.com/mcp-use/mcp-use/tree/main/libraries/typescript/packages/server/examples/auth/auth0">
    Compare with the maintained Auth0 example.
  </Card>

  <Card title="Auth0 MCP Authorization Guide" icon="book-open" href="https://auth0.com/ai/docs/mcp/get-started/authorization-for-your-mcp-server">
    Configure Auth0 for MCP authorization.
  </Card>

  <Card title="User Context" icon="user" href="/v2/typescript/server/authentication/user-context">
    Use normalized Auth0 identity and permissions.
  </Card>
</CardGroup>