Auth0 server-side Python SDK: authentication flows, token management, and session handling\nfor web applications.
\nImport
\nfrom auth0_server_python.auth_schemes.bearer_auth import BearerAuth\nBases: httpx.Auth
Base class for all authentication schemes.
\nTo implement a custom authentication scheme, subclass Auth and override\nthe .auth_flow() method.
\nIf the authentication scheme does I/O such as disk access or network calls, or uses\nsynchronization primitives such as locks, you should override .sync_auth_flow()\nand/or .async_auth_flow() instead of .auth_flow() to provide specialized\nimplementations that will be used by Client and AsyncClient respectively.
\nExecute the authentication flow.
\nTo dispatch a request, yield it:
\n`\nyield request\n`
The client will .send() the response back into the flow generator. You can\naccess it like so:
\n`\nresponse = yield request\n`
A return (or reaching the end of the generator) will result in the\nclient returning the last response obtained from the server.
\nYou can dispatch as many requests as is necessary.
\nBearerAuth\nImport
\nfrom auth0_server_python.auth_schemes.client_assertion import (\n build_client_assertion,\n validate_client_assertion_key,\n)\nMint a private_key_jwt client assertion for token-endpoint authentication (RFC 7523).
\nprivate_key \u2013 The client\u2019s private signing key (PKCS8 PEM string or bytes).
client_id \u2013 The Auth0 client ID, used as both the issuer and subject claim.
issuer \u2013 The authorization server issuer identifier, used as the audience claim.
alg \u2013 The signing algorithm (defaults to \u201cRS256\u201d).
The signed client-assertion JWT.
\nVerify the signing key and algorithm can produce a client assertion.
\nprivate_key \u2013 The client\u2019s private signing key (PKCS8 PEM string or bytes).
alg \u2013 The signing algorithm (defaults to \u201cRS256\u201d).
ConfigurationError \u2013 If the key is malformed or does not match the algorithm.
\nImport
\nfrom auth0_server_python.auth_schemes.dpop_auth import (\n DPoPAuth,\n make_dpop_proof_for_token_endpoint,\n)\nBases: httpx.Auth
Base class for all authentication schemes.
\nTo implement a custom authentication scheme, subclass Auth and override\nthe .auth_flow() method.
\nIf the authentication scheme does I/O such as disk access or network calls, or uses\nsynchronization primitives such as locks, you should override .sync_auth_flow()\nand/or .async_auth_flow() instead of .auth_flow() to provide specialized\nimplementations that will be used by Client and AsyncClient respectively.
\nExecute the authentication flow.
\nTo dispatch a request, yield it:
\n`\nyield request\n`
The client will .send() the response back into the flow generator. You can\naccess it like so:
\n`\nresponse = yield request\n`
A return (or reaching the end of the generator) will result in the\nclient returning the last response obtained from the server.
\nYou can dispatch as many requests as is necessary.
\nBuild a DPoP proof JWT for use at the token endpoint (RFC 9449 \u00a74.2).\nUnlike resource-server proofs, token-endpoint proofs do NOT include ath\nbecause no access token exists yet at issuance time.
\nAnonymous Sessions client for auth0-server-python SDK.\nHandles pre-login anon@ identity operations against the Auth0 anonymous session API.
\nImport
\nfrom auth0_server_python.auth_server.anonymous.client import AnonymousClient\nClient for Auth0 anonymous session operations.
\nMint a fresh anon@<uuid> identity.
\noptions \u2013 Optional bundle of audience/scope/metadata, accepted as a\nCreateAnonymousSessionOptions or a plain dict. Explicit keyword\narguments below always win over the same field on options.
audience \u2013 Audience for the session. Falls back to options.audience,\nthen to the client\u2019s configured default, when omitted.
scope \u2013 Scope for the session. Falls back to options.scope, then to\nthe client\u2019s configured default, when omitted.
metadata \u2013 Metadata to attach at creation, up to 1KB. Cannot be\nchanged after creation. Falls back to options.metadata.
store_options \u2013 Options passed to the anonymous store.
The newly created AnonymousSession.
\nConfigurationError \u2013 No anonymous_store configured.
AnonymousSessionCreateError \u2013 Invalid options, local validation\nfailure, or server rejection.
Mint a short-lived transfer ticket from the active session for login injection.
\norigin_domain \u2013 The domain the /authorize URL is being built for.
store_options \u2013 Options passed to the anonymous store.
The minted transfer ticket, or None.
\nReturn stored anonymous session identity without calling Auth0.
\nstore_options \u2013 Options passed to the anonymous store.
\nThe stored AnonymousSessionData, or None when there is no session,\nthe session is corrupt, or (in resolver mode) the stored domain\ndoes not match the current tenant.
\nReturn a valid anonymous access token, renewing or re-minting as needed.
\nstore_options \u2013 Options passed to the anonymous store.
audience \u2013 Audience to retrieve a token for. Falls back to the\nclient\u2019s configured default when omitted.
scope \u2013 Scope to retrieve a token for. Falls back to the client\u2019s\nconfigured default when omitted.
The current or refreshed AnonymousSession.
\nConfigurationError \u2013 No anonymous_store configured.
AnonymousSessionTokenError \u2013 No active session, unrecoverable\nfailure, or expired session (code session_expired).
Clear the locally-held anonymous session without revoking issued tokens.
\nstore_options \u2013 Options passed to the anonymous store.
\nConfigurationError \u2013 No anonymous_store configured.
\nPure helper functions for anonymous session operations.
\nImport
\nfrom auth0_server_python.auth_server.anonymous.helpers import (\n decode_anonymous_sub,\n find_token_set,\n map_anonymous_error,\n normalize_url,\n parse_anonymous_error_body,\n upsert_token_set,\n validate_metadata,\n)\nExtract the sub claim from a JWT access token without verifying the signature.
\naccess_token \u2013 The token to decode.
\nThe sub claim, or None for opaque tokens, non-JWT strings, or\ntokens with no sub claim.
\nReturn the cached token set for an audience/scope pair, or None.
\nMap a server error response to a typed exception.
\nerror_data \u2013 The parsed error response body.
operation \u2013 One of \u2018create\u2019, \u2018token\u2019.
The exception instance. Does not raise it.
\nNormalize a domain-like value for comparison.
\nvalue \u2013 A domain or URL string, or None.
\nThe value lowercased, scheme-qualified, and without a trailing\nslash. Falsy input is returned unchanged.
\nParse an error response body as JSON.
\nresponse \u2013 The HTTP response to parse.
\nThe parsed JSON body, or a fallback dict with \u2018error_description\u2019\nwhen the body is not valid JSON.
\nReturn a copy of context with the token set for entry\u2019s audience/scope replaced.
\nValidate metadata locally before it reaches the network.
\nmetadata \u2013 The metadata dict to validate, or None.
\nAnonymousSessionCreateError \u2013 metadata is not a dict, contains a\na non-JSON-serializable value, or exceeds 1KB.
\nMFA Client for auth0-server-python SDK.\nHandles Multi-Factor Authentication operations against the Auth0 MFA API.
\nImport
\nfrom auth0_server_python.auth_server.mfa_client import MfaClient\nClient for Auth0 MFA API operations.
\nProvides methods for listing authenticators, enrolling new authenticators,\ndeleting authenticators, challenging authenticators, and verifying MFA codes.
\nAll public API methods accept an encrypted mfa_token (as issued by\nMfaRequiredError) and decrypt it internally. Callers never handle the\nraw Auth0 mfa_token directly.
\nInitiates an MFA challenge for user verification.
\noptions \u2013 Dict containing \u2018mfa_token\u2019, \u2018factor_type\u2019 (otp, sms, voice, email, auth0),\nand optionally \u2018authenticator_id\u2019.
store_options \u2013 Optional options passed to the State Store (e.g. request/response).
ChallengeResponse with challenge details.
\nMfaChallengeError \u2013 When the challenge fails.
ConfigurationError \u2013 If neither client_secret nor client_assertion_signing_key is configured.
Decrypt an MFA token and validate TTL.
\nEnrolls a new MFA authenticator for the user.
\noptions \u2013 Dict containing enrollment parameters.\nRequired: \u2018mfa_token\u2019, \u2018factor_type\u2019 (otp, sms, voice, email, auth0).\nOptional: \u2018phone_number\u2019, \u2018email\u2019.
store_options \u2013 Optional options passed to the State Store (e.g. request/response).
OtpEnrollmentResponse or OobEnrollmentResponse.
\nMfaEnrollmentError \u2013 When enrollment fails.
\nLists all MFA authenticators enrolled by the user.
\noptions \u2013 Dict containing \u2018mfa_token\u2019 (raw, decrypted).
store_options \u2013 Optional options passed to the State Store (e.g. request/response).
List of enrolled authenticators.
\nMfaListAuthenticatorsError \u2013 When the request fails.
\nVerifies an MFA code and completes authentication.
\nSupports OTP, OOB (with binding code), and recovery code verification.
\nIf Auth0 returns \u2018mfa_required\u2019 again (chained MFA), raises MfaRequiredError\nwith a raw mfa_token. The framework SDK (e.g. auth0-fastapi) is responsible\nfor encrypting the token before returning it to the client.
\noptions \u2013 Dict containing \u2018mfa_token\u2019 and one of:\n- \u2018otp\u2019: OTP code\n- \u2018oob_code\u2019 + \u2018binding_code\u2019: OOB verification\n- \u2018recovery_code\u2019: Recovery code\n- \u2018persist\u2019: bool (optional, default=False) - Persist tokens to state store\n- \u2018audience\u2019: str (optional, required if persist=True) - Audience for token_set\n- \u2018scope\u2019: str (optional) - Scope for token_set
store_options \u2013 Optional options passed to the State Store (e.g. request/response).
dpop_key \u2013 Optional EC P-256 JWK to DPoP-bind the token. Pass the same\nkey used at login (e.g. given to signin_with_passkey) to preserve\nthe sender constraint through step-up. Never stored by the SDK.
MfaVerifyResponse with access_token, token_type, etc.
\nMfaVerifyError \u2013 When verification fails, or when dpop_key was supplied\nbut the server returned an unbound (Bearer) token.
MfaRequiredError \u2013 When chained MFA is required.
ConfigurationError \u2013 If dpop_key is combined with use_mtls. DPoP and mTLS\nuse incompatible token-binding mechanisms and cannot be used together.
ConfigurationError \u2013 If neither client_secret nor client_assertion_signing_key is configured.
Import
\nfrom auth0_server_python.auth_server.my_account_client import MyAccountClient\nClient for interacting with the Auth0 MyAccount API.
\nComplete the connected account flow after user authorization.
\naccess_token \u2013 User\u2019s access token for authentication
request \u2013 Request containing the auth session, connect code, and redirect URI
Response containing the connected account details including ID, connection, and scopes
\nMyAccountApiError \u2013 If the API returns an error response
ApiError \u2013 If the request fails due to network or other issues
Initiate the connected account flow.
\naccess_token \u2013 User\u2019s access token for authentication
request \u2013 Request containing connection details and configuration
Response containing the connect URI and authentication session details
\nMyAccountApiError \u2013 If the API returns an error response
ApiError \u2013 If the request fails due to network or other issues
Delete an authentication method by ID.
\naccess_token \u2013 User\u2019s access token (scope: delete:me:authentication-methods).
authentication_method_id \u2013 ID of the authentication method to delete.
dpop_key \u2013 Optional EC P-256 key for DPoP-bound token presentation.
MissingRequiredArgumentError \u2013 If access_token or authentication_method_id is not provided.
MyAccountApiError \u2013 If the API returns an error response.
ApiError \u2013 If the request fails due to network or other issues.
Delete a connected account for the authenticated user.
\naccess_token \u2013 User\u2019s access token for authentication
connected_account_id \u2013 ID of the connected account to delete
None
\nMissingRequiredArgumentError \u2013 If access_token or connected_account_id is not provided
MyAccountApiError \u2013 If the API returns an error response
ApiError \u2013 If the request fails due to network or other issues
Step 1 of 2: Start enrollment (POST /me/v1/authentication-methods).
\nFor passkey enrollment, pass the returned authn_params_public_key to\nnavigator.credentials.create(), then call verify_authentication_method()\nwith the auth_session and credential result.
\nRequires scope: create:me:authentication-methods
\nRetrieve a single authentication method by ID.
\naccess_token \u2013 User\u2019s access token (scope: read:me:authentication-methods).
authentication_method_id \u2013 ID of the authentication method to retrieve.
dpop_key \u2013 Optional EC P-256 key for DPoP-bound token presentation.
AuthenticationMethod for the requested ID.
\nMissingRequiredArgumentError \u2013 If access_token or authentication_method_id is not provided.
MyAccountApiError \u2013 If the API returns an error response.
ApiError \u2013 If the request fails due to network or other issues.
Retrieve the list of factors available for enrollment.
\naccess_token \u2013 User\u2019s access token (scope: read:me:factors).
dpop_key \u2013 Optional EC P-256 key for DPoP-bound token presentation.
GetFactorsResponse containing the available factors.
\nMissingRequiredArgumentError \u2013 If access_token is not provided.
MyAccountApiError \u2013 If the API returns an error response.
ApiError \u2013 If the request fails due to network or other issues.
List the user\u2019s enrolled authentication methods.
\naccess_token \u2013 User\u2019s access token (scope: read:me:authentication-methods).
type_filter \u2013 Optional authentication-method type to filter results by.
dpop_key \u2013 Optional EC P-256 key for DPoP-bound token presentation.
ListAuthenticationMethodsResponse containing the enrolled methods.
\nMissingRequiredArgumentError \u2013 If access_token is not provided.
MyAccountApiError \u2013 If the API returns an error response.
ApiError \u2013 If the request fails due to network or other issues.
List available connections that support connected accounts.
\naccess_token \u2013 User\u2019s access token for authentication
from_param \u2013 Optional pagination cursor for fetching next page of results
take \u2013 Optional number of results to return (must be a positive integer)
Response containing the list of available connections and pagination details
\nMissingRequiredArgumentError \u2013 If access_token is not provided
InvalidArgumentError \u2013 If take parameter is not a positive integer
MyAccountApiError \u2013 If the API returns an error response
ApiError \u2013 If the request fails due to network or other issues
List connected accounts for the authenticated user.
\naccess_token \u2013 User\u2019s access token for authentication
connection \u2013 Optional filter to list accounts for a specific connection
from_param \u2013 Optional pagination cursor for fetching next page of results
take \u2013 Optional number of results to return (must be a positive integer)
Response containing the list of connected accounts and pagination details
\nMissingRequiredArgumentError \u2013 If access_token is not provided
InvalidArgumentError \u2013 If take parameter is not a positive integer
MyAccountApiError \u2013 If the API returns an error response
ApiError \u2013 If the request fails due to network or other issues
Update an authentication method by ID.
\naccess_token \u2013 User\u2019s access token (scope: update:me:authentication-methods).
authentication_method_id \u2013 ID of the authentication method to update.
request \u2013 Fields to update on the authentication method.
dpop_key \u2013 Optional EC P-256 key for DPoP-bound token presentation.
AuthenticationMethod reflecting the updated state.
\nMissingRequiredArgumentError \u2013 If access_token, authentication_method_id, or request is not provided.
MyAccountApiError \u2013 If the API returns an error response.
ApiError \u2013 If the request fails due to network or other issues.
Step 2 of 2: Verify enrollment (POST /me/v1/authentication-methods/{id}/verify).
\nRequires scope: create:me:authentication-methods
\nMyAccountClientMyAccountClient.complete_connect_account()MyAccountClient.connect_account()MyAccountClient.delete_authentication_method()MyAccountClient.delete_connected_account()MyAccountClient.enroll_authentication_method()MyAccountClient.get_authentication_method()MyAccountClient.get_factors()MyAccountClient.list_authentication_methods()MyAccountClient.list_connected_account_connections()MyAccountClient.list_connected_accounts()MyAccountClient.update_authentication_method()MyAccountClient.verify_authentication_method()MyAccountClient.audiencePasswordless Client for auth0-server-python SDK.
\nImplements embedded passwordless login for a client:
\nEmail OTP / SMS OTP - start() sends a code, verify() exchanges it for\ntokens via the passwordless-OTP grant and establishes a server-side session.
Magic link - start(send="link") emails a one-click link. Completion is\nhandled by the standard callback (ServerClient.complete_interactive_login),\nnot by verify().
Tokens never leave the server. The browser holds only the opaque session.
\nImport
\nfrom auth0_server_python.auth_server.passwordless_client import PasswordlessClient\nClient for Auth0 embedded passwordless operations.
\nComposes the parent ServerClient to reuse domain resolution, OIDC\ndiscovery, JWKS/ID-token verification, and session persistence.
Start a passwordless flow by sending an OTP code or a magic link.
\noptions \u2013 StartPasswordlessEmailOptions or\nStartPasswordlessSmsOptions.
store_options \u2013 Options passed to the transaction store (e.g.\nrequest/response). Required for the magic-link flow so the\ntransaction cookie can be written.
PasswordlessStartResult with Auth0\u2019s start response payload.
\nPasswordlessStartError \u2013 When POST /passwordless/start fails.
InvalidArgumentError \u2013 When options is not a recognized type, or\ncaller auth_params contains an SDK-owned or unrecognized key.
MissingRequiredArgumentError \u2013 When a magic link is requested but no\nredirect_uri is configured on the client, or store_options\nis not provided.
ConfigurationError \u2013 When client authentication is not configured.
Verify a passwordless OTP and establish a server-side session.
\nOnly for the OTP flows (email/SMS code). Magic link completes via the\nstandard callback handler, not here.
\noptions \u2013 VerifyPasswordlessOtpOptions.
store_options \u2013 Options passed to the state store (e.g.\nrequest/response) so the session can be written.
Dict containing state_data for the established session.
PasswordlessVerifyError \u2013 When token exchange or ID-token\nverification fails.
MfaRequiredError \u2013 When Auth0 requires MFA before completing login.
ApiError \u2013 When fetching the JWKS used to verify the ID token fails.
SessionExpiredError \u2013 When the token\u2019s session-expiry ceiling is\nalready in the past.
ConfigurationError \u2013 When client authentication is not configured.
Main client for auth0-server-python SDK.\nHandles authentication flows, token management, and user sessions.
\nImport
\nfrom auth0_server_python.auth_server.server_client import (\n ServerClient,\n is_federated_domain,\n)\nBases: Generic[TStoreOptions]
Main client for Auth0 server SDK. Handles authentication flows, session management,\nand token operations using Authlib for OIDC functionality.
\nPerforms backchannel authentication with Auth0.
\nThis method starts a Client-Initiated Backchannel Authentication (CIBA) flow,\nwhich allows an application to request authentication from a user via a separate\ndevice or channel.
\nThen polls the token endpoint until the user has authenticated or the request times out.
\noptions (dict) \u2013
Configuration options for backchannel authentication\n- login_hint (dict): Must contain a \u2018sub\u2019 field (e.g., {\u2018sub\u2019: \u2018user_id\u2019}).\n- binding_message (str, optional): Message to display to the user.\n- authorization_params (dict, optional): Additional authorization parameters.
\n\n\n\n\n
\n- \n
requested_expiry (int, optional): Requested expiry time in seconds, default is 30 secs.
- \n
authorization_details (str, optional): JSON string for RAR.
Token response data from the backchannel authentication
\nApiError \u2013 If the backchannel authentication fails
EnterpriseConnectError \u2013 If the client is configured for Enterprise Connect.
Retrieves a token by exchanging an auth_req_id.
\nauth_req_id (str) \u2013 The authentication request ID obtained from bc-authorize
store_options \u2013 Optional options used to pass to the Transaction and State Store.
AccessTokenError \u2013 If there was an issue requesting the access token.
ConfigurationError \u2013 If no client authentication is configured.
A dictionary containing the token response from Auth0.
\nBuilds the redirect URL that hands the STT to the target app\u2019s login URL.
\ntarget_login_url must be a trusted, app-controlled absolute https URL (http is allowed\nonly for localhost/loopback) - the STT is a single-use credential and must not leak to an\nuntrusted host.
\ntarget_login_url \u2013 The target app\u2019s login URL (absolute, https)
result \u2013 The SessionTransferTokenResult from request_session_transfer_token
organization \u2013 Organization identifier to forward (optional)
A URL string with session_transfer_token (and organization) as query parameters
\nMissingRequiredArgumentError \u2013 If target_login_url is missing or blank
InvalidArgumentError \u2013 If target_login_url is not an absolute https URL, or organization is blank
EnterpriseConnectError \u2013 If the client is configured for Enterprise Connect.
Handles the redirect callback to complete the connect account flow for linking a third-party\naccount to the user\u2019s profile.
\nThis works similar to the redirect from the login flow except it verifies the connect_code\nwith the My Account API rather than the code with the Authorization Server.
\nurl \u2013 The full callback URL including query parameters
store_options \u2013 Optional options used to pass to the Transaction and State Store.
A response from the connect account flow.
\nEnterpriseConnectError \u2013 If the client is configured for Enterprise Connect.
\nCompletes the login process after user is redirected back.
\nurl \u2013 The full callback URL including query parameters
store_options \u2013 Options to pass to the state store
Dictionary containing session data and app state
\nConfigurationError \u2013 If no client authentication is configured.
\nCompletes the user linking process.
\nurl \u2013 The URL from which the query params should be extracted
store_options \u2013 Optional options for the stores
Dictionary containing the original app state
\nEnterpriseConnectError \u2013 If the client is configured for Enterprise Connect.
\nCompletes the user unlinking process.
\nurl \u2013 The URL from which the query params should be extracted
store_options \u2013 Optional options for the stores
Dictionary containing the original app state
\nEnterpriseConnectError \u2013 If the client is configured for Enterprise Connect.
\nExchanges a custom token for Auth0 tokens using RFC 8693.
\nThis method implements the OAuth 2.0 Token Exchange specification,\nallowing you to exchange external custom tokens for Auth0 access tokens.
\noptions \u2013 Configuration for the token exchange
store_options \u2013 Optional options used to pass to the Transaction and State Store.
TokenExchangeResponse containing access_token and metadata
\nCustomTokenExchangeError \u2013 If token exchange fails
MissingRequiredArgumentError \u2013 If required parameters are missing
ConfigurationError \u2013 If no client authentication is configured
Example
\n```python\nresponse = await client.custom_token_exchange(
\n\n\n\n\n\n
\n- CustomTokenExchangeOptions(
- \n
subject_token=\u201dcustom-token-value\u201d,\nsubject_token_type=\u201durn:acme:mcp-token\u201d,\naudience=\u201dhttps://api.example.com\u201d,\nscope=\u201dread:data write:data\u201d
\n)
\n
Deletes a connected account.
\nconnected_account_id (str) \u2013 The ID of the connected account to delete.
store_options \u2013 Optional options used to pass to the Transaction and State Store.
Auth0Error \u2013 If there is an error retrieving the access token.
MyAccountApiError \u2013 If the My Account API returns an error response.
EnterpriseConnectError \u2013 If the client is configured for Enterprise Connect.
Retrieves the access token from the store, or calls Auth0 when the access token\nis expired and a refresh token is available in the store.\nAlso updates the store when a new token was retrieved from Auth0.
\nstore_options \u2013 Optional options used to pass to the Transaction and State Store.
\nThe access token, retrieved from the store or Auth0.
\nAccessTokenError \u2013 If the token is expired and no refresh token is available.
EnterpriseConnectError \u2013 If the client is configured for Enterprise Connect.
Retrieves an access token for a connection.
\nThis method attempts to obtain an access token for a specified connection.\nIt first checks if a refresh token exists in the store.\nIf no refresh token is found, it throws an AccessTokenForConnectionError indicating\nthat the refresh token was not found.
\noptions \u2013 Options for retrieving an access token for a connection.
store_options \u2013 Optional options used to pass to the Transaction and State Store.
The access token for the connection
\nAccessTokenForConnectionError \u2013 If the access token was not found or\nthere was an issue requesting the access token.
EnterpriseConnectError \u2013 If the client is configured for Enterprise Connect.
Retrieve the user session from the store, or None if no session found.
\nstore_options \u2013 Optional options used to pass to the Transaction and State Store.
\nThe session, or None if no session found in the store.
\nEnterpriseConnectError \u2013 If the client is configured for Enterprise Connect.
\nRetrieves a token by exchanging a refresh token.
\noptions \u2013 Dictionary containing the refresh token and any additional options.\nMust include a \u2018refresh_token\u2019 key.
\nAccessTokenError \u2013 If there was an issue requesting the access token.
ConfigurationError \u2013 If no client authentication is configured.
EnterpriseConnectError \u2013 If the client is configured for Enterprise Connect.
A dictionary containing the token response from Auth0.
\nRetrieves a token for a connection.
\noptions \u2013 Options for retrieving an access token for a connection.\nMust include \u2018connection\u2019 and \u2018refresh_token\u2019 keys.\nMay optionally include \u2018login_hint\u2019.
\nAccessTokenForConnectionError \u2013 If there was an issue requesting the access token.
ConfigurationError \u2013 If no client authentication is configured.
EnterpriseConnectError \u2013 If the client is configured for Enterprise Connect.
Dictionary containing the token response with accessToken, expiresAt, and scope.
\nRetrieves the user from the store, or None if no user found.
\nstore_options \u2013 Optional options used to pass to the Transaction and State Store.
\nThe user, or None if no user found in the store.
\nEnterpriseConnectError \u2013 If the client is configured for Enterprise Connect.
\nHandles backchannel logout requests.
\nlogout_token \u2013 The logout token sent by Auth0
store_options \u2013 Options to pass to the state store
Start backchannel authentication with Auth0.
\nThis method starts a Client-Initiated Backchannel Authentication (CIBA) flow,\nwhich allows an application to request authentication from a user via a separate\ndevice or channel.
\noptions (dict) \u2013
Configuration options for backchannel authentication\n- login_hint (dict): Must contain a \u2018sub\u2019 field (e.g., {\u2018sub\u2019: \u2018user_id\u2019}).\n- binding_message (str, optional): Message to display to the user.\n- authorization_params (dict, optional): Additional authorization parameters.
\n\n\n\n\n
\n- \n
requested_expiry (int, optional): Requested expiry time in seconds, default is 30 secs.
- \n
authorization_details (str, optional): JSON string for RAR.
auth_req_id (str): The authentication request ID.
expires_in (int): Time in seconds until the request expires.
interval (int, optional): Polling interval in seconds.
ApiError \u2013 If the backchannel authentication fails
\nRetrieves a list of available connections that can be used connected accounts for the authenticated user.
\nfrom_param (Optional[str], optional) \u2013 A pagination token indicating where to start retrieving results, obtained from a prior request. Defaults to None.
take (Optional[int], optional) \u2013 The maximum number of connections to retrieve. Defaults to None.
store_options \u2013 Optional options used to pass to the Transaction and State Store.
The response object containing the list of connected account connections.
\nAuth0Error \u2013 If there is an error retrieving the access token.
MyAccountApiError \u2013 If the My Account API returns an error response.
EnterpriseConnectError \u2013 If the client is configured for Enterprise Connect.
Retrieves a list of connected accounts for the authenticated user.
\nconnection (Optional[str], optional) \u2013 Filter results to a specific connection. Defaults to None.
from_param (Optional[str], optional) \u2013 A pagination token indicating where to start retrieving results, obtained from a prior request. Defaults to None.
take (Optional[int], optional) \u2013 The maximum number of connections to retrieve. Defaults to None.
store_options \u2013 Optional options used to pass to the Transaction and State Store.
The response object containing the list of connected accounts.
\nAuth0Error \u2013 If there is an error retrieving the access token.
MyAccountApiError \u2013 If the My Account API returns an error response.
EnterpriseConnectError \u2013 If the client is configured for Enterprise Connect.
Logs in using Client-Initiated Backchannel Authentication.
\nNote
\nUsing Client-Initiated Backchannel Authentication requires the feature\nto be enabled in the Auth0 dashboard.
\noptions \u2013 Options used to configure the backchannel login process.
store_options \u2013 Optional options used to pass to the Transaction and State Store.
A dictionary containing the authorizationDetails (when RAR was used).
\nEnterpriseConnectError \u2013 If the client is configured for Enterprise Connect.
\nPerforms token exchange and establishes a user session.
\nThis method combines custom_token_exchange() with session management,\nexchanging a custom token for Auth0 tokens and storing the session state.
\noptions \u2013 Configuration for token exchange and login
store_options \u2013 Optional options for state store (e.g., request/response for cookies)
LoginWithCustomTokenExchangeResult containing session state
\nCustomTokenExchangeError \u2013 If token exchange fails
ApiError \u2013 If session management fails
EnterpriseConnectError \u2013 If the client is configured for Enterprise Connect.
Example
\n```python\nresult = await client.login_with_custom_token_exchange(
\n\n\n\n\n\n
\n- LoginWithCustomTokenExchangeOptions(
- \n
subject_token=\u201dcustom-token-value\u201d,\nsubject_token_type=\u201durn:acme:mcp-token\u201d,\naudience=\u201dhttps://api.example.com\u201d
\n),\nstore_options={\u201crequest\u201d: request, \u201cresponse\u201d: response}
\n
Step 1 of 2: Initiate a passkey login challenge (POST /passkey/challenge).
\nPass the returned authn_params_public_key to navigator.credentials.get(),\nthen call signin_with_passkey() with the auth_session and credential result.
\nusername \u2013 Deprecated and ignored. Auth0 rejects username on the\npasskey login challenge (the user is identified by the selected\ncredential, not by a supplied username), so it is never forwarded.\nRetained for backward compatibility and will be removed in a future\nmajor release. Passing it emits a DeprecationWarning.
connection \u2013 Auth0 database connection name (realm).
organization \u2013 Auth0 organization ID or name.
store_options \u2013 Optional options for domain resolution.
client_ip \u2013 Optional end user IP address, sent as the auth0-forwarded-for header.
PasskeyLoginChallengeResponse with auth_session and authn_params_public_key.
\nPasskeyError \u2013 If the challenge request fails or the request is rate limited.
EnterpriseConnectError \u2013 If the client is configured for Enterprise Connect.
Step 1 of 2: Initiate a passkey signup challenge (POST /passkey/register).
\nPass the returned authn_params_public_key to navigator.credentials.create(),\nthen call signin_with_passkey() with the auth_session and credential result.
\nuser_profile \u2013 Optional user profile data (email, name, username, etc.).\nUse PasskeyUserProfile \u2014 supports extra fields for forward compatibility.
connection \u2013 Auth0 database connection name (realm).
organization \u2013 Auth0 organization ID or name.
user_metadata \u2013 Optional custom metadata added at the root of the request body,\nnot nested inside user_profile (per Auth0 API spec).
store_options \u2013 Optional options for domain resolution.
delivery_method \u2013 Optional channel for the phone verification code, \u201ctext\u201d or \u201cvoice\u201d.
client_ip \u2013 Optional end user IP address, sent as the auth0-forwarded-for header.
PasskeySignupChallengeResponse with auth_session, authn_params_public_key and,\nwhen the connection requires verification, verification_required.
\nInvalidArgumentError \u2013 If delivery_method is set to a value other than \u201ctext\u201d or \u201cvoice\u201d.
PasskeyError \u2013 If the challenge request fails or the request is rate limited.
EnterpriseConnectError \u2013 If the client is configured for Enterprise Connect.
Requests a Session Transfer Token (STT) for impersonation via session transfer.
\nPerforms a custom token exchange against the session_transfer audience. The returned\nSTT is opaque and single-use; hand it to build_session_transfer_redirect and do not\ndecode or store it. The act claim is not on this result.
\nsubject_token \u2013 Your proof of which customer to impersonate (validated by your Action)
subject_token_type \u2013 The subject token type URI routing to your CTE Profile
actor_token \u2013 The acting party\u2019s token; optional. Defaults to the agent session\u2019s ID token
actor_token_type \u2013 Type URI of the actor token; defaults to the ID token URN
scope \u2013 Space-delimited list of scopes (optional)
organization \u2013 Organization identifier (optional)
store_options \u2013 Optional options used to read the agent session and resolve the domain
SessionTransferTokenResult containing the STT and its metadata
\nCustomTokenExchangeError \u2013 If no actor can be resolved or the exchange fails
InvalidArgumentError \u2013 If organization is provided but blank
EnterpriseConnectError \u2013 If the client is configured for Enterprise Connect.
Completes passkey authentication by exchanging the WebAuthn assertion\nfor tokens and establishing a server-side session.
\nThis is step 2 of 2: call passkey_signup_challenge or passkey_login_challenge\nfirst to obtain auth_session and the WebAuthn challenge options.
\nauth_session \u2013 Session credential from passkey_signup_challenge or passkey_login_challenge.
authn_response \u2013 Serialized WebAuthn credential from navigator.credentials.create/get.
store_options \u2013 Options passed to the state store (e.g., request/response for cookies).\nPassed through to the store on every call.
connection \u2013 Auth0 database connection name (realm).
organization \u2013 Auth0 organization ID or name.
scope \u2013 OAuth2 scope string.
audience \u2013 Target API audience.
dpop_key \u2013 Optional EC P-256 JWK for DPoP-bound token exchange. When provided,\nattaches a DPoP proof header so Auth0 issues a DPoP-bound token\n(token_type: DPoP). Required when the tenant mandates DPoP binding.
verification \u2013 Optional signup codes keyed by \u201cemail\u201d or \u201cphone\u201d, not used for login.
client_ip \u2013 Optional end user IP address, sent as the auth0-forwarded-for header.
PasskeyLoginResult containing state_data with user claims and token sets,\nconsistent with complete_interactive_login and login_with_custom_token_exchange.
\nMissingRequiredArgumentError \u2013 If auth_session or authn_response is missing.
ConfigurationError \u2013 If dpop_key is combined with use_mtls. DPoP and mTLS\nuse incompatible token-binding mechanisms and cannot be used together.
InvalidArgumentError \u2013 If verification has a key other than \u201cemail\u201d or \u201cphone\u201d,\nor a code that is not a string.
PasskeyError \u2013 If token exchange or session creation fails, or the request is\nrate limited.
MfaRequiredError \u2013 If the tenant requires step-up MFA after the passkey sign-in.
ApiError \u2013 If the ID token fails signature, audience, expiry or JWKS validation.
IssuerValidationError \u2013 If the ID token issuer does not match the tenant.
OrganizationTokenValidationError \u2013 If an organization was requested but the\ntoken response included no ID token, or the ID token\u2019s org claim does\nnot match.
EnterpriseConnectError \u2013 If the client is configured for Enterprise Connect.
Initiates the connect account flow for linking a third-party account to the user\u2019s profile.
\nThis method generates PKCE parameters, creates a transaction and calls the My Account API\nto create a connect account request, returning /connect url containing a ticket.
\noptions \u2013 Options for retrieving an access token for a connection.
store_options \u2013 Optional options used to pass to the Transaction and State Store.
The a connect URL containing a ticket to redirect the user to.
\nEnterpriseConnectError \u2013 If the client is configured for Enterprise Connect.
\nBegin an Enterprise Connect login from an email address.
\nRuns WebFinger discovery on the email domain. When the domain is managed,\nbuilds an authorization URL with the email as login_hint so Auth0 can\nresolve the connection and organization. When it is not managed, returns\nNone so the caller can fall back to its own login. A static client-level\norganization is never forwarded - Auth0 resolves it from the email.
\noptions \u2013 Enterprise login options carrying the user\u2019s email.
store_options \u2013 Per-request store options threaded through the flow.
The authorization URL to redirect to, or None when the domain is not\nmanaged by Auth0.
\nMissingRequiredArgumentError \u2013 If no email is provided.
InvalidArgumentError \u2013 If the email is not a valid address.
Starts the interactive login process and returns a URL to redirect to.
\noptions \u2013 Configuration options for the login process
store_options \u2013 Store options containing request/response
Authorization URL to redirect the user to
\nConfigurationError \u2013 If no client authentication is configured.
\nStarts the user linking process, and returns a URL to redirect the user-agent to.
\noptions \u2013 Options used to configure the user linking process.
store_options \u2013 Optional options used to pass to the Transaction and State Store.
URL to redirect the user to for authentication.
\nEnterpriseConnectError \u2013 If the client is configured for Enterprise Connect.
\nStarts the user unlinking process, and returns a URL to redirect the user-agent to.
\noptions \u2013 Options used to configure the user unlinking process.
store_options \u2013 Optional options used to pass to the Transaction and State Store.
URL to redirect the user to for authentication.
\nEnterpriseConnectError \u2013 If the client is configured for Enterprise Connect.
\nAccess the anonymous sessions client for pre-login anon@ identity operations.
\nAccess the MFA client for multi-factor authentication operations.
\nAccess the passwordless client for embedded passwordless operations.
\nCheck whether an email domain is Auth0-managed for enterprise SSO via WebFinger.
\nA stateless routing hint, not an authorization decision. Fails closed to False\non any error or non-200/non-404 response. Prefer ServerClient in normal\nuse, which caches results and resolves the domain per request. This standalone\nform is for callers that need a one-off check without a client instance.
\ndomain \u2013 The Auth0 domain to query.
email_domain \u2013 The email domain to check (case-insensitive).
timeout \u2013 Per-request timeout in seconds.
True only when Auth0 reports the domain as a managed OIDC issuer.
\nServerClientServerClient.backchannel_authentication()ServerClient.backchannel_authentication_grant()ServerClient.build_session_transfer_redirect()ServerClient.complete_connect_account()ServerClient.complete_interactive_login()ServerClient.complete_link_user()ServerClient.complete_unlink_user()ServerClient.custom_token_exchange()ServerClient.delete_connected_account()ServerClient.get_access_token()ServerClient.get_access_token_for_connection()ServerClient.get_session()ServerClient.get_token_by_refresh_token()ServerClient.get_token_for_connection()ServerClient.get_user()ServerClient.handle_backchannel_logout()ServerClient.initiate_backchannel_authentication()ServerClient.list_connected_account_connections()ServerClient.list_connected_accounts()ServerClient.login_backchannel()ServerClient.login_with_custom_token_exchange()ServerClient.logout()ServerClient.passkey_login_challenge()ServerClient.passkey_signup_challenge()ServerClient.request_session_transfer_token()ServerClient.signin_with_passkey()ServerClient.start_connect_account()ServerClient.start_enterprise_login()ServerClient.start_interactive_login()ServerClient.start_link_user()ServerClient.start_unlink_user()ServerClient.DEFAULT_AUDIENCE_STATE_KEYServerClient.GRANT_TYPE_PASSKEYServerClient.PASSKEY_CHALLENGE_PATHServerClient.PASSKEY_REGISTER_PATHServerClient.PASSKEY_VERIFICATION_IDENTIFIERSServerClient.anonymousServerClient.mfaServerClient.passwordlessis_federated_domain()ID_TOKEN_TYPEINTERNAL_AUTHORIZE_PARAMSSESSION_TRANSFER_TOKEN_TYPETStoreOptionsWEBFINGER_CACHE_MAX_ENTRIESWEBFINGER_CACHE_TTL_FOUNDWEBFINGER_CACHE_TTL_NOT_FOUNDWEBFINGER_ISSUER_RELloggerType definitions for auth0-server-python SDK.\nThese Pydantic models provide type safety and validation for all SDK data structures.
\nImport
\nfrom auth0_server_python.auth_types import (\n AccessTokenForConnectionOptions,\n AnonymousCreateTokenResponse,\n AnonymousSession,\n AnonymousSessionContext,\n AnonymousSessionData,\n AnonymousTokenResponse,\n AnonymousTokenSetEntry,\n AnonymousTransferTokenResponse,\n AuthenticationMethod,\n AuthenticatorResponse,\n AuthorizationDetails,\n AuthorizationParameters,\n ChallengeOptions,\n ChallengeResponse,\n CompleteConnectAccountRequest,\n CompleteConnectAccountResponse,\n ConnectAccountOptions,\n ConnectAccountRequest,\n ConnectAccountResponse,\n ConnectParams,\n ConnectedAccount,\n ConnectedAccountBase,\n ConnectedAccountConnection,\n ConnectionTokenSet,\n CreateAnonymousSessionOptions,\n CustomTokenExchangeOptions,\n DomainResolverContext,\n EncryptedStoreOptions,\n EnrollAuthenticationMethodRequest,\n EnrollEmailOptions,\n EnrollOobOptions,\n EnrollOtpOptions,\n EnrollmentChallengeResponse,\n Factor,\n GetFactorsResponse,\n InternalStateData,\n ListAuthenticationMethodsResponse,\n ListAuthenticatorsOptions,\n ListConnectedAccountConnectionsResponse,\n ListConnectedAccountsResponse,\n LoginBackchannelOptions,\n LoginBackchannelResult,\n LoginWithCustomTokenExchangeOptions,\n LoginWithCustomTokenExchangeResult,\n LogoutOptions,\n LogoutTokenClaims,\n MfaRequirement,\n MfaRequirements,\n MfaTokenContext,\n MfaVerifyResponse,\n OobEnrollmentResponse,\n OtpEnrollmentResponse,\n PasskeyAuthResponse,\n PasskeyAuthenticatorSelection,\n PasskeyLoginChallengeResponse,\n PasskeyLoginResult,\n PasskeyPubKeyCredParam,\n PasskeyPublicKeyOptions,\n PasskeyRpInfo,\n PasskeySignupChallengeResponse,\n PasskeyTokenResponse,\n PasskeyUserInfo,\n PasskeyUserProfile,\n PasswordlessStartResult,\n ServerClientOptionsBase,\n ServerClientOptionsWithSecret,\n SessionData,\n SessionTransferTokenResult,\n StartEnterpriseLoginOptions,\n StartInteractiveLoginOptions,\n StartLinkUserOptions,\n StartPasswordlessEmailOptions,\n StartPasswordlessSmsOptions,\n StateData,\n TokenExchangeResponse,\n TokenSet,\n TransactionData,\n UpdateAuthenticationMethodRequest,\n UserClaims,\n VerifyAuthenticationMethodRequest,\n VerifyOobOptions,\n VerifyOtpOptions,\n VerifyPasswordlessOtpOptions,\n VerifyRecoveryCodeOptions,\n)\nBases: pydantic.BaseModel
Options for retrieving an access token for a specific connection.
\n\n\n\n\nBases: AnonymousTokenResponse
Raw response from POST /anonymous/token on the create path.
\n\n\nBases: pydantic.BaseModel
Public result of create_session() and the renewal ladder.
\n\n\n\n\n\n\n\n\n\n\n\n\nBases: pydantic.BaseModel
Internal context stored inside the encrypted anonymous session record, rejecting extra fields so a tampered payload raises on decrypt.
\n\n\n\n\n\n\nConfiguration for the model, should be a dictionary conforming to [ConfigDict][pydantic.config.ConfigDict].
\nBases: pydantic.BaseModel
Identity and metadata fields returned by AnonymousClient.get_session(), with no session_token.
\n\n\n\n\n\n\n\n\n\n\nBases: pydantic.BaseModel
Raw response from POST /anonymous/token.
\n\n\n\n\n\n\n\n\n\n\n\n\nBases: pydantic.BaseModel
One cached access token for a specific audience/scope pair.
\n\n\n\n\n\n\n\n\nConfiguration for the model, should be a dictionary conforming to [ConfigDict][pydantic.config.ConfigDict].
\nBases: pydantic.BaseModel
Raw response from POST /anonymous/token on the transfer-ticket path.
\n\n\n\n\nConfiguration for the model, should be a dictionary conforming to [ConfigDict][pydantic.config.ConfigDict].
\nBases: pydantic.BaseModel
[Models](../concepts/models.md)
\nA base class for creating Pydantic models.
\nThe names of the class variables defined on the model.
\nMetadata about the private attributes of the model.
\nThe synthesized __init__ [Signature][inspect.Signature] of the model.
\nWhether model building is completed, or if there are still undefined fields.
\nThe core schema of the model.
\nWhether the model has a custom __init__ function.
\nMetadata containing the decorators defined on the model.\nThis replaces Model.__validators__ and Model.__root_validators__ from Pydantic V1.
\nA dictionary containing metadata about generic Pydantic models.\nThe origin and args items map to the [__origin__][genericalias.__origin__]\nand [__args__][genericalias.__args__] attributes of [generic aliases][types-genericalias],\nand the parameter item maps to the __parameter__ attribute of generic classes.
\nParent namespace of the model, used for automatic rebuilding of models.
\nThe name of the post-init method for the model, if defined.
\nWhether the model is a [RootModel][pydantic.root_model.RootModel].
\nThe pydantic-core SchemaSerializer used to dump instances of the model.
\nThe pydantic-core SchemaValidator used to validate instances of the model.
\nA dictionary of field names and their corresponding [FieldInfo][pydantic.fields.FieldInfo] objects.
\nA dictionary of computed field names and their corresponding [ComputedFieldInfo][pydantic.fields.ComputedFieldInfo] objects.
\nA dictionary containing extra values, if [extra][pydantic.config.ConfigDict.extra]\nis set to \u2018allow\u2019.
\nThe names of fields explicitly set during instantiation.
\nValues of private attributes set on the model instance.
\nConfiguration for the model, should be a dictionary conforming to [ConfigDict][pydantic.config.ConfigDict].
\nBases: pydantic.BaseModel
Represents an MFA authenticator enrolled by a user.
\n\n\n\n\n\n\n\n\n\n\nConfiguration for the model, should be a dictionary conforming to [ConfigDict][pydantic.config.ConfigDict].
\nBases: pydantic.BaseModel
Authorization details returned from Auth0.\nUsed for Resource Access Rights (RAR).
\n\n\n\n\n\n\n\n\n\n\nBases: pydantic.BaseModel
Parameters used in authorization requests.\nBased on standard OAuth2/OIDC parameters.
\n\n\n\n\n\n\n\n\n\n\n\n\nBases: pydantic.BaseModel
Options for initiating an MFA challenge.
\n\n\nBases: pydantic.BaseModel
Response from initiating an MFA challenge.
\n\n\n\n\n\n\nConfiguration for the model, should be a dictionary conforming to [ConfigDict][pydantic.config.ConfigDict].
\nBases: pydantic.BaseModel
[Models](../concepts/models.md)
\nA base class for creating Pydantic models.
\nThe names of the class variables defined on the model.
\nMetadata about the private attributes of the model.
\nThe synthesized __init__ [Signature][inspect.Signature] of the model.
\nWhether model building is completed, or if there are still undefined fields.
\nThe core schema of the model.
\nWhether the model has a custom __init__ function.
\nMetadata containing the decorators defined on the model.\nThis replaces Model.__validators__ and Model.__root_validators__ from Pydantic V1.
\nA dictionary containing metadata about generic Pydantic models.\nThe origin and args items map to the [__origin__][genericalias.__origin__]\nand [__args__][genericalias.__args__] attributes of [generic aliases][types-genericalias],\nand the parameter item maps to the __parameter__ attribute of generic classes.
\nParent namespace of the model, used for automatic rebuilding of models.
\nThe name of the post-init method for the model, if defined.
\nWhether the model is a [RootModel][pydantic.root_model.RootModel].
\nThe pydantic-core SchemaSerializer used to dump instances of the model.
\nThe pydantic-core SchemaValidator used to validate instances of the model.
\nA dictionary of field names and their corresponding [FieldInfo][pydantic.fields.FieldInfo] objects.
\nA dictionary of computed field names and their corresponding [ComputedFieldInfo][pydantic.fields.ComputedFieldInfo] objects.
\nA dictionary containing extra values, if [extra][pydantic.config.ConfigDict.extra]\nis set to \u2018allow\u2019.
\nThe names of fields explicitly set during instantiation.
\nValues of private attributes set on the model instance.
\nBases: ConnectedAccountBase
[Models](../concepts/models.md)
\nA base class for creating Pydantic models.
\nThe names of the class variables defined on the model.
\nMetadata about the private attributes of the model.
\nThe synthesized __init__ [Signature][inspect.Signature] of the model.
\nWhether model building is completed, or if there are still undefined fields.
\nThe core schema of the model.
\nWhether the model has a custom __init__ function.
\nMetadata containing the decorators defined on the model.\nThis replaces Model.__validators__ and Model.__root_validators__ from Pydantic V1.
\nA dictionary containing metadata about generic Pydantic models.\nThe origin and args items map to the [__origin__][genericalias.__origin__]\nand [__args__][genericalias.__args__] attributes of [generic aliases][types-genericalias],\nand the parameter item maps to the __parameter__ attribute of generic classes.
\nParent namespace of the model, used for automatic rebuilding of models.
\nThe name of the post-init method for the model, if defined.
\nWhether the model is a [RootModel][pydantic.root_model.RootModel].
\nThe pydantic-core SchemaSerializer used to dump instances of the model.
\nThe pydantic-core SchemaValidator used to validate instances of the model.
\nA dictionary of field names and their corresponding [FieldInfo][pydantic.fields.FieldInfo] objects.
\nA dictionary of computed field names and their corresponding [ComputedFieldInfo][pydantic.fields.ComputedFieldInfo] objects.
\nA dictionary containing extra values, if [extra][pydantic.config.ConfigDict.extra]\nis set to \u2018allow\u2019.
\nThe names of fields explicitly set during instantiation.
\nValues of private attributes set on the model instance.
\nBases: pydantic.BaseModel
[Models](../concepts/models.md)
\nA base class for creating Pydantic models.
\nThe names of the class variables defined on the model.
\nMetadata about the private attributes of the model.
\nThe synthesized __init__ [Signature][inspect.Signature] of the model.
\nWhether model building is completed, or if there are still undefined fields.
\nThe core schema of the model.
\nWhether the model has a custom __init__ function.
\nMetadata containing the decorators defined on the model.\nThis replaces Model.__validators__ and Model.__root_validators__ from Pydantic V1.
\nA dictionary containing metadata about generic Pydantic models.\nThe origin and args items map to the [__origin__][genericalias.__origin__]\nand [__args__][genericalias.__args__] attributes of [generic aliases][types-genericalias],\nand the parameter item maps to the __parameter__ attribute of generic classes.
\nParent namespace of the model, used for automatic rebuilding of models.
\nThe name of the post-init method for the model, if defined.
\nWhether the model is a [RootModel][pydantic.root_model.RootModel].
\nThe pydantic-core SchemaSerializer used to dump instances of the model.
\nThe pydantic-core SchemaValidator used to validate instances of the model.
\nA dictionary of field names and their corresponding [FieldInfo][pydantic.fields.FieldInfo] objects.
\nA dictionary of computed field names and their corresponding [ComputedFieldInfo][pydantic.fields.ComputedFieldInfo] objects.
\nA dictionary containing extra values, if [extra][pydantic.config.ConfigDict.extra]\nis set to \u2018allow\u2019.
\nThe names of fields explicitly set during instantiation.
\nValues of private attributes set on the model instance.
\nBases: pydantic.BaseModel
[Models](../concepts/models.md)
\nA base class for creating Pydantic models.
\nThe names of the class variables defined on the model.
\nMetadata about the private attributes of the model.
\nThe synthesized __init__ [Signature][inspect.Signature] of the model.
\nWhether model building is completed, or if there are still undefined fields.
\nThe core schema of the model.
\nWhether the model has a custom __init__ function.
\nMetadata containing the decorators defined on the model.\nThis replaces Model.__validators__ and Model.__root_validators__ from Pydantic V1.
\nA dictionary containing metadata about generic Pydantic models.\nThe origin and args items map to the [__origin__][genericalias.__origin__]\nand [__args__][genericalias.__args__] attributes of [generic aliases][types-genericalias],\nand the parameter item maps to the __parameter__ attribute of generic classes.
\nParent namespace of the model, used for automatic rebuilding of models.
\nThe name of the post-init method for the model, if defined.
\nWhether the model is a [RootModel][pydantic.root_model.RootModel].
\nThe pydantic-core SchemaSerializer used to dump instances of the model.
\nThe pydantic-core SchemaValidator used to validate instances of the model.
\nA dictionary of field names and their corresponding [FieldInfo][pydantic.fields.FieldInfo] objects.
\nA dictionary of computed field names and their corresponding [ComputedFieldInfo][pydantic.fields.ComputedFieldInfo] objects.
\nA dictionary containing extra values, if [extra][pydantic.config.ConfigDict.extra]\nis set to \u2018allow\u2019.
\nThe names of fields explicitly set during instantiation.
\nValues of private attributes set on the model instance.
\nBases: pydantic.BaseModel
[Models](../concepts/models.md)
\nA base class for creating Pydantic models.
\nThe names of the class variables defined on the model.
\nMetadata about the private attributes of the model.
\nThe synthesized __init__ [Signature][inspect.Signature] of the model.
\nWhether model building is completed, or if there are still undefined fields.
\nThe core schema of the model.
\nWhether the model has a custom __init__ function.
\nMetadata containing the decorators defined on the model.\nThis replaces Model.__validators__ and Model.__root_validators__ from Pydantic V1.
\nA dictionary containing metadata about generic Pydantic models.\nThe origin and args items map to the [__origin__][genericalias.__origin__]\nand [__args__][genericalias.__args__] attributes of [generic aliases][types-genericalias],\nand the parameter item maps to the __parameter__ attribute of generic classes.
\nParent namespace of the model, used for automatic rebuilding of models.
\nThe name of the post-init method for the model, if defined.
\nWhether the model is a [RootModel][pydantic.root_model.RootModel].
\nThe pydantic-core SchemaSerializer used to dump instances of the model.
\nThe pydantic-core SchemaValidator used to validate instances of the model.
\nA dictionary of field names and their corresponding [FieldInfo][pydantic.fields.FieldInfo] objects.
\nA dictionary of computed field names and their corresponding [ComputedFieldInfo][pydantic.fields.ComputedFieldInfo] objects.
\nA dictionary containing extra values, if [extra][pydantic.config.ConfigDict.extra]\nis set to \u2018allow\u2019.
\nThe names of fields explicitly set during instantiation.
\nValues of private attributes set on the model instance.
\nBases: pydantic.BaseModel
[Models](../concepts/models.md)
\nA base class for creating Pydantic models.
\nThe names of the class variables defined on the model.
\nMetadata about the private attributes of the model.
\nThe synthesized __init__ [Signature][inspect.Signature] of the model.
\nWhether model building is completed, or if there are still undefined fields.
\nThe core schema of the model.
\nWhether the model has a custom __init__ function.
\nMetadata containing the decorators defined on the model.\nThis replaces Model.__validators__ and Model.__root_validators__ from Pydantic V1.
\nA dictionary containing metadata about generic Pydantic models.\nThe origin and args items map to the [__origin__][genericalias.__origin__]\nand [__args__][genericalias.__args__] attributes of [generic aliases][types-genericalias],\nand the parameter item maps to the __parameter__ attribute of generic classes.
\nParent namespace of the model, used for automatic rebuilding of models.
\nThe name of the post-init method for the model, if defined.
\nWhether the model is a [RootModel][pydantic.root_model.RootModel].
\nThe pydantic-core SchemaSerializer used to dump instances of the model.
\nThe pydantic-core SchemaValidator used to validate instances of the model.
\nA dictionary of field names and their corresponding [FieldInfo][pydantic.fields.FieldInfo] objects.
\nA dictionary of computed field names and their corresponding [ComputedFieldInfo][pydantic.fields.ComputedFieldInfo] objects.
\nA dictionary containing extra values, if [extra][pydantic.config.ConfigDict.extra]\nis set to \u2018allow\u2019.
\nThe names of fields explicitly set during instantiation.
\nValues of private attributes set on the model instance.
\nBases: ConnectedAccountBase
[Models](../concepts/models.md)
\nA base class for creating Pydantic models.
\nThe names of the class variables defined on the model.
\nMetadata about the private attributes of the model.
\nThe synthesized __init__ [Signature][inspect.Signature] of the model.
\nWhether model building is completed, or if there are still undefined fields.
\nThe core schema of the model.
\nWhether the model has a custom __init__ function.
\nMetadata containing the decorators defined on the model.\nThis replaces Model.__validators__ and Model.__root_validators__ from Pydantic V1.
\nA dictionary containing metadata about generic Pydantic models.\nThe origin and args items map to the [__origin__][genericalias.__origin__]\nand [__args__][genericalias.__args__] attributes of [generic aliases][types-genericalias],\nand the parameter item maps to the __parameter__ attribute of generic classes.
\nParent namespace of the model, used for automatic rebuilding of models.
\nThe name of the post-init method for the model, if defined.
\nWhether the model is a [RootModel][pydantic.root_model.RootModel].
\nThe pydantic-core SchemaSerializer used to dump instances of the model.
\nThe pydantic-core SchemaValidator used to validate instances of the model.
\nA dictionary of field names and their corresponding [FieldInfo][pydantic.fields.FieldInfo] objects.
\nA dictionary of computed field names and their corresponding [ComputedFieldInfo][pydantic.fields.ComputedFieldInfo] objects.
\nA dictionary containing extra values, if [extra][pydantic.config.ConfigDict.extra]\nis set to \u2018allow\u2019.
\nThe names of fields explicitly set during instantiation.
\nValues of private attributes set on the model instance.
\nBases: pydantic.BaseModel
[Models](../concepts/models.md)
\nA base class for creating Pydantic models.
\nThe names of the class variables defined on the model.
\nMetadata about the private attributes of the model.
\nThe synthesized __init__ [Signature][inspect.Signature] of the model.
\nWhether model building is completed, or if there are still undefined fields.
\nThe core schema of the model.
\nWhether the model has a custom __init__ function.
\nMetadata containing the decorators defined on the model.\nThis replaces Model.__validators__ and Model.__root_validators__ from Pydantic V1.
\nA dictionary containing metadata about generic Pydantic models.\nThe origin and args items map to the [__origin__][genericalias.__origin__]\nand [__args__][genericalias.__args__] attributes of [generic aliases][types-genericalias],\nand the parameter item maps to the __parameter__ attribute of generic classes.
\nParent namespace of the model, used for automatic rebuilding of models.
\nThe name of the post-init method for the model, if defined.
\nWhether the model is a [RootModel][pydantic.root_model.RootModel].
\nThe pydantic-core SchemaSerializer used to dump instances of the model.
\nThe pydantic-core SchemaValidator used to validate instances of the model.
\nA dictionary of field names and their corresponding [FieldInfo][pydantic.fields.FieldInfo] objects.
\nA dictionary of computed field names and their corresponding [ComputedFieldInfo][pydantic.fields.ComputedFieldInfo] objects.
\nA dictionary containing extra values, if [extra][pydantic.config.ConfigDict.extra]\nis set to \u2018allow\u2019.
\nThe names of fields explicitly set during instantiation.
\nValues of private attributes set on the model instance.
\nBases: pydantic.BaseModel
[Models](../concepts/models.md)
\nA base class for creating Pydantic models.
\nThe names of the class variables defined on the model.
\nMetadata about the private attributes of the model.
\nThe synthesized __init__ [Signature][inspect.Signature] of the model.
\nWhether model building is completed, or if there are still undefined fields.
\nThe core schema of the model.
\nWhether the model has a custom __init__ function.
\nMetadata containing the decorators defined on the model.\nThis replaces Model.__validators__ and Model.__root_validators__ from Pydantic V1.
\nA dictionary containing metadata about generic Pydantic models.\nThe origin and args items map to the [__origin__][genericalias.__origin__]\nand [__args__][genericalias.__args__] attributes of [generic aliases][types-genericalias],\nand the parameter item maps to the __parameter__ attribute of generic classes.
\nParent namespace of the model, used for automatic rebuilding of models.
\nThe name of the post-init method for the model, if defined.
\nWhether the model is a [RootModel][pydantic.root_model.RootModel].
\nThe pydantic-core SchemaSerializer used to dump instances of the model.
\nThe pydantic-core SchemaValidator used to validate instances of the model.
\nA dictionary of field names and their corresponding [FieldInfo][pydantic.fields.FieldInfo] objects.
\nA dictionary of computed field names and their corresponding [ComputedFieldInfo][pydantic.fields.ComputedFieldInfo] objects.
\nA dictionary containing extra values, if [extra][pydantic.config.ConfigDict.extra]\nis set to \u2018allow\u2019.
\nThe names of fields explicitly set during instantiation.
\nValues of private attributes set on the model instance.
\nBases: TokenSet
Token set specific to a connection.\nExtends TokenSet with connection-specific information.
\n\n\n\n\nBases: pydantic.BaseModel
Options bundle for create_session(), carrying audience, scope, and metadata.
\n\n\n\n\nConfiguration for the model, should be a dictionary conforming to [ConfigDict][pydantic.config.ConfigDict].
\nBases: pydantic.BaseModel
Options for custom token exchange (RFC 8693).
\nsubject_token \u2013 The security token being exchanged
subject_token_type \u2013 Identifier indicating the token format
audience \u2013 Logical name of target service (optional)
scope \u2013 Space-delimited list of scopes (optional)
actor_token \u2013 Security token representing the acting party (optional)
actor_token_type \u2013 Type of actor token (required if actor_token present)
organization \u2013 Organization identifier for the token exchange (optional)
authorization_params \u2013 Additional OAuth parameters (optional)
Bases: pydantic.BaseModel
Context passed to domain resolver function for MCD support.
\nContains request information needed to determine the correct Auth0 domain\nbased on the incoming request\u2019s hostname or headers.
\nThe full request URL (e.g., \u201chttps://a.my-app.com/auth/login\u201d)
\nDictionary of request headers (e.g., {\u201chost\u201d: \u201ca.my-app.com\u201d, \u201cx-forwarded-host\u201d: \u201c\u2026\u201d})
\nExample
\nhost = context.request_headers.get(\u2018host\u2019, \u2018\u2019).split(\u2018:\u2019)[0]\nreturn DOMAIN_MAP.get(host, DEFAULT_DOMAIN)
\nBases: pydantic.BaseModel
Options for encrypted stores.\nContains the secret used for encryption.
\n\n\nBases: pydantic.BaseModel
[Models](../concepts/models.md)
\nA base class for creating Pydantic models.
\nThe names of the class variables defined on the model.
\nMetadata about the private attributes of the model.
\nThe synthesized __init__ [Signature][inspect.Signature] of the model.
\nWhether model building is completed, or if there are still undefined fields.
\nThe core schema of the model.
\nWhether the model has a custom __init__ function.
\nMetadata containing the decorators defined on the model.\nThis replaces Model.__validators__ and Model.__root_validators__ from Pydantic V1.
\nA dictionary containing metadata about generic Pydantic models.\nThe origin and args items map to the [__origin__][genericalias.__origin__]\nand [__args__][genericalias.__args__] attributes of [generic aliases][types-genericalias],\nand the parameter item maps to the __parameter__ attribute of generic classes.
\nParent namespace of the model, used for automatic rebuilding of models.
\nThe name of the post-init method for the model, if defined.
\nWhether the model is a [RootModel][pydantic.root_model.RootModel].
\nThe pydantic-core SchemaSerializer used to dump instances of the model.
\nThe pydantic-core SchemaValidator used to validate instances of the model.
\nA dictionary of field names and their corresponding [FieldInfo][pydantic.fields.FieldInfo] objects.
\nA dictionary of computed field names and their corresponding [ComputedFieldInfo][pydantic.fields.ComputedFieldInfo] objects.
\nA dictionary containing extra values, if [extra][pydantic.config.ConfigDict.extra]\nis set to \u2018allow\u2019.
\nThe names of fields explicitly set during instantiation.
\nValues of private attributes set on the model instance.
\nBases: pydantic.BaseModel
Options for enrolling an email authenticator.
\n\n\n\n\n\n\n\n\nBases: pydantic.BaseModel
Options for enrolling an OOB authenticator (SMS, Voice, Push).
\n\n\n\n\n\n\n\n\nBases: pydantic.BaseModel
Options for enrolling an OTP authenticator.
\n\n\n\n\nBases: pydantic.BaseModel
[Models](../concepts/models.md)
\nA base class for creating Pydantic models.
\nThe names of the class variables defined on the model.
\nMetadata about the private attributes of the model.
\nThe synthesized __init__ [Signature][inspect.Signature] of the model.
\nWhether model building is completed, or if there are still undefined fields.
\nThe core schema of the model.
\nWhether the model has a custom __init__ function.
\nMetadata containing the decorators defined on the model.\nThis replaces Model.__validators__ and Model.__root_validators__ from Pydantic V1.
\nA dictionary containing metadata about generic Pydantic models.\nThe origin and args items map to the [__origin__][genericalias.__origin__]\nand [__args__][genericalias.__args__] attributes of [generic aliases][types-genericalias],\nand the parameter item maps to the __parameter__ attribute of generic classes.
\nParent namespace of the model, used for automatic rebuilding of models.
\nThe name of the post-init method for the model, if defined.
\nWhether the model is a [RootModel][pydantic.root_model.RootModel].
\nThe pydantic-core SchemaSerializer used to dump instances of the model.
\nThe pydantic-core SchemaValidator used to validate instances of the model.
\nA dictionary of field names and their corresponding [FieldInfo][pydantic.fields.FieldInfo] objects.
\nA dictionary of computed field names and their corresponding [ComputedFieldInfo][pydantic.fields.ComputedFieldInfo] objects.
\nA dictionary containing extra values, if [extra][pydantic.config.ConfigDict.extra]\nis set to \u2018allow\u2019.
\nThe names of fields explicitly set during instantiation.
\nValues of private attributes set on the model instance.
\nConfiguration for the model, should be a dictionary conforming to [ConfigDict][pydantic.config.ConfigDict].
\nBases: pydantic.BaseModel
[Models](../concepts/models.md)
\nA base class for creating Pydantic models.
\nThe names of the class variables defined on the model.
\nMetadata about the private attributes of the model.
\nThe synthesized __init__ [Signature][inspect.Signature] of the model.
\nWhether model building is completed, or if there are still undefined fields.
\nThe core schema of the model.
\nWhether the model has a custom __init__ function.
\nMetadata containing the decorators defined on the model.\nThis replaces Model.__validators__ and Model.__root_validators__ from Pydantic V1.
\nA dictionary containing metadata about generic Pydantic models.\nThe origin and args items map to the [__origin__][genericalias.__origin__]\nand [__args__][genericalias.__args__] attributes of [generic aliases][types-genericalias],\nand the parameter item maps to the __parameter__ attribute of generic classes.
\nParent namespace of the model, used for automatic rebuilding of models.
\nThe name of the post-init method for the model, if defined.
\nWhether the model is a [RootModel][pydantic.root_model.RootModel].
\nThe pydantic-core SchemaSerializer used to dump instances of the model.
\nThe pydantic-core SchemaValidator used to validate instances of the model.
\nA dictionary of field names and their corresponding [FieldInfo][pydantic.fields.FieldInfo] objects.
\nA dictionary of computed field names and their corresponding [ComputedFieldInfo][pydantic.fields.ComputedFieldInfo] objects.
\nA dictionary containing extra values, if [extra][pydantic.config.ConfigDict.extra]\nis set to \u2018allow\u2019.
\nThe names of fields explicitly set during instantiation.
\nValues of private attributes set on the model instance.
\nConfiguration for the model, should be a dictionary conforming to [ConfigDict][pydantic.config.ConfigDict].
\nBases: pydantic.BaseModel
[Models](../concepts/models.md)
\nA base class for creating Pydantic models.
\nThe names of the class variables defined on the model.
\nMetadata about the private attributes of the model.
\nThe synthesized __init__ [Signature][inspect.Signature] of the model.
\nWhether model building is completed, or if there are still undefined fields.
\nThe core schema of the model.
\nWhether the model has a custom __init__ function.
\nMetadata containing the decorators defined on the model.\nThis replaces Model.__validators__ and Model.__root_validators__ from Pydantic V1.
\nA dictionary containing metadata about generic Pydantic models.\nThe origin and args items map to the [__origin__][genericalias.__origin__]\nand [__args__][genericalias.__args__] attributes of [generic aliases][types-genericalias],\nand the parameter item maps to the __parameter__ attribute of generic classes.
\nParent namespace of the model, used for automatic rebuilding of models.
\nThe name of the post-init method for the model, if defined.
\nWhether the model is a [RootModel][pydantic.root_model.RootModel].
\nThe pydantic-core SchemaSerializer used to dump instances of the model.
\nThe pydantic-core SchemaValidator used to validate instances of the model.
\nA dictionary of field names and their corresponding [FieldInfo][pydantic.fields.FieldInfo] objects.
\nA dictionary of computed field names and their corresponding [ComputedFieldInfo][pydantic.fields.ComputedFieldInfo] objects.
\nA dictionary containing extra values, if [extra][pydantic.config.ConfigDict.extra]\nis set to \u2018allow\u2019.
\nThe names of fields explicitly set during instantiation.
\nValues of private attributes set on the model instance.
\nBases: pydantic.BaseModel
Internal data used for managing state.\nNot meant to be accessed directly by SDK users.
\n\n\n\n\n\n\nBases: pydantic.BaseModel
[Models](../concepts/models.md)
\nA base class for creating Pydantic models.
\nThe names of the class variables defined on the model.
\nMetadata about the private attributes of the model.
\nThe synthesized __init__ [Signature][inspect.Signature] of the model.
\nWhether model building is completed, or if there are still undefined fields.
\nThe core schema of the model.
\nWhether the model has a custom __init__ function.
\nMetadata containing the decorators defined on the model.\nThis replaces Model.__validators__ and Model.__root_validators__ from Pydantic V1.
\nA dictionary containing metadata about generic Pydantic models.\nThe origin and args items map to the [__origin__][genericalias.__origin__]\nand [__args__][genericalias.__args__] attributes of [generic aliases][types-genericalias],\nand the parameter item maps to the __parameter__ attribute of generic classes.
\nParent namespace of the model, used for automatic rebuilding of models.
\nThe name of the post-init method for the model, if defined.
\nWhether the model is a [RootModel][pydantic.root_model.RootModel].
\nThe pydantic-core SchemaSerializer used to dump instances of the model.
\nThe pydantic-core SchemaValidator used to validate instances of the model.
\nA dictionary of field names and their corresponding [FieldInfo][pydantic.fields.FieldInfo] objects.
\nA dictionary of computed field names and their corresponding [ComputedFieldInfo][pydantic.fields.ComputedFieldInfo] objects.
\nA dictionary containing extra values, if [extra][pydantic.config.ConfigDict.extra]\nis set to \u2018allow\u2019.
\nThe names of fields explicitly set during instantiation.
\nValues of private attributes set on the model instance.
\nBases: pydantic.BaseModel
Options for listing MFA authenticators.
\n\n\nBases: pydantic.BaseModel
[Models](../concepts/models.md)
\nA base class for creating Pydantic models.
\nThe names of the class variables defined on the model.
\nMetadata about the private attributes of the model.
\nThe synthesized __init__ [Signature][inspect.Signature] of the model.
\nWhether model building is completed, or if there are still undefined fields.
\nThe core schema of the model.
\nWhether the model has a custom __init__ function.
\nMetadata containing the decorators defined on the model.\nThis replaces Model.__validators__ and Model.__root_validators__ from Pydantic V1.
\nA dictionary containing metadata about generic Pydantic models.\nThe origin and args items map to the [__origin__][genericalias.__origin__]\nand [__args__][genericalias.__args__] attributes of [generic aliases][types-genericalias],\nand the parameter item maps to the __parameter__ attribute of generic classes.
\nParent namespace of the model, used for automatic rebuilding of models.
\nThe name of the post-init method for the model, if defined.
\nWhether the model is a [RootModel][pydantic.root_model.RootModel].
\nThe pydantic-core SchemaSerializer used to dump instances of the model.
\nThe pydantic-core SchemaValidator used to validate instances of the model.
\nA dictionary of field names and their corresponding [FieldInfo][pydantic.fields.FieldInfo] objects.
\nA dictionary of computed field names and their corresponding [ComputedFieldInfo][pydantic.fields.ComputedFieldInfo] objects.
\nA dictionary containing extra values, if [extra][pydantic.config.ConfigDict.extra]\nis set to \u2018allow\u2019.
\nThe names of fields explicitly set during instantiation.
\nValues of private attributes set on the model instance.
\nBases: pydantic.BaseModel
[Models](../concepts/models.md)
\nA base class for creating Pydantic models.
\nThe names of the class variables defined on the model.
\nMetadata about the private attributes of the model.
\nThe synthesized __init__ [Signature][inspect.Signature] of the model.
\nWhether model building is completed, or if there are still undefined fields.
\nThe core schema of the model.
\nWhether the model has a custom __init__ function.
\nMetadata containing the decorators defined on the model.\nThis replaces Model.__validators__ and Model.__root_validators__ from Pydantic V1.
\nA dictionary containing metadata about generic Pydantic models.\nThe origin and args items map to the [__origin__][genericalias.__origin__]\nand [__args__][genericalias.__args__] attributes of [generic aliases][types-genericalias],\nand the parameter item maps to the __parameter__ attribute of generic classes.
\nParent namespace of the model, used for automatic rebuilding of models.
\nThe name of the post-init method for the model, if defined.
\nWhether the model is a [RootModel][pydantic.root_model.RootModel].
\nThe pydantic-core SchemaSerializer used to dump instances of the model.
\nThe pydantic-core SchemaValidator used to validate instances of the model.
\nA dictionary of field names and their corresponding [FieldInfo][pydantic.fields.FieldInfo] objects.
\nA dictionary of computed field names and their corresponding [ComputedFieldInfo][pydantic.fields.ComputedFieldInfo] objects.
\nA dictionary containing extra values, if [extra][pydantic.config.ConfigDict.extra]\nis set to \u2018allow\u2019.
\nThe names of fields explicitly set during instantiation.
\nValues of private attributes set on the model instance.
\nBases: pydantic.BaseModel
Options for Client-Initiated Backchannel Authentication.
\n\n\n\n\n\n\nBases: pydantic.BaseModel
Result from Client-Initiated Backchannel Authentication.
\nBases: pydantic.BaseModel
Options for logging in via custom token exchange.
\nCombines token exchange parameters with session management.
\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\nBases: pydantic.BaseModel
Result from login with custom token exchange.
\nContains session data established after token exchange.
\nBases: pydantic.BaseModel
Options for logout operations.\nConfigures how the logout request is constructed.
\n\n\n\n\nBases: pydantic.BaseModel
Claims expected in a logout token.\nUsed for backchannel logout processing.
\n\n\n\n\n\n\nBases: pydantic.BaseModel
A single MFA requirement entry.
\n\n\nBases: pydantic.BaseModel
MFA requirements from an mfa_required error response.
\nBases: pydantic.BaseModel
Internal context stored inside encrypted mfa_token.
\n\n\n\n\nBases: pydantic.BaseModel
Response from MFA verification.
\n\n\n\n\n\n\n\n\nConfiguration for the model, should be a dictionary conforming to [ConfigDict][pydantic.config.ConfigDict].
\nBases: pydantic.BaseModel
Response when enrolling an OOB authenticator.
\n\n\n\n\n\n\n\n\nBases: pydantic.BaseModel
Response when enrolling an OTP authenticator.
\n\n\n\n\n\n\n\n\n\n\nBases: pydantic.BaseModel
WebAuthn credential returned by the browser, passed to signin_with_passkey.
\n\n\n\n\n\n\nConfiguration for the model, should be a dictionary conforming to [ConfigDict][pydantic.config.ConfigDict].
\nBases: pydantic.BaseModel
Authenticator requirements for a WebAuthn registration.
\nConfiguration for the model, should be a dictionary conforming to [ConfigDict][pydantic.config.ConfigDict].
\nBases: _PasskeyChallengeResponseBase
Login challenge with the auth_session and WebAuthn options for the browser. auth_session is hidden from repr and str.
\nBases: pydantic.BaseModel
Result from signin_with_passkey.
\nContains the session data established after the webauthn token exchange.\nMirrors LoginWithCustomTokenExchangeResult \u2014 passkey sign-in is a complete\nlogin ceremony and creates a server-side session like every other login path.
\n\n\nBases: pydantic.BaseModel
Public key type and algorithm the relying party accepts.
\n\n\n\n\nBases: pydantic.BaseModel
WebAuthn public key options to pass to the browser credentials API.
\nConfiguration for the model, should be a dictionary conforming to [ConfigDict][pydantic.config.ConfigDict].
\nBases: pydantic.BaseModel
Relying party identity for a WebAuthn ceremony.
\n\n\n\n\nBases: _PasskeyChallengeResponseBase
Signup challenge, with verification_required set when the user must enter codes first. auth_session is hidden from repr and str.
\n\n\nBases: pydantic.BaseModel
Token endpoint response for the passkey grant.
\n\n\n\n\n\n\n\n\nConfiguration for the model, should be a dictionary conforming to [ConfigDict][pydantic.config.ConfigDict].
\nBases: pydantic.BaseModel
User identity for a WebAuthn registration.
\n\n\n\n\nConfiguration for the model, should be a dictionary conforming to [ConfigDict][pydantic.config.ConfigDict].
\nBases: pydantic.BaseModel
User profile attributes sent with a passkey signup challenge.
\n\n\n\n\n\n\nConfiguration for the model, should be a dictionary conforming to [ConfigDict][pydantic.config.ConfigDict].
\nBases: pydantic.BaseModel
Success payload from POST /passwordless/start.
\n\n\nBases: pydantic.BaseModel
Base options for configuring the Auth0 server client.\nContains core settings required for all clients.
\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\nBases: ServerClientOptionsBase
Client options using a secret for encryption.\nExtends base options with secret and duration settings.
\n\n\n\n\nBases: pydantic.BaseModel
Represents a user session with Auth0.\nContains user information and tokens.
\nBases: pydantic.BaseModel
Response from a session transfer token (STT) request.
\nThe opaque, single-use session transfer token
\nFormat of issued token (the session-transfer URN)
\nToken lifetime in seconds
\nToken type as returned by the server (typically \u201cN_A\u201d)
\nGranted scopes (if returned)
\nBases: StartInteractiveLoginOptions
Options for starting an Enterprise Connect login.\nAdds the user\u2019s email, used for WebFinger discovery and as the login hint.
\n\n\nBases: pydantic.BaseModel
Options for starting the interactive login process.\nConfigures how the authorization request is constructed.
\n\n\n\n\n\n\n\n\n\n\nBases: pydantic.BaseModel
[Models](../concepts/models.md)
\nA base class for creating Pydantic models.
\nThe names of the class variables defined on the model.
\nMetadata about the private attributes of the model.
\nThe synthesized __init__ [Signature][inspect.Signature] of the model.
\nWhether model building is completed, or if there are still undefined fields.
\nThe core schema of the model.
\nWhether the model has a custom __init__ function.
\nMetadata containing the decorators defined on the model.\nThis replaces Model.__validators__ and Model.__root_validators__ from Pydantic V1.
\nA dictionary containing metadata about generic Pydantic models.\nThe origin and args items map to the [__origin__][genericalias.__origin__]\nand [__args__][genericalias.__args__] attributes of [generic aliases][types-genericalias],\nand the parameter item maps to the __parameter__ attribute of generic classes.
\nParent namespace of the model, used for automatic rebuilding of models.
\nThe name of the post-init method for the model, if defined.
\nWhether the model is a [RootModel][pydantic.root_model.RootModel].
\nThe pydantic-core SchemaSerializer used to dump instances of the model.
\nThe pydantic-core SchemaValidator used to validate instances of the model.
\nA dictionary of field names and their corresponding [FieldInfo][pydantic.fields.FieldInfo] objects.
\nA dictionary of computed field names and their corresponding [ComputedFieldInfo][pydantic.fields.ComputedFieldInfo] objects.
\nA dictionary containing extra values, if [extra][pydantic.config.ConfigDict.extra]\nis set to \u2018allow\u2019.
\nThe names of fields explicitly set during instantiation.
\nValues of private attributes set on the model instance.
\nBases: _StartPasswordlessBase
Options for starting an email passwordless flow (OTP code or magic link).
\n\n\n\n\n\n\nBases: _StartPasswordlessBase
Options for starting an SMS passwordless (OTP) flow.
\n\n\n\n\nBases: SessionData
Complete state data stored in the state store.\nExtends SessionData with internal management information.
\nBases: pydantic.BaseModel
Response from token exchange operation.
\nThe issued access token
\nToken type (typically \u201cBearer\u201d)
\nToken lifetime in seconds
\nGranted scopes (if different from requested)
\nFormat of issued token
\nOpenID Connect ID token (optional)
\nRefresh token (optional)
\nActor claim for delegation/impersonation exchanges (optional)
\nBases: pydantic.BaseModel
Represents a set of tokens issued by Auth0.\nContains the access token and related metadata.
\n\n\n\n\n\n\n\n\nBases: pydantic.BaseModel
Represents data for an in-progress authentication transaction.\nUsed during the authorization code flow to correlate requests.
\n\n\n\n\n\n\n\n\n\n\n\n\n\n\nBases: pydantic.BaseModel
[Models](../concepts/models.md)
\nA base class for creating Pydantic models.
\nThe names of the class variables defined on the model.
\nMetadata about the private attributes of the model.
\nThe synthesized __init__ [Signature][inspect.Signature] of the model.
\nWhether model building is completed, or if there are still undefined fields.
\nThe core schema of the model.
\nWhether the model has a custom __init__ function.
\nMetadata containing the decorators defined on the model.\nThis replaces Model.__validators__ and Model.__root_validators__ from Pydantic V1.
\nA dictionary containing metadata about generic Pydantic models.\nThe origin and args items map to the [__origin__][genericalias.__origin__]\nand [__args__][genericalias.__args__] attributes of [generic aliases][types-genericalias],\nand the parameter item maps to the __parameter__ attribute of generic classes.
\nParent namespace of the model, used for automatic rebuilding of models.
\nThe name of the post-init method for the model, if defined.
\nWhether the model is a [RootModel][pydantic.root_model.RootModel].
\nThe pydantic-core SchemaSerializer used to dump instances of the model.
\nThe pydantic-core SchemaValidator used to validate instances of the model.
\nA dictionary of field names and their corresponding [FieldInfo][pydantic.fields.FieldInfo] objects.
\nA dictionary of computed field names and their corresponding [ComputedFieldInfo][pydantic.fields.ComputedFieldInfo] objects.
\nA dictionary containing extra values, if [extra][pydantic.config.ConfigDict.extra]\nis set to \u2018allow\u2019.
\nThe names of fields explicitly set during instantiation.
\nValues of private attributes set on the model instance.
\nBases: pydantic.BaseModel
User profile information as returned by Auth0.\nContains standard OIDC claims about the authenticated user.
\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\nBases: pydantic.BaseModel
[Models](../concepts/models.md)
\nA base class for creating Pydantic models.
\nThe names of the class variables defined on the model.
\nMetadata about the private attributes of the model.
\nThe synthesized __init__ [Signature][inspect.Signature] of the model.
\nWhether model building is completed, or if there are still undefined fields.
\nThe core schema of the model.
\nWhether the model has a custom __init__ function.
\nMetadata containing the decorators defined on the model.\nThis replaces Model.__validators__ and Model.__root_validators__ from Pydantic V1.
\nA dictionary containing metadata about generic Pydantic models.\nThe origin and args items map to the [__origin__][genericalias.__origin__]\nand [__args__][genericalias.__args__] attributes of [generic aliases][types-genericalias],\nand the parameter item maps to the __parameter__ attribute of generic classes.
\nParent namespace of the model, used for automatic rebuilding of models.
\nThe name of the post-init method for the model, if defined.
\nWhether the model is a [RootModel][pydantic.root_model.RootModel].
\nThe pydantic-core SchemaSerializer used to dump instances of the model.
\nThe pydantic-core SchemaValidator used to validate instances of the model.
\nA dictionary of field names and their corresponding [FieldInfo][pydantic.fields.FieldInfo] objects.
\nA dictionary of computed field names and their corresponding [ComputedFieldInfo][pydantic.fields.ComputedFieldInfo] objects.
\nA dictionary containing extra values, if [extra][pydantic.config.ConfigDict.extra]\nis set to \u2018allow\u2019.
\nThe names of fields explicitly set during instantiation.
\nValues of private attributes set on the model instance.
\nBases: pydantic.BaseModel
Verify with OOB code + binding code.
\n\n\n\n\n\n\nBases: pydantic.BaseModel
Verify with OTP code.
\n\n\n\n\nBases: pydantic.BaseModel
Options for verifying a passwordless OTP and establishing a session.
\nExactly one of email / phone_number must be provided and must\nmatch connection (email -> email, sms -> phone_number).
Configuration for the model, should be a dictionary conforming to [ConfigDict][pydantic.config.ConfigDict].
\nBases: pydantic.BaseModel
Verify with recovery code.
\n\n\n\n\nAccessTokenForConnectionOptions\nAnonymousCreateTokenResponse\nAnonymousSession\nAnonymousSessionContext\nAnonymousSessionData\nAnonymousTokenResponse\nAnonymousTokenSetEntry\nAnonymousTransferTokenResponse\nAuthenticationMethodAuthenticationMethod.__class_vars__AuthenticationMethod.__private_attributes__AuthenticationMethod.__signature__AuthenticationMethod.__pydantic_complete__AuthenticationMethod.__pydantic_core_schema__AuthenticationMethod.__pydantic_custom_init__AuthenticationMethod.__pydantic_decorators__AuthenticationMethod.__pydantic_generic_metadata__AuthenticationMethod.__pydantic_parent_namespace__AuthenticationMethod.__pydantic_post_init__AuthenticationMethod.__pydantic_root_model__AuthenticationMethod.__pydantic_serializer__AuthenticationMethod.__pydantic_validator__AuthenticationMethod.__pydantic_fields__AuthenticationMethod.__pydantic_computed_fields__AuthenticationMethod.__pydantic_extra__AuthenticationMethod.__pydantic_fields_set__AuthenticationMethod.__pydantic_private__AuthenticationMethod.aaguidAuthenticationMethod.confirmedAuthenticationMethod.created_atAuthenticationMethod.credential_backed_upAuthenticationMethod.credential_device_typeAuthenticationMethod.emailAuthenticationMethod.idAuthenticationMethod.identity_user_idAuthenticationMethod.key_idAuthenticationMethod.last_password_resetAuthenticationMethod.model_configAuthenticationMethod.nameAuthenticationMethod.phone_numberAuthenticationMethod.preferred_authentication_methodAuthenticationMethod.public_keyAuthenticationMethod.relying_party_idAuthenticationMethod.transportsAuthenticationMethod.typeAuthenticationMethod.usageAuthenticationMethod.user_agentAuthenticationMethod.user_handleAuthenticatorResponseAuthenticatorResponse.activeAuthenticatorResponse.authenticator_typeAuthenticatorResponse.created_atAuthenticatorResponse.idAuthenticatorResponse.last_authAuthenticatorResponse.model_configAuthenticatorResponse.nameAuthenticatorResponse.oob_channelAuthenticatorResponse.phone_numberAuthenticatorResponse.typeAuthorizationDetails\nAuthorizationParameters\nChallengeOptions\nChallengeResponse\nCompleteConnectAccountRequestCompleteConnectAccountRequest.__class_vars__CompleteConnectAccountRequest.__private_attributes__CompleteConnectAccountRequest.__signature__CompleteConnectAccountRequest.__pydantic_complete__CompleteConnectAccountRequest.__pydantic_core_schema__CompleteConnectAccountRequest.__pydantic_custom_init__CompleteConnectAccountRequest.__pydantic_decorators__CompleteConnectAccountRequest.__pydantic_generic_metadata__CompleteConnectAccountRequest.__pydantic_parent_namespace__CompleteConnectAccountRequest.__pydantic_post_init__CompleteConnectAccountRequest.__pydantic_root_model__CompleteConnectAccountRequest.__pydantic_serializer__CompleteConnectAccountRequest.__pydantic_validator__CompleteConnectAccountRequest.__pydantic_fields__CompleteConnectAccountRequest.__pydantic_computed_fields__CompleteConnectAccountRequest.__pydantic_extra__CompleteConnectAccountRequest.__pydantic_fields_set__CompleteConnectAccountRequest.__pydantic_private__CompleteConnectAccountRequest.auth_sessionCompleteConnectAccountRequest.code_verifierCompleteConnectAccountRequest.connect_codeCompleteConnectAccountRequest.redirect_uriCompleteConnectAccountResponseCompleteConnectAccountResponse.__class_vars__CompleteConnectAccountResponse.__private_attributes__CompleteConnectAccountResponse.__signature__CompleteConnectAccountResponse.__pydantic_complete__CompleteConnectAccountResponse.__pydantic_core_schema__CompleteConnectAccountResponse.__pydantic_custom_init__CompleteConnectAccountResponse.__pydantic_decorators__CompleteConnectAccountResponse.__pydantic_generic_metadata__CompleteConnectAccountResponse.__pydantic_parent_namespace__CompleteConnectAccountResponse.__pydantic_post_init__CompleteConnectAccountResponse.__pydantic_root_model__CompleteConnectAccountResponse.__pydantic_serializer__CompleteConnectAccountResponse.__pydantic_validator__CompleteConnectAccountResponse.__pydantic_fields__CompleteConnectAccountResponse.__pydantic_computed_fields__CompleteConnectAccountResponse.__pydantic_extra__CompleteConnectAccountResponse.__pydantic_fields_set__CompleteConnectAccountResponse.__pydantic_private__CompleteConnectAccountResponse.app_stateConnectAccountOptionsConnectAccountOptions.__class_vars__ConnectAccountOptions.__private_attributes__ConnectAccountOptions.__signature__ConnectAccountOptions.__pydantic_complete__ConnectAccountOptions.__pydantic_core_schema__ConnectAccountOptions.__pydantic_custom_init__ConnectAccountOptions.__pydantic_decorators__ConnectAccountOptions.__pydantic_generic_metadata__ConnectAccountOptions.__pydantic_parent_namespace__ConnectAccountOptions.__pydantic_post_init__ConnectAccountOptions.__pydantic_root_model__ConnectAccountOptions.__pydantic_serializer__ConnectAccountOptions.__pydantic_validator__ConnectAccountOptions.__pydantic_fields__ConnectAccountOptions.__pydantic_computed_fields__ConnectAccountOptions.__pydantic_extra__ConnectAccountOptions.__pydantic_fields_set__ConnectAccountOptions.__pydantic_private__ConnectAccountOptions.app_stateConnectAccountOptions.authorization_paramsConnectAccountOptions.connectionConnectAccountOptions.redirect_uriConnectAccountOptions.scopesConnectAccountRequestConnectAccountRequest.__class_vars__ConnectAccountRequest.__private_attributes__ConnectAccountRequest.__signature__ConnectAccountRequest.__pydantic_complete__ConnectAccountRequest.__pydantic_core_schema__ConnectAccountRequest.__pydantic_custom_init__ConnectAccountRequest.__pydantic_decorators__ConnectAccountRequest.__pydantic_generic_metadata__ConnectAccountRequest.__pydantic_parent_namespace__ConnectAccountRequest.__pydantic_post_init__ConnectAccountRequest.__pydantic_root_model__ConnectAccountRequest.__pydantic_serializer__ConnectAccountRequest.__pydantic_validator__ConnectAccountRequest.__pydantic_fields__ConnectAccountRequest.__pydantic_computed_fields__ConnectAccountRequest.__pydantic_extra__ConnectAccountRequest.__pydantic_fields_set__ConnectAccountRequest.__pydantic_private__ConnectAccountRequest.authorization_paramsConnectAccountRequest.code_challengeConnectAccountRequest.code_challenge_methodConnectAccountRequest.connectionConnectAccountRequest.redirect_uriConnectAccountRequest.scopesConnectAccountRequest.stateConnectAccountResponseConnectAccountResponse.__class_vars__ConnectAccountResponse.__private_attributes__ConnectAccountResponse.__signature__ConnectAccountResponse.__pydantic_complete__ConnectAccountResponse.__pydantic_core_schema__ConnectAccountResponse.__pydantic_custom_init__ConnectAccountResponse.__pydantic_decorators__ConnectAccountResponse.__pydantic_generic_metadata__ConnectAccountResponse.__pydantic_parent_namespace__ConnectAccountResponse.__pydantic_post_init__ConnectAccountResponse.__pydantic_root_model__ConnectAccountResponse.__pydantic_serializer__ConnectAccountResponse.__pydantic_validator__ConnectAccountResponse.__pydantic_fields__ConnectAccountResponse.__pydantic_computed_fields__ConnectAccountResponse.__pydantic_extra__ConnectAccountResponse.__pydantic_fields_set__ConnectAccountResponse.__pydantic_private__ConnectAccountResponse.auth_sessionConnectAccountResponse.connect_paramsConnectAccountResponse.connect_uriConnectAccountResponse.expires_inConnectParamsConnectParams.__class_vars__ConnectParams.__private_attributes__ConnectParams.__signature__ConnectParams.__pydantic_complete__ConnectParams.__pydantic_core_schema__ConnectParams.__pydantic_custom_init__ConnectParams.__pydantic_decorators__ConnectParams.__pydantic_generic_metadata__ConnectParams.__pydantic_parent_namespace__ConnectParams.__pydantic_post_init__ConnectParams.__pydantic_root_model__ConnectParams.__pydantic_serializer__ConnectParams.__pydantic_validator__ConnectParams.__pydantic_fields__ConnectParams.__pydantic_computed_fields__ConnectParams.__pydantic_extra__ConnectParams.__pydantic_fields_set__ConnectParams.__pydantic_private__ConnectParams.ticketConnectedAccountConnectedAccount.__class_vars__ConnectedAccount.__private_attributes__ConnectedAccount.__signature__ConnectedAccount.__pydantic_complete__ConnectedAccount.__pydantic_core_schema__ConnectedAccount.__pydantic_custom_init__ConnectedAccount.__pydantic_decorators__ConnectedAccount.__pydantic_generic_metadata__ConnectedAccount.__pydantic_parent_namespace__ConnectedAccount.__pydantic_post_init__ConnectedAccount.__pydantic_root_model__ConnectedAccount.__pydantic_serializer__ConnectedAccount.__pydantic_validator__ConnectedAccount.__pydantic_fields__ConnectedAccount.__pydantic_computed_fields__ConnectedAccount.__pydantic_extra__ConnectedAccount.__pydantic_fields_set__ConnectedAccount.__pydantic_private__ConnectedAccount.access_typeConnectedAccount.connectionConnectedAccount.created_atConnectedAccount.expires_atConnectedAccount.idConnectedAccount.scopesConnectedAccountBaseConnectedAccountBase.__class_vars__ConnectedAccountBase.__private_attributes__ConnectedAccountBase.__signature__ConnectedAccountBase.__pydantic_complete__ConnectedAccountBase.__pydantic_core_schema__ConnectedAccountBase.__pydantic_custom_init__ConnectedAccountBase.__pydantic_decorators__ConnectedAccountBase.__pydantic_generic_metadata__ConnectedAccountBase.__pydantic_parent_namespace__ConnectedAccountBase.__pydantic_post_init__ConnectedAccountBase.__pydantic_root_model__ConnectedAccountBase.__pydantic_serializer__ConnectedAccountBase.__pydantic_validator__ConnectedAccountBase.__pydantic_fields__ConnectedAccountBase.__pydantic_computed_fields__ConnectedAccountBase.__pydantic_extra__ConnectedAccountBase.__pydantic_fields_set__ConnectedAccountBase.__pydantic_private__ConnectedAccountBase.access_typeConnectedAccountBase.connectionConnectedAccountBase.created_atConnectedAccountBase.expires_atConnectedAccountBase.idConnectedAccountBase.scopesConnectedAccountConnectionConnectedAccountConnection.__class_vars__ConnectedAccountConnection.__private_attributes__ConnectedAccountConnection.__signature__ConnectedAccountConnection.__pydantic_complete__ConnectedAccountConnection.__pydantic_core_schema__ConnectedAccountConnection.__pydantic_custom_init__ConnectedAccountConnection.__pydantic_decorators__ConnectedAccountConnection.__pydantic_generic_metadata__ConnectedAccountConnection.__pydantic_parent_namespace__ConnectedAccountConnection.__pydantic_post_init__ConnectedAccountConnection.__pydantic_root_model__ConnectedAccountConnection.__pydantic_serializer__ConnectedAccountConnection.__pydantic_validator__ConnectedAccountConnection.__pydantic_fields__ConnectedAccountConnection.__pydantic_computed_fields__ConnectedAccountConnection.__pydantic_extra__ConnectedAccountConnection.__pydantic_fields_set__ConnectedAccountConnection.__pydantic_private__ConnectedAccountConnection.nameConnectedAccountConnection.scopesConnectedAccountConnection.strategyConnectionTokenSet\nCreateAnonymousSessionOptions\nCustomTokenExchangeOptionsCustomTokenExchangeOptions.actor_tokenCustomTokenExchangeOptions.actor_token_typeCustomTokenExchangeOptions.audienceCustomTokenExchangeOptions.authorization_paramsCustomTokenExchangeOptions.organizationCustomTokenExchangeOptions.scopeCustomTokenExchangeOptions.subject_tokenCustomTokenExchangeOptions.subject_token_typeDomainResolverContext\nEncryptedStoreOptions\nEnrollAuthenticationMethodRequestEnrollAuthenticationMethodRequest.__class_vars__EnrollAuthenticationMethodRequest.__private_attributes__EnrollAuthenticationMethodRequest.__signature__EnrollAuthenticationMethodRequest.__pydantic_complete__EnrollAuthenticationMethodRequest.__pydantic_core_schema__EnrollAuthenticationMethodRequest.__pydantic_custom_init__EnrollAuthenticationMethodRequest.__pydantic_decorators__EnrollAuthenticationMethodRequest.__pydantic_generic_metadata__EnrollAuthenticationMethodRequest.__pydantic_parent_namespace__EnrollAuthenticationMethodRequest.__pydantic_post_init__EnrollAuthenticationMethodRequest.__pydantic_root_model__EnrollAuthenticationMethodRequest.__pydantic_serializer__EnrollAuthenticationMethodRequest.__pydantic_validator__EnrollAuthenticationMethodRequest.__pydantic_fields__EnrollAuthenticationMethodRequest.__pydantic_computed_fields__EnrollAuthenticationMethodRequest.__pydantic_extra__EnrollAuthenticationMethodRequest.__pydantic_fields_set__EnrollAuthenticationMethodRequest.__pydantic_private__EnrollAuthenticationMethodRequest.connectionEnrollAuthenticationMethodRequest.emailEnrollAuthenticationMethodRequest.identity_user_idEnrollAuthenticationMethodRequest.phone_numberEnrollAuthenticationMethodRequest.preferred_authentication_methodEnrollAuthenticationMethodRequest.typeEnrollEmailOptions\nEnrollOobOptions\nEnrollOtpOptions\nEnrollmentChallengeResponseEnrollmentChallengeResponse.__class_vars__EnrollmentChallengeResponse.__private_attributes__EnrollmentChallengeResponse.__signature__EnrollmentChallengeResponse.__pydantic_complete__EnrollmentChallengeResponse.__pydantic_core_schema__EnrollmentChallengeResponse.__pydantic_custom_init__EnrollmentChallengeResponse.__pydantic_decorators__EnrollmentChallengeResponse.__pydantic_generic_metadata__EnrollmentChallengeResponse.__pydantic_parent_namespace__EnrollmentChallengeResponse.__pydantic_post_init__EnrollmentChallengeResponse.__pydantic_root_model__EnrollmentChallengeResponse.__pydantic_serializer__EnrollmentChallengeResponse.__pydantic_validator__EnrollmentChallengeResponse.__pydantic_fields__EnrollmentChallengeResponse.__pydantic_computed_fields__EnrollmentChallengeResponse.__pydantic_extra__EnrollmentChallengeResponse.__pydantic_fields_set__EnrollmentChallengeResponse.__pydantic_private__EnrollmentChallengeResponse.auth_sessionEnrollmentChallengeResponse.authentication_method_idEnrollmentChallengeResponse.authn_params_public_keyEnrollmentChallengeResponse.model_configFactorFactor.__class_vars__Factor.__private_attributes__Factor.__signature__Factor.__pydantic_complete__Factor.__pydantic_core_schema__Factor.__pydantic_custom_init__Factor.__pydantic_decorators__Factor.__pydantic_generic_metadata__Factor.__pydantic_parent_namespace__Factor.__pydantic_post_init__Factor.__pydantic_root_model__Factor.__pydantic_serializer__Factor.__pydantic_validator__Factor.__pydantic_fields__Factor.__pydantic_computed_fields__Factor.__pydantic_extra__Factor.__pydantic_fields_set__Factor.__pydantic_private__Factor.model_configFactor.typeFactor.usageGetFactorsResponseGetFactorsResponse.__class_vars__GetFactorsResponse.__private_attributes__GetFactorsResponse.__signature__GetFactorsResponse.__pydantic_complete__GetFactorsResponse.__pydantic_core_schema__GetFactorsResponse.__pydantic_custom_init__GetFactorsResponse.__pydantic_decorators__GetFactorsResponse.__pydantic_generic_metadata__GetFactorsResponse.__pydantic_parent_namespace__GetFactorsResponse.__pydantic_post_init__GetFactorsResponse.__pydantic_root_model__GetFactorsResponse.__pydantic_serializer__GetFactorsResponse.__pydantic_validator__GetFactorsResponse.__pydantic_fields__GetFactorsResponse.__pydantic_computed_fields__GetFactorsResponse.__pydantic_extra__GetFactorsResponse.__pydantic_fields_set__GetFactorsResponse.__pydantic_private__GetFactorsResponse.factorsInternalStateData\nListAuthenticationMethodsResponseListAuthenticationMethodsResponse.__class_vars__ListAuthenticationMethodsResponse.__private_attributes__ListAuthenticationMethodsResponse.__signature__ListAuthenticationMethodsResponse.__pydantic_complete__ListAuthenticationMethodsResponse.__pydantic_core_schema__ListAuthenticationMethodsResponse.__pydantic_custom_init__ListAuthenticationMethodsResponse.__pydantic_decorators__ListAuthenticationMethodsResponse.__pydantic_generic_metadata__ListAuthenticationMethodsResponse.__pydantic_parent_namespace__ListAuthenticationMethodsResponse.__pydantic_post_init__ListAuthenticationMethodsResponse.__pydantic_root_model__ListAuthenticationMethodsResponse.__pydantic_serializer__ListAuthenticationMethodsResponse.__pydantic_validator__ListAuthenticationMethodsResponse.__pydantic_fields__ListAuthenticationMethodsResponse.__pydantic_computed_fields__ListAuthenticationMethodsResponse.__pydantic_extra__ListAuthenticationMethodsResponse.__pydantic_fields_set__ListAuthenticationMethodsResponse.__pydantic_private__ListAuthenticationMethodsResponse.authentication_methodsListAuthenticatorsOptions\nListConnectedAccountConnectionsResponseListConnectedAccountConnectionsResponse.__class_vars__ListConnectedAccountConnectionsResponse.__private_attributes__ListConnectedAccountConnectionsResponse.__signature__ListConnectedAccountConnectionsResponse.__pydantic_complete__ListConnectedAccountConnectionsResponse.__pydantic_core_schema__ListConnectedAccountConnectionsResponse.__pydantic_custom_init__ListConnectedAccountConnectionsResponse.__pydantic_decorators__ListConnectedAccountConnectionsResponse.__pydantic_generic_metadata__ListConnectedAccountConnectionsResponse.__pydantic_parent_namespace__ListConnectedAccountConnectionsResponse.__pydantic_post_init__ListConnectedAccountConnectionsResponse.__pydantic_root_model__ListConnectedAccountConnectionsResponse.__pydantic_serializer__ListConnectedAccountConnectionsResponse.__pydantic_validator__ListConnectedAccountConnectionsResponse.__pydantic_fields__ListConnectedAccountConnectionsResponse.__pydantic_computed_fields__ListConnectedAccountConnectionsResponse.__pydantic_extra__ListConnectedAccountConnectionsResponse.__pydantic_fields_set__ListConnectedAccountConnectionsResponse.__pydantic_private__ListConnectedAccountConnectionsResponse.connectionsListConnectedAccountConnectionsResponse.nextListConnectedAccountsResponseListConnectedAccountsResponse.__class_vars__ListConnectedAccountsResponse.__private_attributes__ListConnectedAccountsResponse.__signature__ListConnectedAccountsResponse.__pydantic_complete__ListConnectedAccountsResponse.__pydantic_core_schema__ListConnectedAccountsResponse.__pydantic_custom_init__ListConnectedAccountsResponse.__pydantic_decorators__ListConnectedAccountsResponse.__pydantic_generic_metadata__ListConnectedAccountsResponse.__pydantic_parent_namespace__ListConnectedAccountsResponse.__pydantic_post_init__ListConnectedAccountsResponse.__pydantic_root_model__ListConnectedAccountsResponse.__pydantic_serializer__ListConnectedAccountsResponse.__pydantic_validator__ListConnectedAccountsResponse.__pydantic_fields__ListConnectedAccountsResponse.__pydantic_computed_fields__ListConnectedAccountsResponse.__pydantic_extra__ListConnectedAccountsResponse.__pydantic_fields_set__ListConnectedAccountsResponse.__pydantic_private__ListConnectedAccountsResponse.accountsListConnectedAccountsResponse.nextLoginBackchannelOptions\nLoginBackchannelResult\nLoginWithCustomTokenExchangeOptionsLoginWithCustomTokenExchangeOptions.actor_tokenLoginWithCustomTokenExchangeOptions.actor_token_typeLoginWithCustomTokenExchangeOptions.audienceLoginWithCustomTokenExchangeOptions.authorization_paramsLoginWithCustomTokenExchangeOptions.organizationLoginWithCustomTokenExchangeOptions.scopeLoginWithCustomTokenExchangeOptions.subject_tokenLoginWithCustomTokenExchangeOptions.subject_token_typeLoginWithCustomTokenExchangeResult\nLogoutOptions\nLogoutTokenClaims\nMfaRequirement\nMfaRequirements\nMfaTokenContext\nMfaVerifyResponse\nOobEnrollmentResponse\nOtpEnrollmentResponse\nPasskeyAuthResponse\nPasskeyAuthenticatorSelection\nPasskeyLoginChallengeResponsePasskeyLoginResult\nPasskeyPubKeyCredParam\nPasskeyPublicKeyOptionsPasskeyPublicKeyOptions.authenticator_selectionPasskeyPublicKeyOptions.challengePasskeyPublicKeyOptions.model_configPasskeyPublicKeyOptions.pub_key_cred_paramsPasskeyPublicKeyOptions.rpPasskeyPublicKeyOptions.rp_idPasskeyPublicKeyOptions.timeoutPasskeyPublicKeyOptions.userPasskeyPublicKeyOptions.user_verificationPasskeyRpInfo\nPasskeySignupChallengeResponse\nPasskeyTokenResponse\nPasskeyUserInfo\nPasskeyUserProfile\nPasswordlessStartResult\nServerClientOptionsBaseServerClientOptionsBase.authorization_paramsServerClientOptionsBase.client_assertion_signing_algServerClientOptionsBase.client_assertion_signing_keyServerClientOptionsBase.client_idServerClientOptionsBase.client_secretServerClientOptionsBase.custom_fetchServerClientOptionsBase.domainServerClientOptionsBase.organizationServerClientOptionsBase.state_identifierServerClientOptionsBase.transaction_identifierServerClientOptionsWithSecret\nSessionData\nSessionTransferTokenResultSessionTransferTokenResult.session_transfer_tokenSessionTransferTokenResult.issued_token_typeSessionTransferTokenResult.expires_inSessionTransferTokenResult.token_typeSessionTransferTokenResult.scopeSessionTransferTokenResult.expires_inSessionTransferTokenResult.issued_token_typeSessionTransferTokenResult.scopeSessionTransferTokenResult.session_transfer_tokenSessionTransferTokenResult.token_typeStartEnterpriseLoginOptions\nStartInteractiveLoginOptions\nStartLinkUserOptionsStartLinkUserOptions.__class_vars__StartLinkUserOptions.__private_attributes__StartLinkUserOptions.__signature__StartLinkUserOptions.__pydantic_complete__StartLinkUserOptions.__pydantic_core_schema__StartLinkUserOptions.__pydantic_custom_init__StartLinkUserOptions.__pydantic_decorators__StartLinkUserOptions.__pydantic_generic_metadata__StartLinkUserOptions.__pydantic_parent_namespace__StartLinkUserOptions.__pydantic_post_init__StartLinkUserOptions.__pydantic_root_model__StartLinkUserOptions.__pydantic_serializer__StartLinkUserOptions.__pydantic_validator__StartLinkUserOptions.__pydantic_fields__StartLinkUserOptions.__pydantic_computed_fields__StartLinkUserOptions.__pydantic_extra__StartLinkUserOptions.__pydantic_fields_set__StartLinkUserOptions.__pydantic_private__StartLinkUserOptions.app_stateStartLinkUserOptions.authorization_paramsStartLinkUserOptions.connectionStartLinkUserOptions.connection_scopeStartPasswordlessEmailOptions\nStartPasswordlessSmsOptions\nStateData\nTokenExchangeResponseTokenExchangeResponse.access_tokenTokenExchangeResponse.token_typeTokenExchangeResponse.expires_inTokenExchangeResponse.scopeTokenExchangeResponse.issued_token_typeTokenExchangeResponse.id_tokenTokenExchangeResponse.refresh_tokenTokenExchangeResponse.actTokenExchangeResponse.access_tokenTokenExchangeResponse.actTokenExchangeResponse.expires_inTokenExchangeResponse.id_tokenTokenExchangeResponse.issued_token_typeTokenExchangeResponse.refresh_tokenTokenExchangeResponse.scopeTokenExchangeResponse.token_typeTokenSet\nTransactionData\nUpdateAuthenticationMethodRequestUpdateAuthenticationMethodRequest.__class_vars__UpdateAuthenticationMethodRequest.__private_attributes__UpdateAuthenticationMethodRequest.__signature__UpdateAuthenticationMethodRequest.__pydantic_complete__UpdateAuthenticationMethodRequest.__pydantic_core_schema__UpdateAuthenticationMethodRequest.__pydantic_custom_init__UpdateAuthenticationMethodRequest.__pydantic_decorators__UpdateAuthenticationMethodRequest.__pydantic_generic_metadata__UpdateAuthenticationMethodRequest.__pydantic_parent_namespace__UpdateAuthenticationMethodRequest.__pydantic_post_init__UpdateAuthenticationMethodRequest.__pydantic_root_model__UpdateAuthenticationMethodRequest.__pydantic_serializer__UpdateAuthenticationMethodRequest.__pydantic_validator__UpdateAuthenticationMethodRequest.__pydantic_fields__UpdateAuthenticationMethodRequest.__pydantic_computed_fields__UpdateAuthenticationMethodRequest.__pydantic_extra__UpdateAuthenticationMethodRequest.__pydantic_fields_set__UpdateAuthenticationMethodRequest.__pydantic_private__UpdateAuthenticationMethodRequest.nameUpdateAuthenticationMethodRequest.preferred_authentication_methodUserClaims\nVerifyAuthenticationMethodRequestVerifyAuthenticationMethodRequest.__class_vars__VerifyAuthenticationMethodRequest.__private_attributes__VerifyAuthenticationMethodRequest.__signature__VerifyAuthenticationMethodRequest.__pydantic_complete__VerifyAuthenticationMethodRequest.__pydantic_core_schema__VerifyAuthenticationMethodRequest.__pydantic_custom_init__VerifyAuthenticationMethodRequest.__pydantic_decorators__VerifyAuthenticationMethodRequest.__pydantic_generic_metadata__VerifyAuthenticationMethodRequest.__pydantic_parent_namespace__VerifyAuthenticationMethodRequest.__pydantic_post_init__VerifyAuthenticationMethodRequest.__pydantic_root_model__VerifyAuthenticationMethodRequest.__pydantic_serializer__VerifyAuthenticationMethodRequest.__pydantic_validator__VerifyAuthenticationMethodRequest.__pydantic_fields__VerifyAuthenticationMethodRequest.__pydantic_computed_fields__VerifyAuthenticationMethodRequest.__pydantic_extra__VerifyAuthenticationMethodRequest.__pydantic_fields_set__VerifyAuthenticationMethodRequest.__pydantic_private__VerifyAuthenticationMethodRequest.auth_sessionVerifyAuthenticationMethodRequest.authn_responseVerifyAuthenticationMethodRequest.otp_codeVerifyAuthenticationMethodRequest.passwordVerifyAuthenticationMethodRequest.recovery_codeVerifyOobOptions\nVerifyOtpOptions\nVerifyPasswordlessOtpOptionsVerifyPasswordlessOtpOptions.audienceVerifyPasswordlessOtpOptions.client_ipVerifyPasswordlessOtpOptions.connectionVerifyPasswordlessOtpOptions.emailVerifyPasswordlessOtpOptions.model_configVerifyPasswordlessOtpOptions.phone_numberVerifyPasswordlessOtpOptions.scopeVerifyPasswordlessOtpOptions.usernameVerifyPasswordlessOtpOptions.verification_codeVerifyRecoveryCodeOptions\nChallengeTypeEnrollAuthenticatorOptionsEnrollmentResponseEnrollmentTypeOobChannelPASSWORDLESS_ALLOWED_AUTH_PARAMSPASSWORDLESS_RESERVED_AUTH_PARAMSPasskeyDeliveryMethodPasswordlessConnectionPreferredAuthMethodSESSION_EXPIRY_MAX_PLAUSIBLEStartPasswordlessOptionsVerifyMfaOptionsImport
\nfrom auth0_server_python.encryption.encrypt import (\n decrypt,\n derive_encryption_key,\n encrypt,\n)\nDecrypts the JWE token back to the original payload.
\nDerives a key using HKDF with SHA-256.
\nEncrypts the given payload into a JWE using the direct algorithm and A256CBC-HS512 encryption.
\nError classes for the SDK.\nThese exceptions provide specific error types for different failure scenarios.
\nImport
\nfrom auth0_server_python.error import (\n AccessTokenError,\n AccessTokenForConnectionError,\n AnonymousSessionCreateError,\n AnonymousSessionError,\n AnonymousSessionTokenError,\n ApiError,\n Auth0Error,\n BackchannelLogoutError,\n ConfigurationError,\n CustomTokenExchangeError,\n DomainResolverError,\n EnterpriseConnectError,\n InvalidArgumentError,\n IssuerValidationError,\n MfaApiError,\n MfaChallengeError,\n MfaEnrollmentError,\n MfaListAuthenticatorsError,\n MfaRequiredError,\n MfaTokenExpiredError,\n MfaTokenInvalidError,\n MfaVerifyError,\n MissingRequiredArgumentError,\n MissingTransactionError,\n MyAccountApiError,\n OrganizationTokenValidationError,\n PasskeyError,\n PasswordlessStartError,\n PasswordlessVerifyError,\n PollingApiError,\n SessionExpiredError,\n StartLinkUserError,\n AccessTokenErrorCode,\n AccessTokenForConnectionErrorCode,\n CustomTokenExchangeErrorCode,\n EnterpriseConnectErrorCode,\n PasskeyErrorCode,\n PasswordlessErrorCode,\n)\nBases: Auth0Error
Error raised when there\u2019s an issue with access tokens.
\nBases: Auth0Error
Error when retrieving access tokens for a specific connection fails.
\nBases: AnonymousSessionError
Error thrown when creating or re-minting an anonymous session fails.
\nBases: Auth0Error
Base class for anonymous session errors.
\nBases: AnonymousSessionError
Error thrown when get_token() fails for reasons other than session expiry.
\nBases: Auth0Error
Error raised when an API request to Auth0 fails.\nContains details about the original error from Auth0.
\nBases: Exception
Base class for all Auth0 SDK errors.
\nBases: Auth0Error
Error raised during backchannel logout processing.\nThis can happen when validating or processing logout tokens.
\nBases: Auth0Error
Error raised when SDK configuration is invalid.\nThis includes invalid combinations of parameters or incorrect configuration values.
\nBases: Auth0Error
Error raised during custom token exchange operations.
\nBases: Auth0Error
Error raised when domain resolver function fails or returns invalid value.
\nThis error indicates an issue with the custom domain resolver function\nprovided for MCD (Multiple Custom Domains) support.
\nBases: Auth0Error
Error raised when a session or token method is called on a client\nconfigured for Enterprise Connect, where the SDK owns no session.
\nParents Auth0Error rather than ApiError because the refusal makes no\nrequest to Auth0, so there is no upstream error body to carry.
\nBases: Auth0Error
Error raised when a given argument is an invalid value.
\nBases: Auth0Error
Error raised when token issuer validation fails.\nThis can happen when the issuer claim in a token does not match\nthe expected issuer for the configured domain.
\nBases: Auth0Error
Base class for MFA API errors.
\nBases: MfaApiError
Error thrown when initiating an MFA challenge fails.
\nBases: MfaApiError
Error thrown when enrolling an authenticator fails.
\nBases: MfaApiError
Error thrown when listing authenticators fails.
\nBases: AccessTokenError
Error thrown when MFA step-up is required during token refresh.
\nContains an encrypted mfa_token that can be passed to MfaClient methods.\nThis error is raised in get_access_token() when the token endpoint returns\n\u2018mfa_required\u2019.
\nBases: Auth0Error
Error thrown when the encrypted MFA token has expired.
\nBases: Auth0Error
Error thrown when the encrypted MFA token is invalid or tampered.
\nBases: MfaApiError
Error thrown when MFA verification fails.
\nBases: Auth0Error
Error raised when a required argument is missing.\nIncludes the name of the missing argument in the error message.
\nBases: Auth0Error
Error raised when a required transaction is missing.\nThis typically happens during the callback phase when the transaction\nfrom the initial authorization request cannot be found.
\nBases: Auth0Error
Error raised when an API request to My Account API fails.\nContains details about the original error from Auth0.
\nBases: Auth0Error
Raised when org_id or org_name claim in the ID token fails validation\nagainst the organization value that was requested at login.
\nBases: Auth0Error
Error raised during passkey authentication operations.
\ncode \u2013 Error code, see PasskeyErrorCode.
message \u2013 Human-readable description.
cause \u2013 Underlying exception, if any.
auth_session \u2013 Session to resubmit against, set when Auth0 keeps it alive after a wrong code.
verification_required \u2013 Identifiers whose codes are still unverified.
retry_after \u2013 Seconds from the Retry-After header, None when absent or not whole seconds.
status_code \u2013 HTTP status of an Auth0 error response, None otherwise.
True when a code was wrong but the session is alive, so the caller can resubmit.
\nBases: ApiError
Error raised when POST /passwordless/start fails.
\nBases: ApiError
Error raised when the passwordless OTP token exchange fails.
\nBases: ApiError
Error raised when a polling API request to Auth0 fails.\nContains details about the original error from Auth0 and the requested polling interval.
\nBases: Auth0Error
Error raised when a session is rejected at login because its\nsession_expiry ceiling is already in the past.
\nBases: Auth0Error
Error raised when user linking process fails to start.\nThis typically happens when trying to link accounts without\nhaving an authenticated user first.
\nError codes for access token operations.
\nError codes for connection-specific token operations.
\nError codes for custom token exchange operations.
\nError code for the Enterprise Connect misuse guard.
\nError codes for passkey operations.
\nError codes for passwordless operations.
\nAccessTokenError\nAccessTokenForConnectionError\nAnonymousSessionCreateErrorAnonymousSessionError\nAnonymousSessionTokenErrorApiError\nAuth0Error\nBackchannelLogoutError\nConfigurationError\nCustomTokenExchangeError\nDomainResolverError\nEnterpriseConnectError\nInvalidArgumentError\nIssuerValidationError\nMfaApiError\nMfaChallengeErrorMfaEnrollmentErrorMfaListAuthenticatorsErrorMfaRequiredError\nMfaTokenExpiredError\nMfaTokenInvalidError\nMfaVerifyErrorMissingRequiredArgumentError\nMissingTransactionError\nMyAccountApiError\nOrganizationTokenValidationError\nPasskeyError\nPasswordlessStartError\nPasswordlessVerifyError\nPollingApiError\nSessionExpiredError\nStartLinkUserError\nAccessTokenErrorCodeAccessTokenErrorCode.AUTH_REQ_ID_ERRORAccessTokenErrorCode.DOMAIN_MISMATCHAccessTokenErrorCode.FAILED_TO_REFRESH_TOKENAccessTokenErrorCode.FAILED_TO_REQUEST_TOKENAccessTokenErrorCode.INCORRECT_AUDIENCEAccessTokenErrorCode.MISSING_REFRESH_TOKENAccessTokenErrorCode.MISSING_SESSIONAccessTokenErrorCode.MISSING_SESSION_DOMAINAccessTokenErrorCode.REFRESH_TOKEN_ERRORAccessTokenErrorCode.SESSION_EXPIREDAccessTokenForConnectionErrorCodeAccessTokenForConnectionErrorCode.API_ERRORAccessTokenForConnectionErrorCode.DOMAIN_MISMATCHAccessTokenForConnectionErrorCode.FAILED_TO_RETRIEVEAccessTokenForConnectionErrorCode.FETCH_ERRORAccessTokenForConnectionErrorCode.MISSING_REFRESH_TOKENAccessTokenForConnectionErrorCode.MISSING_SESSION_DOMAINCustomTokenExchangeErrorCodeCustomTokenExchangeErrorCode.ACTOR_UNAVAILABLECustomTokenExchangeErrorCode.INVALID_RESPONSECustomTokenExchangeErrorCode.INVALID_TOKEN_FORMATCustomTokenExchangeErrorCode.MISSING_ACTOR_TOKENCustomTokenExchangeErrorCode.MISSING_ACTOR_TOKEN_TYPECustomTokenExchangeErrorCode.SESSION_TRANSFER_DISABLEDCustomTokenExchangeErrorCode.SETACTOR_REQUIREDCustomTokenExchangeErrorCode.TOKEN_EXCHANGE_FAILEDEnterpriseConnectErrorCode\nPasskeyErrorCode\nPasswordlessErrorCodePasswordlessErrorCode.BAD_CONNECTIONPasswordlessErrorCode.BAD_EMAILPasswordlessErrorCode.DISCOVERY_ERRORPasswordlessErrorCode.INVALID_AUDIENCEPasswordlessErrorCode.INVALID_GRANTPasswordlessErrorCode.INVALID_ISSUERPasswordlessErrorCode.SMS_PROVIDER_ERRORPasswordlessErrorCode.START_FAILEDPasswordlessErrorCode.TOKEN_EXPIREDPasswordlessErrorCode.TOO_MANY_REQUESTSPasswordlessErrorCode.VERIFY_FAILEDThis page contains auto-generated API reference documentation [1].
\nImport
\nfrom auth0_server_python.store.abstract import (\n AbstractDataStore,\n StateStore,\n TransactionStore,\n)\nAbstract base class for data stores.\nProvides common functionality for different store implementations.
\nDecrypt data after retrieval.
\nidentifier \u2013 Unique key used as part of encryption salt
encrypted_data \u2013 Encrypted data to decrypt
Decrypted data
\nDelete data by identifier.
\nidentifier \u2013 Unique key for the stored data
options \u2013 Additional operation-specific options
Encrypt data before storing.
\nidentifier \u2013 Unique key used as part of encryption salt
state_data \u2013 Data to encrypt
Encrypted string representation of the data
\nRetrieve data by identifier.
\nidentifier \u2013 Unique key for the stored data
options \u2013 Additional operation-specific options
The stored data or None if not found
\nStore data with the given identifier.
\nidentifier \u2013 Unique key for the stored data
state \u2013 Data to store
remove_if_expires \u2013 Whether to auto-remove expired data
options \u2013 Additional operation-specific options
Bases: AbstractDataStore[dict[str, Any]]
Abstract store for persistent session data.\nExtends AbstractDataStore with logout token functionality.
\nDelete sessions based on logout token claims.
\nPer the OIDC Back-Channel Logout spec, either sid or sub\n(or both) will be present. Implementations should match on\nwhichever claim is present (OR logic), not require both (AND).
When iss is present in claims (always included by the SDK),\nimplementations should validate that the token\u2019s issuer matches\nthe session\u2019s stored domain before deleting. This prevents\ncross-domain session deletion in MCD deployments.
claims \u2013
Claims from the logout token. Keys:\n- sub: Subject identifier of the user\n- sid: Session identifier\n- iss: Token issuer (always included; compare against
\n\nsession domain before deletion)
\n
options \u2013 Additional operation-specific options
Note
\nDefault implementation raises NotImplementedError.\nConcrete implementations should override this method.
\nBases: AbstractDataStore[dict[str, Any]]
Abstract store for temporary transaction data during auth flows.
\nTelemetry support for auth0-server-python SDK.
\nBuilds and caches the Auth0-Client and User-Agent headers sent\non every HTTP request to Auth0 endpoints.
\nImport
\nfrom auth0_server_python.telemetry import Telemetry\nBuilds telemetry headers for Auth0 HTTP requests.
\nCreate a Telemetry instance with this SDK\u2019s package metadata.
\nImport
\nfrom auth0_server_python.utils.helpers import (\n PKCE,\n State,\n URL,\n build_domain_resolver_context,\n validate_org_claims,\n validate_resolved_domain_value,\n)\nGenerate a PKCE code challenge from a code verifier.
\nTrue when the session ceiling is already in the past at login.
\nCompares the ceiling against the ID token iat, or wall-clock now when\niat is absent, using the same leeway as is_session_ceiling_reached. A\nNone ceiling means none was asserted and is never treated as expired.
\nTrue when the session ceiling has been reached (applying negative\nleeway for clock skew). None means no ceiling was asserted, so the\nsession is never expired on this basis.
\nUtility function to update the state with a new response from the token endpoint
\naudience \u2013 The audience of the token endpoint response
state_data \u2013 The existing state data to update, or None if no state data available
token_endpoint_response \u2013 The response from the token endpoint
Updated state data
\nUpdate state data with connection token set information
\noptions \u2013 Options containing connection details
state_data \u2013 Existing state data
token_endpoint_response \u2013 Response from token endpoint
Updated state data
\nBuild a complete URL by appending query parameters to a base URL.
\nbase_url \u2013 The base URL without query parameters.
params \u2013 A dictionary of query parameters to add.
The complete URL with the query parameters appended.
\nCreate an Auth0 logout URL.
\ndomain \u2013 Auth0 domain.
client_id \u2013 Auth0 client ID.
return_to \u2013 Optional URL to redirect to after logout.
federated \u2013 When True, add federated so Auth0 also ends the upstream\nIdP session. Its presence is the signal; the value is ignored.
The complete logout URL.
\nBuild DomainResolverContext from store_options.
\nExtracts request information in a framework-agnostic way using duck typing.
\nstore_options \u2013 Dictionary containing \u2018request\u2019 and \u2018response\u2019 objects
\nDomainResolverContext with extracted request data
\nValidate org_id or org_name in token claims against the requested organization.
\n\u2018org_\u2019 prefix \u2192 validate claims[\u2018org_id\u2019] exact match (case-sensitive)
no prefix \u2192 validate claims[\u2018org_name\u2019] case-insensitive match (NFC-normalized)
OrganizationTokenValidationError \u2013 if the claim is missing, not a string, or mismatched.
\nValidate the value returned by domain resolver.
\ndomain_value \u2013 The value returned by the domain resolver
\nThe validated domain string
\nDomainResolverError \u2013 If the returned value is invalid
\nUtility functions for auth0-server-python SDK.\nThese helpers provide common functionality used across the SDK.
\n