Auth0
Overview
Section titled “Overview”The EQTY Governance Platform integrates with Auth0 for user authentication and authorization.
Required Auth0 applications:
- Platform API (M2M) – Machine-to-machine app for backend API token validation
- Auth Service Backend (M2M) – Machine-to-machine app for user management via Auth0 Management API
- Governance Studio (SPA) – Single Page Application for frontend authentication
This guide covers:
- Creating Auth0 applications (Auth0 CLI or Dashboard)
- Configuring API permissions and scopes
- Setting up organization support for multi-tenancy
- Configuring the Helm chart for Auth0
Prerequisites
Section titled “Prerequisites”- Auth0 tenant (sign up at auth0.com if needed)
- Auth0 CLI installed (for CLI method)
- Auth0 tenant domain (e.g.
your-tenant.us.auth0.com)
Helm Configuration
Section titled “Helm Configuration”Add the following to the values.yaml and secrets.yaml files. Placeholders will be filled in throughout the steps below.
values.yaml:
auth-service
:
config
:
idp
:
provider
:
"
auth0
"
issuer
:
"
https://
/
"
# Filled in after step 1
auth0
:
domain
:
"
/api/v2/
"
# Filled in after step 1
apiIdentifier
:
"
/api/v2/
"
# Filled in after step 1
secrets.yaml:
global
:
secrets
:
create
:
true
auth
:
provider
:
"
auth0
"
auth0
:
secretName
:
"
platform-auth0
"
values
:
clientId
:
"
Quick Start (CLI Method - Recommended)
Section titled “Quick Start (CLI Method - Recommended)”1. Install and Authenticate Auth0 CLI
Section titled “1. Install and Authenticate Auth0 CLI”Install the Auth0 CLI:
# macOS
brew
install
auth0/auth0-cli/auth0
# Linux
curl
-sSfL
https://raw.githubusercontent.com/auth0/auth0-cli/main/install.sh
|
sh
Authenticate with the Auth0 tenant:
auth0
login
Note the tenant domain shown after login (e.g. your-tenant.us.auth0.com).
Update values.yaml with the tenant domain.
values.yaml -> auth-service.config.idp:
issuer
:
"
https://
/
"
auth0
:
domain
:
"
/api/v2/
"
values.yaml -> governance-service.config:
auth0Domain
:
"
values.yaml -> governance-studio.config:
auth0Domain
:
"
/api/v2/
"
2. Create Platform API (M2M Application)
Section titled “2. Create Platform API (M2M Application)”
auth0
apps
create
\
--name
"
EQTY Platform API
"
\
--type
m2m
\
--description
"
Backend API for EQTY Governance Platform token validation
"
\
--reveal-secrets
The output will look like:
=== your-tenant.us.auth0.com application created
CLIENT ID abc123def456
NAME EQTY Platform API
TYPE Machine to Machine
CLIENT SECRET your-client-secret-here
Save both the Client ID and Client Secret.
Update secrets.yaml with the Platform API credentials.
secrets.yaml -> global.secrets.auth.auth0.values:
clientId
:
"
3. Create Auth Service Backend (M2M Application)
Section titled “3. Create Auth Service Backend (M2M Application)”
auth0
apps
create
\
--name
"
EQTY Auth Service Backend
"
\
--type
m2m
\
--description
"
User management for EQTY Governance Platform
"
\
--reveal-secrets
Save both the Client ID and Client Secret.
Grant the required Management API permissions. Replace
with the Client ID from above:
auth0
api
post
/api/v2/client-grants
\
--data
'
{
"client_id": "
",
"audience": "https://
/api/v2/",
"scope": ["read:users", "update:users", "create:users", "read:organizations", "update:organizations", "create:organizations"]
}
'
Update secrets.yaml with the Auth Service Backend credentials.
secrets.yaml -> global.secrets.auth.auth0.values:
mgmtClientId
:
"
4. Create Governance Studio SPA
Section titled “4. Create Governance Studio SPA”Replace
with the governance platform domain (e.g. governance.example.com):
auth0
apps
create
\
--name
"
EQTY Governance Studio
"
\
--type
spa
\
--description
"
Frontend SPA for EQTY Governance Platform
"
\
--callbacks
"
https://
/callback,http://localhost:3000/callback
"
\
--logout-urls
"
https://
,http://localhost:3000
"
\
--web-origins
"
https://
,http://localhost:3000
"
\
--reveal-secrets
Save the Client ID from the output.
Update values.yaml with the SPA client ID.
values.yaml -> governance-studio.config:
auth0ClientId
:
"
5. Configure for Business Users (Organizations)
Section titled “5. Configure for Business Users (Organizations)”Enable organizations on the SPA to support multi-tenancy. Replace
with the Client ID from step 4:
auth0
apps
update
6. Create an API Definition
Section titled “6. Create an API Definition”Replace
with the governance platform domain:
auth0
apis
create
\
--name
"
EQTY Governance Platform API
"
\
--identifier
"
https://
Update values.yaml with the API identifier.
values.yaml -> auth-service.config.idp.auth0:
apiIdentifier
:
"
https://
Alternative: Web UI Setup
Section titled “Alternative: Web UI Setup”Click to expand Auth0 Dashboard instructions
Using the Auth0 Dashboard
Section titled “Using the Auth0 Dashboard”1. Create Platform API Application
Section titled “1. Create Platform API Application”- Navigate to Applications > Applications in Auth0 Dashboard
- Click “Create Application”
- Name: “EQTY Platform API”
- Type: Machine to Machine Applications
- Save the Client ID and Client Secret
Update secrets.yaml with the Platform API credentials.
secrets.yaml -> global.secrets.auth.auth0.values:
clientId
:
"
2. Create Auth Service Backend Application
Section titled “2. Create Auth Service Backend Application”- Create another M2M application: “EQTY Auth Service Backend”
- Authorize it to call the Auth0 Management API
- Grant scopes:
read:users,update:users,create:users,read:organizations,update:organizations,create:organizations - Save the Client ID and Client Secret
Update secrets.yaml with the Auth Service Backend credentials.
secrets.yaml -> global.secrets.auth.auth0.values:
mgmtClientId
:
"
3. Create Governance Studio SPA
Section titled “3. Create Governance Studio SPA”- Create a Single Page Application: “EQTY Governance Studio”
- Configure callbacks, logout URLs, and web origins with the governance platform domain
- Change the application’s login experience to “Business Users”
- Save the Client ID
Update values.yaml with the domain and SPA client ID.
values.yaml -> auth-service.config.idp:
issuer
:
"
https://
/
"
auth0
:
domain
:
"
/api/v2/
"
values.yaml -> governance-service.config:
auth0Domain
:
"
values.yaml -> governance-studio.config:
auth0Domain
:
"
/api/v2/
"
4. Create API Definition
Section titled “4. Create API Definition”- Navigate to Applications > APIs
- Create API with identifier:
https:// - Define scopes as needed
Update values.yaml with the API identifier.
values.yaml -> auth-service.config.idp.auth0:
apiIdentifier
:
"
https://
Verification
Section titled “Verification”Verify the OIDC discovery endpoint:
curl
"
https://
/.well-known/openid-configuration
"
|
jq
.
Test token issuance with Platform API credentials:
curl
-X
POST
"
https://
/oauth/token
"
\
-H
"
Content-Type: application/json
"
\
-d
'
{
"client_id": "
",
"client_secret": "
",
"audience": "https://
",
"grant_type": "client_credentials"
}
'
|
jq
.
If both commands succeed and return valid JSON, the Auth0 configuration is correct.
Security Best Practices
Section titled “Security Best Practices”- Rotate Secrets: Regularly rotate client secrets and update Kubernetes secrets
- Least Privilege: Only grant the Management API scopes required (
read:users,update:users,create:users,read:organizations,update:organizations,create:organizations) - Organizations: Use Auth0 Organizations for tenant isolation in multi-tenant deployments
- Monitor Activity: Enable Auth0 log streaming to monitor authentication events and detect anomalies