Configure Auth0 OIDC
Connect an Auth0 confidential or public OIDC application to Oore.
Create a dedicated Auth0 application for Oore. This page covers only Auth0-specific configuration.
Configure the shared OIDC network and enablement steps separately.
What you need
- Permission to create applications in the Auth0 tenant
- The exact Oore frontend callback ending in
/auth/callback
1. Create the Auth0 application
- In the Auth0 Dashboard, open Applications > Applications.
- Select Create Application.
- Choose Regular Web Applications.
- Open the application’s settings.
- Add the exact Oore callback under Allowed Callback URLs. If you operate more than one frontend origin, list each complete callback explicitly.
- Copy the application’s domain and client ID.
Auth0 can show an extra confirmation for a localhost callback. Approve it only when the host, port, and /auth/callback path match Oore.
2. Choose the client type
Use a confidential client when Oore can store the application secret. This is the recommended Regular Web Application path.
- Keep Auth0’s default client-secret authentication method.
- Copy the client secret from the application’s credentials.
- Enter that secret in Oore.
Use a public client only when you do not want Auth0 to issue a usable client secret.
- Open the application’s Credentials settings.
- Set Token Endpoint Authentication Method to None.
- Save the Auth0 application.
- Leave Client secret blank in Oore.
- Select Use an Auth0 public client without a secret in Oore.
Oore uses the Authorization Code flow with PKCE for both paths. The public path sends no client secret during token exchange.
3. Save Auth0 in Oore
In Oore’s OIDC step, select Auth0 under Identity provider, then enter:
| Oore field | Confidential client | Public client |
|---|---|---|
| Issuer URL | https://<your-auth0-domain>/ | https://<your-auth0-domain>/ |
| Client ID | The application’s client ID | The application’s client ID |
| Client secret | The application’s client secret | Leave blank |
| Public checkbox | Leave clear | Select the public-client checkbox |
Keep the trailing slash in the Auth0 issuer and select Configure OIDC.
Use the exact domain shown by Auth0, including a custom domain when that is the issuer your tenant exposes.
Oore requests only the openid and email scopes. It does not request profile.
Verify the result
Confirm that Oore reports the same Auth0 issuer.
After you turn on External Access, start a new sign-in. Confirm that Auth0 returns the browser to the exact Oore callback.
Auth0 documents confidential and public applications.
Auth0 also documents the Authorization Code flow with PKCE.
Troubleshooting
Auth0 reports an unauthorized callback URL
The complete callback is missing from Allowed Callback URLs or differs in scheme, host, port, path, or trailing slash. Register the exact URI Oore sends.
Oore reports an issuer mismatch
The issuer does not exactly match the Auth0 tenant or custom domain discovery response. Copy the tenant domain and preserve its trailing slash.
Auth0 rejects the token exchange
The Oore client type and Auth0 authentication method do not match.
For a confidential client, enter the current client secret. For a public client, set the token endpoint method to None.
Next step
Return to Configure External Access (OIDC) to run technical checks and enable access.