Configure M2M Access with Auth0 Organizations

Machine-to-Machine Access for Organizations enables you to define the Auth0 Organization a given application can access for each API using the Client Credentials Flow.

Authorize M2M access

To authorize machine-to-machine access for an application, you must enable it to use an Organization for a specific API. To do so, you must associate the application’s client grant to the corresponding API with the Organization. Once associated, the application can use the Organization when requesting tokens for the API and scopes defined in the client grant. Define this association for each API your application needs to access for the Organization.

This flow is supported for third-party applications. Third-party applications cannot use allow_any_organization, so each Organization must be explicitly authorized using the following steps.

You can authorize M2M access for an application using the Auth0 Dashboard or Management API.

Auth0 Dashboard
Management API

To associate an application’s client grant to an Organization via the Auth0 Dashboard:

Navigate to Organizations and choose the Organization you want to associate with.
Select the Machine-to-Machine Access tab.
Select Add Access.
Select the application you want to associate with the Organization.
Select an API.
Select Save.

Auth0 Dashboard showing M2M access configuration for an application associated with an organization and API

Revoke M2M access

To revoke M2M access, or remove access to an Organization for your application, you must delete the association between its client grant(s) and the Organization. Once this association is deleted, the application is no longer permitted to use the Organization when requesting new tokens for the API defined in the grant. Revoking M2M access works the same way for third-party applications.

Revoking M2M access does not impact applications that have been granted access to any Organization. To learn more, read Define Organization Behavior.

Auth0 Dashboard
Management API

To remove the association between an application’s client grant and an Organization via the Auth0 Dashboard:

Navigate to Organizations and choose the Organization you wish to remove the association from.
Select the Machine-to-Machine Access tab.
Choose an application.
Uncheck the box next to the APIs you wish to disassociate with the Organization.
Select Save.

Auth0 Dashboard showing the revoke M2M access view for removing an application client grant from an organization

Delete the association between an application’s client grant and an Organization via the Disassociate client grants from organizations endpoint:

curl -X DELETE --location "https://{yourDomain}/api/v2/organizations/{ORG_id}/client-grants/{GRANT_ID}" \
  --header 'authorization: Bearer MGMT_API_ACCESS_TOKEN' ;

Audit M2M access

Machine-to-Machine Access to Organizations can be granted by directly associating a client grant to an Organization or allowing access to any Organization in the client grant settings. Both scenarios can be audited via the or the , where you can view or retrieve a list of client grants associated with an Organization for an application. To learn more about how M2M access to Organizations permissions work, read Configure Your Application for M2M Access and Authorize M2M Access. Auditing works the same way for third-party applications.

Access granted via direct association

Use the Auth0 Dashboard and Management API to audit M2M access for client grants that are directly associated with an Organization.

Auth0 Dashboard
Management API

To view the application client grants that have been authorized for a specific Organization on the Auth0 Dashboard:

Navigate to Organizations and choose the Organization you wish to inspect.
Select the Machine-to-Machine Access tab. You get a paginated list of all the applications that can access an API for this Organization via direct association.
Choose an application to review the authorized APIs listed for that application.

Auth0 Dashboard showing a paginated list of applications with direct M2M access association to an organization

Retrieve client grants associated with an Organization via the Organization Client Grants API endpoint:Alternatively, if you want to retrieve information on applications that can access at least one of the APIs for an Organization, you can use the q query parameter on the Get Clients API endpoint with the search term client_grant.organization_id:{organization_id}. Use the Lucene syntax, which is similar to the User Search Query Syntax.

Access granted to any organization

Use the Auth0 Dashboard and Management API to audit M2M access for applications that have access granted to any Organization.

This section does not apply to third-party applications. Third-party applications cannot use allow_any_organization and will not appear in this audit query. Use the direct association queries above instead.

Auth0 Dashboard
Management API

Navigate to Organizations.
Select the Machine-to-Machine Access tab. You get a paginated list of all the applications that can access at least one of the APIs for an Organization.
Choose an application to review the authorized APIs listed for that application.

Auth0 Dashboard showing a paginated list of applications with M2M access granted to any organization

Retrieve client grants with the allow_any_organization parameter via the Get Client Grants API endpoint:Alternatively, if you want to retrieve information on applications that can access at least one of the APIs for any Organization, you can use the q query parameter on the Get Client Grants API endpoint with the search term client_grant.allow_any_organization:true. Use the Lucene syntax, which is similar to the User Search Query Syntax.

Search applications based on organization access

Search results are eventually consistent.

The following table shows the search terms supported to query applications with the q parameter on the /clients endpoint:

Field	Description
`client_grant.organization_id:{organization_id}`	Use to search for applications that can access at least one of the APIs for an Organization.
`client_grant.allow_any_organization:true`	Use to search for applications that can access at least one of the APIs for any Organization.

Tenant logs

Machine-to-Machine Access for Organizations is also reflected in tenant logs. You can check the organization associated to the request in the corresponding seccft tenant log. The following code sample is an example seccft tenant log with organization information:

{
  "date": "2024-10-24T19:06:17.460Z",
  "type": "seccft",
  "description": "Client Credentials for Access Token",
  "connection_id": "",
  "client_id": "qoQKtXuhdSibs1jUeXk3mmCwXoAafGnO",
  "client_name": "jwt.io (Test Application)",
  "ip": "130.41.219.72",
  "user_agent": "Other 0.0.0 / Other 0.0.0",
  "hostname": "david-test.test-aws-abundant-lobster-6004.auth0c.com",
  "user_id": "",
  "user_name": "",
  "organization_id": "org_mPdwToiiHHOtz0SH",
  "organization_name": "cc_test",
  "audience": "https://jwt.io.com",
  "scope": "read:data",
  "$event_schema": {
    "version": "1.0.0"
  },
  "log_id": "90020241024190617517817000000000000001223372036854775862",
  "tenant_name": "david-test",
  "_id": "90020241024190617517817000000000000001223372036854775862",
  "isMobile": false,
  "id": "90020241024190617517817000000000000001223372036854775862"
}

​Authorize M2M access

​Revoke M2M access

​Audit M2M access

​Access granted via direct association

​Access granted to any organization

​Search applications based on organization access

​Tenant logs

Authorize M2M access

Revoke M2M access

Audit M2M access

Access granted via direct association

Access granted to any organization

Search applications based on organization access

Tenant logs