Docs · Integrations
Auth0
Stream Auth0 tenant logs to Invoance and every sign-in, signup, password and email change becomes a signed audit event. The stream token is checked first.
Set up
Create the source
In the dashboard open Audit Logs, then Integrations, and connect Auth0. Auth0 issues no secret, so set a token of 16 to 512 characters, or press Generate. Copy the URL and the token.
Create a custom webhook stream
In the Auth0 Dashboard open Monitoring, then Streams, then Create Stream, and choose Custom Webhook.
Fill in the stream
Payload URL: the webhook URL. Content Type: application/json. Content Format: JSON Array. Authorization Token: the token. Auth0 sends it on every delivery.
Pick category filters
Choose the stream's category filters. Only the codes in the map below become events; every other code is skipped.
Event map
| Auth0 log code | Auth0 meaning | Becomes |
|---|---|---|
s | Successful login | user.signed_in |
slo | Successful logout | user.signed_out |
f, fp, fu | Failed login: generic, wrong password, unknown user | user.sign_in_failed |
ss | Successful signup | user.created |
sdu | User deleted | user.deleted |
scp | Successful password change | user.password_changed |
sce | Successful email change | user.email_changed |
limit_wc, limit_mu | IP blocked after repeated failed logins | account.blocked |
- f, fp, fu, limit_wc and limit_mu keep the exact code in metadata.auth0_code.
- The actor is user_id with user_name as its name. ip and user_agent are stored as context.location and context.user_agent.
- org_id and org_name on an entry route it to that organization, created if new. Entries without one follow the org-less policy.
- du is not mapped: it coexists with sdu in Auth0's catalog and mapping both would double count. sdu is the record.
- s fires on every successful login and f, fp and fu on every failed one. Filter the stream with your monthly quota in mind.
DeliveryResponse codes and skip reasons
| Auth | The Authorization header must equal the token on the source, compared after trimming. |
|---|---|
| Success | 200 {"received": true, "accepted": n, "skipped": n} |
| Bad token | 401 invalid_authorization. Nothing in the batch is counted. |
| Batch | A JSON array of {log_id, data} entries; a single object is accepted too. Up to 1 MB per delivery and 64 KB per entry. |
| Retries | Each entry is deduplicated by its log_id. One transient failure fails the whole batch with 500; Auth0 replays it and entries that already landed are not stored twice. |
| Time | data.date becomes occurred_at. Missing or invalid falls back to the receive time. |