Auth0

Log into your Auth0 Dashboard at manage.auth0.com. In the left sidebar, navigate to Applications → Applications and click 'Create Application'. Choose 'Machine to Machine Applications' as the application type — this is the correct type for server-to-server API access (as opposed to 'Single Page Application' or 'Regular Web Application' which are for user-facing login). Give it a descriptive name like 'Bubble Admin Integration'. After creation, you'll be prompted to authorize the application against an API. Select 'Auth0 Management API' from the dropdown. In the permissions section, select the minimum scopes your use-case requires: - read:users — search and view user profiles - update:users — block/unblock users, update metadata - read:logs — access audit log events - read:roles and create:role_members and delete:role_members — only if you need role assignment Click 'Authorize'. Then go to the application's Settings tab and copy the Client ID and Client Secret — you'll need both in the next step. Also note your Auth0 tenant domain (e.g., your-app.us.auth0.com) shown at the top of the Settings page.

Open your Bubble app editor and click the Plugins tab. Search for and install 'API Connector' by Bubble (free). Click 'API Connector' to open the configuration panel. First group — Auth0 Token Exchange: Click 'Add another API' and name it 'Auth0 Token'. Add a call: - Name: Get M2M Token - Method: POST - URL: https://YOUR_TENANT.auth0.com/oauth/token - Body type: JSON - Body content (as key-value params): - grant_type: client_credentials - client_id: your-client-id (mark as Private) - client_secret: your-client-secret (mark as Private — this is the most critical secret to protect) - audience: https://YOUR_TENANT.auth0.com/api/v2/ - Set 'Use as': Action (returns a token, not a list of records) Initialize this call — it should return access_token, token_type (Bearer), and expires_in (86400). Note the access_token value from the initialization — you'll need it temporarily. Second group — Auth0 Management API: Click 'Add another API' and name it 'Auth0 Mgmt'. Set the base URL to https://YOUR_TENANT.auth0.com/api/v2. Add a shared header: - Key: Authorization - Value: Bearer YOUR_ACCESS_TOKEN_FROM_INITIALIZATION - Mark as Private After initialization, you'll replace the hardcoded token value with a dynamic reference to a stored token field (explained in Step 3). For now, the hardcoded token lets you initialize and test calls.

1{
2  "group_1": {
3    "api_name": "Auth0 Token",
4    "call_name": "Get M2M Token",
5    "method": "POST",
6    "url": "https://YOUR_TENANT.auth0.com/oauth/token",
7    "body_type": "JSON",
8    "body": {
9      "grant_type": "client_credentials",
10      "client_id": "<private>",
11      "client_secret": "<private>",
12      "audience": "https://YOUR_TENANT.auth0.com/api/v2/"
13    }
14  },
15  "group_2": {
16    "api_name": "Auth0 Mgmt",
17    "base_url": "https://YOUR_TENANT.auth0.com/api/v2",
18    "shared_headers": [
19      {
20        "key": "Authorization",
21        "value": "Bearer <private_stored_token>",
22        "private": true
23      }
24    ]
25  }
26}

Auth0 M2M tokens expire after 86,400 seconds (24 hours). You need to store the token in a Bubble database field and set up an automatic refresh so your integration doesn't silently break overnight. In Bubble's Data tab, create a new data type called 'App Settings' (or use an existing settings type if you have one). Add a field: auth0_bearer_token (type: text). Add a second field: auth0_token_expires_at (type: date). Create a Bubble workflow that runs on page load or via a manual trigger to populate this field initially: 1. Action: API Connector — Auth0 Token — Get M2M Token 2. Action: Make changes to a Thing — find or create the App Settings record 3. Set auth0_bearer_token = result of step 1's access_token 4. Set auth0_token_expires_at = current date/time + 86400 seconds Now update the Auth0 Mgmt API Connector's Authorization header to use this dynamic value. In the API Connector configuration, change the Authorization header value from the hardcoded token to: Bearer [App Settings' auth0_bearer_token] — use Bubble's dynamic data expression to reference the stored field. Automated refresh (requires paid plan): In Settings → API, enable 'This app exposes a Workflow API'. Go to Backend Workflows and create a new Recurring Backend Workflow named 'refresh_auth0_token'. Set the interval to 20 hours (shorter than the 24-hour expiry to avoid edge cases). In this workflow: call 'Get M2M Token', then update the App Settings record with the new token and expiry time. Privacy: Set a privacy rule on the App Settings data type so that the auth0_bearer_token field is never exposed through Bubble's data API or the client-side. Only logged-in admins should be able to read this type.

In the Auth0 Mgmt API Connector group, add the core Management API calls: User Search call: - Name: Search Users - Method: GET - URL: https://YOUR_TENANT.auth0.com/api/v2/users - Use as: Data - Parameters: - q: text (dynamic) — the Lucene search query - search_engine: v3 (IMPORTANT — always pass this; without it, free tenants get severely limited results that look like the API is broken) - per_page: 25 - page: number (dynamic, 0-indexed in Auth0) Initialize with q=email:*a*&search_engine=v3&per_page=1. This should return at least one user. Auth0's user fields include user_id, name, email, blocked, created_at, last_login. Block/Unblock User call: - Name: Block User - Method: PATCH - URL: https://YOUR_TENANT.auth0.com/api/v2/users/[user_id] (dynamic path param) - Body type: JSON - Body: { "blocked": true } for block, or use a dynamic boolean param - Use as: Action In your Bubble UI, create a search input and Repeating Group showing user results. For page navigation (Auth0 is 0-indexed while Bubble pagination is 1-indexed): pass 'Current page - 1' as the page parameter to the Auth0 API call. Wire up a 'Block User' button with a confirmation dialog → API Connector action PATCH /users/{user_id} body {"blocked": true}. Add a 'Unblock' button with body {"blocked": false}. Refresh the Repeating Group's data source after each action to reflect the updated blocked status. Set up Privacy rules in Bubble's Data tab for any Things you create to store Auth0 user data — prevent public read access to user PII.

1{
2  "call_name": "Search Users",
3  "method": "GET",
4  "url": "https://YOUR_TENANT.auth0.com/api/v2/users",
5  "use_as": "Data",
6  "params": [
7    { "key": "q", "value": "<dynamic>", "initial": "email:*a*" },
8    { "key": "search_engine", "value": "v3" },
9    { "key": "per_page", "value": "25" },
10    { "key": "page", "value": "<dynamic>", "initial": "0" }
11  ]
12}
13
14{
15  "call_name": "Block User",
16  "method": "PATCH",
17  "url": "https://YOUR_TENANT.auth0.com/api/v2/users/<dynamic_user_id>",
18  "use_as": "Action",
19  "body_type": "JSON",
20  "body": { "blocked": "<dynamic_boolean>" }
21}

This step requires a paid Bubble plan (Starter $32/mo+) for Backend Workflows. If you only need the admin panel use-case, skip this step. In your Auth0 Dashboard, create a new 'Regular Web Application' (separate from the M2M application). Note its Client ID and Client Secret. In the application settings, add your Backend Workflow URL as an Allowed Callback URL: https://yourapp.bubbleapps.io/api/1.1/wf/auth0_callback In Bubble, go to Settings → API and enable 'This app exposes a Workflow API'. Create a new Backend Workflow named 'auth0_callback'. Enable 'This workflow can be run without authentication'. Add 'Detect request data' to capture the code and state query parameters. Add a second call to a new API Connector group 'Auth0 User Login': - Name: Exchange Login Code - Method: POST - URL: https://YOUR_TENANT.auth0.com/oauth/token - Body type: form-url-encoded (required for OIDC code exchange) - Body params: - grant_type: authorization_code - client_id: YOUR_WEB_APP_CLIENT_ID - client_secret: YOUR_WEB_APP_CLIENT_SECRET (mark Private) - code: {{code}} (dynamic) - redirect_uri: your Backend Workflow URL In the auth0_callback Backend Workflow: call 'Exchange Login Code' with the detected 'code' value. Parse the returned id_token or call GET /userinfo with the access_token to get the user's email, name, and sub (Auth0 user_id). Search for or create a Bubble User record with this email, store the Auth0 user_id in a custom field, and log the user in. For the login button on your Bubble frontend: add a 'Go to external website' workflow action with the URL: https://YOUR_TENANT.auth0.com/authorize?client_id={WEB_APP_CLIENT_ID}&response_type=code&scope=openid%20profile%20email&redirect_uri={YOUR_WORKFLOW_URL}&state={RANDOM_STRING} If you need help connecting RapidDev's team has built hundreds of Bubble apps with complex auth flows — free scoping call at rapidevelopers.com/contact.

1{
2  "call_name": "Exchange Login Code",
3  "method": "POST",
4  "url": "https://YOUR_TENANT.auth0.com/oauth/token",
5  "body_type": "form-url-encoded",
6  "body_params": [
7    { "key": "grant_type", "value": "authorization_code" },
8    { "key": "client_id", "value": "YOUR_WEB_APP_CLIENT_ID" },
9    { "key": "client_secret", "value": "<private>" },
10    { "key": "code", "value": "<dynamic>" },
11    { "key": "redirect_uri", "value": "https://yourapp.bubbleapps.io/api/1.1/wf/auth0_callback" }
12  ]
13}
14
15Auth0 Authorization URL:
16https://YOUR_TENANT.auth0.com/authorize
17  ?client_id={WEB_APP_CLIENT_ID}
18  &response_type=code
19  &scope=openid%20profile%20email
20  &redirect_uri={YOUR_BACKEND_WORKFLOW_URL}
21  &state={RANDOM_STATE_STRING}