How to Integrate Replit with Auth0

Before writing any code, you need to create an Auth0 application and configure it with your Replit deployment URL. Log into your Auth0 dashboard at manage.auth0.com. In the left sidebar, click 'Applications' → 'Applications' → 'Create Application'. Give it a name (e.g., 'My Replit App'), select 'Regular Web Application' as the type, and click 'Create'. On the application's Settings tab, you will see your Domain, Client ID, and Client Secret — you will need all three. Scroll down to the 'Application URIs' section. This is the critical configuration area for Replit integration. In 'Allowed Callback URLs', enter your deployment URL with the callback path: https://yourapp.replit.app/callback. If you are testing locally during development, you can also add http://localhost:3000/callback separated by a comma — but you must include the production deployment URL because development mode Replit URLs change and go offline when you close the editor. In 'Allowed Logout URLs', enter: https://yourapp.replit.app. This is where Auth0 redirects after logout. In 'Allowed Web Origins', enter: https://yourapp.replit.app. This allows CORS for token requests from your domain. Click 'Save Changes'. Your Auth0 application is now configured. Make note of your Domain (looks like dev-abc123.us.auth0.com), Client ID (a long alphanumeric string), and Client Secret (click to reveal).

Auth0 credentials — particularly the Client Secret — are sensitive values that must never appear in your code or be committed to version control. The Client Secret proves to Auth0 that the callback is coming from your legitimate application, not an attacker trying to hijack the OAuth flow. Open your Repl and click the lock icon (🔒) in the left sidebar to open the Secrets pane. Add the following secrets one by one, clicking 'Add Secret' after each: AUTH0_SECRET: A random 32+ character string used to encrypt Auth0 session cookies. Generate one by running in Shell: node -e "console.log(require('crypto').randomBytes(32).toString('hex'))". Paste the output as the value. AUTH0_BASE_URL: Your full deployment URL, e.g., https://yourapp.replit.app. This must match exactly what you configured as the Allowed Callback base URL in Auth0. AUTH0_ISSUER_BASE_URL: Your Auth0 domain with https://, e.g., https://dev-abc123.us.auth0.com. AUTH0_CLIENT_ID: Your application's Client ID from Auth0 dashboard. AUTH0_CLIENT_SECRET: Your application's Client Secret from Auth0 dashboard. With all five secrets in place, your code will read them using process.env.AUTH0_SECRET etc. — no credentials ever appear in source code.

1// Verify all required secrets are present before starting the server
2const required = [
3  'AUTH0_SECRET',
4  'AUTH0_BASE_URL', 
5  'AUTH0_ISSUER_BASE_URL',
6  'AUTH0_CLIENT_ID',
7  'AUTH0_CLIENT_SECRET'
8];
9
10for (const key of required) {
11  if (!process.env[key]) {
12    throw new Error(`Missing required secret: ${key}. Add it in Replit Secrets (lock icon).`);
13  }
14}
15console.log('All Auth0 secrets verified.');

Auth0 provides the express-openid-connect package — a middleware that handles the entire OAuth 2.0 / OpenID Connect flow. It adds /login, /logout, and /callback routes automatically and provides a requiresAuth() middleware to protect any route. Install the package: in Shell, run npm install express express-openid-connect. The express-openid-connect package reads your Auth0 configuration from environment variables automatically when you pass them in the auth() call. The middleware flow: when a user visits a protected route, they are automatically redirected to Auth0's hosted login page. After successful authentication, Auth0 redirects to /callback with an authorization code. The middleware exchanges the code for tokens, creates an encrypted session cookie, and redirects the user to their original destination. The entire OAuth dance happens inside the middleware — you do not write any of this logic yourself. The req.oidc.user object contains the user's profile: sub (unique ID), name, email, email_verified, and any custom claims you configure in Auth0 Actions. Store this in your database if you need to associate user data beyond what the token provides. For production deployment, ensure your server binds to 0.0.0.0 and the AUTH0_BASE_URL exactly matches your deployed app URL. Any mismatch between the callback URL in code and the URL registered in Auth0 results in an 'Invalid callback URL' error.

1// server.js — Express + Auth0 on Replit
2const express = require('express');
3const { auth, requiresAuth } = require('express-openid-connect');
4
5const app = express();
6
7// Auth0 middleware — reads from environment variables
8app.use(auth({
9  authRequired: false,  // Set to true to require login for all routes
10  auth0Logout: true,
11  secret: process.env.AUTH0_SECRET,
12  baseURL: process.env.AUTH0_BASE_URL,
13  clientID: process.env.AUTH0_CLIENT_ID,
14  issuerBaseURL: process.env.AUTH0_ISSUER_BASE_URL,
15  clientSecret: process.env.AUTH0_CLIENT_SECRET,
16  authorizationParams: {
17    response_type: 'code',
18    scope: 'openid profile email',  // Request basic profile + email
19  }
20}));
21
22// Public route — anyone can access
23app.get('/', (req, res) => {
24  const isLoggedIn = req.oidc.isAuthenticated();
25  if (isLoggedIn) {
26    res.send(`Hello, ${req.oidc.user.name}! <a href="/profile">Profile</a> | <a href="/logout">Logout</a>`);
27  } else {
28    res.send('Welcome! <a href="/login">Login with Auth0</a>');
29  }
30});
31
32// Protected route — requires authentication
33app.get('/profile', requiresAuth(), (req, res) => {
34  const user = req.oidc.user;
35  res.json({
36    sub: user.sub,         // Unique user ID
37    name: user.name,
38    email: user.email,
39    email_verified: user.email_verified,
40    picture: user.picture
41  });
42});
43
44// Protected API endpoint — returns user-specific data
45app.get('/api/dashboard', requiresAuth(), (req, res) => {
46  res.json({
47    message: 'This is protected data',
48    userId: req.oidc.user.sub,
49    timestamp: new Date().toISOString()
50  });
51});
52
53// Auth0 handles /login, /logout, and /callback routes automatically
54// No need to define them — express-openid-connect adds them for you
55
56app.listen(3000, '0.0.0.0', () => {
57  console.log('Server running on port 3000');
58  console.log('Auth0 domain:', process.env.AUTH0_ISSUER_BASE_URL);
59});

For Python Replit projects, Auth0 authentication uses Authlib — a comprehensive OAuth/OpenID Connect library — combined with Flask. The pattern is similar to the Node.js approach but requires slightly more explicit setup for the session and OAuth flow. Install dependencies: pip install flask authlib requests python-dotenv in the Shell tab. Authlib handles all OAuth 2.0 token exchange logic; you register Auth0 as an OAuth provider and let the library manage the redirect flow. The Flask session is used to store the user's ID token between requests. Set a strong Flask SECRET_KEY (different from AUTH0_SECRET — this encrypts Flask's session cookie). Use Flask's session.clear() on logout to remove the stored token. For token validation, Authlib's parse_id_token() method verifies the JWT signature against Auth0's public keys, checks the expiry, and validates the audience claim. This ensures you are processing legitimate tokens from your Auth0 application, not forged tokens. In production, add Flask-Login or a similar session management library for more robust user session handling. For APIs that receive Bearer tokens from a separate frontend, use Auth0's JWKS endpoint to validate tokens on each request without maintaining sessions.

1# app.py — Flask + Auth0 (Authlib) on Replit
2from flask import Flask, redirect, url_for, session, request, jsonify
3from authlib.integrations.flask_client import OAuth
4import os
5
6app = Flask(__name__)
7app.secret_key = os.environ['AUTH0_SECRET']  # Encrypts Flask session cookie
8
9oauth = OAuth(app)
10
11# Register Auth0 as an OAuth provider
12auth0 = oauth.register(
13    'auth0',
14    client_id=os.environ['AUTH0_CLIENT_ID'],
15    client_secret=os.environ['AUTH0_CLIENT_SECRET'],
16    client_kwargs={'scope': 'openid profile email'},
17    server_metadata_url=f"https://{os.environ['AUTH0_DOMAIN']}/.well-known/openid-configuration"
18)
19
20@app.route('/')
21def index():
22    user = session.get('user')
23    if user:
24        return f'Hello, {user["name"]}! <a href="/profile">Profile</a> | <a href="/logout">Logout</a>'
25    return 'Welcome! <a href="/login">Login with Auth0</a>'
26
27@app.route('/login')
28def login():
29    callback_url = os.environ['AUTH0_BASE_URL'] + '/callback'
30    return auth0.authorize_redirect(redirect_uri=callback_url)
31
32@app.route('/callback')
33def callback():
34    token = auth0.authorize_access_token()
35    # Parse and verify the ID token
36    user_info = token.get('userinfo')
37    session['user'] = {
38        'sub': user_info['sub'],
39        'name': user_info.get('name'),
40        'email': user_info.get('email'),
41        'picture': user_info.get('picture')
42    }
43    return redirect('/')
44
45@app.route('/profile')
46def profile():
47    user = session.get('user')
48    if not user:
49        return redirect('/login')
50    return jsonify(user)
51
52@app.route('/logout')
53def logout():
54    session.clear()
55    domain = os.environ['AUTH0_DOMAIN']
56    client_id = os.environ['AUTH0_CLIENT_ID']
57    return_to = os.environ['AUTH0_BASE_URL']
58    # Redirect to Auth0 logout endpoint, then back to your app
59    return redirect(f'https://{domain}/v2/logout?client_id={client_id}&returnTo={return_to}')
60
61if __name__ == '__main__':
62    app.run(host='0.0.0.0', port=3000)

One of Auth0's biggest advantages is enabling multiple login providers with configuration changes in the dashboard — no code changes required. In your Auth0 dashboard, go to 'Authentication' → 'Social' to see the list of available social providers. Google, GitHub, LinkedIn, Microsoft, Apple, and 30+ others are available. Click any provider to enable it and configure your OAuth credentials (you need to create OAuth apps in each provider's developer console and enter the credentials in Auth0). For Google: go to console.cloud.google.com, create a project, enable the Google+ API, create OAuth 2.0 credentials, and add your Auth0 callback URL as an authorized redirect URI. The Auth0 callback URL for social connections is: https://yourauth0domain.auth0.com/login/callback. Copy the Google client ID and secret into Auth0's Google connection settings. For role-based access control, go to Auth0 dashboard → 'User Management' → 'Roles'. Create roles like 'admin', 'editor', 'viewer'. Go to your application → 'API' tab, create an API with your app's URL as the identifier. Under Permissions, add permissions like 'read:data', 'write:data'. Assign roles to users in the Users section. To include roles in tokens, create an Auth0 Action. Go to 'Actions' → 'Flows' → 'Login' → drag 'Add Roles to Token' from the sidebar or create a custom Action that adds roles to the access token. In your backend, validate the token and check for required roles before allowing access to protected endpoints.

1// server.js additions — Check Auth0 roles in JWT
2const { auth, requiresAuth, claimCheck } = require('express-openid-connect');
3const { expressjwt: jwt } = require('express-jwt');
4const jwks = require('jwks-rsa');
5
6// Middleware to validate Auth0 access tokens (for API routes)
7const checkJwt = jwt({
8  secret: jwks.expressJwtSecret({
9    cache: true,
10    rateLimit: true,
11    jwksUri: `${process.env.AUTH0_ISSUER_BASE_URL}/.well-known/jwks.json`
12  }),
13  audience: process.env.AUTH0_AUDIENCE,  // Your Auth0 API identifier
14  issuer: `${process.env.AUTH0_ISSUER_BASE_URL}/`,
15  algorithms: ['RS256']
16});
17
18// Check for specific permission in token
19function checkPermission(permission) {
20  return (req, res, next) => {
21    const permissions = req.auth?.permissions || [];
22    if (!permissions.includes(permission)) {
23      return res.status(403).json({ error: 'Insufficient permissions' });
24    }
25    next();
26  };
27}
28
29// Protected API route requiring a specific permission
30app.get('/api/admin', checkJwt, checkPermission('write:data'), (req, res) => {
31  res.json({ message: 'Admin access granted', userId: req.auth.sub });
32});