How to Integrate Retool with Auth0

Auth0's Management API uses M2M (Machine-to-Machine) tokens obtained via the client credentials grant — a server-to-server token exchange with no user login required. First, log in to your Auth0 Dashboard (manage.auth0.com) and navigate to Applications → Applications. Click Create Application. Enter a name like 'Retool Admin Integration'. Select Machine to Machine Applications as the application type and click Create. On the next screen, Auth0 asks you to authorize the application to access the Management API. Select Auth0 Management API from the API dropdown. Now select the scopes (permissions) this M2M application needs. For user management, select: read:users, update:users, create:users, delete:users, read:users_app_metadata, update:users_app_metadata. For roles: read:roles, create:roles, update:roles, delete:roles, read:role_members, create:role_members, delete:role_members. For logs: read:logs, read:logs_users. For blocking: read:user_idp_tokens, update:users (covers blocking). Click Authorize. You will be taken to the application settings page. Note down the Client ID and Client Secret from the Basic Information section. Also note your Domain (e.g., your-tenant.us.auth0.com) — this is the base URL for API calls. The M2M token endpoint is: https://YOUR_DOMAIN/oauth/token. You will use this to request access tokens.

Auth0 M2M tokens are obtained by posting to Auth0's token endpoint. Unlike OAuth 2.0 user-based flows, client credentials grant does not require a redirect URL or user interaction. The token request is a direct POST. In Retool, you have two options for token management: use a Retool Workflow to refresh tokens on a schedule and store in a Configuration Variable, or configure the REST API Resource with a JavaScript query that fetches a fresh token before each request. For simplicity, first create the resource with a static Bearer token, then implement refresh. To get your initial token, create a temporary JavaScript query in any Retool app: POST to https://YOUR_DOMAIN/oauth/token with body { 'client_id': 'YOUR_CLIENT_ID', 'client_secret': 'YOUR_CLIENT_SECRET', 'audience': 'https://YOUR_DOMAIN/api/v2/', 'grant_type': 'client_credentials' }. The response includes an 'access_token' JWT. Copy this token. Now, in Retool Resources, create a new REST API resource named 'Auth0 Management API'. Set Base URL to https://YOUR_DOMAIN/api/v2. Select Bearer Token authentication and paste the access token. Add default headers: Content-Type: application/json. Click Save. For production, create a Retool Workflow that runs every 12 hours to refresh the token and update a Configuration Variable, then reference that variable in the resource.

1// Token request configuration (use in a Retool JavaScript query or Workflow)
2// POST to https://YOUR_DOMAIN/oauth/token
3{
4  "client_id": "{{ retoolContext.configVars.AUTH0_CLIENT_ID }}",
5  "client_secret": "{{ retoolContext.configVars.AUTH0_CLIENT_SECRET }}",
6  "audience": "https://{{ retoolContext.configVars.AUTH0_DOMAIN }}/api/v2/",
7  "grant_type": "client_credentials"
8}

Auth0's Management API users endpoint supports Lucene query syntax for searching. Create a query named 'searchUsers'. Set Method to GET. Path to /users. Add URL parameters: q → {{ userSearchInput.value ? 'email:*' + userSearchInput.value + '*' : '' }}, search_engine → v3, per_page → {{ pagination.pageSize || 25 }}, page → {{ (pagination.page || 1) - 1 }} (Auth0 pages are 0-indexed), include_totals → true. Auth0's Lucene search supports: email:user@domain.com, name:John, identities.connection:google-oauth2, and combinations with AND/OR operators. Create a transformer to normalize the response. The include_totals:true parameter returns both an array of users and a total count in the response — handle both response shapes in the transformer. For common operations, create these additional queries: 'blockUser' — PATCH /users/{{ usersTable.selectedRow.user_id }}, body { 'blocked': true }. 'unblockUser' — PATCH /users/{{ usersTable.selectedRow.user_id }}, body { 'blocked': false }. 'getUserLogs' — GET /users/{{ usersTable.selectedRow.user_id }}/logs, with URL params: per_page=20, sort=date:-1.

1// Transformer: normalize Auth0 user search response
2const users = Array.isArray(data) ? data : (data.users || []);
3return users.map(user => ({
4  user_id: user.user_id,
5  email: user.email || '(no email)',
6  name: user.name || user.nickname || 'Unknown',
7  connection: user.identities?.[0]?.connection || 'Unknown',
8  last_login: user.last_login
9    ? new Date(user.last_login).toLocaleString()
10    : 'Never',
11  logins_count: user.logins_count || 0,
12  email_verified: user.email_verified ? 'Verified' : 'Unverified',
13  blocked: user.blocked ? 'Blocked' : 'Active',
14  created_at: new Date(user.created_at).toLocaleDateString()
15}));

With working queries, build the admin dashboard UI. Drag a Table component onto the canvas, name it 'usersTable', and set Data to {{ searchUsers.data }}. Configure columns to show: email, name, connection, last_login, email_verified, blocked (with color-coded tag — red for Blocked, green for Active). Add a Text Input above the table named 'userSearchInput' for the email search term, and a Button labeled 'Search' that triggers searchUsers on click. Also toggle searchUsers to run on app load. On the right side, add a detail Container that becomes visible when a row is selected (use conditional visibility: {{ usersTable.selectedRow !== null }}). Inside the Container, display user details using Text components bound to {{ usersTable.selectedRow.name }}, {{ usersTable.selectedRow.user_id }}, etc. Add action buttons: 'Block Account' (triggers blockUser, visible only when blocked is 'Active'), 'Unblock Account' (triggers unblockUser, visible when blocked is 'Blocked'), 'View Logs' (triggers getUserLogs and opens a Modal with a Log Table), 'Assign Role' (opens a Modal with a role selector Form). For role assignment, create a query 'getRoles' — GET /roles — to populate the role selector. Create a query 'assignRole' — POST /users/{{ usersTable.selectedRow.user_id }}/roles, body { 'roles': ['{{ roleSelect.value }}'] }. Add a confirmation modal to the Block action with text 'This will prevent {{ usersTable.selectedRow.email }} from logging in. Proceed?'

1// Query config for assigning roles to a user
2// POST /users/{user_id}/roles
3{
4  "roles": ["{{ roleSelect.value }}"]
5}

Auth0 tenant logs provide a comprehensive audit trail of authentication events. Create a query named 'getTenantLogs'. Set Method to GET, Path to /logs. Add URL parameters: per_page → {{ logsPagination.pageSize || 50 }}, page → {{ (logsPagination.page || 1) - 1 }}, include_totals → true, q → {{ logTypeFilter.value ? 'type:' + logTypeFilter.value : '' }}, sort → date:-1. Auth0 log event types include: 's' (success login), 'f' (failed login), 'fp' (failed login - wrong password), 'fu' (failed login - invalid user), 'slo' (logout), 'ss' (success signup), 'limit_wc' (brute force protection triggered), 'mfar' (MFA required), 'gd_auth_failed' (Guardian MFA failed). Add a Select component for filtering by log type with these common options as labeled choices. Add a transformer that maps raw log types to human-readable labels and extracts relevant fields. Create a Chart component showing login success vs failure counts over time using the log data grouped by date. This chart requires a JavaScript transformer that groups log entries by date and event type.

1// Transformer: reshape Auth0 logs for Table and Chart display
2const logs = data.logs || data || [];
3
4const TYPE_LABELS = {
5  's': 'Success Login', 'f': 'Failed Login', 'fp': 'Wrong Password',
6  'fu': 'Invalid User', 'slo': 'Logout', 'ss': 'Signup',
7  'limit_wc': 'Brute Force Blocked', 'mfar': 'MFA Required',
8  'gd_auth_failed': 'MFA Failed', 'sapi': 'API Operation'
9};
10
11return logs.map(log => ({
12  date: new Date(log.date).toLocaleString(),
13  type: TYPE_LABELS[log.type] || log.type,
14  user_name: log.user_name || log.details?.request?.body?.username || 'N/A',
15  ip: log.ip || 'N/A',
16  user_agent: log.user_agent?.split(' ')[0] || 'N/A',
17  description: log.description || '',
18  is_failure: ['f', 'fp', 'fu', 'limit_wc', 'gd_auth_failed'].includes(log.type)
19}));