You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
Commit e0e4823
Browse filesBrowse the repository at this point in the historyBrowse files
feat: add organization flags to auth0 apps create and update (#1690)
* feat: add organization flags to auth0 apps create and update
Add --organization-usage, --organization-require-behavior, and
--organization-discovery-methods to auth0 apps create and update,
so an application's organization behavior can be configured without
dropping to the raw api command. The flags are additive and follow
the existing optional-flag pattern: create sets each when provided,
update only sends a field when its flag is set so unset flags never
clobber existing values.
* test: cover organization flags and enforce discovery-methods dependency
Add table-driven tests for the organization flag mapping on apps create
and update, and validate client-side that --organization-discovery-methods
is only used with --organization-require-behavior=pre_login_prompt so a
misconfiguration returns an actionable error instead of a server 400.
Gate the create org fields on flag presence to match update.
* fix: align apps organization flag validation with the API
- Drop the client-side organization-require-behavior requires organization-usage=require
check; the Management API accepts any usage, or none, alongside any require behavior
- Keep the one real cross-field rule: organization-discovery-methods requires
organization-require-behavior=pre_login_prompt
- Strip empty organization-discovery-methods entries before sending
- Run organization flag validation before the network read and interactive prompts
- Render organization fields in apps show output
- Update require-behavior help text and regenerate docs
-p, --allow-any-profile-of-type strings Comma-separated list of enabled token exchange types for this client. Possible values: custom_authentication, on_behalf_of_token_exchange.
54
-
-a, --auth-method string Defines the requested authentication method for the token endpoint. Possible values are 'None' (public application without a client secret), 'Post' (application uses HTTP POST parameters) or 'Basic' (application uses HTTP Basic).
55
-
-c, --callbacks strings After the user authenticates we will only call back to any of these URLs. You can specify multiple valid URLs by comma-separating them (typically to handle different environments like QA or testing). Make sure to specify the protocol (https://) otherwise the callback may fail in some cases. With the exception of custom URI schemes for native apps, all callbacks should use protocol https://.
56
-
--data string JSON payload for the operation, as a JSON string or file path (@file.json). Can also be piped via stdin.
57
-
-d, --description string Description of the application. Max character count is 140.
58
-
-g, --grants strings List of grant types supported for this application. Can include code, implicit, refresh-token, credentials, password, password-realm, mfa-oob, mfa-otp, mfa-recovery-code, and device-code.
59
-
-f, --is-first-party Whether the application is a first-party client (true) or third-party client (false). (default true)
60
-
--json Output in json format.
61
-
--json-compact Output in compact json format.
62
-
-l, --logout-urls strings Comma-separated list of URLs that are valid to redirect to after logout from Auth0. Wildcards are allowed for subdomains.
63
-
--metadata stringToString Arbitrary keys-value pairs (max 255 characters each), that can be assigned to each application. More about application metadata: https://auth0.com/docs/get-started/applications/configure-application-metadata (default [])
64
-
-n, --name string Name of the application.
65
-
-o, --origins strings Comma-separated list of URLs allowed to make requests from JavaScript to Auth0 API (typically used with CORS). By default, all your callback URLs will be allowed. This field allows you to enter other origins if necessary. You can also use wildcards at the subdomain level (e.g., https://*.contoso.com). Query strings and hash information are not taken into account when validating these URLs.
66
-
-y, --redirection-policy string Controls whether Auth0 redirects users to the application's callback URL on authentication errors or in email verification flows: 'allow_always' or 'open_redirect_protection'. Require --is-first-party=false
67
-
-z, --refresh-token string Refresh Token Config for the application, formatted as JSON.
68
-
--resource-server-identifier string The identifier of the resource server that this client is associated with. This property can only be sent when app_type=resource_server and cannot be changed once the client is created.
69
-
-r, --reveal-secrets Display the application secrets ('signing_keys', 'client_secret') as part of the command output.
70
-
--schema Print the request payload schema for this command and exit. Use with --json or --json-compact for machine-readable output.
71
-
-s, --third-party-security-mode string Security mode for third-party clients: 'strict' or 'permissive'. Require --is-first-party=false
- spa (single page application): a JavaScript front-end app that uses an API.
75
-
- regular: Traditional web app using redirects.
76
-
- m2m (machine to machine): CLIs, daemons or services running on your backend.
77
-
-w, --web-origins strings Comma-separated list of allowed origins for use with Cross-Origin Authentication, Device Flow, and web message response mode.
54
+
-p, --allow-any-profile-of-type strings Comma-separated list of enabled token exchange types for this client. Possible values: custom_authentication, on_behalf_of_token_exchange.
55
+
-a, --auth-method string Defines the requested authentication method for the token endpoint. Possible values are 'None' (public application without a client secret), 'Post' (application uses HTTP POST parameters) or 'Basic' (application uses HTTP Basic).
56
+
-c, --callbacks strings After the user authenticates we will only call back to any of these URLs. You can specify multiple valid URLs by comma-separating them (typically to handle different environments like QA or testing). Make sure to specify the protocol (https://) otherwise the callback may fail in some cases. With the exception of custom URI schemes for native apps, all callbacks should use protocol https://.
57
+
--data string JSON payload for the operation, as a JSON string or file path (@file.json). Can also be piped via stdin.
58
+
-d, --description string Description of the application. Max character count is 140.
59
+
-g, --grants strings List of grant types supported for this application. Can include code, implicit, refresh-token, credentials, password, password-realm, mfa-oob, mfa-otp, mfa-recovery-code, and device-code.
60
+
-f, --is-first-party Whether the application is a first-party client (true) or third-party client (false). (default true)
61
+
--json Output in json format.
62
+
--json-compact Output in compact json format.
63
+
-l, --logout-urls strings Comma-separated list of URLs that are valid to redirect to after logout from Auth0. Wildcards are allowed for subdomains.
64
+
--metadata stringToString Arbitrary keys-value pairs (max 255 characters each), that can be assigned to each application. More about application metadata: https://auth0.com/docs/get-started/applications/configure-application-metadata (default [])
65
+
-n, --name string Name of the application.
66
+
--organization-discovery-methods strings Comma-separated list of methods for discovering organizations during the 'pre_login_prompt'. Possible values: 'email', 'organization_name'. Requires --organization-require-behavior=pre_login_prompt.
67
+
--organization-require-behavior string How to prompt for an organization at authentication: 'no_prompt', 'pre_login_prompt', or 'post_login_prompt'. 'post_login_prompt' requires an OIDC-conformant application.
68
+
--organization-usage string How the application handles organizations at authentication: 'deny', 'allow', or 'require'.
69
+
-o, --origins strings Comma-separated list of URLs allowed to make requests from JavaScript to Auth0 API (typically used with CORS). By default, all your callback URLs will be allowed. This field allows you to enter other origins if necessary. You can also use wildcards at the subdomain level (e.g., https://*.contoso.com). Query strings and hash information are not taken into account when validating these URLs.
70
+
-y, --redirection-policy string Controls whether Auth0 redirects users to the application's callback URL on authentication errors or in email verification flows: 'allow_always' or 'open_redirect_protection'. Require --is-first-party=false
71
+
-z, --refresh-token string Refresh Token Config for the application, formatted as JSON.
72
+
--resource-server-identifier string The identifier of the resource server that this client is associated with. This property can only be sent when app_type=resource_server and cannot be changed once the client is created.
73
+
-r, --reveal-secrets Display the application secrets ('signing_keys', 'client_secret') as part of the command output.
74
+
--schema Print the request payload schema for this command and exit. Use with --json or --json-compact for machine-readable output.
75
+
-s, --third-party-security-mode string Security mode for third-party clients: 'strict' or 'permissive'. Require --is-first-party=false
- spa (single page application): a JavaScript front-end app that uses an API.
79
+
- regular: Traditional web app using redirects.
80
+
- m2m (machine to machine): CLIs, daemons or services running on your backend.
81
+
-w, --web-origins strings Comma-separated list of allowed origins for use with Cross-Origin Authentication, Device Flow, and web message response mode.
-p, --allow-any-profile-of-type strings Comma-separated list of enabled token exchange types for this client. Possible values: custom_authentication, on_behalf_of_token_exchange.
53
-
-a, --auth-method string Defines the requested authentication method for the token endpoint. Possible values are 'None' (public application without a client secret), 'Post' (application uses HTTP POST parameters) or 'Basic' (application uses HTTP Basic).
54
-
-c, --callbacks strings After the user authenticates we will only call back to any of these URLs. You can specify multiple valid URLs by comma-separating them (typically to handle different environments like QA or testing). Make sure to specify the protocol (https://) otherwise the callback may fail in some cases. With the exception of custom URI schemes for native apps, all callbacks should use protocol https://.
55
-
--data string JSON payload for the operation, as a JSON string or file path (@file.json). Can also be piped via stdin.
56
-
-d, --description string Description of the application. Max character count is 140.
57
-
-g, --grants strings List of grant types supported for this application. Can include code, implicit, refresh-token, credentials, password, password-realm, mfa-oob, mfa-otp, mfa-recovery-code, and device-code.
58
-
-f, --is-first-party Whether the application is a first-party client (true) or third-party client (false). (default true)
59
-
--json Output in json format.
60
-
--json-compact Output in compact json format.
61
-
-l, --logout-urls strings Comma-separated list of URLs that are valid to redirect to after logout from Auth0. Wildcards are allowed for subdomains.
62
-
--metadata stringToString Arbitrary keys-value pairs (max 255 characters each), that can be assigned to each application. More about application metadata: https://auth0.com/docs/get-started/applications/configure-application-metadata (default [])
63
-
-n, --name string Name of the application.
64
-
-o, --origins strings Comma-separated list of URLs allowed to make requests from JavaScript to Auth0 API (typically used with CORS). By default, all your callback URLs will be allowed. This field allows you to enter other origins if necessary. You can also use wildcards at the subdomain level (e.g., https://*.contoso.com). Query strings and hash information are not taken into account when validating these URLs.
65
-
-y, --redirection-policy string Controls whether Auth0 redirects users to the application's callback URL on authentication errors or in email verification flows: 'allow_always' or 'open_redirect_protection'. Require --is-first-party=false
66
-
-z, --refresh-token string Refresh Token Config for the application, formatted as JSON.
67
-
-r, --reveal-secrets Display the application secrets ('signing_keys', 'client_secret') as part of the command output.
68
-
--schema Print the request payload schema for this command and exit. Use with --json or --json-compact for machine-readable output.
69
-
-s, --third-party-security-mode string Security mode for third-party clients: 'strict' or 'permissive'. Require --is-first-party=false
- spa (single page application): a JavaScript front-end app that uses an API.
73
-
- regular: Traditional web app using redirects.
74
-
- m2m (machine to machine): CLIs, daemons or services running on your backend.
75
-
-w, --web-origins strings Comma-separated list of allowed origins for use with Cross-Origin Authentication, Device Flow, and web message response mode.
53
+
-p, --allow-any-profile-of-type strings Comma-separated list of enabled token exchange types for this client. Possible values: custom_authentication, on_behalf_of_token_exchange.
54
+
-a, --auth-method string Defines the requested authentication method for the token endpoint. Possible values are 'None' (public application without a client secret), 'Post' (application uses HTTP POST parameters) or 'Basic' (application uses HTTP Basic).
55
+
-c, --callbacks strings After the user authenticates we will only call back to any of these URLs. You can specify multiple valid URLs by comma-separating them (typically to handle different environments like QA or testing). Make sure to specify the protocol (https://) otherwise the callback may fail in some cases. With the exception of custom URI schemes for native apps, all callbacks should use protocol https://.
56
+
--data string JSON payload for the operation, as a JSON string or file path (@file.json). Can also be piped via stdin.
57
+
-d, --description string Description of the application. Max character count is 140.
58
+
-g, --grants strings List of grant types supported for this application. Can include code, implicit, refresh-token, credentials, password, password-realm, mfa-oob, mfa-otp, mfa-recovery-code, and device-code.
59
+
-f, --is-first-party Whether the application is a first-party client (true) or third-party client (false). (default true)
60
+
--json Output in json format.
61
+
--json-compact Output in compact json format.
62
+
-l, --logout-urls strings Comma-separated list of URLs that are valid to redirect to after logout from Auth0. Wildcards are allowed for subdomains.
63
+
--metadata stringToString Arbitrary keys-value pairs (max 255 characters each), that can be assigned to each application. More about application metadata: https://auth0.com/docs/get-started/applications/configure-application-metadata (default [])
64
+
-n, --name string Name of the application.
65
+
--organization-discovery-methods strings Comma-separated list of methods for discovering organizations during the 'pre_login_prompt'. Possible values: 'email', 'organization_name'. Requires --organization-require-behavior=pre_login_prompt.
66
+
--organization-require-behavior string How to prompt for an organization at authentication: 'no_prompt', 'pre_login_prompt', or 'post_login_prompt'. 'post_login_prompt' requires an OIDC-conformant application.
67
+
--organization-usage string How the application handles organizations at authentication: 'deny', 'allow', or 'require'.
68
+
-o, --origins strings Comma-separated list of URLs allowed to make requests from JavaScript to Auth0 API (typically used with CORS). By default, all your callback URLs will be allowed. This field allows you to enter other origins if necessary. You can also use wildcards at the subdomain level (e.g., https://*.contoso.com). Query strings and hash information are not taken into account when validating these URLs.
69
+
-y, --redirection-policy string Controls whether Auth0 redirects users to the application's callback URL on authentication errors or in email verification flows: 'allow_always' or 'open_redirect_protection'. Require --is-first-party=false
70
+
-z, --refresh-token string Refresh Token Config for the application, formatted as JSON.
71
+
-r, --reveal-secrets Display the application secrets ('signing_keys', 'client_secret') as part of the command output.
72
+
--schema Print the request payload schema for this command and exit. Use with --json or --json-compact for machine-readable output.
73
+
-s, --third-party-security-mode string Security mode for third-party clients: 'strict' or 'permissive'. Require --is-first-party=false
- spa (single page application): a JavaScript front-end app that uses an API.
77
+
- regular: Traditional web app using redirects.
78
+
- m2m (machine to machine): CLIs, daemons or services running on your backend.
79
+
-w, --web-origins strings Comma-separated list of allowed origins for use with Cross-Origin Authentication, Device Flow, and web message response mode.
0 commit comments