Auth0 Integration
Connect Auth0 to authenticate end users interacting with your Char AI widget. This guide covers creating an Auth0 application and configuring Char AI for token validation.Prerequisites
- An Auth0 account and tenant
- Admin access to create applications in Auth0
- Access to the Char AI dashboard
Quick Links
Auth0 Dashboard
Sign in to your Auth0 Dashboard
Auth0 Docs
Single-Page App Quickstarts
ID Token Claims
ID Token documentation
Auth0 SDK Reference
Auth0 SPA SDK
Configuration Steps
1
Create an Application in Auth0
- Sign in to the Auth0 Dashboard
- Navigate to Applications → Applications
- Click Create Application
- Configure the application:
| Setting | Value |
|---|---|
| Name | Char AI Widget (or your preferred name) |
| Application Type | Single Page Web Applications |
- Click Create
2
Configure Application Settings
In your application’s Settings tab, configure:
Scroll down and click Save Changes.
| Setting | Value |
|---|---|
| Allowed Callback URLs | Your application’s callback URL(s) |
| Allowed Logout URLs | Your application’s logout URL(s) |
| Allowed Web Origins | Your application’s origin(s) for silent auth |
3
Note Your Client ID and Domain
From the Settings tab, copy:
- Domain - Your Auth0 tenant domain (e.g.,
acme.auth0.com) - Client ID - Your application’s client ID

Find your Domain and Client ID in Auth0 application settings
4
Configure Char AI
In the Char AI Dashboard:
- Navigate to Settings → Integration
- Under SSO Configuration, select Auth0 as the provider
- Enter your Client ID from Step 3
- Enter your Domain (e.g.,
acme.auth0.com) - Click Test Connection to verify
- Click Save Changes
Configuration Reference
| Char AI Field | Auth0 Value | Example |
|---|---|---|
| Provider Type | Auth0 | auth0 |
| Client ID | Application Client ID | a1b2c3d4e5f6g7h8i9j0 |
| Domain | Auth0 tenant domain | acme.auth0.com |
Auth0 supports regional domains. Depending on your tenant’s region, your domain might be:
acme.auth0.com(US)acme.us.auth0.com(US regional)acme.eu.auth0.com(EU)acme.au.auth0.com(AU)
Token Requirements
Char AI validates Auth0 tokens with these requirements:| Claim | Requirement |
|---|---|
iss | Must match https://{your-domain}/ |
aud | Must include your configured Client ID |
sub | Required - used as the user identifier |
exp | Must not be expired |
Example: Obtaining and Passing the Token
- Auth0 SPA SDK
- React (Auth0 React SDK)
- Next.js (Auth0 Next.js SDK)
Custom Domains
If you’re using a custom domain with Auth0:- Configure your custom domain in Auth0 Dashboard → Settings → Custom Domains
- Update your Auth0 SDK to use the custom domain
- In Char AI, use your custom domain (e.g.,
auth.yourcompany.com) as the domain
When using custom domains, the issuer claim will use your custom domain URL.
Troubleshooting
INVALID_ISSUER error
INVALID_ISSUER error
The token issuer doesn’t match your configured domain:
- Verify the domain in Char matches your Auth0 tenant exactly
- Check if you’re using a regional domain (e.g.,
acme.us.auth0.com) - If using a custom domain, ensure it’s configured in Char
INVALID_AUDIENCE error
INVALID_AUDIENCE error
The token’s
aud claim doesn’t match your configured Client ID:- Ensure the Client ID matches your Auth0 application exactly
- Verify you’re using the ID token (from
getIdTokenClaims().__raw) - Check that your application type is “Single Page Web Applications”
JWKS_FETCH_FAILED error
JWKS_FETCH_FAILED error
Char AI couldn’t reach Auth0’s JWKS endpoint:
- Verify your Auth0 domain is correct
- Check that your tenant exists and is accessible
- Use Test Connection in the dashboard to verify
getIdTokenClaims returns undefined
getIdTokenClaims returns undefined
If you can’t get the ID token:
- Ensure the user has completed the login flow
- Check that
openidis included in your scopes - Verify your Allowed Callback URLs match your application
Auth0 Actions for Additional Claims
You can use Auth0 Actions to add custom claims to your tokens:Security Best Practices
- Enable MFA in Auth0 for enhanced security
- Configure password policies appropriate for your security requirements
- Use refresh token rotation for long-lived sessions
- Review and remove unused applications regularly
- Monitor Auth0 logs for suspicious activity
- Enable anomaly detection in Auth0 to block suspicious IPs

