Getting Started

Overview

Auth0 is an identity platform for application authentication and authorization. With the Britive Access Broker, you can provision Auth0 application clients just-in-time: at checkout a broker Python script authenticates to the Auth0 Management API and creates a client; at checkin the broker deletes it. This avoids long-lived machine-to-machine clients sitting idle in your tenant.

What you’ll accomplish:

Authorize a broker machine-to-machine application against the Auth0 Management API
Create a checkout permission that provisions an Auth0 client
Verify the client is created at checkout and removed at checkin

Before You Begin

The Access Broker is deployed and connected
An Auth0 tenant and a Machine-to-Machine application authorized for the Auth0 Management API with create:clients and delete:clients scopes
Python 3.8+ on the broker host with the auth0-python and python-dotenv packages

Never hardcode the management client secret. Inject auth_domain, auth_client_id, and auth_client_secret as broker environment variables (the script reads them via os.getenv).

How It Works

The script obtains a Management API token via the OAuth2 client-credentials grant, then calls the Management API to create (checkout) or delete (checkin) an application client.

checkout → GetToken(client_credentials) → Auth0 Management API
         → clients.create({ name, description }) → return client_id / secret

checkin  → GetToken(client_credentials) → Auth0 Management API
         → clients.delete(client_id)

Checkout Routine

Full script: auth0/permissions/manageClient/checkout.py

Environment variables:

Variable	Notes
`auth_domain`	Auth0 tenant domain, e.g. `mycompany.us.auth0.com`
`auth_client_id`	Management API M2M application client ID
`auth_client_secret`	Management API M2M application client secret

Authenticate to the Management API and create a client:

auth0/permissions/manageClient/checkout.py

import os
from auth0.management import Auth0
from auth0.authentication import GetToken
from dotenv import load_dotenv

load_dotenv()
domain        = os.getenv("auth_domain")
client_id     = os.getenv("auth_client_id")
client_secret = os.getenv("auth_client_secret")

token = GetToken(domain, client_id, client_secret=client_secret) \
    .client_credentials(f"https://{domain}/api/v2/")
auth0 = Auth0(domain, token["access_token"])

new_client = auth0.clients.create({
    "name":        "New Application Client",
    "description": "JIT client provisioned by Britive",
})
print(new_client)   # surface client_id / client_secret via a response template

Capture new_client["client_id"] so the checkin routine can delete exactly the client it created — store it as part of the checkout output or in the broker’s resource state.

Checkin Routine

The checkin routine reuses the same Management API authentication and deletes the client created at checkout:

checkin.py

auth0.clients.delete(client_id)   # client_id captured at checkout

No standing application client remains in the Auth0 tenant after checkin.

Configure in Britive

Create a resource type

Go to Resource Manager → Resource Types → New Resource Type. Name it Auth0-Tenant.

Create a permission

Go to Resource Manager → Resource Type Permissions → New Permission. Set Language to Python.

Paste the checkout and checkin routines. Declare variables:

Variable	System defined	Notes
`auth_domain`	No	Auth0 tenant domain
`auth_client_id`	No	Management API M2M client ID
`auth_client_secret`	No	Management API M2M client secret

Attach a response template that surfaces the returned client_id and client_secret.

Create a profile and policy

Create a profile (e.g. expiration 1h), associate it with the Auth0 resource, add the permission, then add a policy assigning members (users or tags).

Install dependencies on the broker host and set environment variables:

pip install auth0-python python-dotenv

export auth_domain="mycompany.us.auth0.com"
export auth_client_id="<m2m-client-id>"
export auth_client_secret="<m2m-client-secret>"

python checkout.py

Verify

Check out the profile

Navigate to My Access → find the profile → Check Out. The new client ID and secret appear in the response.

Confirm the client exists

In the Auth0 dashboard, go to Applications → confirm the new application client is listed.

Check in

Return to My Access → Check In.

Confirm the client is removed

Refresh Applications in the Auth0 dashboard — the client provisioned at checkout is gone.

Troubleshoot

Symptom	Cause	Fix
`401 Unauthorized` getting a token	Wrong domain or M2M credentials	Verify `auth_domain`, `auth_client_id`, `auth_client_secret`; confirm the M2M app is authorized for the Management API
`403 insufficient_scope` on create	M2M app missing scopes	Grant `create:clients` (and `delete:clients` for checkin) to the M2M application
Client not removed at checkin	`client_id` not captured at checkout	Persist `new_client["client_id"]` from checkout and pass it to checkin
`ModuleNotFoundError: auth0`	SDK not installed on broker	`pip install auth0-python python-dotenv` on the broker host

Next Steps

Deploy the Access Broker if you haven’t already
Source: britive/access-broker-examples — auth0

Last updated on July 8, 2026