ST-2026-184 · Authentication & identity
Auth0 changes the Management API default for new third-party applications on 23 October
On 23 October 2026, applicable legacy Auth0 tenants transition so that newly created third-party applications default to strict enhanced security when third_party_security_mode is omitted from POST /api/v2/clients.
Previous state
For eligible legacy tenants, Management API creation of a third-party application could default to permissive security mode when third_party_security_mode was omitted.
Current state
After the transition, eligible tenants creating a new third-party application through POST /api/v2/clients receive strict enhanced security by default when third_party_security_mode is omitted.
Affected users
Who needs to care
Auth0 tenants eligible for the Enhanced Security for Third-Party Applications migration whose automation creates new third-party applications through the Management API without explicitly setting third_party_security_mode.
Required response
What to do
Audit third-party application provisioning before 23 October, explicitly set the intended security mode where workflow compatibility requires it, and test new-application creation under the strict default.
Evidence boundary
What the source does not prove
Existing third-party applications remain unchanged. Auth0 continues to permit an explicit permissive setting through the Management API where supported; this event changes the default for new applications in applicable legacy tenants rather than universally removing permissive mode.
Lifecycle history
Dated event sequence
- Enhanced-security default transition
Applicable eligible tenants stop using the legacy permissive default for new third-party applications created without an explicit third_party_security_mode.
Evidence ledger
First-party sources
- 01Auth0 — Deprecations and migrations
Official Auth0 product-lifecycle documentation · 2026-07-23
Open official source ↗ - 02Auth0 — Migrate to Enhanced Security for Third-Party Applications
Official Auth0 migration guide · 2026-07-23
Open official source ↗