Skip to main content
All Auth0 integration capabilities

​
About

Stream your Auth0 tenant log events into Sazabi: logins and failed logins, signups, logouts, multi-factor authentication, password changes and resets, attack protection blocks such as brute-force lockouts (limit_wc), and Management API calls. Auth0 Log Streams send each event to Sazabi over HTTPS as it happens, with at-least-once delivery. There is nothing to deploy. Each event keeps its Auth0 event type code (for example s for a successful login, f for a failed login, gd_auth_succeed for an MFA success) in auth0.type. Successful events are recorded at INFO, failures at WARN, and attack protection blocks and leaked-password detections at ERROR. The event also carries auth0.log_id, auth0.client_id, auth0.connection, auth0.user_id, auth0.user_name, auth0.tenant, and the caller’s IP address as client.address.

​
Prerequisites

  • An Auth0 tenant and a Dashboard role that can manage log streams. Auth0 limits the number of log streams per tenant by plan; if every slot is in use, remove an unused stream or upgrade before you start (Auth0 pricing).
  • Your Sazabi intake URL (shown above).

​
Set up in the dashboard

1

​
Open Log Streams

In the Auth0 Dashboard, select your tenant, navigate to Monitoring > Streams, click Create Log Stream, and choose Custom Webhook.
2

​
Configure the webhook

Fill in the Custom Webhook fields:
  • Name: Sazabi (or a descriptive name for this destination)
  • Payload URL: Paste your Sazabi intake URL (shown above)
  • Authorization Token: Leave empty. The intake URL’s hostname authenticates every delivery.
  • Content Type: application/json
  • Content Format: JSON Lines (JSON Array also works)
  • Filter by Event Category: Leave every category selected to stream all tenant events, or narrow it with Auth0’s event filters.
3

​
Save

Click Save. Auth0 begins sending tenant log events to Sazabi immediately. To include earlier events that are still in your tenant’s log retention, set Starting Cursor before saving.

​
Set up with the CLI

You can also register the Auth0 log source with the Sazabi CLI (installed and authenticated — see CLI reference). Registering the source mints the same intake URL the dashboard shows above (the public key is embedded in its hostname):
The command prints the intake URL for the new source — copy the whole URL and paste it into the Custom Webhook’s Payload URL field. Run sazabi log-sources get <log-source-id> at any time to reprint the endpoint, or sazabi log-sources list to see every log source in the project.

​
Verify

Sign in to an application that uses the tenant, or fail a login with a wrong password. In the Auth0 Dashboard, open the stream’s Health tab and confirm it is Active with no errors (stream health). Then open the Intake page in the Sazabi dashboard and confirm events from the Auth0 source appear. Events typically arrive within a few minutes.

​
Troubleshooting

Stream health shows errors — Confirm the Payload URL is exactly your Sazabi intake URL, with no added path or query string, and that Authorization Token is empty. Stream paused — Auth0 pauses a stream after repeated delivery failures. Fix the URL, then resume the stream from its settings; Auth0 keeps queued events for your tenant’s log retention window. No slot for a new stream — Your tenant has reached its plan’s log stream limit. Remove an unused stream or upgrade the plan.

​
Further reading

Intake

See per-source ingestion volume and health in the Intake page.

Auth0 Log Streams

Auth0’s log stream documentation.

Log sources

Browse the full log source catalog.