> ## Documentation Index
> Fetch the complete documentation index at: https://docs.sazabi.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Auth0

> Create a Custom Webhook log stream in Auth0 pointed at your Sazabi intake URL to stream logins, failed logins, signups, MFA, password resets, attack protection blocks, and Management API calls.

[All Auth0 integration capabilities](https://docs.sazabi.com/catalogs/integrations/auth0)

## About

Stream your Auth0 tenant log events into Sazabi: logins and failed logins, signups, logouts, multi-factor authentication, password changes and resets, attack protection blocks such as brute-force lockouts (`limit_wc`), and Management API calls. Auth0 [Log Streams](https://auth0.com/docs/customize/log-streams) send each event to Sazabi over HTTPS as it happens, with at-least-once delivery. There is nothing to deploy.

Each event keeps its Auth0 event type code (for example `s` for a successful login, `f` for a failed login, `gd_auth_succeed` for an MFA success) in `auth0.type`. Successful events are recorded at `INFO`, failures at `WARN`, and attack protection blocks and leaked-password detections at `ERROR`. The event also carries `auth0.log_id`, `auth0.client_id`, `auth0.connection`, `auth0.user_id`, `auth0.user_name`, `auth0.tenant`, and the caller's IP address as `client.address`.

## Prerequisites

* An Auth0 tenant and a Dashboard role that can manage log streams. Auth0 limits the number of log streams per tenant by plan; if every slot is in use, remove an unused stream or upgrade before you start ([Auth0 pricing](https://auth0.com/pricing)).
* Your Sazabi intake URL (shown above).

## Set up in the dashboard

**Step 1**

### Open Log Streams

In the [Auth0 Dashboard](https://manage.auth0.com/#/log-streams), select your tenant, navigate to **Monitoring > Streams**, click **Create Log Stream**, and choose **Custom Webhook**.

**Step 2**

### Configure the webhook

Fill in the [Custom Webhook](https://auth0.com/docs/customize/log-streams/custom-log-streams) fields:

* **Name**: `Sazabi` (or a descriptive name for this destination)
* **Payload URL**: Paste your Sazabi intake URL (shown above)
* **Authorization Token**: Leave empty. The intake URL's hostname authenticates every delivery.
* **Content Type**: `application/json`
* **Content Format**: `JSON Lines` (`JSON Array` also works)
* **Filter by Event Category**: Leave every category selected to stream all tenant events, or narrow it with Auth0's [event filters](https://auth0.com/docs/customize/log-streams/event-filters).

**Step 3**

### Save

Click **Save**. Auth0 begins sending tenant log events to Sazabi immediately. To include earlier events that are still in your tenant's log retention, set **Starting Cursor** before saving.

## Set up with the CLI

You can also register the Auth0 log source with the [Sazabi CLI](https://docs.sazabi.com/reference/cli.md) (installed and authenticated — see [CLI reference](https://docs.sazabi.com/reference/cli/log-sources.md)).

Registering the source mints the same intake URL the dashboard shows above (the public key is embedded in its hostname):

```bash theme={"system"}
sazabi log-sources create auth0 --mode manual
```

The command prints the intake URL for the new source — copy the whole URL and paste it into the Custom Webhook's **Payload URL** field. Run `sazabi log-sources get <log-source-id>` at any time to reprint the endpoint, or `sazabi log-sources list` to see every log source in the project.

## Verify

Sign in to an application that uses the tenant, or fail a login with a wrong password. In the Auth0 Dashboard, open the stream's **Health** tab and confirm it is **Active** with no errors ([stream health](https://auth0.com/docs/customize/log-streams/check-log-stream-health)). Then open the [Intake page](https://docs.sazabi.com/guides/instrument/intake.md) in the Sazabi dashboard and confirm events from the **Auth0** source appear. Events typically arrive within a few minutes.

## Troubleshooting

**Stream health shows errors** — Confirm the **Payload URL** is exactly your Sazabi intake URL, with no added path or query string, and that **Authorization Token** is empty.

**Stream paused** — Auth0 pauses a stream after repeated delivery failures. Fix the URL, then resume the stream from its settings; Auth0 keeps queued events for your tenant's log retention window.

**No slot for a new stream** — Your tenant has reached its plan's log stream limit. Remove an unused stream or upgrade the plan.

## Further reading

> [card] [Intake](https://docs.sazabi.com/guides/instrument/intake.md)
>
> See per-source ingestion volume and health in the Intake page.

> [card] [Auth0 Log Streams](https://auth0.com/docs/customize/log-streams)
>
> Auth0's log stream documentation.

> [card] [Log sources](https://docs.sazabi.com/catalogs/log-sources.md)
>
> Browse the full log source catalog.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.