Auth0 Management API Static IP Allowlist With Tenant ACL

Auth0 Tenant Access Control List is the native request-level control for this setup. QuotaGuard gives your application two stable source IPs. Auth0 checks that pair before it accepts covered Management API or SCIM requests.

A Credentials Exchange Action can add a separate check before Auth0 issues a machine-to-machine token. It doesn't replace Tenant ACL, and it doesn't inspect every later API request that uses the token.

Auth0 Tenant ACL Enforces the Static IP Pair

Auth0's management scope covers requests to /api/v2/* and /scim/*. The connecting_ipv4_cidrs signal is designed for infrastructure that connects directly to the Auth0 edge, including a proxy or VPN. That makes it the right signal for the two QuotaGuard egress IPs.

Auth0 currently allows one Tenant ACL on Enterprise. Enterprise with the Attack Protection add-on supports up to 10 ACLs. Each ACL supports up to 20 entries per source identifier. See the current Tenant ACL limits before changing an existing policy set.

The final enforcement rule follows Auth0's documented infrastructure-control pattern. Replace the two documentation addresses with both IPv4 addresses shown for the applicable QuotaGuard subscription:

{
  "description": "Block Management API requests outside QuotaGuard",
  "active": true,
  "priority": 10,
  "rule": {
    "action": {
      "block": true
    },
    "not_match": {
      "connecting_ipv4_cidrs": [
        "203.0.113.10/32",
        "203.0.113.11/32"
      ]
    },
    "scope": "management"
  }
}

Auth0 also supports a log action for monitoring without enforcement. Start there if the tenant already has production callers. Confirm every approved client uses the QuotaGuard path. Then change the action to block. Coordinate the priority with any existing Tenant ACL rules.

The Auth0 Management API token used to create or update this rule needs the appropriate network ACL permissions. Auth0's Tenant ACL use cases show the current Management API, SDK, CLI, and Terraform formats.

QuotaGuard Gives Auth0 Calls a Stable Source in 2 Minutes

Every QuotaGuard subscription includes two load-balanced static IPv4 addresses. Add both to Auth0. A request can leave through either address, so allowing only one creates an avoidable failover problem.

Install Axios and the Axios-compatible HTTPS proxy agent:

npm install axios https-proxy-agent

Store the proxy URL and Auth0 credentials in environment variables. Don't commit these values:

QUOTAGUARDSTATIC_URL="http://username:password@us-east-static-01.quotaguard.com:9293"
AUTH0_DOMAIN="YOUR_TENANT.us.auth0.com"
AUTH0_CLIENT_ID="replace-with-your-client-id"
AUTH0_CLIENT_SECRET="replace-with-your-client-secret"

The example host is region-specific. Choose the QuotaGuard region closest to Auth0 when signing up. Changing regions later requires contacting QuotaGuard support.

The Same Proxy Handles the Token and Management API Requests

The code below checks the source IP, requests a production Management API token, and makes a narrow read request. It sends all three HTTPS calls through the same Axios agent.

Authorize the machine-to-machine application for the Auth0 Management API first. The https://YOUR_TENANT.us.auth0.com/api/v2/ value is the audience. Permissions such as read:users determine which operations the token may perform.

const axios = require("axios");
const { HttpsProxyAgent } = require("https-proxy-agent");

const httpsAgent = new HttpsProxyAgent(
  process.env.QUOTAGUARDSTATIC_URL
);

async function main() {
  const domain = process.env.AUTH0_DOMAIN;
  const audience = `https://${domain}/api/v2/`;

  const egressResponse = await axios.get(
    "https://ip.quotaguard.com",
    {
      httpsAgent,
      proxy: false,
    }
  );

  console.log(
    "QuotaGuard egress IP:",
    String(egressResponse.data).trim()
  );

  const tokenResponse = await axios.post(
    `https://${domain}/oauth/token`,
    new URLSearchParams({
      grant_type: "client_credentials",
      client_id: process.env.AUTH0_CLIENT_ID,
      client_secret: process.env.AUTH0_CLIENT_SECRET,
      audience,
    }).toString(),
    {
      httpsAgent,
      proxy: false,
      headers: {
        "content-type": "application/x-www-form-urlencoded",
      },
    }
  );

  const usersResponse = await axios.get(
    `https://${domain}/api/v2/users`,
    {
      httpsAgent,
      proxy: false,
      params: {
        per_page: 1,
        fields: "user_id",
        include_fields: true,
      },
      headers: {
        Authorization: `Bearer ${tokenResponse.data.access_token}`,
      },
    }
  );

  console.log("Auth0 Management API status:", usersResponse.status);
}

main().catch((error) => {
  console.error(error.response?.status || error.message);
  process.exitCode = 1;
});

The first response must match one of the two addresses in the QuotaGuard dashboard. The token request follows Auth0's documented client credentials flow. The final request needs read:users in the application's Management API grant. It logs only the HTTP status, not a token or user record.

Once the Tenant ACL is enforced, a direct request from an unapproved source should be blocked even if it carries an otherwise valid bearer token. Keep proxy credentials, client secrets, access tokens, and tenant data out of logs and test records.

A Credentials Exchange Action Adds an Optional Token Check

Auth0's Credentials Exchange trigger runs before an access token is returned in the client credentials flow. It exposes the originating address as event.request.ip. The Action can deny a token request that doesn't arrive through QuotaGuard.

exports.onExecuteCredentialsExchange = async (event, api) => {
  const allowed = new Set([
    "203.0.113.10",
    "203.0.113.11",
  ]);

  const managementAudience =
    "https://YOUR_TENANT.us.auth0.com/api/v2/";

  if (
    event.resource_server?.identifier === managementAudience &&
    !allowed.has(event.request.ip)
  ) {
    api.access.deny(
      "invalid_request",
      "Token exchange must originate from an approved network."
    );
  }
};

Replace the documentation addresses and audience with the values for your subscription and tenant. Auth0 currently documents invalid_request as an allowed denial code. Its Credentials Exchange API object also supports a separate human-readable reason.

This Action checks token issuance only. It doesn't control the source of later calls made with an already-issued token. Tenant ACL remains the request-level enforcement layer.

Audience, Permissions, and Source Rules Stay Separate

The strongest setup keeps each Auth0 control in its proper role:

• Tenant ACL checks the source of covered Management API and SCIM requests.
• Credentials Exchange Action optionally checks the source of the token request.
• Audience and permissions determine which API the token targets and which operations it can perform.

QuotaGuard changes the network source. It doesn't replace Auth0 authentication, application grants, token lifetime settings, or least-privilege permissions. It also can't stabilize a third-party caller that gives you no control over its HTTP client or proxy configuration.

QuotaGuard Static Pricing Starts at $19/Month

QuotaGuard Static direct Starter costs $19 per month and includes 20,000 requests and 10 GB of bandwidth. It's the default choice for ordinary Auth0 Management API traffic. Starter, Production, and Business use shared static IP pairs. Static Enterprise includes dedicated IPs and proxy resources for $219 per month.

QuotaGuard Shield Pricing Starts at $29/Month

QuotaGuard Shield direct Starter costs $29 per month and includes 20,000 requests and 10 GB of bandwidth. Shield additionally encrypts the customer-to-proxy hop. Neither product decrypts the application's outbound HTTPS payload. Use Shield when an approved architecture for regulated or sensitive identity data requires TLS on every hop. Shield Enterprise includes dedicated IPs and proxy resources for $269 per month. QuotaGuard doesn't make an Auth0 environment compliant by itself.

Standard plans include a 3-day trial. Enterprise plans include a 7-day trial. A credit card is required.

See the full plan table at quotaguard.com/products/pricing. For the architecture, product comparison, and FAQ, see the Auth0 static IP integration page.