
Research
/Security News
Toptal’s GitHub Organization Hijacked: 10 Malicious Packages Published
Threat actors hijacked Toptal’s GitHub org, publishing npm packages with malicious payloads that steal tokens and attempt to wipe victim systems.
auth0-deploy-cli
Advanced tools
The Auth0 Deploy CLI is a tool that helps you manage your Auth0 tenant configuration. It integrates into your development workflows as a standalone CLI or as a node module.
Supported resource types: actions, branding, client grants, clients (applications), connections, custom domains, email templates, emails, grants, guardian, hook secrets, log streams, organizations, pages, prompts, resource servers (APIs), roles, tenant settings, themes, forms, flows, self-service profiles, network ACLs.
🎢 Highlights • 📚 Documentation • 🚀 Getting Started • 📝 Feedback • 💬 Discussions
This guide will help you to a working implementation of the Deploy CLI tool used as a standalone CLI. There are three main steps before the Deploy CLI can be run:
Warning This tool can be destructive to your Auth0 tenant. It is recommended to be familiar with the
AUTH0_ALLOW_DELETE
configuration and to test on development tenants prior to using in production.
To run as a standalone command-line tool:
npm install -g auth0-deploy-cli
In order for the Deploy CLI to call the Management API, a dedicated Auth0 application must be created to make calls on behalf of the tool.
Warning The Deploy CLI's own client is unconfigurable by itself to prevent potentially destructive changes.
The designated application needs to be granted scopes in order to allow the Deploy CLI to execute Management operations.
The principle of least privilege is abided, so it will operate within the set of permissions granted. At a minimum, read:clients
need to be selected, but is is recommended to select read:
, create:
and update:
permissions for all resource types within management purview. To enable deletions, the delete:
scopes are also necessary.
The Deploy CLI can be configured two ways, through a config.json
file and through environment variables. The decision to choose one or both would depend on your specific use case and preferences. More comprehensive information about configuring the tool can be found on the Configuring the Deploy CLI page. However, for this example, the simplest way to get going is by setting the following environment variables:
AUTH0_DOMAIN
AUTH0_CLIENT_ID
AUTH0_CLIENT_SECRET
These values can be found in the “Settings” and “Credentials“ tabs within the Auth0 application created in the previous step.
Finally, with above complete, the Deploy CLI export command can be run:
a0deploy export --format=yaml --output_folder=local
Once the process completes, observe the resource configuration files generated in the local
directory. Then, run the import command, which pushes configuration from the local machine to your Auth0 tenant:
a0deploy import --config_file=config.json --input_file local/tenant.yaml
Refer to Using as a CLI documentation for a comprehensive list of flags and options.
We appreciate feedback and contribution to this repo! Before you get started, please see the following:
To provide feedback or report a bug, please raise an issue on our issue tracker.
Please do not report security vulnerabilities on the public Github issue tracker. The Responsible Disclosure Program details the procedure for disclosing security issues.
Auth0 is an easy to implement, adaptable authentication and authorization platform.
To learn more checkout Why Auth0?
This project is licensed under the MIT license. See the LICENSE file for more info.
[8.11.0] - 2025-07-15
customDomains
. [#1113]FAQs
A command line tool for deploying updates to your Auth0 tenant
The npm package auth0-deploy-cli receives a total of 31,592 weekly downloads. As such, auth0-deploy-cli popularity was classified as popular.
We found that auth0-deploy-cli demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 43 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
/Security News
Threat actors hijacked Toptal’s GitHub org, publishing npm packages with malicious payloads that steal tokens and attempt to wipe victim systems.
Research
/Security News
Socket researchers investigate 4 malicious npm and PyPI packages with 56,000+ downloads that install surveillance malware.
Security News
The ongoing npm phishing campaign escalates as attackers hijack the popular 'is' package, embedding malware in multiple versions.