Releases · auth0/ruby-auth0

08 May 08:05

github-actions

v5.19.0

dbdff31

v5.19.0 Latest

Latest

Added

Make Auth0::Client#get_token public, allowing callers to retrieve the current API token (or refresh if expired) without redundant requests to /oauth/token. (#725) (contributed by @ttstarck)

Fixed

Ship only runtime files in the packaged gem, eliminating false-positive vulnerability scanner findings caused by bundled dev/example Gemfile.lock files. Gem size reduced by ~78%. (#721) (contributed by @tmertens)

Assets 2

30 Apr 08:43

github-actions

v6.0.0.beta.0

d9a7f16

v6.0.0.beta.0 Pre-release

Pre-release

⚠️ This is a beta release. It introduces breaking changes to the Management API. The Authentication API is unchanged. Please consult the v6 Migration Guide for detailed upgrade instructions.

🚀 What's New

This release marks a major milestone for the Auth0 Ruby SDK: the Management API client has been completely rewritten using the Fern code generation tool, built directly from the Auth0 OpenAPI specification. This delivers complete, always-up-to-date API coverage with full type safety.

✨ Highlights

🏗️ Auto-generated Management API - Rebuilt from the Auth0 OpenAPI spec using Fern, ensuring complete endpoint coverage and consistency with the API
🔒 Strongly-typed responses - API methods return typed response objects with accessor methods instead of raw hashes
📄 Built-in pagination - List methods return iterators that automatically fetch pages as you iterate with each
🔑 Automatic token management - Auth0::Client handles OAuth 2.0 client credentials grant and token refresh out of the box
⚡ Built-in retry - Automatic retries with exponential backoff for rate-limited (429) responses
🛡️ Exception-driven error handling - Non-2xx responses raise typed exceptions (Auth0::Errors::NotFoundError, etc.) instead of returning error hashes

🔄 What's Changed

The Authentication API is ported from v5 with identical interface. Login, signup, token exchange, passwordless, and MFA flows all work the same way.

The Management API has breaking changes:

Area	v5	v6
Client	`Auth0Client.new(...)`	`Auth0::Client.new(domain:, client_id:, client_secret:)`
Sub-client access	`client.users(...)`	`client.users.list(...)`
Responses	Raw hashes / arrays	Typed objects (`user.email`, `user.user_id`)
Pagination	Manual `page` param	`client.users.list.each { \|u\| ... }`
Error handling	Check response hash	`rescue Auth0::Errors::NotFoundError`
HTTP client	`rest-client`	`net/http` (internal)

📦 Installation

# Gemfile
gem "auth0", "6.0.0.beta.0"

gem install auth0 --pre

Running gem install auth0 without --pre will install the latest stable v5 release.

🔧 Quick Start

require "auth0"

client = Auth0::Client.new(
  domain: "tenant.auth0.com",
  client_id: "CLIENT_ID",
  client_secret: "CLIENT_SECRET"
)

# List users with automatic pagination
client.users.list(per_page: 50, include_totals: true).each do |user|
  puts user.email
end

📚 Resources

⚠️ Breaking Changes

Management API client rewritten using Fern code generation
Auth0Client replaced by Auth0::Client
Management API methods accessed via namespaced sub-clients
API methods return typed response objects instead of hashes
List methods return paginated iterators instead of arrays
Non-2xx responses raise typed exceptions automatically
rest-client dependency removed; uses net/http internally
Minimum Ruby version raised to 3.3

🙏 Feedback

This is a beta release - we would love your feedback! Please open an issue if you encounter any problems or have suggestions.

Assets 2

13 Mar 07:21

github-actions

v5.18.1

771e5b4

v5.18.1

Fixed

Fixed a bug where passing an array as a request payload would delete its contents, causing API calls with array parameters to silently send empty data. (#697)

Changed

Updated zache from 0.13.2 to 0.15.2
Updated jwt from 2.9.3 to 2.10.2
Updated addressable from 2.8.7 to 2.8.8

Security

Removed unused coveralls and irb dev dependencies, eliminating OS Command Injection vulnerability in thor introduced transitively via coveralls
Replaced dotenv-rails with standalone dotenv, removing the full Rails transitive dependency chain and resolving 5 XSS vulnerabilities in rails-html-sanitizer
Upgraded rexml to 3.4.4 (via simplecov-cobertura and webmock upgrades) to fix XML Entity Expansion vulnerability