Added

• feat: add Cross-App Access resource application support with CrossAppAccessResourceApp on Connection, IdentityAssertionAuthorizationGrant on Client, and DiscoveryURL/OIDCMetadata on ConnectionOptionsSAML #839 (bkiran6398)
• feat: add Cross-App Access requesting application support with CrossAppAccessRequestingApp on Connection #824 (KartikJha)
• feat: add Auth0Managed curated blocklist support to NetworkACLRuleMatch #830 (KartikJha)

Beta

• feat: add B2B integration configuration via the b2b_integration_configuration field (B2BIntegrationConfiguration type with sso_profiles, max one SSO profile ID) on the client and client create/update requests

Stable (from main)

• BREAKING: change module path from github.com/auth0/go-auth0/v2 to github.com/auth0/go-auth0/v3; update your go get command and all imports
• BREAKING: remove the Users.FederatedConnectionsTokensets sub-client (List, Delete) and the FederatedConnectionTokenSet type
• BREAKING: remove the ConnectionFederatedConnectionsAccessTokens type and the FederatedConnectionsAccessTokens field from ConnectionPropertiesOptions, UpdateConnectionOptions, ConnectionOptionsAzureAd, and ConnectionOptionsCommonOidc
• BREAKING: remove the asn value from ClientSessionTransferDelegationDeviceBindingEnum (only ip remains)
• BREAKING: change ListRolesOffsetPaginatedResponseContent Start/Limit/Total from *float64 to float64 (setter signatures change)
• BREAKING: replace the shared ConnectionAttributeIdentifier with per-attribute EmailAttributeIdentifier, PhoneAttributeIdentifier, and UsernameAttributeIdentifier types
• BREAKING: replace PhoneProviderProtectionBackoffStrategyEnumNone ("none") with PhoneProviderProtectionBackoffStrategyEnumDefault ("default")
• feat: add organization role members endpoint (Organizations.Roles.Members.List) with cursor pagination and the RoleMember, ListOrganizationRoleMembersResponseContent, ListOrganizationRoleMembersRequestParameters types
• feat: add organization third-party client access via the ThirdPartyClientAccess field (OrganizationThirdPartyClientAccessEnum)
• feat: add OrganizationID field to UserGrant
• feat: add token vault privileged access Grants field and the TokenVaultPrivilegedAccessGrant type
• feat: add connection OIDC discovery via DiscoveryURL and OidcMetadata fields (and the ConnectionsOidcMetadata type)
• feat: add DefaultMethodPhoneNumberIdentifierEnum (password, phone_otp)
• feat: add connection event stream events (connection.created, connection.deleted, connection.updated) with their CloudEvent type enums
• feat: add Auth0Managed field to NetworkACLMatch
• feat: add confirmation value to PartialGroupsEnum
• feat: add NotFoundErrorBody and TooManyRequestsErrorBody types and their error-code definitions
• feat: add connection cross-app access resource app via the CrossAppAccessResourceApp field (CreateCrossAppAccessResourceApp, UpdateCrossAppAccessResourceApp, ConnectionCrossAppAccessResourceApp types and status enums)
• feat: add client identity assertion authorization grant via the IdentityAssertionAuthorizationGrant field (CreateIdentityAssertionAuthorizationGrant, UpdateIdentityAssertionAuthorizationGrant types)
• feat: add self-service profile ThirdPartyClientAccessConfig type and field on the SSO ticket request
• feat: add branding theme Identifiers field and the BrandingThemeIdentifiers type with login display, phone display formatting, and phone display masking enums
• feat: add session Actor field with the SessionActorMetadata type and the SessionActorClaimValue union
• feat: add SuspiciousIPThrottlingPreCustomTokenExchangeStage to the suspicious IP throttling stages

Added

• feat: add connection cross-app access resource app support via the CrossAppAccessResourceApp field (with CreateCrossAppAccessResourceApp, UpdateCrossAppAccessResourceApp, and ConnectionCrossAppAccessResourceApp types and status enums) on the connection create and update requests #834 (developerkunal)
• feat: add client identity assertion authorization grant support via the IdentityAssertionAuthorizationGrant field (CreateIdentityAssertionAuthorizationGrant, UpdateIdentityAssertionAuthorizationGrant types) on the client requests #834 (developerkunal)
• feat: add self-service profile ThirdPartyClientAccessConfig type and ThirdPartyClientAccessConfig field on the SSO ticket request #834 (developerkunal)
• feat: add branding theme Identifiers field and the BrandingThemeIdentifiers type with login display, phone display formatting, and phone display masking enums #834 (developerkunal)
• feat: add session Actor field with the SessionActorMetadata type and the SessionActorClaimValue union (SessionActorClaimValueVisitor) #834 (developerkunal)
• feat: add SuspiciousIPThrottlingPreCustomTokenExchangeStage to the suspicious IP throttling attack protection stages #834 (developerkunal)

v1.45.0 (2026-07-16)

Full Changelog

Added

• feat: add third_party_client_access field in organization #818 (bkiran6398)
• feat: added support for identifiers in branding_theme, country_codes in tenant structs #811 (KartikJha)

⚠️ BREAKING CHANGES

This is the v3.0.0 major release. The module path changes from github.com/auth0/go-auth0/v2 to github.com/auth0/go-auth0/v3, which every application must update. Please review the Migration Guide for detailed upgrade instructions.

Breaking Changes

• BREAKING: Module path changed from github.com/auth0/go-auth0/v2 to github.com/auth0/go-auth0/v3. Update your go get command and all imports.
• Removed the Users.FederatedConnectionsTokensets sub-client (its List and Delete methods) and the FederatedConnectionTokenSet type #823 (fern-api[bot])
• Removed the ConnectionFederatedConnectionsAccessTokens type and the FederatedConnectionsAccessTokens field from ConnectionPropertiesOptions, UpdateConnectionOptions, ConnectionOptionsAzureAd, and ConnectionOptionsCommonOidc #823 (fern-api[bot])
• Removed the asn value from ClientSessionTransferDelegationDeviceBindingEnum; the only supported value is now ip #823 (fern-api[bot])
• Changed ListRolesOffsetPaginatedResponseContent Start, Limit, and Total fields from *float64 to float64 (JSON tags drop omitempty), so the setter signatures change accordingly #814 (fern-api[bot])
• Replaced the shared ConnectionAttributeIdentifier type with per-attribute EmailAttributeIdentifier, PhoneAttributeIdentifier, and UsernameAttributeIdentifier types, changing the Identifier field type and GetIdentifier/SetIdentifier signatures on EmailAttribute, PhoneAttribute, and UsernameAttribute #814 (fern-api[bot])
• Replaced PhoneProviderProtectionBackoffStrategyEnumNone ("none") with PhoneProviderProtectionBackoffStrategyEnumDefault ("default") #814 (fern-api[bot])

Added

• feat: add organization role members endpoint (Organizations.Roles.Members.List) with cursor pagination and the RoleMember, ListOrganizationRoleMembersResponseContent, and ListOrganizationRoleMembersRequestParameters types #814 (fern-api[bot])
• feat: add organization third-party client access via the ThirdPartyClientAccess field (OrganizationThirdPartyClientAccessEnum) on organization request and response types #814 (fern-api[bot])
• feat: add OrganizationID field to UserGrant #814 (fern-api[bot])
• feat: add token vault privileged access Grants field and the TokenVaultPrivilegedAccessGrant type on ClientTokenVaultPrivilegedAccessWithCredentialID and ClientTokenVaultPrivilegedAccessWithPublicKey #814 (fern-api[bot])
• feat: add connection OIDC discovery via DiscoveryURL and OidcMetadata fields (and the ConnectionsOidcMetadata type) on ConnectionPropertiesOptions and UpdateConnectionOptions #814 (fern-api[bot])
• feat: add DefaultMethodPhoneNumberIdentifierEnum (password, phone_otp) for the phone attribute identifier default method #814 (fern-api[bot])
• feat: add connection event stream events (connection.created, connection.deleted, connection.updated) to the event stream enums with their CloudEvent type enums #814 (fern-api[bot])
• feat: add Auth0Managed field to NetworkACLMatch (available in both match and not_match) #822 (fern-api[bot])
• feat: add confirmation value to PartialGroupsEnum #822 (fern-api[bot])
• feat: add NotFoundErrorBody and TooManyRequestsErrorBody types and their error-code definitions #814 (fern-api[bot])

Added

• feat: Add IDTokenSessionExpirySupported field to connection options #805 (KartikJha)
• feat: Add Delegation configuration to client SessionTransfer #803 (bkiran6398)
• feat: Add FedCMLogin configuration to client #799 (bkiran6398)
• feat: Add SendBackChannelNonce and Type fields to connection options #797 (bkiran6398)

Beta

• No beta-only changes in this release.

Stable (from main)

• feat: add client.AttackProtection.PhoneProviderProtection Get and Patch endpoints
• feat: add token vault privileged access types (ClientTokenVaultPrivilegedAccessWithCredentialID, ClientTokenVaultPrivilegedAccessWithPublicKey, TokenVaultPrivilegedAccessIPAllowlistEntry)
• feat: add CrossAppAccessRequestingApp to connection response types
• feat: add PhoneVerified, Multifactor, MultifactorLastModified, LastIP, LastLogin, and LastPasswordReset user fields
• feat: add auth_email_by_code email template name
• fix: change user date fields (CreatedAt, UpdatedAt, LastLogin, LastPasswordReset, MultifactorLastModified) from UserDateSchema to time.Time (BREAKING)
• fix: change identity UserID fields to a string-or-integer UserID union (BREAKING)

Breaking Changes

• Changed user date fields (CreatedAt, UpdatedAt, LastLogin, LastPasswordReset, MultifactorLastModified) on CreateUserResponseContent, GetUserResponseContent, UpdateUserResponseContent, and UserResponseSchema from *UserDateSchema to *time.Time, and removed the UserDateSchema type and UserDateSchemaVisitor interface #801 (fern-api[bot])
• Changed identity UserID fields on UserIdentitySchema and DeleteUserIdentityResponseContentItem to the string-or-integer UserID union (from *string/string) #801 (fern-api[bot])
• Changed UpdateClientRequestContent NativeSocialLogin to *NativeSocialLoginPatch and FedcmLogin to *FedCmLoginPatch #801 (fern-api[bot])

Added

• feat: add phone provider protection API (Management.AttackProtection.PhoneProviderProtection) with Get and Patch methods and the PhoneProviderProtectionBackoffStrategyEnum #801 (fern-api[bot])
• feat: add native social login configuration types (NativeSocialLoginPatch, NativeSocialLoginApplePatch, NativeSocialLoginFacebookPatch, NativeSocialLoginGooglePatch) and FedCM login configuration types (FedCmLoginPatch, FedCmLoginGooglePatch) #801 (fern-api[bot])
• feat: add token vault privileged access types (ClientTokenVaultPrivilegedAccessWithCredentialID, ClientTokenVaultPrivilegedAccessWithPublicKey, TokenVaultPrivilegedAccessIPAllowlistEntry) #801 (fern-api[bot])
• feat: add CrossAppAccessRequestingApp field and type to CreateConnectionResponseContent and GetConnectionResponseContent #801 (fern-api[bot])
• feat: add PhoneVerified, Multifactor, MultifactorLastModified, LastIP, LastLogin, and LastPasswordReset fields to user response types #801 (fern-api[bot])
• feat: add auth_email_by_code value to EmailTemplateNameEnum #801 (fern-api[bot])

Fixed

• fix: map HTTP 409 responses on self-service profiles to ConflictError #801 (fern-api[bot])
• fix: preserve the raw JSON payload on EventStreamSubscribeEventsResponseContent so unknown union members round-trip through marshal/unmarshal and validation #801 (fern-api[bot])

Beta

• feat: add Experimentation Management API (Management.Experimentation) grouping experiments, feature flags, and segments #795 (fern-api[bot])
• feat: add experiments API (Management.Experimentation.Experiments) with List, Create, Get, Update, Delete, and UpdateStatus for A/B test experiments and their traffic allocations #795 (fern-api[bot])
• feat: add feature flags API (Management.Experimentation.FeatureFlags) with full CRUD and UpdateStatus lifecycle transitions #795 (fern-api[bot])
• feat: add feature flag variations API (Management.Experimentation.FeatureFlags.Variations) with full CRUD for parameter-override variations #795 (fern-api[bot])
• feat: add segments API (Management.Experimentation.Segments) with full CRUD for rule-based audience targeting #795 (fern-api[bot])

Stable (from main)

• feat: add NativeSocialLogin and FedcmLogin configuration fields to client application types, with patch variants (NativeSocialLoginApplePatch, NativeSocialLoginFacebookPatch, NativeSocialLoginGooglePatch, FedCmLoginPatch, FedCmLoginGooglePatch) #795 (fern-api[bot])
• feat: add typed ConflictError (HTTP 409) decoding to the self-service profiles client #795 (fern-api[bot])
• fix: preserve the raw JSON payload of unrecognized EventStreamSubscribeEventsResponseContent union variants so unknown event stream types no longer fail to unmarshal, marshal, or validate #795 (fern-api[bot])

Added

• feat: Add InvitationLandingClientID in MyOrganizationConfiguration #793 (bkiran6398)
• feat: add support for missing fields in connected_accounts #794 (KartikJha)