Auth0
Auth0 provides authentication and authorisation as a service.
What detecting Auth0 tells you about a site
Auth0 is a hosted identity provider that handles login, signup and tokens so the team does not build auth themselves. You detect it at the authentication boundary: a redirect to a *.auth0.com (or custom) tenant domain, the Auth0 SPA SDK loaded as a script, or auth0-shaped state in storage during a login round-trip. Finding it tells you the product treats identity as a solved, outsourced problem — a deliberate buy-not-build decision common at startups and mid-market SaaS that want social login, MFA and enterprise SSO without maintaining the security-sensitive code.
Auth0 in a real-world stack
When you find Auth0, it rarely travels alone. Pairs with a SPA framework on the front end and an API gateway validating the JWTs Auth0 issues; frequently alongside a separate authorization layer for fine-grained permissions.
About
Auth0 provides authentication and authorisation as a service.
Categories: Authentication
Quick facts
Detection methodology for Authentication
Auth providers expose a script SDK and (usually) a hosted login endpoint. Auth0's `@auth0/auth0-spa-js` plus `*.auth0.com` redirects; Clerk's `@clerk/clerk-js` plus `clerk.<account>.lcl.dev`; NextAuth's `next-auth` package plus the `/api/auth/...` route handler. We catch each via the bundle and the network requests, plus the exact SDK version from the sourcemap.
How we detect Auth0
Sourcemap Explorer carries 4 fingerprint signals for Auth0, spread across 3 channels — response header, script src url and dom selector. The exact patterns are listed below, and you can replay each one in Chrome DevTools to confirm a match by hand.
Each signal alone is rarely conclusive — Sourcemap Explorer cross-references all of them and weights by confidence. You can reproduce any of these checks yourself in Chrome DevTools.
Server-side fingerprint: the response header reveals the technology behind the page. Visible in DevTools → Network → response headers.
x-auth0-requestid:
Script URL pattern. Typically a CDN host or chunk path that ships with the technology.
/auth0(?:-js)?/([\d.]+)/auth0(?:.min)?\.js
/auth0-js@([\d.]+)/([a-z]+)/auth0\.min\.js
A DOM selector that only this technology's pages render. Verified at runtime by the content script.
link[href*='cdn.auth0.com']
FAQ
How do I check if a website is using Auth0?
Open the page in Chrome, click the Sourcemap Explorer toolbar icon, and read the Stack tab. Auth0's specific fingerprints here are response header, script src url and dom selector, and the popup flags Auth0 whenever any combination of them is found. The same checks can be reproduced manually in DevTools — see the "How we detect" section above.
What Auth0 version can Sourcemap Explorer detect?
Auth0 ships as a hosted authentication rather than a bundled npm package, so version-specific detection isn't always possible. Where the platform leaks a version in response headers (`X-Powered-By`, `Server`, generator meta tags) we surface it; otherwise we report presence only.
Is Auth0 a SaaS or self-hosted?
Auth0 is offered as a hosted SaaS product. Detection runs against the JavaScript SDK or asset-URL fingerprints the platform ships into pages.
How much does Auth0 cost?
Auth0's pricing model is documented as: freemium, payg, recurring. Detection is independent of the pricing tier — Sourcemap Explorer flags the technology by its fingerprints, regardless of which paid plan a site is on. See the official site for the current pricing page.
Where can I read more about Auth0?
Official site: https://auth0.github.io/auth0.js/index.html. For Sourcemap Explorer's detection guide, see the deep-dive link below or the related guides in the cross-link section.
Keep reading on Sourcemap Explorer
Practical guides
Detected by Sourcemap Explorer
Open the popup on any page running Auth0and you'll see the exact version pulled from the bundled package.json when sourcemaps are exposed.