Auth0 and Dome

1. 01

   Register your tenant as a verification provider

   The issuer is your tenant domain with a trailing slash. Pin the audience to your API's identifier.

   $ dome verification-providers create \
     --name app-auth0 \
     --method oidc \
     --oidc-url https://<tenant>.auth0.com/ \
     --oidc-expected-audience <api-identifier>

2. 02

   Add claims in a post-login Action

   Auth0 reserves groups and roles, so Dome can't read Auth0 roles from the token. Call api.accessToken.setCustomClaim for email, and for a namespaced string such as https://example.com/team.

3. 03

   Read a namespaced claim in a rule

   String claims arrive under principal.act_as.claims. Test that the claim is there before you compare it.

   principal has act_as &&
   principal.act_as has claims &&
   principal.act_as.claims has "https://example.com/team" &&
   principal.act_as.claims["https://example.com/team"] == "platform"

Commands and rules tested against a Dome workspace on October 1, 2026. For anything about Auth0 itself, see Okta's documentation.

forbid (principal, action == Dome::Action::"mcp:call", resource is Dome::MCPTool)
when {
  resource.connection_name == "github" &&
  resource.tool_name == "create_pull_request"
}
unless {
  principal has act_as &&
  principal.act_as has email &&
  principal.act_as.email like "*@example.com"
};