Application Profiles - Auth0 Docs

Documentation Index

Fetch the complete documentation index at: /llms.txt

Use this file to discover all available pages before exploring further.

The Application Profiles feature is in Early Access. To participate, contact Auth0 Support. By using this feature, you agree to the applicable Free Trial terms in Okta's Master Subscription Agreement.

Application Profiles let you define a runtime configuration policy that automatically applies to a group of applications in your tenant. This enables you to set consistent application settings such as refresh token lifetimes and Organization behavior without having to configure each application individually. Application Profiles EA targets dynamically created Client ID Metadata Document (CIMD) applications. Instead of being created manually through the Auth0 Dashboard or Management API, dynamic CIMD applications register themselves at runtime by pointing to a metadata URL. While the CIMD standards include a defined set of parameters governing the OAuth 2.0 client behavior that can be specified in the metadata, they do not include Auth0-specific parameters, which would make all CIMD applications use the same defaults. Application Profiles complement the metadata by supplying values for Auth0-specific parameters.

Application Profiles EA only supports dynamically registered CIMD applications; dynamically registered clients and manually registered CIMD applications are not supported. To learn more, read Limitations.

Use cases

Common use cases for Application Profiles include:

• Dynamic CIMD applications: Applications that register themselves at runtime by pointing to a metadata URL, thus lacking a manual creation step where tenant administrators would usually configure application settings.
• Fleet management: A single configuration controls a large number of applications.

How it works

Application Profiles are defined by the tenant administrator by providing default values for clients governed by that profile. Auth0 evaluates Application Profiles at runtime on every authentication request, not when an application is created. This means:

• A profile applies retroactively to every matching application, including ones that were registered before the profile existed.
• If you update or delete a profile, the change takes effect within the 5-minute cache propagation window on the next authentication request, with no need to update individual applications.
• Application Profile settings are never written to the application record. They’re merged into an in-memory configuration at the moment of the authentication request.

Auth0 caches Application Profile configuration for up to 5 minutes. After creating, updating, or deleting a profile, allow up to 5 minutes for the change to take effect across all authentication requests.

What a profile can match

An Application Profile can only match dynamically registered CIMD applications (external_metadata_type: cimd, created by the client itself rather than a tenant admin). Applications created manually, including a manually-configured CIMD application, are not matched by a profile. If you create an application by hand, you already have direct, explicit control over every one of its settings, and a profile is never applied on top of that configuration.

Only one profile per tenant

A tenant may have at most one Application Profile. Support for multiple profiles, with priority-based conflict resolution, is planned for a future release.

Supported client settings

Application Profiles support the following client settings:

Tokens

In Application Profiles EA, you cannot configure refresh token rotation behavior (rotation_type) through an Application Profile. It’s determined automatically from each application’s authentication method: public applications rotate refresh tokens by default, confidential applications do not.

You must set both the Idle Refresh Token Lifetime and Maximum Refresh Token Lifetime together; you cannot override just one side of a dependent pair, since doing so could produce an invalid combination once merged with the application’s own value or platform default.

Login Experience

Manage Application Profiles

Manage Application Profiles using the Auth0 Dashboard or Management API.

To create an Application Profile in the Auth0 Dashboard:

1. Navigate to Applications > Application Profiles.
2. Toggle on Application Profile.
3. In the Settings tab, enter the name for the Application Profile (required) and provide a description.
4. In the Tokens section, configure client settings related to refresh tokens.
5. In the Login Experience tab, configure how clients behave in relation to Organizations.

To delete the Application Profile, toggle it off.

Manage Application Profiles through the Management API. All operations require an access token with the relevant scope.

Create an Application Profile

To create an Application Profile, make a POST request to the /api/v2/client-profiles endpoint:

Using the Auth0 CLI? If you haven’t already, set up and authenticate your CLI session before running this command.

auth0 api post "client-profiles" \
  --data '{\n    "name": "Dynamic Third-Party Applications",\n    "description": "Default runtime policy for dynamically registered third-party clients",\n    "apply_policy": {\n      "external_metadata_type": "cimd",\n      "external_metadata_created_by": "client"\n    },\n    "client_configuration": {\n      "refresh_token": {\n        "token_lifetime": { "default_value": 2592000 },\n        "idle_token_lifetime": { "default_value": 1296000 },\n        "leeway": { "default_value": 0 }\n      },\n      "organization_usage": { "default_value": "deny" },\n      "organization_require_behavior": { "default_value": "no_prompt" },\n      "organization_discovery_methods": { "default_value": ["email", "organization_name"] },\n      "require_proof_of_possession": { "default_value": false }\n    }\n  }'\n```

curl --request POST
--url 'https://YOUR_AUTH0_DOMAIN/api/v2/client-profiles'
--header 'Authorization: Bearer YOUR_MANAGEMENT_API_TOKEN'
--header 'Content-Type: application/json'
--data '{\n "name": "Dynamic Third-Party Applications",\n "description": "Default runtime policy for dynamically registered third-party clients",\n "apply_policy": {\n "external_metadata_type": "cimd",\n "external_metadata_created_by": "client"\n },\n "client_configuration": {\n "refresh_token": {\n "token_lifetime": { "default_value": 2592000 },\n "idle_token_lifetime": { "default_value": 1296000 },\n "leeway": { "default_value": 0 }\n },\n "organization_usage": { "default_value": "deny" },\n "organization_require_behavior": { "default_value": "no_prompt" },\n "organization_discovery_methods": { "default_value": ["email", "organization_name"] },\n "require_proof_of_possession": { "default_value": false }\n }\n }'\n```

name and client_configuration are required. apply_policy is also required, although currently it only accepts one value:

{ "external_metadata_type": "cimd", "external_metadata_created_by": "client" }

A successful request returns 201 Created with the full profile object, and a Location header pointing to the new resource.

Retrieve an Application Profile

To retrieve an Application Profile, make a GET request to the /api/v2/client-profiles/{clientId} endpoint:

auth0 api get "client-profiles/YOUR_PROFILE_ID"

curl --request GET \
  --url 'https://YOUR_AUTH0_DOMAIN/api/v2/client-profiles/YOUR_PROFILE_ID' \
  --header 'Authorization: Bearer YOUR_MANAGEMENT_API_TOKEN'

Returns 200 OK with the profile object, or 404 Not Found if no profile exists with that ID.

List Application Profiles

To list all Application Profiles, make a GET request to the /api/v2/client-profiles endpoint:

auth0 api get "client-profiles"

curl --request GET \
  --url 'https://YOUR_AUTH0_DOMAIN/api/v2/client-profiles' \
  --header 'Authorization: Bearer YOUR_MANAGEMENT_API_TOKEN'

If successful, Auth0 returns an array of client profile objects:

{
  "client_profiles": [\
    {\
      "id": "cpr_7Yw3kBnP4mQ8vX",\
      "name": "Dynamic Third-Party Applications",\
      "apply_policy": { "external_metadata_type": "cimd", "external_metadata_created_by": "client" },\
      "client_configuration": { "..." },\
      "created_at": "2026-01-15T10:30:00.000Z",\
      "updated_at": "2026-05-11T14:22:00.000Z"\
    }\
  ],
  "next": "eyJpZCI6ImNwcl83..."
}

This endpoint supports checkpoint pagination.

Update an Application Profile

To update an Application Profile, make a PATCH request to the /api/v2/client-profiles/{clientId} endpoint:

auth0 api patch "client-profiles/YOUR_PROFILE_ID" \
  --data '{\n    "client_configuration": {\n      "refresh_token": {\n        "token_lifetime": { "default_value": 2592000 },\n        "idle_token_lifetime": { "default_value": 604800 },\n        "leeway": { "default_value": 30 }\n      },\n      "organization_usage": { "default_value": "allow" }\n    }\n  }'

curl --request PATCH \
  --url 'https://YOUR_AUTH0_DOMAIN/api/v2/client-profiles/YOUR_PROFILE_ID' \
  --header 'Authorization: Bearer YOUR_MANAGEMENT_API_TOKEN' \
  --header 'Content-Type: application/json' \
  --data '{\n    "client_configuration": {\n      "refresh_token": {\n        "token_lifetime": { "default_value": 2592000 },\n        "idle_token_lifetime": { "default_value": 604800 },\n        "leeway": { "default_value": 30 }\n      },\n      "organization_usage": { "default_value": "allow" }\n    }\n  }'

PATCH accepts a partial update at the top level; you only need to include the fields you’re changing (name, description, client_configuration, apply_policy).

The parameters client_configuration and apply_policy must be submitted in full when included in a PATCH request. Partial updates to nested fields inside these objects are not supported. Any sub-fields you omit from the object are treated as not set on the profile (falling back to the governed application’s own configuration), not left unchanged from the previous version.

A successful update returns 200 OK with the full, updated profile object. Changes take effect within the 5-minute cache propagation window.

Delete an Application Profile

To delete an Application Profile, make a DELETE request to the /api/v2/client-profiles/{clientId} endpoint:

auth0 api delete "client-profiles/YOUR_PROFILE_ID"

curl --request DELETE \
  --url 'https://YOUR_AUTH0_DOMAIN/api/v2/client-profiles/YOUR_PROFILE_ID' \
  --header 'Authorization: Bearer YOUR_MANAGEMENT_API_TOKEN'

Returns 204 No Content, whether or not a profile with that ID existed. Deleting a profile immediately removes its governance from every application that matched it — those applications revert to their own individually-configured settings (or platform defaults) on their next authentication request.

Limitations

This is an Early Access release. The following limitations apply and are expected to be addressed in future releases:

• Only one Application Profile is allowed per tenant.
• Application Profiles apply only to dynamically registered CIMD applications. Manually created applications, including manually configured CIMD applications, are never matched.
• Dynamic Client Registration (DCR) applications are not supported by Application Profiles in this release.
• There is no way to list which applications a given profile currently governs.
• There is no way to exempt (opt out) an individual application from an Application Profile that would otherwise match it.
• Refresh token settings applied by a profile do not distinguish between public and confidential applications; the same values apply to every governed application regardless of authentication method.

Learn more

• CIMD Overview
• Register Applications with CIMD
• Dynamic Client Registration