auth0/auth0-php 9.0.0 on PHP Packagist

This is the first stable release of v9. It introduces breaking changes to the Management API, and two behavior changes to the Authentication API. Please consult the v9 Migration Guide and UPGRADE.md for detailed upgrade instructions.

🚀 What's New

This release marks a major milestone for the Auth0 PHP SDK. The Management API client has been completely rewritten using the Fern code generation tool, built directly from the Auth0 OpenAPI specification. This delivers complete, always-up-to-date API coverage with full type safety.

✨ Highlights

🏗️ Auto-generated Management API - Rebuilt from the Auth0 OpenAPI spec using Fern, ensuring complete endpoint coverage and consistency with the API
🔒 Strongly-typed requests & responses - No more associative arrays or manual JSON decoding. Every request parameter and response field is a typed PHP object with IDE autocompletion
📄 Built-in pagination - Pager<T> implements IteratorAggregate, automatically fetching pages as you iterate with foreach
🔑 Automatic token management - New ManagementClient wrapper handles OAuth 2.0 client credentials grant, token caching (PSR-6), and custom token providers out of the box
⚡ Built-in retry middleware - Automatic retries for rate-limited (429) responses
🛡️ Exception-driven error handling - Non-2xx responses throw Auth0ApiException with status code and response body, replacing manual status code checks
🔁 Custom Token Exchange - New Authentication::customTokenExchange() and Auth0::loginWithCustomTokenExchange() methods

🔄 What's Changed

The Management API has breaking changes:

Area	v8	v9
Sub-client access	`$mgmt->users()->getAll()`	`$client->users->list()`
Request params	Associative arrays	Typed classes (`ListUsersRequestParameters`)
Responses	`ResponseInterface` + `json_decode()`	Typed objects (`$user->getEmail()`)
Pagination	`HttpResponsePaginator`	`foreach ($pager as $user)`
Error handling	Check `$response->getStatusCode()`	`catch (Auth0ApiException $e)`
Initialization	`$auth0->management()` via `SdkConfiguration`	`new ManagementClient(new ManagementClientOptions(...))`
Minimum PHP	`^8.1`	`^8.2`

The Authentication API is largely unchanged, with two behavior changes:

client_id, response_type, and response_mode can no longer be overridden through the $params argument on Auth0::login(), Auth0::signup(), Auth0::handleInvitation(), Authentication::getLoginLink(), and the Pushed Authorization Request flow. They are always resolved from your SdkConfiguration
Auth0::handleBackchannelLogout() now stores cache entries with the configured relative expiry (backchannelLogoutExpires, default 30 days) instead of an absolute timestamp. If you ran a persistent backchannel logout cache on 8.10.0 or later, flush it once after upgrading

📦 Installation

composer require auth0/auth0-php

🔧 Quick Start

use Auth0\SDK\API\Management\Wrapper\ManagementClient;
use Auth0\SDK\API\Management\Wrapper\ManagementClientOptions;
use Auth0\SDK\API\Management\Users\Requests\ListUsersRequestParameters;

$client = new ManagementClient(new ManagementClientOptions(
    domain: 'tenant.auth0.com',
    clientId: 'CLIENT_ID',
    clientSecret: 'CLIENT_SECRET',
));

// List users with automatic pagination
$pager = $client->users->list(new ListUsersRequestParameters([
    'perPage' => 50,
    'includeTotals' => true,
]));

foreach ($pager as $user) {
    echo $user->getEmail();
}