Brasspage First one free

Auth0 Rules and Hooks stop running after November 18, 2026.

Auth0 says that after November 18, 2026, Rules and Hooks "will stop being executed and removed." If a login still leans on a Rule, that step just stops happening. Actions are the replacement.

Try Auth0's own free Migrate to Action tool first. If a Rule is too tangled for it, email it to us: the first one is moved free, then $49 once for up to 5, each with a local test.

Send one Rule free Try the free tool first

Ported by Tack, our AI personality. We never ask for your secrets or tenant access. Brasspage is not part of Auth0 or Okta.

What changes, and when

The dates are on Auth0's own deprecations and migrations page, under "Rules and Hooks". Older posts that say November 18, 2024 mean the read-only step, not the end.

  • May 16, 2023: Rules and Hooks deprecated.
  • November 18, 2024: read-only. You can no longer make new ones.
  • November 18, 2026: end of life. After this date, Rules and Hooks stop running and are removed.

The free fix first: Migrate to Action

Auth0 built a tool for this, and for simple Rules it is the right answer. It costs nothing.

  1. In the Auth0 dashboard, open the Rules page.
  2. Pick a Rule and choose "Migrate to Action".
  3. It makes the Action and adds api.rules.wasExecuted(), so the logic does not run twice while the old Rule is still on.
  4. In the Action editor, accept the Quick Fix edits it offers, then use the Test button.
  5. Rules run before Actions, so Auth0 says to move them in reverse run order: start with the last Rule.

A Rule that checks a verified email or an IP allow list is a few minutes in the tool. Do those yourself.

Free tool: two ported Rules and a test harness on GitHub (MIT), if you want to do it yourself.

Where the free tool stops

These are the spots that need real changes, not a rename. They are what we do.

  • The global auth0 object. Actions get no Management API token. Metadata writes move to api.user.setUserMetadata. Any other Management API call needs a machine to machine app that you make, its client id and secret as Action secrets, and a token fetch on each run.
  • configuration to secrets. Rules shared one global config. Each Action has its own secrets, and you re-enter each value in the Action editor. We never see them.
  • Side calls that were not awaited. A Rule could start a request and call back. An Action may stop as soon as it returns, so each call is awaited with a timeout, and the whole run must end within 20 seconds.
  • Redirects. context.redirect and the "redirect-callback" protocol have no direct match. A login that comes back after a redirect runs onContinuePostLogin, so the Rule splits into two handlers.
  • Callbacks and errors. callback(null, user, context) becomes a return, and callback(err) becomes api.access.deny(reason). Actions return access denied, not UnauthorizedError, so an app that reads that error code may act differently.

A worked example

Auth0's public Slack Rule posts "New User" on a first login. In the Action, the webhook URL moves from configuration to event.secrets, the slack-notify package gives way to the built-in fetch, and the post is awaited with a 3 second timeout. A Slack failure is logged and never blocks the login, as before. Its test fakes the login event, so it runs with no tenant and no network.

The limits, in plain words

  • Some Rules cannot move. Auth0's limits page says Actions have no match for context.connectionOptions, upstream identity provider tokens in user.identities, deleting standard claims, and some linked account changes. We tell you before you pay.
  • Our test is not your tenant. It fakes the event and api objects from Auth0's docs. Run the Action editor's Test button before you turn it on.
  • Order is on you. Each test covers one Action on its own, not how your Rules and Actions run together.
  • Hooks take the same kind of work, but our own trial ported Rules, not Hooks. The first free one is our real test of yours.
  • You deploy it. We send code and tests. We never log in to your tenant.

Price

Start well before November 18, so you have time to test in your tenant.

  1. Step 1

    Free

    Send one Rule or Hook

    Email its code, subject "Auth0 move". Remove secret values first. Never send a secret.

  2. Step 2

    Free

    Get the Action and its test

    We reply usually within 2 business days.

  3. Step 3

    $49 once

    Up to 5 more

    Pay with the email you used, then send the rest the same way. No subscription.

    Pay $49 for up to 5

Questions

What if you cannot move one?

We tell you before you pay. If we cannot move one you paid for, we refund the $49 in full. Terms.

Should I just use Auth0's tool?

For simple Rules, yes. Send us the ones it cannot finish, the ones with Management API calls, shared config, side calls or redirects.

Do you need my secrets or a login?

No. Send code with secret values removed. You put each secret in the Action editor yourself.

Who does the work?

Tack, our AI personality, ports each one and writes its test.

Are you part of Auth0?

No. Brasspage is an independent studio. Auth0 is Okta's name; we only help you move.