⚠️ This is a beta release. It moves the SDK onto auth0-php v9, which rewrites the Management API. The Authentication API is unchanged. Please consult the v7 to v8 Upgrade Guide before upgrading.

🚀 What's New

This release makes the Auth0 Laravel SDK compatible with auth0-php v9. The SDK wraps the Authentication API, which is unchanged in v9, so authentication flows require no changes. The changes are all in the Management API surface.

✨ Highlights

• 🔑 management() returns the base ManagementClient - Auth0::management() and $guard->management() return a v9 ManagementClient built from your existing guard configuration (domain, client_id, client_secret), with automatic client credentials token management and PSR-6 caching
• 🏗️ auth0-php v9 Management API - Strongly-typed requests and responses, sub-clients accessed as properties ($management->users->list()), and built-in Pager<T> pagination
• ⚙️ Configurable options - management() accepts an options array (timeout, maxRetries, additionalHeaders, and more), settable per call or as defaults under a management key in config/auth0.php (global or per-guard)
• 🛡️ Authentication API unchanged - Guards, middleware, user providers, session store, and events behave exactly as in v7

🔄 What's Changed

The Authentication surface is completely unchanged. Login, logout, callback, and token handling work exactly as before.

The Management API usage has changed:

📦 Installation

composer require auth0/login:8.0.0-beta.0

🔧 Quick Start

use Auth0\Laravel\Facade\Auth0;
use Auth0\SDK\API\Management\Users\Requests\ListUsersRequestParameters;

$management = Auth0::management();

$users = $management->users->list(
    new ListUsersRequestParameters(['perPage' => 25, 'page' => 0, 'includeTotals' => true])
);

foreach ($users as $user) {
    echo $user->getEmail();
}

⚠️ Breaking Changes

• Bumped the auth0/auth0-php dependency from ^8.19 to ^9.0
• management() now returns the base ManagementClient instead of ManagementInterface
• Removed the deprecated/ v6 to v7 compatibility shims

📚 Resources

• v7 to v8 Upgrade Guide
• auth0-php v9 API Reference

🙏 Feedback

This is a beta release - we would love your feedback! Please open an issue if you encounter any problems or have suggestions.

Added

• Laravel 13 support #491 (cosmastech)

Fixed

• Add missing hashPasswordForCookie to AuthenticationGuard #492 (steffjenl)

Changed

• Add PHP 8.4 to CI test matrix, cap Psalm <6.5, disable static_lambda CS rule for PHP 8.5+ compat #491 (kishore7snehil)

Fixed

• Security fix: Resolve CVE-2026-34236

Fixed

• Security fix: Resolve CVE-2025-68129

Fixed

• Security fix: Resolve CVE-2025-58769

Contributing Changes

Added:

• feat: add macroable guards (#459) by erikn69
• docs: Added facade methods documentation for better developer guidance (#466) by lucascbittencourt

Fixed:

• docs: Update CHANGELOG.md (#465) by nickescobedo

Fixed

• Security fix: Resolve CVE-2025-47275

Added

• Laravel 12 Support #470 (lee-to)

Fixed

• refactor: fix failing tests #471 (noevidenz)

Changed

• perf: Update getCredential to only refresh credential once per request #453 (ComputerTinker)

Changed

• refactor: add additional Telescope state check #447 (samuelhgf)
• chore(deps): replace temporary psalm-laravel-plugin fork with official #448 (alies-dev)

Added

• Add support for Laravel 11 #445 (evansims)

Changed

• Verify that Telescope is enabled via configuration helper #444 (samuelhgf)

Added

• Implement support for Back-Channel Logout #435 (evansims)
• Restore configurable route paths #436 (evansims)

Fixed

• Resolve CacheBridgeAbstract::save() not storing values when cache misses #434 (seruymt)

Added

• Significant performance improvements by eliminating redundant user queries.
• Compatibility support for Laravel Telescope. See docs/Telescope.md for more information.
• A refactored Events API has been introduced. See docs/Events.md for more information.
• AUTH0_SESSION_STORAGE and AUTH0_TRANSIENT_STORAGE now support a cookie value to enable the native Auth0-PHP SDK cookie session handler. See docs/Cookies.md for more information.

Fixed

• Addressed an issue where, under certain circumstances, the first user authentication attempt after a session invalidation could fail.

Changed

• Session regeneration/invalidation has been refactored.
• Discarded sessions are now deleted when they are invalidated by the SDK, rather than wait for Laravel to garbage collect.
• Session storage has been refactored. Session data is now stored as a JSON array in a single auth0_session entry in the Laravel session store, rather than in multiple keys.

Documentation

• A demonstration Eloquent user model and repository implementation has been added to docs/Eloquent.md.
• A new docs/Sessions.md document has been added for guidance on the various session driver options available.

Fixed

• Addressed an issue where, under certain circumstances, permissions state could be lost after authenticating.

Added

• Organization Name support added for Authentication API and token handling ¹

Changed

• Guards are now registered with the priority middleware list.
• Bumped auth0-php dependency version range to ^8.7.
• Updated telemetry to indicate new laravel package name (previously laravel-auth0.)

Fixed

• Addressed issue where placeholder AUTH0_ dotenv values could erroneously be interpreted as true configuration values.

Note ¹ To use this feature, an Auth0 tenant must have support for it enabled. This feature is not yet available to all tenants.

Fixed

• Resolved an issue where, under certain circumstances, the AuthenticationGuard middleware could get erroneously added to the api middleware group, causing a session to be established in a stateless request. (#415)

Added

• SDK configuration (config/auth0.php) now supports a configurationPath property for specifying a custom search path for .auth0.*.json and .env* files. (#407)
• Auth0\Laravel\Guards\GuardAbstract now extends Illuminate\Contracts\Auth\Guard. (#410)

Fixed

• Resolved host environment variables not being loaded as expected when a .env file is also used. (#408)
• Resolved surrounding quote characters not being trimmed from environment variables and .env files during processing. (#409)

Fixed

• Resolved an issue where parsing .env files could sometimes throw an exception when handling non-key-value pair strings. (#395)

Good news, Laravel Artisans! Auth0 is proud to announce the availability of v7.8 of our Laravel SDK! 🎉 This is a substantial release that includes features long requested by developers, including fully separate and independently configurable authentication and authorization guards, support for Laravel's auth and can middleware, and Laravel's Gates and Policies APIs.

We've made some exciting changes that remove nearly all the boilerplate and setup required to integrate the SDK. Short of configuring your account details, the SDK can now work largely "out of the box," as it will silently register its guards, middleware, and authentication routes. Speaking of configuration — the SDK can now be configured entirely using the Auth0 CLI!

We've updated our authentication and authorization quickstarts to reflect the simplified setup process. Of course, the updated quickstart code is available here on GitHub, as well.

Added

• This release adds support for authenticating using Pushed Authorization Requests.

• This release introduces two new Authentication Guards which provide a streamlined integration experience for developers that need to simultaneously support both session-based authentication and token-based endpoint authorization in their Laravel applications.

  Guard	Class	Description
  auth0.authenticator	Auth0\Laravel\Auth\Guards\AuthenticationGuard	Session-based authentication.
  auth0.authorizer	Auth0\Laravel\Auth\Guards\AuthorizationGuard	Token-based authorization.

• These guards are compatible with Laravel's Authentication API and support the standard auth middleware.

• These guards are compatible with Laravel's Authorization API and support the standard can middleware, and the Guard facade, and work with the Policies API.

• 3 new pre-built Guards are available: scope and permission, as well as a dynamic *:*. This enables you to verify whether the user's access token has a particular scope or (if RBAC is enabled on the Auth0 API) a particular permission. For example Gate::check('scope', 'email') or Route::get(/*...*/)->can('read:messages').

• The SDK now automatically registers these guards to Laravel's standard web and api middleware groups, respectively. Manual Guard setup in config/auth.php is no longer necessary.

• The SDK now automatically registers the Authentication routes. Manual route setup in routes/web.php is no longer necessary.

• 2 new routing Middleware have been added: Auth0\Laravel\Http\Middleware\AuthenticatorMiddleware and Auth0\Laravel\Http\Middleware\AuthorizerMiddleware. These are automatically registered with your Laravel application, and ensure the Auth0 Guards are used for authentication for web routes and authorization for api routes, respectively. This replaces the need for the guard middleware or otherwise manual Guard assignment in your routes.

Improved

• We've introduced a new configuration syntax. This new syntax is more flexible and allows for more complex configuration scenarios, and introduces support for multiple guard instances. Developers using the previous syntax will have their existing configurations applied to all guards uniformly.

• The SDK can now configure itself using a .auth0.json file in the project root directory. This file can be generated using the Auth0 CLI, and provides a significantly simpler configuration experience for developers.

• The previous auth0.guard Guard (Auth0\Laravel\Auth\Guard) has been refactored as a lightweight wrapper around the new AuthenticationGuard and AuthorizationGuard guards.

Notes

• This is a significant refactoring of the SDK's codebase, but we have implemented these changes in a manner that should avoid breaking changes.
• We have deprecated the previous auth0.guard. It will continue to work until the next release, but we recommend migrating to auth0.authorizer and/or auth0.authenticator for a better experience.
• We have deprecated the previous auth0.authorize, auth0.authorize.optional, auth0.authenticate and auth0.authenticate.optional middleware. These will continue to work until the next release, but we recommend migrating to the new auth0.authorizer and/or auth0.authenticator guards for a better experience. These new guards do not require the previous middleware to work, and support Laravel's standard auth and can middleware.

Added

• Auth0\Laravel\Auth0 now has a management() shortcut method for issuing Management API calls. (#376)

• Auth0\Laravel\Auth0\Guard now has a refreshUser() method for querying /userinfo endpoint and refreshing the authenticated user's cached profile data. (#375)

• Auth0\Laravel\Http\Controller\Stateful\Login now raises a LoginAttempting event, offering an opportunity to customize the authorization parameters before the login redirect is issued. (#382)

Improved

• The tokenCache, managementTokenCache, sessionStorage and transientStorage configuration values now support false or string values pointing to class names (e.g. \Some\Cache::class) or class aliases (e.g. cache.psr6) registered with Laravel. (#381)

Added

• Auth0\Laravel\Http\Middleware\Guard, new middleware that forces Laravel to route requests through a group using a specific Guard. (#362)

Improved

• Auth0\Laravel\Http\Middleware\Stateful\Authenticate now remembers the intended route (using redirect()->setIntendedUrl()) before kicking off authentication flow redirect. Users will be returned to the memorized intended route after completing their authentication flow. (#364)

Fixed

• legacyGuardUserMethod behaviour should use $session, not $token (#353)

Fixed

• Relaxed response types from middleware to use low-level Symfony\Component\HttpFoundation\Response class, allowing for broader and custom response types.

Fixed

• Resolved an issue wherein custom user repositories could fail to be instantiated under certain circumstances.

This release includes support for Laravel 10, and major improvements to the internal state handling mechanisms of the SDK.

Added

— Support for Laravel 10 #349 — New Auth0\Laravel\Traits\Imposter trait to allow for easier testing. Example usage — New Exception types have been added for more precise error catching.

Changed The following changes have no effect on the external API of this package, but may affect internal usage.

— Guard will now more reliably detect changes in the underlying Auth0-PHP SDK session state. — Guard will now more reliably sync changes back to the underlying Auth0-PHP SDK session state. — StateInstance concept has been replaced by new Credentials entity. — Guard updated to use new Credentials entity as primary internal storage for user data. — Auth0\Laravel\Traits\ActingAsAuth0User was updated to use newCredentials entity. — The HTTP middleware have been refactored to more clearly differentiate between token and session based identities. — The authenticate, authenticate.optional and authorize.optional HTTP middleware now support scope filtering, as authorize already did.

Fixed

— A 'Session store not set on request' error could occur when downstream applications implemented unit testing that use the Guard. This should be resolved now. — Guard would not always honor the provider configuration value in config/auth.php. — Guard is no longer defined as a Singleton to better support applications that need multi-guard configurations.

Maintenance

— Upgraded test suite to use PEST 2.0 framework. — Updated test coverage to 100%.

Important Notes

1. Changes to user() behavior This release includes a significant behavior change around the user() method of the Guard. Previously, by simply invoking the method, the SDK would search for any available credential (access token, device session, etc.) and automatically assign the user within the Guard. The HTTP middleware have been upgraded to handle the user assignment step, and user() now only returns the current state of user assignment without altering it.

A new property has been added to the config/auth0.php configuration file: behavior. This is an array. At this time, there is a single option: legacyGuardUserMethod, a bool. If this value is set to true, or if the key is missing, the previously expected behavior will be applied, and user() will behave as it did before this release. The property defaults to false.

2. Changes to Guard and Provider driver aliases We identified an issue with using identical alias naming for both the Guard and Provider singletons under Laravel 10, which has required us to rename these aliases. As previous guidance had been to instantiate these using their class names, this should not be a breaking change in most cases. However, if you had used auth0 as the name for either the Guard or the Provider drivers, kindly note that these have changed. Please use auth0.guard for the Guard driver, and auth0.provider for the Provider driver. This is a regrettable change, but was necessary for adequate Laravel 10 support.

Thanks to our contributors for this release: taida957789

Added

• Added Auth0\Laravel\Event\Middleware\... event hooks #340 (evansims)
• Added Auth0\Laravel\Event\Configuration\Building event hook #339 (evansims)

Full Changelog

Added

• add: Raise additional Laravel Auth Events #331 (evansims)

Fixed

• fix: env() incorrectly assigns cookieExpires to a string value #332 (evansims)
• fix: Auth0\Laravel\Cache\LaravelCachePool::createItem returning a cache miss #329 (pkivits-litebit)

Full Changelog

Fixed

• [SDK-3720] Restore php artisan vendor:publish command #321 (evansims)
• [SDK-3721] Bump minimum auth0/auth0-php version to ^8.3.4 #322 (evansims)

Fixed

• Auth0\Laravel\Auth0 no longer requires a session configuration for stateless strategies, restoring previous behavior. #317 (evansims)
• The SDK now requires ^3.0 of the psr/cache dependency, to accommodate breaking changes made in the upstream interface (typed parameters and return types) for PHP 8.0+. #316 (evansims)

https://user-images.githubusercontent.com/3093/195164064-31845e82-65f6-4100-80e7-97ced4f2d26d.mp4

Thank you to tonyfox-disguise, jeovajr and nie7321 for their contributions to this release.

Changed

• Auth0\Laravel\Store\LaravelSession has been added as the default sessionStorage and transientStorage interfaces for the underlying Auth0-PHP SDK. The SDK now leverages the native Laravel Session APIs by default. #307 (evansims)¹
• Auth0\Laravel\Cache\LaravelCachePool and Auth0\Laravel\Cache\LaravelCacheItem have been added as the default tokenCache and managementTokenCache interfaces for the underlying Auth0-PHP SDK. The SDK now leverages the native Laravel Cache APIs by default. #307 (evansims)
• Auth0\Laravel\Auth\Guard now supports the viaRemember method. #306 (tonyfox-disguise)
• Auth0\Laravel\Http\Middleware\Stateless\Authorize now returns a 401 status instead of 403 for unauthenticated users. #304 (jeovajr)
• PHP 8.0 is now the minimum supported runtime version. Please review the README for more information on support windows.

¹ This change may require your application's users to re-authenticate. You can avoid this by changing the sessionStorage and transientStorage options in your SDK configuration to their previous default instances of Auth0\SDK\Store\CookieStore, but it is recommended you migrate to the new LaravelSession default.

Full Changelog

Changed

• [SDK-3576] Return interfaces instead of concrete classes #296 (evansims)
• Use class names for app() calls #291 (evansims)

Fixed

• [SDK-3585] Fix: Missing Code error on Callback Route for Octane Customers* #297 (evansims)

*Please note that Octane support is considered experimental and pre-release, and should not be used in production.

Full Changelog

Fixed

• Fixed an issue in Auth0\Laravel\Http\Controller\Stateful\Callback where $errorDescription's value was assigned an incorrect value when an error was encountered. #266 (evansims)

Closed Issues

• Resolves #287 (piljac1)