Version 3.0
Self-host Sema4.ai
Identity providers (OIDC)
Auth0

Auth0

Configure an Auth0 application so the platform can sign users in over OIDC. Follow these steps, then bring the resulting Discovery URL, Client ID, and Client Secret to your deployment.

Audience: IT (the enabler)

Replace <YOUR_HOSTNAME> with your deployment's hostname, and <YOUR_AUTH0_DOMAIN> with your Auth0 tenant domain (e.g. your-tenant.us.auth0.com).

What you'll collect

ValueWhere it comes fromEnvironment variable
Discovery URLYour Auth0 domain's OpenID configuration (see Step 4)AS_API_OIDC_SERVER
Client IDThe application's Settings tabAS_API_OIDC_CLIENT_ID
Client SecretThe application's Settings tabAS_API_OIDC_CLIENT_SECRET

Step 1: Create the application

  1. In the Auth0 Dashboard (opens in a new tab), go to Applications > Applications and click Create Application.
  2. Give it a name (for example, "Sema4.ai Agents"), choose Regular Web Applications, and click Create.

Regular Web Applications use the authorization code flow by default, which is what the platform needs.

Step 2: Configure the callback URL

On the application's Settings tab, fill in these four fields, then Save Changes:

FieldValue
Allowed Callback URLshttps://<YOUR_HOSTNAME>/api/v1/auth/callback
Allowed Logout URLshttps://<YOUR_HOSTNAME>
Application Login URIhttps://<YOUR_HOSTNAME>/login
Allowed Web Originshttps://<YOUR_HOSTNAME>

The Application Login URI must be https, so Auth0 rejects a localhost value here.

Step 3: Capture the credentials

From the Settings tab, copy:

  • Client ID (your Client ID → AS_API_OIDC_CLIENT_ID).
  • Client Secret (your Client Secret → AS_API_OIDC_CLIENT_SECRET).
  • Domain, which you use to build the Discovery URL in the next step.

Step 4: Get the Discovery URL

Your Discovery URL (→ AS_API_OIDC_SERVER) is your Auth0 domain's OpenID configuration endpoint:

https://<YOUR_AUTH0_DOMAIN>/.well-known/openid-configuration

For example, https://your-tenant.us.auth0.com/.well-known/openid-configuration. See Auth0's OIDC discovery docs (opens in a new tab).

Step 5: Restrict who can sign in (optional)

Auth0 offers several ways to limit who can access the application: enabling only specific connections for this application, using Organizations, or adding an Action that allows only certain users or groups. Configure this to match your Auth0 setup.

Step 6: Finalize

You now have the three values from the table at the top of this page:

  • Discovery URL (AS_API_OIDC_SERVER)
  • Client ID (AS_API_OIDC_CLIENT_ID)
  • Client Secret (AS_API_OIDC_CLIENT_SECRET)

Set these on your deployment when you install the application. See Single sign-on and identity for where they go.

Microsoft Entra IDOkta