Invite Organization Members
Availability varies by Auth0 plan and login method
Both the login implementation you use and your Auth0 plan or custom agreement affect whether this feature is available. To learn more, read New Universal Login vs. Classic Universal Login and Pricing.
If you would like to assign a member to an Organization, but the user does not yet exist in your data store (or the user exists in your data store but is not yet a member of your organization), you can invite them to the organization. In this case, the user will receive an email containing a link that will allow them to create an account or log in and join the organization, optionally with predefined roles, and be redirected to your application so that they can immediately start using it.
Organization member roles are separate from the roles assigned to users through Auth0's Role-Based Access Control. When a predefined role is applied to a user who accepts an invitation to an Organization, the assigned role only applies when the user is logging in via that Organization. You can see Organization Member roles in the Dashboard.
To configure the invitation flow:
Limitations
Auth0 can send user invitations only via email. If you prefer to send the invitation in another way, you can choose to only generate an invitation URL.
Invited users must log in or create an account with the email address to which the invitation was sent.
Integrate the membership invitation flow into your application
For user invitations to work, you must set up a route in your application as part of the invitation acceptance flow and configure an associated default login route for your tenant or application. A link to the configured URI will be included in the email invitation that is sent to users.
Configure the URI
If the URI should be shared across all of your applications, you can set the Tenant Login URL at Auth0 Dashboard > Settings > Advanced. Otherwise, you can set the URI on a per-application basis by using Application Login URI in your application's settings, which you can reach from Auth0 Dashboard > Applications > Applications.
Specify route behavior
The route in your application must accept the invitation and organization parameters in the query string, and then call the Auth0 Authentication API Authorization endpoint with both parameters.
To support multi-tenant scenarios where the organization name is used as a subdomain or path variable in your application (for example, acme.myapp.com), the organization_name parameter is also included in the invitation link sent to users. This parameter does not need to be sent to the Authentication API Authorization endpoint.
For example, if you have an organization-enabled application with an Application Login URI set to https://myapp.com/login, then the link in the email invitation sent to the end user would be: https://myapp.com/login?invitation={invitation_ticket_id}&organization={organization_id}&organization_name={organization_name}.
Customize the user invitation flow
To customize the user invitation flow, you must use custom domains, which is a feature of any paid pricing plan.
To customize the user invitation prompt and email that the user receives, modify the Universal Login prompt and email templates. To learn more, read these pages:
Localization
Since the locale of the invited user is not known ahead of time, you can send an optional user_metadata parameter to the invitation endpoint using the Management API. When localizing the user invitation flow, you can access this parameter through the User Invitation email template and use the same logic as you would with other multilingual email templates.
For the invited user to see the invitation in the appropriate language, your application will need to send the ui_locales parameter or the invited user's browser must send the appropriate Accept-Language header. To learn more, read Customize Email Templates: Multilingual Email Templates.
Send membership invitations
You can send organization membership invitations to users using either the Auth0 Dashboard or the Management API. If you prefer to send the invitation using your own email service, you can choose to only generate an invitation URL. Otherwise, the user will receive an email containing the link, which will allow them to log in to the organization using a configured connection.
When a user accepts an invitation, their email address will be marked as verified.
If the user accepts an invitation through federated login, then the identity provider must return the email address that matches the email address to which the invitation was sent. The email verification will not be overridden with the value returned by the identity provider on subsequent logins.