How log delivery works
You do not create Log Streams, ingest URLs, or pollers manually. If Log Stream provisioning is unavailable on your Auth0 plan, the connection stays active and Flarehawk ingests through the poller.
Prerequisites
- An active Flarehawk account with Auth0 available for your organization.
- An Auth0 tenant administrator who can create applications and authorize the Auth0 Management API.
- A Machine to Machine application in that same Auth0 tenant (not a Regular Web App, and not an app in a different tenant).
Required Management API scopes
Authorize your M2M app for the Auth0 Management API and grant:
Flarehawk uses the OAuth 2.0 client credentials grant with the Client ID and Client secret from your tenant-local M2M app. No redirect URIs or refresh tokens are required.
Connect Auth0 to Flarehawk
1
Create a Machine to Machine application
In the Auth0 Dashboard, open Applications → Applications → Create Application. Choose
Machine to Machine Applications, name it (for example Flarehawk), and create it.Leave Client ID Metadata URL empty. That field is for Auth0’s third-party Client ID
Metadata Document (CIMD) registration and cannot authorize the Management API Flarehawk needs.
2
Keep the app first-party and authorize the Management API
Do not enable “This application is owned by a third party. Enable stricter security
controls.” That toggle disables Auth0 Management API access and will block Flarehawk connect.When Auth0 asks which API to authorize, select Auth0 Management API. Enable every scope in
the table above, then authorize. You can change permissions later under APIs → Auth0
Management API → Machine to Machine Applications.
3
Copy Domain, Client ID, and Client Secret
Open the app Settings tab. Copy Domain (hostname only, for example
dev-abc.us.auth0.com), Client ID, and Client Secret.4
Open the connection wizard
In Flarehawk, go to Manage → Connections → Add Connection and choose Auth0.
5
Paste credentials and test
Enter the tenant domain, Client ID, and Client secret, then click Test connection. Flarehawk
validates access with the client credentials grant against your tenant’s Management API.
6
Create the connection
Click Create connection. Flarehawk stores the credentials encrypted, discovers the Auth0
tenant asset, and attempts to create a managed Log Stream. If your Auth0 plan does not support
HTTP Log Streams, Flarehawk keeps the connection active and ingests via the Management API
poller instead.
7
Verify ingestion
Generate a sign-in (success or failure) in Auth0, then open Monitor → Logs, filter by
provider Auth0, and confirm events appear with the correct organization and connection.
Poller delivery may lag by one schedule interval (typically up to about 15 minutes).
Disconnect
When you disconnect the Auth0 connection in Flarehawk, Flarehawk deletes only that connection’s managed Log Stream (when one was created). Your M2M application in Auth0 is left in place so you can reconnect later; rotate or delete the Auth0 application yourself if you no longer need it.Troubleshooting
Test connection fails with unauthorized or insufficient scope
Confirm the M2M app is in the same Auth0 tenant as the Domain you entered, and that Auth0 Management API authorization includes every scope in the table above. Also confirm the app is first-party — if “This application is owned by a third party…” is enabled, Management API access is unavailable and Flarehawk cannot connect.Test connection fails with invalid client
Confirm you copied Client ID and Client Secret from the M2M app Settings tab — not from a Regular Web App, SPA, a Client ID Metadata URL registration, or a different tenant.Can I use Client ID Metadata URL instead of pasting a Client secret?
No. Auth0 Client ID Metadata Documents are for third-party clients only, and third-party apps cannot be authorized for the Auth0 Management API. Flarehawk requires a first-party Machine to Machine app with Domain, Client ID, and Client secret.Auth0 says my plan does not support Log Streams
Some Auth0 subscription tiers cannot create HTTP Log Streams (Auth0 may show a Log Stream conflict or plan limitation). Flarehawk still connects successfully and uses the Management API poller as the primary delivery path. You do not need to create a stream manually.No events after connect
- Confirm Test connection succeeded and the connection status is active under Manage → Connections.
- Generate a fresh login (or other) event in Auth0.
- Wait for the next poller interval if Log Stream delivery is not available on your plan, then refresh Monitor → Logs filtered to provider Auth0.
- If a Flarehawk Log Stream exists under Monitoring → Streams in Auth0 and it is paused, reconnect or run connection sync in Flarehawk so the stream can be repaired.