Set up Auth0 for evaluation

Choose this path when you lack corporate IdP admin access (or prefer not to use the corporate IdP for a PoC). Complete every step below in order: this is the full Auth0 setup for Step 1 of the fast track. When you finish, SSO works and the Admin Dashboard shows providers and models.

One linear path

Do not treat Auth0 setup and Management plane onboarding as separate jobs. You will open the onboarding wizard mid-flow to copy the Redirect URI, finish Auth0, paste credentials back into the same wizard, then complete onboarding.

What you will have when done

Value	Where it comes from
Issuer	https://<DOMAIN>/ (trailing slash) from the Auth0 Domain
Discovery URL	https://<DOMAIN>/.well-known/openid-configuration
Client ID	Auth0 application Settings
Client Secret	Auth0 application Settings

You also register in Auth0: Allowed Callback URLs, Allowed Web Origins, and optionally Allowed Logout URLs.

Step 1: create an Auth0 tenant

1. Go to https://auth0.com and sign up (or sign in).
2. Create a tenant if prompted (any region is fine for evaluation).
3. Confirm you can open the Auth0 Dashboard and create applications.

Step 2: open Management plane onboarding and copy the Redirect URI

1. Open your Admin Dashboard URL and start Management plane onboarding.
2. Complete organization details if prompted, then reach the Configure SSO (Corporate Login) step.
3. Click IdP setup guide at the top of the form. A panel opens with the tenant Redirect URI.
4. Use the copy icon. The URL looks like:

https://auth.<tenant>.tetrate.ai/api/auth/sso/callback/corporate

tip

Always copy the Redirect URI from the IdP setup guide panel. Do not type it from memory or paste the placeholder from this page—any mismatch causes redirect_uri_mismatch at sign-in.

Leave the wizard open on the Configure SSO step. You will paste Auth0 values into this form after Step 6.

Step 3: create the Auth0 application

1. In the Auth0 Dashboard, go to Applications.
2. Click + Create Application.
3. Select Create Manually.
4. Enter a recognizable name, for example Tetrate Agent Router Enterprise.
5. Select Regular Web Application.
6. Click Create.

Step 4: configure application settings

1. Open the Settings tab.
2. Under Basic Information, copy Domain, Client ID, and Client Secret into a notes app.
3. Under Application Properties, set Application Logo to:

https://router.internal.tetrate.ai/favicon.svg

1. Under Application URIs, set Allowed Callback URLs to the Redirect URI you copied in Step 2 (exact match).
2. Set Allowed Web Origins to your tenant hostnames:

https://auth.<tenant>.tetrate.ai
https://dashboard.<tenant>.tetrate.ai
https://router.<tenant>.tetrate.ai

Replace <tenant> with the same tenant segment as in your Redirect URI (for example, if the callback host is auth.acme.tetrate.ai, use acme).

Step 5: set the logout URL (optional)

1. Still under Application URIs, set Allowed Logout URLs to:

https://auth.<tenant>.tetrate.ai

1. Click Save.

Step 6: create an Auth0 user and note Tetrate form values

1. In Auth0, go to User Management → Users → + Create User.
2. Use an email you control; set a password Auth0 allows. This email must appear under Admin emails in the Tetrate SSO form.
3. From the application Settings tab, build:

Field	How to build it
Issuer	https://<Domain>/ with a trailing slash. Example: Domain acme.us.auth0.com → Issuer https://acme.us.auth0.com/
Discovery URL	<Issuer>/.well-known/openid-configuration
Client ID	From Basic Information
Client Secret	From Basic Information
Scopes	openid, profile, email
Admin emails	The Auth0 user email from this step (plus any other admins)
Attribute mapping	Default email → email

Step 7: paste into the wizard and finish onboarding

1. Return to the Configure SSO step left open in Step 2.
2. Fill in Issuer, Discovery URL (if required), Client ID, Client Secret, scopes, admin emails, and attribute mapping.
3. Click Configure.
4. Continue the wizard: connect at least one LLM provider and select models.
5. Skip Step 5 (data plane credential)—Fully Managed only.
6. Complete setup.

If the wizard is already closed without SSO, configure SSO from the Admin Dashboard using Configure SSO Part 1, then confirm providers and models under Models / Providers.

Step 8: verify SSO sign-in

1. Sign out of the Admin Dashboard if you are still on initial admin credentials.
2. Sign in with the Auth0 user from Step 6 (Sign in with SSO / corporate login).
3. Confirm the Admin Dashboard loads and shows the providers and models you configured.

Verify (Step 1 complete)

• Auth0 Regular Web Application exists with callback and web origins from the live Redirect URI.
• SSO sign-in with the Auth0 user succeeds.
• Admin Dashboard catalog shows providers and models.

Team prep: add teammates in Auth0

The fast track's team step needs 2 to 5 people signed in through the same Auth0 tenant. Corporate IdP invites do not apply on this path.

1. In Auth0, go to User Management → Users → + Create User for each teammate (use emails they control).
2. Share the Console URL (https://router.<tenant>.tetrate.ai) and tell them to Sign in with SSO (Auth0).
3. After each teammate’s first SSO login, their Agent Router user record appears in the Admin Dashboard Users list.
4. Continue with Step 6 of the fast track: teammates connect passthrough credentials, point their agents at the gateway, and get team budgets.

Where to go next

Continue the fast track to route your first request. When you reach the team step, return to Team prep.