# Set up Auth0 for evaluation

> Ground-up Auth0 path for Fully Managed evaluations: tenant, Redirect URI from the wizard, Auth0 app, paste SSO, finish onboarding, confirm sign-in.

# Set up Auth0 for evaluation

  Choose this path when you lack corporate IdP admin access (or prefer not to use the corporate IdP for a PoC). Complete every step below in order: this is the full Auth0 setup for [Step 1 of the fast track](/agent-router-enterprise/fully-managed/fast-track/#sign-in-and-onboard). When you finish, SSO works and the Admin Dashboard shows providers and models.

:::info One linear path
Do not treat Auth0 setup and Management plane onboarding as separate jobs. You will open the onboarding wizard mid-flow to copy the Redirect URI, finish Auth0, paste credentials back into the same wizard, then complete onboarding.
:::

:::warning
Only change the settings listed below. Leave everything else at its default.
:::

## What you will have when done

| Value | Where it comes from |
| :---- | :---- |
| **Issuer** | `https://<DOMAIN>/` *(trailing slash)* from the Auth0 Domain |
| **Discovery URL** | `https://<DOMAIN>/.well-known/openid-configuration` |
| **Client ID** | Auth0 application Settings |
| **Client Secret** | Auth0 application Settings |

You also register in Auth0: **Allowed Callback URLs**, **Allowed Web Origins**, and optionally **Allowed Logout URLs**.

## Step 1: create an Auth0 tenant

1. Go to [https://auth0.com](https://auth0.com) and sign up (or sign in).
1. Create a tenant if prompted (any region is fine for evaluation).
1. Confirm you can open the **Auth0 Dashboard** and create applications.

## Step 2: open Management plane onboarding and copy the Redirect URI

1. Open your Admin Dashboard URL and start [Management plane onboarding](/agent-router-enterprise/fully-managed/onboarding/).
1. Complete organization details if prompted, then reach the **Configure SSO** (Corporate Login) step.
1. Click **IdP setup guide** at the top of the form. A panel opens with the tenant **Redirect URI**.
1. Use the copy icon. The URL looks like:

```text
https://auth.<tenant>.tetrate.ai/api/auth/sso/callback/corporate
```

:::tip
Always copy the Redirect URI from the IdP setup guide panel. Do not type it from memory or paste the placeholder from this page—any mismatch causes `redirect_uri_mismatch` at sign-in.
:::

Leave the wizard open on the Configure SSO step. You will paste Auth0 values into this form after Step 6.

## Step 3: create the Auth0 application

1. In the **Auth0 Dashboard**, go to **Applications**.
1. Click **+ Create Application**.
1. Select **Create Manually**.
1. Enter a recognizable name, for example `Tetrate Agent Router Enterprise`.
1. Leave **"This application is owned by a third party"** toggled **off**. Select **Regular Web Application**.
1. Click **Create**.

:::warning Do not enable third-party ownership
Leave "This application is owned by a third party" off. Third-party applications require PKCE, which this integration doesn't support — sign-in fails immediately with `invalid_request: The PKCE protocol extension is required`. This can't be changed after creation; if set wrong, delete the app and create a new one.
:::

## Step 4: configure application settings

1. Open the **Settings** tab.
1. Under **Basic Information**, copy **Domain**, **Client ID**, and **Client Secret** into a notes app.
1. Under **Application Properties**, optionally set **Application Logo** to a logo URL of your choosing (this only affects the branding your team sees on the Auth0 login screen).
1. Under **Application URIs**, set **Allowed Callback URLs** to the Redirect URI you copied in Step 2 (exact match).
1. Set **Allowed Web Origins** to your tenant hostnames:

```text
https://auth.<tenant>.tetrate.ai
https://dashboard.<tenant>.tetrate.ai
https://router.<tenant>.tetrate.ai
```

Replace `<tenant>` with the same tenant segment as in your Redirect URI (for example, if the callback host is `auth.acme.tetrate.ai`, use `acme`).

## Step 5: set the logout URL (optional)

1. Still under **Application URIs**, set **Allowed Logout URLs** to:

```text
https://auth.<tenant>.tetrate.ai
```

1. Click **Save**.

## Step 6: create an Auth0 user and note Tetrate form values

1. In Auth0, go to **User Management** → **Users** → **+ Create User**.
1. Use an email you control; set a password Auth0 allows. This email must appear under **Admin emails** in the Tetrate SSO form.

:::warning Admin emails is not optional in practice
If you leave **Admin emails** empty or omit this user's email from it, your first SSO sign-in lands as a regular, non-admin user — and because there is no email/password fallback in TARE, nobody will be able to grant admin access from inside the product. Recovering from this requires contacting Tetrate Support. Set this field before you finish Step 7.
:::

1. From the application **Settings** tab, build:

| Field | How to build it |
| :---- | :---- |
| **Issuer** | `https://<Domain>/` with a trailing slash. Example: Domain `acme.us.auth0.com` → Issuer `https://acme.us.auth0.com/` |
| **Discovery URL** | `<Issuer>/.well-known/openid-configuration` |
| **Client ID** | From Basic Information |
| **Client Secret** | From Basic Information |
| **Scopes** | `openid, profile, email` |
| **Admin emails** | The Auth0 user email from this step (plus any other admins) |
| **Attribute mapping** | Default `email` → `email` |

## Step 7: paste into the wizard and finish onboarding

1. Return to the Configure SSO step left open in Step 2.
1. Fill in Issuer, Discovery URL (if required), Client ID, Client Secret, scopes, admin emails, and attribute mapping.
1. Click **Configure**.
1. Continue the wizard: connect at least one LLM provider and select models.
1. **Skip Step 5** (data-plane credential)—Fully Managed only. Do not create, regenerate, or download a data-plane credential.
1. Complete setup.

If the wizard is already closed without SSO, configure SSO from the Admin Dashboard using [Configure SSO](/agent-router-enterprise/guides/identity-and-access-management/single-sign-on/sso-configuration-guide/) Part 1, then confirm providers and models under **Models** / **Providers**.

## Step 8: verify SSO sign-in

1. Sign out of the Admin Dashboard if you are still on initial admin credentials.
1. Sign in with the Auth0 user from Step 6 (**Sign in with SSO** / corporate login).
1. Confirm the Admin Dashboard loads and shows the providers and models you configured.
1. Confirm the default project is ready: its default gateway's **endpoint** is set to the assigned proxy host (set it if empty), your admin user is a project member, and the project-scoped models you plan to call are enabled.

## Verify (Step 1 complete)

- Auth0 Regular Web Application exists with callback and web origins from the live Redirect URI.
- SSO sign-in with the Auth0 user succeeds.
- Admin Dashboard catalog shows providers and models, and the default project is ready for traffic.

## Team prep: add teammates in Auth0

The fast track's team step needs 2 to 5 people signed in through the same Auth0 tenant. Corporate IdP invites do not apply on this path.

1. In Auth0, go to **User Management** → **Users** → **+ Create User** for each teammate (use emails they control).
1. Share the Console URL (`https://router.<tenant>.tetrate.ai`) and tell them to **Sign in with SSO** (Auth0).
1. After each teammate’s first SSO login, their Agent Router user record appears in the Admin Dashboard **Users** list.
1. Continue with [Step 6 of the fast track](/agent-router-enterprise/fully-managed/fast-track/#bring-teammates): teammates connect passthrough credentials, point their agents at the gateway, and get team budgets.

## Where to go next

Continue the [fast track](/agent-router-enterprise/fully-managed/fast-track/#first-request) to route your first request. When you reach the team step, return to [Team prep](#team-prep-add-teammates-in-auth0).