Set up Auth0 for evaluation

Choose this path where corporate IdP admin access is unavailable (or where the corporate IdP is not preferred for a PoC). Complete every step below in order: this is the full Auth0 setup for Step 1 of the fast track. On completion, SSO works and the Admin Console shows providers and models.

One linear path

Do not treat Auth0 setup and Management plane onboarding as separate jobs. The onboarding wizard is opened mid-flow to copy the Redirect URI, then Auth0 is finished, the credentials are pasted back into the same wizard, and onboarding is completed.

warning

Only change the settings listed below. Leave everything else at its default.

What is in place when done

Value	Where it comes from
Issuer	https://<DOMAIN>/ (trailing slash) from the Auth0 Domain
Discovery URL	https://<DOMAIN>/.well-known/openid-configuration
Client ID	Auth0 application Settings
Client Secret	Auth0 application Settings

Also registered in Auth0: Allowed Callback URLs, Allowed Web Origins, and optionally Allowed Logout URLs.

Step 1: create an Auth0 tenant

1. Go to https://auth0.com and sign up (or sign in).
2. Create a tenant if prompted (any region is fine for evaluation).
3. Confirm that the Auth0 Dashboard opens and applications can be created.

Step 2: open Management plane onboarding and copy the Redirect URI

1. Open the Admin Console URL and start Management plane onboarding.
2. Complete organization details if prompted, then reach the Configure SSO (Corporate Login) step.
3. Click IdP setup guide at the top of the form. A panel opens with the tenant Redirect URI.
4. Use the copy icon. The URL looks like:

https://auth.<tenant>.tetrate.ai/api/auth/sso/callback/corporate

tip

Always copy the Redirect URI from the IdP setup guide panel. Do not type it from memory or paste the placeholder from this page: any mismatch causes redirect_uri_mismatch at sign-in.

Leave the wizard open on the Configure SSO step. Auth0 values are pasted into this form after Step 6.

Step 3: create the Auth0 application

1. In the Auth0 Dashboard, go to Applications.
2. Click + Create Application.
3. Select Create Manually.
4. Enter a recognizable name, for example Tetrate Agent Router Enterprise.
5. Leave "This application is owned by a third party" toggled off. Select Regular Web Application.
6. Click Create.

Do not enable third-party ownership

Leave "This application is owned by a third party" off. Third-party applications require PKCE, which this integration doesn't support, sign-in fails immediately with invalid_request: The PKCE protocol extension is required. This can't be changed after creation; if set wrong, delete the app and create a new one.

Step 4: configure application settings

1. Open the Settings tab.
2. Under Basic Information, copy Domain, Client ID, and Client Secret into a notes app.
3. Under Application Properties, optionally set Application Logo to any logo URL (this only affects the branding shown to the team on the Auth0 login screen).
4. Under Application URIs, set Allowed Callback URLs to the Redirect URI copied in Step 2 (exact match).
5. Set Allowed Web Origins to the tenant hostnames:

https://auth.<tenant>.tetrate.ai
https://dashboard.<tenant>.tetrate.ai
https://router.<tenant>.tetrate.ai

Replace <tenant> with the same tenant segment as in the Redirect URI (for example, if the callback host is auth.acme.tetrate.ai, use acme).

Step 5: set the logout URL (optional)

1. Still under Application URIs, set Allowed Logout URLs to:

https://auth.<tenant>.tetrate.ai

1. Click Save.

Step 6: create an Auth0 user and note Tetrate form values

1. In Auth0, go to User Management → Users → + Create User.
2. Use a reachable email address; set a password Auth0 allows. This email must appear under Admin emails in the Tetrate SSO form.

Admin emails is not optional in practice

If Admin emails is left empty or omits this user's email, the first SSO sign-in lands as a regular, non-admin user, and because there is no email/password fallback in TARE, nobody will be able to grant admin access from inside the product. Recovering from this requires contacting Tetrate Support. Set this field before finishing Step 7.

1. From the application Settings tab, build:

Field	How to build it
Issuer	https://<Domain>/ with a trailing slash. Example: Domain acme.us.auth0.com → Issuer https://acme.us.auth0.com/
Discovery URL	<Issuer>/.well-known/openid-configuration
Client ID	From Basic Information
Client Secret	From Basic Information
Scopes	openid, profile, email
Admin emails	The Auth0 user email from this step (plus any other admins)
Attribute mapping	Default email → email

Step 7: paste into the wizard and finish onboarding

1. Return to the Configure SSO step left open in Step 2.
2. Fill in Issuer, Discovery URL (if required), Client ID, Client Secret, scopes, admin emails, and attribute mapping.
3. Click Configure.
4. Continue the wizard: connect at least one LLM provider and select models.
5. Skip Step 5 (data-plane credential): Fully Managed only. Do not create, regenerate, or download a data-plane credential.
6. Complete setup.

If the wizard is already closed without SSO, configure SSO from the Admin Console using Configure SSO Part 1, then confirm providers and models under Models / Providers.

Step 8: verify SSO sign-in

1. Sign out of the Admin Console if the session is still on initial admin credentials.
2. Sign in with the Auth0 user from Step 6 (Sign in with SSO / corporate login).
3. Confirm the Admin Console loads and shows the configured providers and models.
4. Confirm the default project is ready: its default gateway's endpoint is set to the assigned proxy host (set it if empty), the admin user is a project User, and the project-scoped models to be called are enabled.

Verify (Step 1 complete)

• Auth0 Regular Web Application exists with callback and web origins from the live Redirect URI.
• SSO sign-in with the Auth0 user succeeds.
• Admin Console catalog shows providers and models, and the default project is ready for traffic.

Team prep: add teammates in Auth0

The fast track's team step needs 2 to 5 people signed in through the same Auth0 tenant. Corporate IdP invites do not apply on this path.

1. In Auth0, go to User Management → Users → + Create User for each teammate (use emails they control).
2. Share the Console URL (https://router.<tenant>.tetrate.ai) and tell them to Sign in with SSO (Auth0).
3. After each teammate's first SSO login, their Agent Router user record appears in the Admin Console Users list.
4. Continue with Step 6 of the fast track: teammates connect passthrough credentials, point their agents at the gateway, and get team budgets.

Where to go next

Continue the fast track to route the first request. At the team step, return to Team prep.