Tenants and environments

The six Auth0 tenants and when to use each one
Report issue

CSI Auth runs six Auth0 tenants. Each is a fully separate Auth0 environment with its own users, clients, connections, and configuration. Nothing is shared between them, so a user or client that exists in one tenant does not exist in another until it is created there.

The tenants

TenantPurposeDataWho changes it
sandboxExperiments and spikesDisposableAnyone
devDay-to-day developmentDevelopersCI
testAutomated and integration testingSyntheticCI
stagePre-production verificationProduction-likeRelease process
prodLive trafficReal customer dataRelease process only

Choosing a tenant

  • Trying something out, or learning the API: use sandbox. It is expected to be messy and can be reset without notice.
  • Building a feature: use dev.
  • Writing automated tests: use test so test data churn does not disturb development.
  • Verifying a release: use stage.
  • Never point local development at prod.

What differs between tenants

  • Domains and API audiences
  • Connections available, particularly enterprise connections
  • Which Actions are enabled
  • Rate limits, which are higher in production

How configuration is promoted

Tenant configuration is managed in Terraform, not through the Auth0 dashboard. Changes move forward through the environments rather than being applied directly to each one.

Data handling

prod holds real customer data. Do not copy production users into a lower tenant, and do not use production credentials outside production.