Skip to main content
Auth0 log streams deliver tenant logs in near real time to a custom webhook. Set the webhook’s Payload URL to your Flashduty push URL to send security-relevant tenant logs to Flashduty On-call: leaked password logins (pwd_leak), attack protection blocks (limit_wc, limit_mu, and others), failed logins and signups (f, fu, fp, fs, and others), MFA failures, and API rate limits. Successful logins, successful management operations, and other non-security logs do not create alerts.

In Flashduty On-call

You can get the integration push URL in either of the following ways.

Use a dedicated integration

  1. In the Flashduty console, select Channel and open a channel
  2. Select Configuration → Integrations → Private integration, then click Add integration
  3. Select Auth0 and click Save
  4. Open the generated integration card and copy the Push URL

Use a shared integration

  1. In the Flashduty console, go to Integration Center → Alert Events
  2. Select Auth0 and enter an integration name
  3. Configure the default route and select a channel. You can add more rules under Routing after creation
  4. Click Save and copy the generated Push URL

In Auth0

1

Create the log stream

Where: Auth0 Dashboard › Monitoring › Streams › Create Stream › Custom Webhook (older dashboards label Streams as Log Streams)Click Save when done.The Payload URL must be an HTTPS address with a certificate from a trusted authority. Auth0 does not support self-signed certificates.
2

Trigger and verify

Where: Auth0 Dashboard › Monitoring › Streams
  1. Open the stream’s Health page and confirm Stream Status is Active
  2. Log in to a test application with a wrong password to produce an fp (wrong password) log
  3. Confirm the alert arrives in Flashduty. If it does not, check the log stream delivery errors under Monitoring → Logs in Auth0
Auth0 log streams have no “send test notification” button, so verify with a real log.

Events and recovery

Auth0 sends each tenant log once and never sends an update or a recovery. Each log has a unique log_id, which Flashduty uses as the Alert Key. A retried delivery of the same log does not create a duplicate alert, and different logs each create their own Flashduty alert. Alerts do not recover automatically. Turn on the channel’s auto-resolve timeout (24 hours suggested), or close alerts by hand after handling them. When the same source IP triggers many logs, configure a noise-reduction rule on the channel to merge them into one incident.

Alert key

The Alert Key is computed from the log’s log_id. An alertable log without log_id is rejected with an invalid-parameter error.

Status and severity

Severity follows the log type code (type); logs with any other type code are ignored: For the full list of type codes, see Auth0 log event type codes.

Labels

The alert description comes from the log’s description and details.error.message. Flashduty does not read the user’s email, the User-Agent, or other fields.

Troubleshooting

  • Flashduty returns an invalid-parameter error: confirm Content Type is application/json and check the integration_key in the Payload URL
  • No alert arrives: confirm the log type is in the table above, the Health tab shows Active, and the stream’s event category filter does not exclude that type
  • Too many alerts: narrow the categories under Filter by Event Category and configure a noise-reduction rule on the channel
  • Alerts never close: Auth0 sends no recovery, so turn on the channel’s auto-resolve timeout
For more settings, see the Auth0 documentation on custom webhook log streams.