Auth0

Auth0

Detect intent → detect framework → detect tooling → load 2–3 reference files.

---

Step 1: Detect intent

Match the request against the What the developer wants column — it describes the goal in plain language, not just the Auth0 term (someone who says "make users confirm with a code from their phone" lands on feature:mfa). The Intent you pick is a lookup key: in Step 4 it appears verbatim as a section heading (### feature:mfa) listing which reference files to load.

---

Step 2: Detect framework

Skip this step for the tooling intent — a CLI-first request has no framework. Go to Step 3, load the tooling reference; only ask about a framework if the developer later pivots to integrating auth into an app.

Work top-down. Stop at the first tier that yields a framework.

Tier 1 — Auth0 SDK already installed (strongest signal)

Read the project files. Stop at the first match.

Node.js / JavaScript / TypeScript — check package.json → dependencies

Rows are most-specific first — an Ionic/Capacitor project also carries @auth0/auth0-angular (etc.), so check the @capacitor/browser rows first.

Python — check requirements.txt or pyproject.toml

Java / Kotlin — check build.gradle or pom.xml

.NET — check *.csproj or NuGet.Config

PHP — check composer.json

auth0/auth0-php powers both PHP web apps and APIs; the mode is set via SdkConfiguration's strategy. The STRATEGY_API row is more specific — check it first.

If auth0/auth0-php is installed but no SdkConfiguration strategy is set yet (fresh project), fall through to variant disambiguation below (intent: building/protecting an API → php-api, else php).

Go — check go.mod

Mobile (native)

Tier 2 — Framework from non-Auth0 workspace dependencies

If no Auth0 SDK matched, detect the framework from ordinary (non-Auth0) dependencies. Stop at the first match. For a web-vs-API split, the base is chosen here; the variant is resolved in "Variant disambiguation" below. Rows are most-specific first — an Ionic project also carries @angular/core / vue / react, so check the @ionic/* rows first (as in Tier 1).

react note: a plain React project maps to react for an SPA using the React SDK, or spa-js if the app is framework-agnostic vanilla JS. If unclear, ask before loading.

Tier 3 — Framework from the prompt

If no workspace signal matched, read the developer's request for a framework or language name and map it here. Stop at the first match.

Variant disambiguation (web app vs API)

Some frameworks have separate web-app and API references. When Tier 1 did not pin the variant, choose intent-first:

If intent is still ambiguous (both a UI and protected endpoints, or unclear), state what you detected and ask the developer web app vs API before loading.

If nothing matched

Ask the developer what framework/language they are using. Do not guess.

Conflicts

If Tier 2 (workspace) and Tier 3 (prompt) disagree materially (e.g. the prompt says "Next.js" but package.json has no next), state the conflict and ask rather than silently picking. Workspace signals outrank the prompt when both are present and consistent.

---

Step 3: Detect tooling

Read the project file tree. This is a project-context decision, not a product preference.

---

Step 4: Load reference files

Find the section below whose heading matches the Intent you picked in Step 1, then read the reference files it lists.

integrate

Read: references/framework-{framework}.md
Read: references/tooling-{tooling}.md
Follow the integration workflow in framework-{framework}.md.
Use tooling-{tooling}.md for all Auth0 tenant configuration steps.

feature:mfa

Read: references/feature-mfa.md
Read: references/tooling-{tooling}.md
If framework detected: Read references/framework-{framework}.md (for SDK-side step-up trigger)

feature:organizations

Read: references/feature-organizations.md
Read: references/tooling-{tooling}.md
If framework detected: Read references/framework-{framework}.md
If multi-tenant architecture / B2B SaaS design question: also Read references/pattern-multi-tenant.md

feature:custom-domains

Read: references/feature-custom-domains.md
Read: references/tooling-{tooling}.md

feature:acul

Read: references/feature-acul.md
Read: references/tooling-{tooling}.md

feature:branding

Read: references/feature-branding.md
Read: references/tooling-{tooling}.md

feature:dpop

Read: references/feature-dpop.md
Read: references/tooling-{tooling}.md
If a SPA framework is detected (vue/react/angular/spa-js): Read references/framework-{framework}.md
DPoP is SPA-only (no SSR: Next.js/Nuxt) — feature-dpop.md states the exclusion.

guidance

Read: references/pattern-security.md
If framework detected: Read references/framework-{framework}.md (for SDK-specific guidance — token storage, session handling, route protection)
If token handling / JWT vs opaque / storage: Read references/pattern-token-handling.md
If multi-tenant / B2B architecture: Read references/pattern-multi-tenant.md + references/feature-organizations.md

debug

Read: references/pattern-common-errors.md
If framework detected: Read references/framework-{framework}.md

debug:rate-limit

Read: references/pattern-rate-limiting.md

migrate

Read: references/feature-migration.md
Read: references/tooling-{tooling}.md
If framework detected: Read references/framework-{framework}.md

upgrade-sdk

Read: references/framework-{framework}.md
Follow its "Major Version Migration" section (e.g. Auth0.swift v3, Auth0.Android v4).
This is an Auth0 SDK version bump — NOT a provider migration. Do not load feature-migration.md.
If no framework is detected: ask which Auth0 SDK the developer is upgrading.

tooling

Read: references/tooling-{tooling}.md
No framework file — this is a CLI/tooling-only task (create apps/APIs, script
tenant setup, automate config in CI). If the developer then wants to integrate
auth into an app, return to Step 1 with the integrate intent.