Releases: auth0/auth0-PHP
9.0.0-beta.0
⚠️ This is a beta release. It introduces breaking changes to the Management API. The Authentication API is unchanged. Please consult the v9 Migration Guide for detailed upgrade instructions.
🚀 What's New
This release marks a major milestone for the Auth0 PHP SDK: the Management API client has been completely rewritten using the Fern code generation tool, built directly from the Auth0 OpenAPI specification. This delivers complete, always-up-to-date API coverage with full type safety.
✨ Highlights
- 🏗️ Auto-generated Management API - Rebuilt from the Auth0 OpenAPI spec using Fern, ensuring complete endpoint coverage and consistency with the API
- 🔒 Strongly-typed requests & responses - No more associative arrays or manual JSON decoding. Every request parameter and response field is a typed PHP object with IDE autocompletion
- 📄 Built-in pagination -
Pager<T>implementsIteratorAggregate, automatically fetching pages as you iterate withforeach - 🔑 Automatic token management - New
ManagementClientwrapper handles OAuth 2.0 client credentials grant, token caching (PSR-6), and custom token providers out of the box - ⚡ Built-in retry middleware - Automatic retries for rate-limited (429) responses
- 🛡️ Exception-driven error handling - Non-2xx responses throw
Auth0ApiExceptionwith status code and response body, replacing manual status code checks
🔄 What's Changed
The Authentication API is completely unchanged. Auth0\SDK\Auth0, session handling, token verification, and all authentication flows work exactly as before.
The Management API has breaking changes:
| Area | v8 | v9 |
|---|---|---|
| Sub-client access | $mgmt->users()->getAll() |
$client->users->list() |
| Request params | Associative arrays | Typed classes (ListUsersRequestParameters) |
| Responses | ResponseInterface + json_decode() |
Typed objects ($user->getEmail()) |
| Pagination | HttpResponsePaginator |
foreach ($pager as $user) |
| Error handling | Check $response->getStatusCode() |
catch (Auth0ApiException $e) |
| Initialization | $auth0->management() via SdkConfiguration |
new ManagementClient(new ManagementClientOptions(...)) |
📦 Installation
composer require auth0/auth0-php:9.0.0-beta.0Running
composer require auth0/auth0-phpwithout a version constraint will install the latest stable v8 release.
🔧 Quick Start
use Auth0\SDK\API\Management\Wrapper\ManagementClient;
use Auth0\SDK\API\Management\Wrapper\ManagementClientOptions;
use Auth0\SDK\API\Management\Users\Requests\ListUsersRequestParameters;
$client = new ManagementClient(new ManagementClientOptions(
domain: 'tenant.auth0.com',
clientId: 'CLIENT_ID',
clientSecret: 'CLIENT_SECRET',
));
// List users with automatic pagination
$pager = $client->users->list(new ListUsersRequestParameters([
'perPage' => 50,
'includeTotals' => true,
]));
foreach ($pager as $user) {
echo $user->getEmail();
}📚 Resources
⚠️ Breaking Changes
- Management API methods return typed objects instead of
ResponseInterface - Management API methods accept typed request classes instead of arrays
- Sub-clients accessed as properties (
->users) instead of methods (->users()) getAll()renamed tolist()across all endpointsHttpResponsePaginatorreplaced byPager<T>- Non-2xx responses throw
Auth0ApiExceptionautomatically - Minimum PHP version remains 8.2 (unchanged from v8.19.0)
🙏 Feedback
This is a beta release - we would love your feedback! Please open an issue if you encounter any problems or have suggestions.
8.19.0
Fixed
- Security fix: Resolve CVE-2026-34236
Changed
- Dropped support for PHP 8.1 (EOL since Dec 2025). The minimum supported PHP version is now 8.2.
8.18.0
Changes
Security fix: Resolve CVE-2025-68129
8.17.0
Changes
Security fix: Resolve CVE-2025-58769
8.16.0
8.15.0
Added
- feat: Adding M2M Quota Support #788 (kishore7snehil)
8.14.0
Fixed
- Security fix: Resolve CVE-2025-47275
8.13.0
8.12.0
Added
-
Adding client credentials support #775 (kishore7snehil)
-
Adding Support For CYOK #779 (kishore7snehil)
Fixed
- fix jobs test fail #773 (yasuaki640)
8.11.1
Fixed
- fix: Resolve erroneous exception throw on tenant domain validation #755 (ramonschriks)