⚠️ This is a beta release. It moves the SDK onto auth0-php v9, which rewrites the Management API. The Authentication API is unchanged. Please consult the v7 to v8 Upgrade Guide before upgrading.

🚀 What's New

This release makes the Auth0 Laravel SDK compatible with auth0-php v9. The SDK wraps the Authentication API, which is unchanged in v9, so authentication flows require no changes. The changes are all in the Management API surface.

✨ Highlights

• 🔑 management() returns the base ManagementClient - Auth0::management() and $guard->management() return a v9 ManagementClient built from your existing guard configuration (domain, client_id, client_secret), with automatic client credentials token management and PSR-6 caching
• 🏗️ auth0-php v9 Management API - Strongly-typed requests and responses, sub-clients accessed as properties ($management->users->list()), and built-in Pager<T> pagination
• ⚙️ Configurable options - management() accepts an options array (timeout, maxRetries, additionalHeaders, and more), settable per call or as defaults under a management key in config/auth0.php (global or per-guard)
• 🛡️ Authentication API unchanged - Guards, middleware, user providers, session store, and events behave exactly as in v7

🔄 What's Changed

The Authentication surface is completely unchanged. Login, logout, callback, and token handling work exactly as before.

The Management API usage has changed:

📦 Installation

composer require auth0/login:8.0.0-beta.0

🔧 Quick Start

use Auth0\Laravel\Facade\Auth0;
use Auth0\SDK\API\Management\Users\Requests\ListUsersRequestParameters;

$management = Auth0::management();

$users = $management->users->list(
    new ListUsersRequestParameters(['perPage' => 25, 'page' => 0, 'includeTotals' => true])
);

foreach ($users as $user) {
    echo $user->getEmail();
}

⚠️ Breaking Changes

• Bumped the auth0/auth0-php dependency from ^8.19 to ^9.0
• management() now returns the base ManagementClient instead of ManagementInterface
• Removed the deprecated/ v6 to v7 compatibility shims

📚 Resources

• v7 to v8 Upgrade Guide
• auth0-php v9 API Reference

🙏 Feedback

This is a beta release - we would love your feedback! Please open an issue if you encounter any problems or have suggestions.

Added

• Laravel 13 support #491 (cosmastech)

Fixed

• Add missing hashPasswordForCookie to AuthenticationGuard #492 (steffjenl)

Changed

• Add PHP 8.4 to CI test matrix, cap Psalm <6.5, disable static_lambda CS rule for PHP 8.5+ compat #491 (kishore7snehil)

Fixed

• Security fix: Resolve CVE-2026-34236

Fixed

• Security fix: Resolve CVE-2025-68129

Fixed

• Security fix: Resolve CVE-2025-58769

Contributing Changes

Added:

• feat: add macroable guards (#459) by erikn69
• docs: Added facade methods documentation for better developer guidance (#466) by lucascbittencourt

Fixed:

• docs: Update CHANGELOG.md (#465) by nickescobedo

Fixed

• Security fix: Resolve CVE-2025-47275

Added

• Laravel 12 Support #470 (lee-to)

Fixed

• refactor: fix failing tests #471 (noevidenz)

Changed

• perf: Update getCredential to only refresh credential once per request #453 (ComputerTinker)

Changed

• refactor: add additional Telescope state check #447 (samuelhgf)
• chore(deps): replace temporary psalm-laravel-plugin fork with official #448 (alies-dev)