Nametag Docs
Get help Launch Nametag
Integrations Auth0

How to set up self-service account recovery with Auth0

This tutorial describes how to configure Nametag for self-service account recovery with Auth0. Once connected, your users can verify their identity with a government ID and a selfie, then reset their own MFA or password in your Auth0 tenant — without a help-desk ticket.

1. Create a machine-to-machine application in Auth0

Nametag calls the Auth0 Management API using a machine-to-machine (M2M) application that you create in your own tenant.

  1. Sign in to the Auth0 Dashboard.

  2. Go to Applications → Applications and press Create Application.

  3. Choose Machine to Machine Applications, name it (for example, Nametag Recovery), and create it.

  4. Authorize it for the Auth0 Management API.

  5. Grant only these three scopes:

    • read:users
    • delete:authentication_methods
    • create:user_tickets

    Note: Nametag never requests update:users or delete:users. It only looks up a user, removes their enrolled MFA factors, and issues a password-change ticket.

  6. From the application’s Settings tab, copy the Domain, Client ID, and Client Secret.

2. Connect Auth0 in the Nametag console

  1. Sign in to Nametag at https://www.getnametag.com and press Configure.

  2. Choose Auth0, then press Connect.

  3. Enter the three values you copied from Auth0:

    • Auth0 Domain — your tenant domain ending in .auth0.com (for example, example.us.auth0.com). Use the tenant domain, not a custom sign-in domain.
    • Client ID
    • Client Secret

  4. Press Connect to Auth0. Nametag validates the credentials and confirms that the required scopes were granted. If a scope is missing, Nametag tells you which one, so you can grant it in Auth0 and try again.

    Note: You enter your Auth0 credentials here — you never paste a Nametag key. Nametag stores the client secret encrypted and uses it only to perform resets for verified users.

3. Choose self-service permissions

Decide which actions verified users may perform:

  • Reset MFA — removes the user’s enrolled authentication methods so they can enroll a new one.
  • Reset password — issues a password-change link the user can follow to set a new password.

You can also set the minimum assurance required before any reset is allowed.

4. Synchronize users

Nametag synchronizes user accounts from your Auth0 tenant automatically. To synchronize immediately, press Sync now on the directory’s page.

5. Set up your recovery website

  1. Choose a URL for your account-recovery site, hosted under a domain your users recognize (for example, accounts.example.com). Nametag hosts the site.

  2. Point that host at Nametag with a CNAME record targeting nametaghosted.com:

    accounts.example.com. IN CNAME nametaghosted.com.

  3. Email help@nametag.co to let us know your URL is ready, and we’ll finish setting up your site.

6. Direct your users

Send your users to the new URL to verify their identity and recover their accounts if they’re ever locked out. See the self-service account recovery end-user’s guide for what they’ll experience.