feat: add Auth0 emulator

Author: mvanhorn

README.md

@@ -17,6 +17,12 @@ All services start with sensible defaults. No config file needed:
 - **Apple** on `http://localhost:4004`
 - **Microsoft** on `http://localhost:4005`
 - **AWS** on `http://localhost:4006`
+- **Okta** on `http://localhost:4007`
+- **MongoDB Atlas** on `http://localhost:4008`
+- **Auth0** on `http://localhost:4009`
+- **Resend** on `http://localhost:4010`
+- **Stripe** on `http://localhost:4011`
+- **Clerk** on `http://localhost:4012`
 
 ## CLI
 
@@ -141,7 +147,7 @@ afterAll(() => Promise.all([github.close(), vercel.close()]))
 
 | Option | Default | Description |
 |--------|---------|-------------|
-| `service` | *(required)* | Service name: `'vercel'`, `'github'`, `'google'`, `'slack'`, `'apple'`, `'microsoft'`, or `'aws'` |
+| `service` | *(required)* | Service name: `'vercel'`, `'github'`, `'google'`, `'slack'`, `'apple'`, `'microsoft'`, `'aws'`, `'okta'`, `'mongoatlas'`, `'auth0'`, `'resend'`, `'stripe'`, or `'clerk'` |
 | `port` | `4000` | Port for the HTTP server |
 | `seed` | none | Inline seed data (same shape as YAML config) |
 | `baseUrl` | none | Override advertised base URL. Per-service `baseUrl` in seed config takes highest priority, then this option, then `EMULATE_BASE_URL` env var (supports `{service}`), then `PORTLESS_URL` (supports `{service}`, automatically set by the `portless` CLI wrapper), then `http://localhost:<port>`. |
@@ -299,6 +305,24 @@ aws:
     roles:
       - role_name: lambda-execution-role
         description: Role for Lambda function execution
+
+auth0:
+  tenant: my-tenant
+  applications:
+    - client_id: my-app
+      client_secret: secret
+      callbacks:
+        - http://localhost:3000/api/auth/callback
+      grant_types: [authorization_code, refresh_token, client_credentials]
+  users:
+    - email: dev@example.com
+      name: Developer
+      password: pass
+  roles:
+    - name: admin
+  connections:
+    - name: Username-Password-Authentication
+      strategy: auth0
 ```
 
 ## OAuth & Integrations
@@ -399,6 +423,25 @@ microsoft:
         - "http://localhost:3000/api/auth/callback/microsoft-entra-id"
 ```
 
+### Auth0 Applications
+
+```yaml
+auth0:
+  tenant: "my-tenant"
+  applications:
+    - client_id: "my-app"
+      client_secret: "secret"
+      callbacks:
+        - "http://localhost:3000/api/auth/callback"
+      grant_types:
+        - authorization_code
+        - refresh_token
+        - client_credentials
+  apis:
+    - audience: "https://api.example.test/"
+      name: "Example API"
+```
+
 ## Vercel API
 
 Every endpoint below is fully stateful with Vercel-style JSON responses and cursor-based pagination.
@@ -655,6 +698,22 @@ Microsoft Entra ID (Azure AD) v2.0 OAuth 2.0 and OpenID Connect emulation with a
 - `GET /oauth2/v2.0/logout` - end session / logout
 - `POST /oauth2/v2.0/revoke` - token revocation
 
+## Auth0 API
+
+Auth0 identity provider emulation with tenant-aware OIDC discovery, Universal Login pages, PKCE, refresh token rotation, Userinfo, and Management API resources.
+
+- `GET /.well-known/openid-configuration` - OIDC discovery document
+- `GET /.well-known/jwks.json` - JSON Web Key Set (JWKS)
+- `GET /authorize` - authorization endpoint (shows Universal Login)
+- `POST /oauth/token` - token exchange (authorization code, refresh token, client credentials)
+- `GET /userinfo` - OpenID Connect user info
+- `GET /v2/logout` - logout
+- `GET /api/v2/users` / `POST /api/v2/users` - list and create users
+- `GET /api/v2/roles` / `POST /api/v2/roles` - list and create roles
+- `GET /api/v2/applications` / `POST /api/v2/applications` - list and create applications
+- `GET /api/v2/organizations` / `POST /api/v2/organizations` - list and create organizations
+- `GET /api/v2/connections` / `POST /api/v2/connections` - list and create connections
+
 ## AWS
 
 S3, SQS, IAM, and STS emulation with AWS SDK-compatible S3 paths and query-style SQS/IAM/STS endpoints. All responses use AWS-compatible XML.

apps/web/app/docs/architecture/page.mdx

@@ -15,6 +15,7 @@ packages/
     aws/            # AWS S3, SQS, IAM, STS
     okta/           # Okta identity provider / OIDC
     mongoatlas/     # MongoDB Atlas Admin API + Data API
+    auth0/          # Auth0 identity provider / OIDC
     resend/         # Resend email API
     stripe/         # Stripe billing and payments API
 apps/

apps/web/app/docs/auth0/layout.tsx

@@ -0,0 +1,7 @@
+import { pageMetadata } from "@/lib/page-metadata";
+
+export const metadata = pageMetadata("auth0");
+
+export default function Layout({ children }: { children: React.ReactNode }) {
+  return children;
+}

apps/web/app/docs/auth0/page.mdx

@@ -0,0 +1,85 @@
+# Auth0
+
+Auth0 identity provider emulation with OAuth 2.0 / OIDC, Universal Login pages, refresh token rotation, Userinfo, and Management API resources for users, roles, applications, organizations, and connections.
+
+## OAuth / OIDC
+
+- `GET /.well-known/openid-configuration` — OIDC discovery
+- `GET /.well-known/jwks.json` — JSON Web Key Set
+- `GET /authorize` — authorization endpoint
+- `GET /u/login` — Universal Login page
+- `POST /oauth/token` — token endpoint
+- `GET /userinfo` — user info
+- `GET /v2/logout` — logout
+
+Authorization Code with PKCE is supported with both `plain` and `S256` code challenge methods. The token endpoint supports `authorization_code`, `refresh_token`, and `client_credentials`.
+
+## Tenant URLs
+
+Auth0 advertises tenant-aware URLs. With this config:
+
+```yaml
+auth0:
+  tenant: my-tenant
+```
+
+Discovery returns endpoints under:
+
+```text
+http://my-tenant.auth0.localhost:4009
+```
+
+For test environments that cannot route subdomains, call discovery with a tenant query parameter:
+
+```bash
+curl "http://localhost:4009/.well-known/openid-configuration?tenant=my-tenant"
+```
+
+The returned endpoints include the same `tenant` parameter.
+
+## Management API
+
+- `GET /api/v2/users` — list users
+- `POST /api/v2/users` — create user
+- `GET /api/v2/users/:id` — get user
+- `PATCH /api/v2/users/:id` — update user
+- `DELETE /api/v2/users/:id` — delete user
+- `GET /api/v2/users/:id/roles` — list user roles
+- `POST /api/v2/users/:id/roles` — assign roles
+- `GET /api/v2/roles` — list roles
+- `POST /api/v2/roles` — create role
+- `GET /api/v2/applications` — list applications
+- `POST /api/v2/applications` — create application
+- `GET /api/v2/organizations` — list organizations
+- `POST /api/v2/organizations` — create organization
+- `GET /api/v2/connections` — list connections
+- `POST /api/v2/connections` — create connection
+
+## Seed Config
+
+```yaml
+auth0:
+  tenant: my-tenant
+  applications:
+    - client_id: my-app
+      client_secret: secret
+      name: My App
+      callbacks:
+        - http://localhost:3000/api/auth/callback
+      grant_types:
+        - authorization_code
+        - refresh_token
+        - client_credentials
+  users:
+    - email: dev@example.com
+      name: Developer
+      password: pass
+  roles:
+    - name: admin
+  connections:
+    - name: Username-Password-Authentication
+      strategy: auth0
+  apis:
+    - audience: https://api.example.test/
+      name: Example API
+```

apps/web/app/docs/configuration/page.mdx

@@ -327,6 +327,34 @@ mongoatlas:
       username: app-user
 ```
 
+## Auth0 Seed Config
+
+```yaml
+auth0:
+  tenant: my-tenant
+  applications:
+    - client_id: my-app
+      client_secret: secret
+      callbacks:
+        - http://localhost:3000/api/auth/callback
+      grant_types:
+        - authorization_code
+        - refresh_token
+        - client_credentials
+  users:
+    - email: dev@example.com
+      name: Developer
+      password: pass
+  roles:
+    - name: admin
+  connections:
+    - name: Username-Password-Authentication
+      strategy: auth0
+  apis:
+    - audience: https://api.example.test/
+      name: Example API
+```
+
 ## Resend Seed Config
 
 ```yaml

apps/web/app/docs/page.mdx

@@ -1,6 +1,6 @@
 # Getting Started
 
-Local drop-in replacement for Vercel, GitHub, Google, Slack, Apple, Microsoft, AWS, Okta, MongoDB Atlas, Resend, and Stripe APIs. Built for CI and no-network sandboxes. Fully stateful, production-fidelity API emulation. Not mocks.
+Local drop-in replacement for Vercel, GitHub, Google, Slack, Apple, Microsoft, AWS, Okta, MongoDB Atlas, Auth0, Resend, and Stripe APIs. Built for CI and no-network sandboxes. Fully stateful, production-fidelity API emulation. Not mocks.
 
 ## Quick Start
 
@@ -19,8 +19,9 @@ All services start with sensible defaults. No config file needed:
 - **AWS** on `http://localhost:4006`
 - **Okta** on `http://localhost:4007`
 - **MongoDB Atlas** on `http://localhost:4008`
-- **Resend** on `http://localhost:4009`
-- **Stripe** on `http://localhost:4010`
+- **Auth0** on `http://localhost:4009`
+- **Resend** on `http://localhost:4010`
+- **Stripe** on `http://localhost:4011`
 
 ## CLI
 

apps/web/app/docs/programmatic-api/page.mdx

@@ -59,7 +59,7 @@ afterAll(() => Promise.all([github.close(), vercel.close()]))
     <tr>
       <td><code>service</code></td>
       <td><em>(required)</em></td>
-      <td>Service name: <code>'vercel'</code>, <code>'github'</code>, <code>'google'</code>, <code>'slack'</code>, <code>'apple'</code>, <code>'microsoft'</code>, <code>'aws'</code>, <code>'okta'</code>, <code>'mongoatlas'</code>, <code>'resend'</code>, or <code>'stripe'</code></td>
+      <td>Service name: <code>'vercel'</code>, <code>'github'</code>, <code>'google'</code>, <code>'slack'</code>, <code>'apple'</code>, <code>'microsoft'</code>, <code>'aws'</code>, <code>'okta'</code>, <code>'mongoatlas'</code>, <code>'auth0'</code>, <code>'resend'</code>, or <code>'stripe'</code></td>
     </tr>
     <tr>
       <td><code>port</code></td>
@@ -131,6 +131,7 @@ npm install @emulators/github @emulators/google @emulators/stripe
     <tr><td><code>@emulators/aws</code></td><td>AWS S3, SQS, IAM, STS</td></tr>
     <tr><td><code>@emulators/okta</code></td><td>Okta identity provider / OIDC</td></tr>
     <tr><td><code>@emulators/mongoatlas</code></td><td>MongoDB Atlas Admin API + Data API</td></tr>
+    <tr><td><code>@emulators/auth0</code></td><td>Auth0 identity provider / OIDC</td></tr>
     <tr><td><code>@emulators/resend</code></td><td>Resend email API</td></tr>
     <tr><td><code>@emulators/stripe</code></td><td>Stripe billing and payments API</td></tr>
     <tr><td><code>@emulators/core</code></td><td>Shared store, middleware, and utilities</td></tr>

apps/web/lib/docs-navigation.ts

@@ -17,6 +17,7 @@ export const allDocsPages: NavItem[] = [
   { name: "AWS", href: "/docs/aws" },
   { name: "Okta", href: "/docs/okta" },
   { name: "MongoDB Atlas", href: "/docs/mongoatlas" },
+  { name: "Auth0", href: "/docs/auth0" },
   { name: "Resend", href: "/docs/resend" },
   { name: "Stripe", href: "/docs/stripe" },
   { name: "Authentication", href: "/docs/authentication" },

apps/web/lib/page-titles.ts

@@ -12,6 +12,7 @@ export const PAGE_TITLES: Record<string, string> = {
   aws: "AWS",
   okta: "Okta",
   mongoatlas: "MongoDB Atlas",
+  auth0: "Auth0",
   resend: "Resend",
   stripe: "Stripe",
   authentication: "Authentication",

emulate.config.example.yaml

@@ -128,3 +128,27 @@ google:
       mime_type: application/vnd.google-apps.folder
       parent_ids:
         - root
+
+auth0:
+  tenant: my-tenant
+  applications:
+    - client_id: my-app
+      client_secret: secret
+      callbacks:
+        - http://localhost:3000/api/auth/callback
+      grant_types:
+        - authorization_code
+        - refresh_token
+        - client_credentials
+  users:
+    - email: dev@example.com
+      name: Developer
+      password: pass
+  roles:
+    - name: admin
+  connections:
+    - name: Username-Password-Authentication
+      strategy: auth0
+  apis:
+    - audience: https://api.example.test/
+      name: Example API