Skip to content


Switch branches/tags

Name already in use

A tag already exists with the provided branch name. Many Git commands accept both tag and branch names, so creating this branch may cause unexpected behavior. Are you sure you want to create this branch?

Latest commit


Git stats


Failed to load latest commit information.
Latest commit message
Commit time

Auth0 SDK to add authentication to your Java Servlet applications.

Build Status Coverage Status License Maven Central javadoc

Note As part of our ongoing commitment to best security practices, we have rotated the signing keys used to sign previous releases of this SDK. As a result, new patch builds have been released using the new signing key. Please upgrade at your earliest convenience.

While this change won't affect most developers, if you have implemented a dependency signature validation step in your build process, you may notice a warning that past releases can't be verified. This is expected, and a result of the key rotation process. Updating to the latest version will resolve this for you.

πŸ“š Documentation - πŸš€ Getting Started - πŸ’» API Reference πŸ’¬ Feedback


  • Quickstart - our interactive guide for quickly adding login, logout and user information to a Java Servlet application using Auth0.
  • Sample App - a sample Java Servlet application integrated with Auth0.
  • Examples - code samples for common scenarios.
  • Docs site - explore our docs site and learn more about Auth0.

Getting Started


Java 8 or above and javax.servlet version 3.

If you are using Spring, we recommend leveraging Spring's OIDC and OAuth2 support, as demonstrated by the Spring Boot Quickstart.


Add the dependency via Maven:


or Gradle:

implementation 'com.auth0:mvc-auth-commons:1.10.0'

Configure Auth0

Create a Regular Web Application in the Auth0 Dashboard. Verify that the "Token Endpoint Authentication Method" is set to POST.

Next, configure the callback and logout URLs for your application under the "Application URIs" section of the "Settings" page:

  • Allowed Callback URLs: The URL of your application where Auth0 will redirect to during authentication, e.g., http://localhost:3000/callback.
  • Allowed Logout URLs: The URL of your application where Auth0 will redirect to after user logout, e.g., http://localhost:3000/login.

Note the Domain, Client ID, and Client Secret. These values will be used later.

Add login to your application

Create a new AuthenticationController using your Auth0 domain, and Auth0 application client ID and secret. Configure the builder with a JwkProvider for your Auth0 domain.

public class AuthenticationControllerProvider {
    private String domain = "YOUR-AUTH0-DOMAIN";
    private String clientId = "YOUR-CLIENT-ID";
    private String clientSecret = "YOUR-CLIENT-SECRET";
    private AuthenticationController authenticationController;
    static {
        JwkProvider jwkProvider = new JwkProviderBuilder("YOUR-AUTH0-DOMAIN").build();
        authenticationController = AuthenticationController.newBuilder(domain, clientId, clientSecret)
    public getInstance() {
        return authenticationController;

Note: The AuthenticationController.Builder is not to be reused, and an IllegalStateException will be thrown if build() is called more than once.

Redirect users to the Auth0 login page using the AuthenticationController:

@WebServlet(urlPatterns = {"/login"})
public class LoginServlet extends HttpServlet {

    protected void doGet(final HttpServletRequest req, final HttpServletResponse res) throws ServletException, IOException {
        // Where your application will handle the authoriztion callback
        String redirectUrl = "http://localhost:3000/callback";

        String authorizeUrl = AuthenticationControllerProvider
                .buildAuthorizeUrl(req, res, redirectUrl)

Finally, complete the authentication and obtain the tokens by calling handle() on the AuthenticationController.

@WebServlet(urlPatterns = {"/callback"})
public class CallbackServlet extends HttpServlet {
    public void doGet(HttpServletRequest req, HttpServletResponse res) throws IOException, ServletException {
        try {
            // authentication complete; the tokens can be stored as needed
            Tokens tokens = AuthenticationControllerProvider
                    .handle(req, res);
        } catch (IdentityVerificationException e) {
            // handle authentication error

That's it! You have authenticated the user using Auth0.

API Reference



We appreciate feedback and contribution to this repo! Before you get started, please see the following:

Raise an issue

To provide feedback or report a bug, please raise an issue on our issue tracker.

Vulnerability Reporting

Please do not report security vulnerabilities on the public Github issue tracker. The Responsible Disclosure Program details the procedure for disclosing security issues.

Auth0 Logo

Auth0 is an easy to implement, adaptable authentication and authorization platform. To learn more checkout Why Auth0?

This project is licensed under the MIT license. See the LICENSE file for more info.


Contains common helper classes and api client logic that are used across our Java MVC libraries




Security policy





No packages published