M2M Quota Utilization When an Action Denies Access

This article clarifies whether a request counts toward the Machine-to-Machine (M2M) quota utilization when an Action calls api.access.deny() during the client-exchange trigger.

• Auth0

• Auth Actions

• Machine-to-Machine Flow

M2M authentication, represented in Quota Utilization, is the number of access tokens issued by Auth0 for the Client Credentials Flow per calendar month, per tenant. Tokens issued for the Auth0 Management API or other Auth0 built-in APIs are not counted.

The credentials-exchange trigger, as specified in the Machine-to-Machine Flow documentation, is a function executed before the access token is returned. Therefore, if api.access.deny() is called in the Action, no access token is returned. This action does not count toward the M2M tokens quota.

This behavior can be verified with the following steps:

1. Create an Action where the onExecuteCredentialsExchange trigger calls the api.access.deny() function.

2. Attempt a token exchange.

3. Review the tenant logs. No log with the type Seccft (Successful exchange of Access Token for a Client Credentials Grant) should appear, confirming that no M2M utilization was counted.