Auth0 Deploy CLI Fails on Re-deploy with Private Key JWT Clients

Auth0 Deploy CLI deployments fail on subsequent runs when configuring Private Key JSON Web Token (JWT) clients due to a bug in older CLI versions. Upgrading the Auth0 Deploy CLI to version 8.40.0 or later resolves the issue. When using version 8.27.0, the initial deployment succeeds, but subsequent deployments fail with a payload validation error. Additionally, a deprecation warning for the AUTH0_EXCLUDED_CLIENTS parameter appears, though the parameter remains fully supported.

The following error occurs during redeployment:

ManagementApiError: Payload validation error: 'Additional properties not allowed: alg,pem,credential_type,name' on property client_authentication_methods.private_key_jwt.credentials

• Auth0 Deploy CLI (versions prior to 8.40.0)
• Private Key JSON Web Token (JWT) Authentication

Auth0 Deploy CLI version 8.27.0 lacks dedicated handling for client_authentication_methods. The CLI passes the credential configuration directly to the Management API on every deployment. The initial client creation accepts the full credential objects inline, including name, credential type, Privacy-Enhanced Mail (PEM), and algorithm. However, subsequent deployments send the same objects to the client PATCH endpoint, which only accepts credentials referenced by ID on update. This causes redeployments to fail unless the administrator deletes the client first.

How is the redeployment error resolved?

Resolve the payload validation error and ensure successful redeployments by performing the following action:

1. Upgrade the Auth0 Deploy CLI to version 8.40.0 or later.

Version 8.40.0 manages Private Key JWT and mutual Transport Layer Security (mTLS) credentials as proper child resources via the /clients/{id}/credentials API. The CLI no longer includes credential objects in the client update payload, and it preserves existing credentials by matching their names.

Deprecation Status of the Excluded Clients Parameter

The AUTH0_EXCLUDED_CLIENTS parameter displays a deprecation warning, but Auth0 has no scheduled removal date. The parameter remains fully supported, including in the version 9 beta release. Administrators can continue using the parameter or remove the exclusion after upgrading the Auth0 Deploy CLI to version 8.40.0 or later.