Disable Sign-Ups for a Specific Auth0 Application

Last Updated: Oct 8, 2026

Overview

Restrict new user sign-ups for a specific application while permitting sign-ups for other applications that share the same database connection by utilizing a combination of an Action and Page Template modification. When multiple applications share a single Database Connection, the Disable Sign-ups setting for that connection applies globally to all applications using it. The most robust architectural solution separates the applications into different Database Connections. However, if requiring a shared connection, this workaround utilizes a combination of an Action for security and a Page Template modification for User Experience (UX).

Applies To

Auth0
New Universal Login
Page Templates
Actions
Management API

Solution

Create an Action to Block Sign-Up Attempts at the Security Layer

NOTE: This is the most critical step. Without this back-end validation, hiding the button on the front end does not prevent a user from crafting a direct API call to create a user.

Create a custom Action that triggers on Pre User Registration to check the Client ID and deny access to the blocked application.

Choose Actions > Library from the dashboard.
Select Build Custom.
Create a new Action with the following settings:
- Name: Block Sign-up for <App Name>
- Trigger: Pre User Registration
- Runtime: Node 22 (or latest recommended)

Enter the following logic in the code editor to check the Client ID and deny access:

/**
* Handler that will be called during the execution of a PreUserRegistration flow.
*
* @param {Event} event - Details about the context and user that is attempting to register.
* @param {PreUserRegistrationAPI} api - Interface whose methods can be used to change the behavior of the signup.
*/
exports.onExecutePreUserRegistration = async (event, api) => {
  // REPLACEMENT REQUIRED:
  // Paste the Client ID of the application where sign-ups should be blocked
  const BLOCKED_APP_CLIENT_ID = "<BLOCKED_APP_CLIENT_ID_HERE>";
  // Check if the registration attempt is from the blocked application
  if (event.client.client_id === BLOCKED_APP_CLIENT_ID) {
    // Deny the registration
    api.access.deny(
      'signup_not_allowed',
      'New user sign-ups are not permitted for this application.'
    );
  }
};

Select Deploy.
Choose Actions > Triggers > Pre User Registration.
Drag the new Action into the trigger and select Apply.

How is the sign-up button hidden on the user experience layer?

Updating the Login Page Template hides the button on the New Universal Login page. This requires using the Management API and is not available in the Dashboard User Interface (UI).

NOTE: While the steps below utilize Cascading Style Sheets (CSS) within the Page Template to hide the button, Auth0 generally discourages CSS customization for elements controlled by the widget. Class names (like .ulp-alternate-action) do not guarantee static behavior over time. If the underlying HTML structure changes, this CSS may stop working.

Ensure the following prerequisites are met before proceeding:

A Management API Access Token with the update:branding scope.
A Custom Domain set up.
A tool to make API requests (for example, Postman or cURL; use a tool that best fits organizational guidelines).

Retrieve the current Login HTML using the Management API, insert Liquid conditional logic to hide the sign-up button for the specific application, and update the template with a PUT request.

Perform a GET request to retrieve the current Login HTML to modify the existing content rather than overwriting it using the GET /api/v2/branding/templates/universal-login endpoint.

Edit the HTML content to include the following Liquid conditional logic inside the <style> tag in the <head> section:

<head>
  <style>
    /* Custom Logic to hide Sign Up for specific app */
    {% if application.name == "<App Name>" %}
      .ulp-alternate-action {
         display: none;
      }
    {% endif %}
  </style>
  {%- auth0:head -%}
</head>

NOTE: Replace <App Name> with the exact name of the application as it appears in the Dashboard.

Perform a PUT request to update the template using the PUT /api/v2/branding/templates/universal-login endpoint with the Authorization: Bearer <enter_access_token> and Content-Type: application/json headers.
Configure the body as a JSON object containing the full HTML string in the template field.
```
{
  "template": "<!DOCTYPE html><html><head>...</head><body>...</body></html>"
}
```

NOTE: Properly escape double quotes and newlines within the HTML string when constructing this JSON.