Enable Strict Mode for Dynamic Client Registration on Legacy Auth0 Tenants

Legacy Auth0 tenants default to permissive mode for Dynamic Client Registration (DCR), causing missing API scopes in access tokens. Updating the tenant settings via the Management API enforces strict mode for future registrations, resolving the issue. On Auth0 accounts that had at least one tenant with third-party applications prior to April 23, 2026, DCR defaults to creating clients in permissive mode. Auth0 ignores the default client grant mechanism, silently drops requested API scopes, and generates an access token containing only scope: "openid" and permissions: [].

Attempting to manually update the client via the Management API generates the following error:

Cannot set third_party_security_mode to strict. Only new third-party clients can be created with strict mode.

• Auth0
• Dynamic Client Registration (DCR)
• Model Context Protocol (MCP) servers
• Legacy tenants

Because the account met the permissive eligibility criteria before April 23, 2026, the tenant operates in a backward-compatible state. A dedicated backend setting (dynamic_client_registration_security_mode) governs the DCR security mode, operating independently of the broader permissive toggle found in the Dashboard. Additionally, Auth0 permanently locks a client's third_party_security_mode at the exact moment of creation, preventing upgrades from permissive to strict mode after creation.

Prerequisites and Limitations

Review the following prerequisites and limitations regarding API permissions, existing clients, and supported scopes before enabling strict mode.

• Configure default API permissions for third-party applications (for example, a default client grant with default_for: "third_party_clients") before updating the tenant to strict mode. Otherwise, newly registered DCR clients lack API access.
• Changing this tenant setting only affects new clients registered via POST /oidc/register. Existing permissive clients cannot be upgraded. External tools must run the registration flow again to generate a new, strict-mode client ID.
• Strict mode does not currently support OpenID Connect (OIDC) scopes (openid, profile, email) or ID tokens. Ensure MCP flows and external applications do not depend on these for authentication.

NOTE: Auth0 officially supports the MCP + Authorization Code + Proof Key for Code Exchange (PKCE) flow in the migration documentation for Enhanced Security for Third-Party Applications.

Update Tenant to Enforce Strict Mode

Issue a PATCH request to the tenant settings endpoint using the Management API to explicitly enforce strict mode for all future Dynamic Client Registration requests.

curl --request PATCH \
  --url 'https://<yourDomain>/api/v2/tenants/settings' \
  --header 'Authorization: Bearer <YOUR_MANAGEMENT_API_TOKEN>' \
  --header 'Content-Type: application/json' \
  --data '{ "dynamic_client_registration_security_mode": "strict" }'