End-of-Life Rollout for Omitting Password on SMTP Email Provider Host-related Changes

The end-of-life date for omitting the password field when performing host-related changes to SMTP email providers was November 13, 2025. After this date, the deprecated behavior progressively became unavailable. The process to remove access to the deprecated behavior had the following phases:

• December 2, 2025 - Remove access for tenants tagged as development or staging tenants.
• February 2, 2026 - Remove access for outstanding tenants, including production tenants.

The end-of-life rollout ended on March 25, 2026, and as of that date, all tenants had transitioned to the non-deprecated behavior. The corresponding migration toggle is no longer available in the Auth0 Dashboard (Tenant Settings > Advanced) as the updated behavior is now effective and permanent for all Auth0 tenants.

With the updated behavior, updating an SMTP Email Provider using the Management API update email provider endpoint (PATCH - /api/v2/emails/provider) will require specifying an explicit value for the credentials.smtp_pass field when the content of the update (PATCH) request includes other fields within the credentials object.

Currently, besides the credentials.smtp_pass field, the credentials object for an SMTP email provider supports these fields:

• credentials.smtp_host
• credentials.smtp_port
• credentials.smtp_user

Per the above, including the password field will be required when the (PATCH) request content includes:

• Only a subset of the three fields listed above, regardless of provided values.
• All three fields but one or more of the corresponding values differ from the pre-existing configuration at the time of the update.

In these situations, an update request omitting the password field will fail with a 400 status code and the following response content:

{
  "statusCode": 400,
  "error": "Bad Request",
  "message": "smtp_pass is required when you patch smtp_host, smtp_port, or smtp_user",
  "errorCode": "invalid_body"
}

The management Dashboard will also reflect the password requirement. In particular, the Dashboard will require entering a password as part of an update to an SMTP email provider when changing the Host, Port, or Username fields.

• SMTP Email Providers
• Management API

The service imposed additional requirements when updating SMTP email providers as part of a calendar year 2025 scheduled change to enhance security by reducing the risk of disclosing the value of an already configured password. In particular, the change prevents its use with a host other than the one with which the password was initially associated.

On May 13, 2025, Auth0 announced the deprecation of the previous service behavior. The information provided in the original announcement is available in the respective Dashboard and Support Center notification.

Management API requests to update SMTP email providers must include the password field (credentials.smtp_pass) as part of the update request content, or do not attempt to update any field within the credentials object.

When performing host-related changes to an SMTP email provider via the Dashboard, re-enter the password manually.