We recently received the notification regarding the upcoming change where newly created third-party applications will default to strict mode when third_party_security_mode is not explicitly specified during client creation.
We have a few questions:
- How can a tenant determine whether it is actually impacted by this change?
- Are notification emails sent to all tenants, or only to tenants that have existing third-party applications that may be affected?
- If a tenant does not create third-party applications through the Management API (
POST /api/v2/clients), is any action required before the enforcement date?
- Is there a recommended way to identify existing third-party applications that may rely on the current permissive behavior?
- For tenants with no impacted applications, is this notification purely informational, or are there any migration or validation activities that should still be completed?
Any clarification from the Auth0 team or community members would be appreciated.
Hi @priyanshu.shrivastav
Welcome to the Auth0 Community!
I understand you are looking for additional details regarding a notification that you received about third-party applications defaulting to strict mode when third_party_security_mode is not explicitly specified during client creation.
Here are the details regarding the upcoming Auth0 third_party_security_mode breaking change (which will enforce strict mode by default on October 23, 2026) based on Auth0’s product lifecycle documentation.
Official Recommendation
1. Determining tenant impact
You can determine impact by looking at your current third-party applications and how you provision them. A tenant is impacted if:
-
You programmatically create third-party applications via the Management API (POST /api/v2/clients) without explicitly passing the third_party_security_mode parameter.
-
You currently rely on applications that have third_party_security_mode set to permissive.
2. Notification targeting
Auth0 typically targets these deprecation notifications to administrators of customers who have at least one tenant with existing third-party applications created before April 2026. This is because only those customers are eligible for the legacy “permissive” mode. If a tenant had no prior third-party application usage, they are already restricted to strict mode and generally would not be the primary target of migration alerts.
3. Action required if not using the Management API
If your tenant only creates third-party applications manually via the Auth0 Dashboard, no action is required regarding application creation. The Auth0 Dashboard already enforces enhanced security controls (strict mode) for all new third-party applications, and this behavior cannot be changed in the UI.
Note: If you use Dynamic Client Registration (DCR), that is controlled by a separate tenant setting (dynamic_client_registration_security_mode) independent of the Management API deprecation, which may still require your review.
4. Identifying existing permissive applications
The recommended approach is to query your applications using the Management API’s GET /api/v2/clients endpoint.
-
Filter for clients where is_first_party is false.
-
Check the third_party_security_mode property on those clients. If it is set to "permissive", the application relies on the old behavior.
-
Visual indicator: Strict third-party clients often have a tpc_ prefix in their Client ID, whereas permissive clients use the standard Client ID format.
5. Is the notification purely informational for unaffected tenants?
Yes. If your tenant does not have any applications relying on permissive mode, does not use Dynamic Client Registration for permissive clients, and does not automate client creation without explicit mode flags via the Management API, this notification is purely informational. You do not need to perform any migration or validation activities. Starting October 23, 2026, the strict default will simply formalize the secure behavior you are already observing.
We hope this information helped clear some details regarding the upcoming migration to Enhanced Security for Third-Party Applications. Feel free to reach out to us for any other issues or requests, we will gladly look into it!
Have a great one,
Gerald