Possibility of a New User Being Created with a Previously Deleted user_id

Knowledge Articles
,
1

Last Updated: Aug 13, 2024

Overview

This article explains whether Auth0 maintains the previously used user_id (auth0| < id number > ) when an account is deleted for users in the Username-Password-Authentication database.

Applies To

  • Username-Password-Authentication DataBase
  • user_id
  • User Creation

Solution

Auth0 does not maintain older/used user IDs.
The user_id is generated via an incremental automated internal process, so it should be unique for new users.

But, if a custom user_id is specified while creating a user with Create a User, then the user could be created with the same user_id after deletion.

If the above endpoint is used to create a new user with the below sample payload:

{
  "email": "john.doe@somedomain.com",
  "password": "toPsecret!",
  "user_id": "abc123",
  "connection": "Username-Password-Authentication"
}

Subsequently, if this user is deleted via the dashboard or API, then this user account can be recreated again with the exact same details, so in this scenario, the same user_id can be reused after a delete process.