We’re looking at moving off of our own auth for our external API that’s accessible by a subset of our customers (machine to machine). Basically, we have several hundred customers for which we want to grant access, but with their own, distinct client ids and secrets to keep access tracked and limited. The general idea would be that our customer would make a request to Auth0 for a token, then submit that token to our API, which would validate it for authenticity and scope before serving any data.
From my reading, it sounds like Auth0 wants there to be an Application per customer if we want distinct ids and secrets, but it seems really cumbersome to provision a new application for each new customer we onboard.
So my question is: is there a way to implement this that I’m missing? If not, what’s the “Auth0” way to accomplish this?