Which Auth0 plan is required for Advanced Customizations for Universal Login (ACUL)?

Get Help
,
3

Hi @jannikwschwarz

Welcome to the Auth0 Community!

I understand that you are interested in our Advanced Customizations for Universal Login (ACUL) feature and which subscription level supports it, along with additional questions on the matter.

Please allow us to share some details on each question to further clarify any requirements or recommendations that we have.

Official recommendations

1. Is ACUL available with Essentials, or does it require Professional or Enterprise?

ACUL is available starting with the Essentials plan ($35/month). You do not need to upgrade all the way to Professional or Enterprise just to use ACUL. The ability to customize the UI and authentication flows is part of the core customization features unlocked once you move off the Free tier.

2. Does “Customize Signup & Login” on the pricing page include ACUL?

Yes. The “Customize Signup & Login” feature listed on the pricing page encompasses the capabilities of ACUL. By unlocking this feature on the Essentials plan (or higher), you gain the ability to build custom, client-rendered user interfaces for Universal Login using your preferred frontend technologies.

3. Can ACUL support a single login interface with email/password, Google, and username/password across two Database Connections?

Yes, but it requires specific configuration for the dual database connections.
ACUL can easily display a single login page featuring Google (social) alongside a standard credential prompt. However, because you are using two Database Connections, Auth0 needs a way to determine which database a user belongs to.

  • The Challenge: By default, Auth0 will only attempt to authenticate the user against the first available database connection.

  • The Solution: You must implement Home Realm Discovery (often called Identifier-First login). In this flow, the user first enters their email address. Auth0 (or your custom ACUL logic) evaluates the email domain or context and passes a connection parameter hint to route the authentication request to the correct database .

4. Can self-service signup be disabled for invited tenant employees while remaining available for regular customers?

Yes, and you have two primary architectural approaches to achieve this:

  • Approach A: Connection-Level via Auth0 Organizations (Recommended)
    If your tenant employees and regular customers are separated by different Database Connections (or if employees use Enterprise SSO), you can disable self-service signup globally on the employee connection. Through Auth0 Organizations, you can restrict sign-ups so that only users explicitly invited to the Organization can create an account, while keeping your customer-facing connection fully open for self-service.

  • Approach B: Pre-User Registration Action
    If your users share a connection or application, you can write an Auth0 Action that triggers on Pre User Registration. This custom Node.js script can evaluate the user’s email domain, client ID, or check if they have a pending Organization invitation. If they are a tenant employee trying to self-register without an invite, the script executes api.access.deny() to securely block the attempt on the backend.

Key Takeaway: The Essentials plan will give you the ACUL capabilities you need. However, because you are building a B2B SaaS application utilizing Auth0 Organizations and complex user routing (multiple databases, conditional signups), you should evaluate if you will eventually need the Professional plan. The Professional tier unlocks features like Machine-to-Machine (M2M) capabilities for organizations, which are common requirements as B2B apps scale.

We hope the above information provided clarity and helped make the decision easier. We warmly recommend that you reach out to our Sales team for additional assistance in finding the subscription plan that best suits your requirements and architecture.

Have a great one!
Gerald