Feature
Auth0 (Okta)
Auth0 Rules and Hooks, the legacy extensibility products that run custom JavaScript during authentication and other flows, reach end of life on 18 November 2026; after that date they stop executing and are removed, and Auth0 directs all customers to Actions as the replacement
departs 18 Nov 2026
Quick answers
- Is it true that Auth0 Rules and Hooks reach end of life on 18 November 2026 — migrate to Actions?
- Yes. Auth0 (Okta) has officially announced it, effective 18 Nov 2026. Auth0 Rules and Hooks are the original way to run your own JavaScript inside Auth0 — Rules fire during the login/authentication pipeline (enriching tokens, enforcing access policy, calling external APIs), and Hooks run around specific extensibility points such as pre-user-registration and post-change-password.
- When does it take effect?
- 18 Nov 2026. Verified against the vendor's own announcement.
- What should I use instead?
- Move every active Rule and Hook to Auth0 **Actions** before 18 November 2026.
What this means for you
Auth0 Rules and Hooks are the original way to run your own JavaScript inside Auth0 — Rules fire during the login/authentication pipeline (enriching tokens, enforcing access policy, calling external APIs), and Hooks run around specific extensibility points such as pre-user-registration and post-change-password. Auth0 deprecated both on 16 May 2023 in favour of **Actions**, and has been winding them down in stages: no new tenant has had Rules or Hooks since 16 October 2023, and on 18 November 2024 all existing Rules and Hooks went read-only — they kept executing, but their source code could no longer be edited through the Dashboard or the Management API, which also broke CI/CD tooling such as Terraform and the Auth0 Deploy CLI for those objects. The final step is the one that actually takes functionality away: on **18 November 2026, Rules and Hooks stop being executed and are removed.** If you still have active Rules or Hooks on that date, the custom logic they run — token claims, authorization checks, external callouts, user-registration hooks — simply stops firing, which for most tenants means logins and signups silently lose behaviour they depend on. This is a forced migration with a hard date, and because the objects are already read-only, you cannot fix them in place at the last minute — the migration has to happen in Actions.
Where to go
Move every active Rule and Hook to Auth0 **Actions** before 18 November 2026. Actions are the supported successor: individually versioned, bound to specific triggers (for example the Login / post-login trigger replaces most Rules, and dedicated triggers cover the pre-user-registration and post-change-password Hooks), with their own secrets and npm-dependency management. Start by inventorying what you have — the Dashboard lists your Rules and Hooks, and because they have been read-only since November 2024 the set is frozen, so nothing new can creep in while you migrate. Port each one to the equivalent Action trigger, re-implementing the logic (the execution model and the available objects differ, so this is a rewrite, not a copy-paste), then test in a non-production tenant before cutting over. Auth0 publishes a "Migrate from Rules to Actions" and "Migrate from Hooks to Actions" guide plus a migration-status indicator in the Dashboard. Do not leave this to November 2026: once Rules and Hooks are removed there is no fallback, and you cannot edit the old objects to patch a gap.
- Auth0 Actions — the vendor's named replacement; trigger-bound, versioned serverless functions that run custom JavaScript in the Auth0 pipeline (post-login trigger replaces most Rules; dedicated triggers cover the pre-user-registration and post-change-password Hooks)
Auth0’s official deprecations documentation sets a hard end-of-life date for Rules and Hooks: 18 November 2026. After that date, the page states, “Rules and Hooks will stop being executed and removed.” If you still run custom logic in either, this is a forced migration to Actions with a firm deadline.
What Rules and Hooks do — and the wind-down so far
Rules are JavaScript functions that run during the Auth0 authentication pipeline — enriching tokens, enforcing authorization, calling external APIs on login. Hooks run custom code at specific extensibility points such as pre-user-registration and post-change-password. Auth0 deprecated both on 16 May 2023 in favour of Actions, and has removed them in stages:
- 16 October 2023 — no newly created tenant has Rules or Hooks at all.
- 18 November 2024 — all existing Rules and Hooks became read-only: they keep executing, but their source can no longer be edited through the Dashboard or the Management API, which also broke CI/CD tooling such as Terraform and the Auth0 Deploy CLI for those objects.
- 18 November 2026 — Rules and Hooks stop being executed and are removed.
Why the final date bites
Because the objects have been read-only since November 2024, you cannot patch them at the last minute — the only way forward is to re-implement the logic in Actions. If an active Rule or Hook is still in place on 18 November 2026, the behaviour it provides (custom token claims, authorization checks, external callouts, registration hooks) simply stops firing. For most tenants that means logins and signups quietly lose policy they depend on, rather than throwing an obvious error.
What to do
Inventory your Rules and Hooks in the Dashboard — the set has been frozen since 2024, so nothing new can appear while you migrate — and port each to the equivalent Actions trigger (the post-login trigger covers most Rules; dedicated triggers cover the pre-user-registration and post-change-password Hooks). The execution model and available objects differ, so treat this as a rewrite, test it in a non-production tenant, and cut over well before November 2026. Auth0 publishes migration guides for both Rules→Actions and Hooks→Actions and shows a migration-status indicator in the Dashboard.
Entry changelog
- — last reviewed.
- — Entry created from Auth0's official "Deprecations and Migrations" documentation (auth0.com/docs/troubleshoot/product-lifecycle/deprecations-and-migrations), which states the end-of-life date for Rules and Hooks as 18 November 2026 ("After November 18, 2026, Rules and Hooks will stop being executed and removed") and the earlier read-only transition as 18 November 2024. Timeline (deprecated 16 May 2023, no new tenants from 16 October 2023, read-only 18 November 2024, EOL 18 November 2026) recorded exactly as stated; no date inferred (Constitution §3.2). detect left empty: Rules and Hooks are server-side Auth0 tenant configuration, not a dependency, image or literal that reliably appears in a customer's repository, so there is no safe fingerprint.
Put this countdown in your README
Building on Auth0 (Okta)? Drop this badge into a project’s README or docs — it shows the days left and
refreshes on its own every night from this page. 
[](https://lastcall.dev/entries/auth0-rules-hooks-end-of-life)Spot an error or a changed date? Tell us and it’s corrected the same night.