Decommissioning Notice — Legacy FGA Token Issuer

Decommissioning on April 15, 2026

The legacy token issuer fga.us.auth0.com will be completely turned off on April 15, 2026. If you are still using this endpoint, you must migrate to auth.fga.dev before this date or your application will lose access to the FGA API. If you have any questions, please reach out to FGA support.

At Auth0/Okta, we are continuously improving the reliability, security and performance of the Fine-Grained Authorization (FGA) service to ensure the best experience for our customers. As part of these enhancements, we migrated to a new token issuer, which further strengthens the security and resilience of your applications connected to the FGA store.

What does this mean for you?

To continue using your FGA store without any interruptions, there are a few key updates that need to be made to your environment. Specifically, you will need to update the API Token Issuer (env: FGA_API_TOKEN_ISSUER) value in your configuration from fga.us.auth0.com to auth.fga.dev.

On April 30, 2025, the legacy token issuer (fga.us.auth0.com) was deprecated and no longer supported. On April 15, 2026, this endpoint will be decommissioned and completely turned off. To avoid any disruption to your services, you must update your settings before this date.

Steps to Update Your Environment

If you have set up your SDK client as described in our How To Setup The SDK Client docs, you must change the FGA_API_TOKEN_ISSUER environment variable to auth.fga.dev:

If you are not using an environment variable as described in our docs, please see below for the changes you need to make for each SDK.

Node.js

Update the value of apiTokenIssuer to reflect the new token issuer value when the FGA client is created:

const openFga = new OpenFgaClient({
    // ..
    credentials: {
        method: CredentialsMethod.ClientCredentials,
        config: {
          // ..
          apiTokenIssuer: "auth.fga.dev"
        },
    }
});

Go

Update the value of ClientCredentialsApiTokenIssuer to reflect the new token issuer value when the FGA client is created:

fgaClient, err := NewSdkClient(&ClientConfiguration{
        // ..
        Credentials: &credentials.Credentials{
            Method: credentials.CredentialsMethodClientCredentials,
            Config: &credentials.Config{
                // ..
                ClientCredentialsApiTokenIssuer: "auth.fga.dev",
            },
        },
    })

.NET

Update the value of ApiTokenIssuer to reflect the new token issuer value when the FGA client is created:

var configuration = new ClientConfiguration() {
    // ..
    Credentials = new Credentials() {
        Method = CredentialsMethod.ClientCredentials,
        Config = new CredentialsConfig() {
            // ..
            ApiTokenIssuer = "auth.fga.dev"
        }
    }
};

Python

Update the value of api_issuer to reflect the new token issuer value when the FGA client is created:

credentials = Credentials(
    method='client_credentials',
    configuration=CredentialConfiguration(
        api_issuer= 'auth.fga.dev'
        # ..
    )
)

Java

Update the value provided to .apiTokenIssuer to reflect the new token issuer when the FGA client is created:

var config = new ClientConfiguration()
  // ..
  .credentials(new Credentials(
      new ClientCredentials()
        // ..
        .apiTokenIssuer("auth.fga.dev")
));

Need Help?

Our support team is ready to assist with this transition. If you have any questions or concerns, don’t hesitate to reach out to our team.