Decommissioning Notice - Legacy FGA Token Issuer

Decommissioning on April 15, 2026The legacy token issuer fga.us.auth0.com will be completely turned off on April 15, 2026. If you are still using this endpoint, you must migrate to auth.fga.dev before this date or your application will lose access to the FGA API. If you have any questions, please reach out to FGA support.

At Auth0/Okta, we are continuously improving the reliability, security and performance of the Fine-Grained Authorization (FGA) service to ensure the best experience for our customers. As part of these enhancements, we migrated to a new token issuer, which further strengthens the security and resilience of your applications connected to the FGA store.

What does this mean for you?

To continue using your FGA store without any interruptions, there are a few key updates that need to be made to your environment. Specifically, you will need to update the API Token Issuer (env: FGA_API_TOKEN_ISSUER) value in your configuration from fga.us.auth0.com to auth.fga.dev. On April 30, 2025, the legacy token issuer (fga.us.auth0.com) was deprecated and no longer supported. On April 15, 2026, this endpoint will be decommissioned and completely turned off. To avoid any disruption to your services, you must update your settings before this date.

Steps to Update Your Environment

If you have set up your SDK client as described in our How To Setup The SDK Client docs, you must change the FGA_API_TOKEN_ISSUER environment variable to auth.fga.dev: Image showing the model explorer

If you are not using an environment variable as described in our docs, please see below for the changes you need to make for each SDK.

Node.js
Go
.NET
Python
Java

Update the value of apiTokenIssuer to reflect the new token issuer value when the FGA client is created:

const openFga = new OpenFgaClient({
    // ..
    credentials: {
        method: CredentialsMethod.ClientCredentials,
        config: {
          // ..
          apiTokenIssuer: "auth.fga.dev"
        },
    }
});

Update the value of ClientCredentialsApiTokenIssuer to reflect the new token issuer value when the FGA client is created:

fgaClient, err := NewSdkClient(&ClientConfiguration{
        // ..
        Credentials: &credentials.Credentials{
            Method: credentials.CredentialsMethodClientCredentials,
            Config: &credentials.Config{
                // ..
                ClientCredentialsApiTokenIssuer: "auth.fga.dev",
            },
        },
    })

Update the value of ApiTokenIssuer to reflect the new token issuer value when the FGA client is created:

var configuration = new ClientConfiguration() {
    // ..
    Credentials = new Credentials() {
        Method = CredentialsMethod.ClientCredentials,
        Config = new CredentialsConfig() {
            // ..
            ApiTokenIssuer = "auth.fga.dev"
        }
    }
};

Update the value of api_issuer to reflect the new token issuer value when the FGA client is created:

credentials = Credentials(
    method='client_credentials',
    configuration=CredentialConfiguration(
        api_issuer= 'auth.fga.dev'
        # ..
    )
)

Update the value provided to .apiTokenIssuer to reflect the new token issuer when the FGA client is created:

var config = new ClientConfiguration()
  // ..
  .credentials(new Credentials(
      new ClientCredentials()
        // ..
        .apiTokenIssuer("auth.fga.dev")
));

Need Help?

Our support team is ready to assist with this transition. If you have any questions or concerns, don’t hesitate to reach out to our team.

Introduction to Auth0 FGA

Permissions Index

FGA Dashboard

Define your authorization model

Write Your Authorization Data

Add Authorization To Your API

Auth0 Relationship Sync

Advanced Modeling

Deprecation Notices & Migrations

Decommissioning Notice - Legacy FGA Token Issuer

What does this mean for you?

Steps to Update Your Environment

Need Help?

​What does this mean for you?

​Steps to Update Your Environment

​Need Help?

What does this mean for you?

Steps to Update Your Environment

Need Help?