Identity foundation
Independent ADV Sign-In
Auth0 authenticates the ADV user. Microsoft 365 and Google Workspace remain optional organization connectors rather than owners of the ADV identity.
Required Auth0 Objects
Create these in your independent Auth0 tenant.
Single Page Application: ADV Operations Platform.
API: ADV Operations API with RS256 access tokens.
Owner identity: your independent Auth0 user, not dependent on a client Microsoft tenant.
Roles: Administrator, Manager, Supervisor, Field, Driver, Viewer.
Post Login Action: add ADV roles/email claims to API access tokens.
Netlify Environment Variables
Auth0 SPA client ID/domain/audience are configuration; owner mapping and role maps are still kept server-side.
ADV_AUTH_REQUIRED
Keep false during setup. Change to true only after login and API token validation pass.
ADV_AUTH0_DOMAIN
Your Auth0 tenant/custom domain without https://.
ADV_AUTH0_CLIENT_ID
The Auth0 Single Page Application client ID.
ADV_AUTH0_AUDIENCE
The identifier/audience of the ADV Operations API.
ADV_AUTH0_OWNER_SUBS
Comma-separated Auth0 subject IDs that always resolve to ADV Administrator. Start with your independent owner identity.
ADV_AUTH_ROLE_MAP_JSON
Optional server-side subject → ADV role mapping for exceptions/bootstrapping.
Cutover Sequence
This prevents accidentally locking ourselves out.
1. Create the Auth0 SPA and API.
2. Set callback/logout/web-origin URLs for the actual Netlify domain.
3. Add the public Auth0 configuration to Netlify with
ADV_AUTH_REQUIRED=false.4. Deploy and test Universal Login.
5. Capture your Auth0
sub and set it as ADV_AUTH0_OWNER_SUBS.6. Run a protected API test and Connector Lab.
7. Set
ADV_AUTH_REQUIRED=true and redeploy.8. Verify owner/admin login before inviting anyone else.
Prepared Files
Everything tenant-neutral is already built.