Already using Auth0? Use your existing tenant to authenticate users for local LLMs. Attach Gateway verifies Auth0 JWTs and adds per-user identity to every request.
Auth0 handles user authentication beautifully. But local LLMs like Ollama don't speak OIDC. Attach bridges the gap:
┌──────────┐ ┌──────────┐ ┌─────────────────┐ ┌─────────┐ │ User │────▶│ Auth0 │────▶│ Attach Gateway │────▶│ Ollama │ │ (App) │ JWT │ Verify │ │ (Token Check) │ │ / vLLM │ └──────────┘ └──────────┘ └─────────────────┘ └─────────┘
Attach validates Auth0 JWTs automatically. Invalid tokens get rejected before reaching your LLM.
X-Attach-User headers carry the verified Auth0 user ID to all downstream services.
Use your existing Auth0 tenant and applications. No new identity provider to configure.
From your Auth0 dashboard, grab your domain and API audience.
# Auth0 Dashboard > Applications > APIs Domain: your-tenant.auth0.com Audience: your-api-identifier
export OIDC_ISSUER=https://your-tenant.auth0.com/ export OIDC_AUD=your-api-identifier # Start the gateway attach-gateway --port 8080
# Using Auth0 CLI or SDK auth0 login export JWT=$(auth0 api tokens create --audience your-api-identifier)
curl -H "Authorization: Bearer $JWT" \
-d '{"model":"llama3","prompt":"hello"}' \
http://localhost:8080/api/chat
# Without valid token: 401 Unauthorized
# With valid token: 200 OK + responseAttach Gateway verifies tokens using Auth0's JWKS endpoint. Private keys never leave Auth0. Tokens are validated for signature, expiration, audience, and issuer on every request.
Yes. Auth0 Actions can add custom claims to tokens (like roles, permissions, or organization IDs). Attach passes these through in the X-Attach-Claims header, and you can use them for fine-grained access control in your LLM application.
No. Auth0's free tier works perfectly with Attach. You get up to 7,500 monthly active users and unlimited machine-to-machine tokens. The free tier includes custom API audiences, which is all Attach needs.
Token refresh is handled client-side using Auth0's SDK. When your access token expires, your app requests a new one from Auth0 using the refresh token. Attach doesn't need to know about refresh—it just validates whatever JWT you send.
Absolutely. Create one API in Auth0, authorize multiple applications to request tokens for it, and all those apps can use the same Attach Gateway. User identity is preserved across apps via the 'sub' claim.
Connect your existing Auth0 tenant in under 5 minutes. No new identity provider needed.