Auth0 moved the Rules and Hooks deadline: Hooks stop on 30 April 2027, Rules on 31 January 2028

If your Auth0 tenant still runs RulesdefinitionThe JavaScript snippets Auth0 used to run at login. Someone would write one to add a role to the token or block a sign-in, and each one ran after the last. or HooksdefinitionOlder Auth0 scripts for moments outside login. Someone might have used one to stamp machine-to-machine tokens or check sign-ups, and then forgotten about it., the 18 November 2026 cut-off you were planning around is gone. Auth0's docs now say Hooks stop running after 30 April 2027 and Rules after 31 January 2028. Use the extra months to migrate properly, not to wait.

A rule that adds a role to a token is a security control. When it stops running, the app gets a token without the role. Depending on how the app was written, that user either can't do their job or gets in with the wrong permissions. A hook that checks sign-ups or stamps machine-to-machine tokens fails the same way, and you only find out when something downstream breaks.

The extension helps, but only if you spend it. You still can't fix a bug in an old rule, because the code is frozen. And this is the second time the plan has changed. Auth0's original plan in 2023 was to remove both on 18 November 2024. That became read-only modedefinitionWhat old Rules and Hooks have been stuck in since 18 November 2024. They still run and you can still switch them off. Nobody can change a line of their code. instead, then an 18 November 2026 end of life, and now two separate dates. Don't budget on a third move.

The split matters most for teams that planned one project for both. Hooks are usually fewer and simpler, but people forget them because they don't run at login. They handle things like client credentials grants for your APIs and phone messages for MFA. Move those first and give the bigger Rules pipeline the rest of the runway.

For engineers: Auth0 says Post-Login Actions run after active Rules, and recommends converting from the end of the pipeline backwards. The rules that run early stay in place while the later logic moves to Actions, so nothing reads a claim before the code that writes it is in place.

The read-only rule is the one that bites in practice. If a rule has a bug today, the only fix is to switch it off and replace it with an Action. That also catches CI/CD pipelines: Auth0 says editing their code is unsupported and tells you to make sure deploys don't attempt it, so check your Deploy CLI or Terraform config before the next release goes out.

Operators on Auth0's community forum point to two traps the docs don't stress. Some tenants have rules they never wrote by hand, such as the one the Authorization Extension generates, and people have had to rewrite that one as an Action themselves. One user found that after switching the tenant to Node 22, a package their extension's Hooks needed was missing from the legacy sandbox. Auth0 says that setting applies to Rules, Hooks, custom database scripts and custom social connections at once, so a runtime change can break frozen code you can't patch.

Two gaps are the likeliest to need a real redesign. Rules that read an upstream social or enterprise provider's token from user.identities have no direct equivalent in post-login Actions, so the feature built on top of them needs a new design. Rules that call the Management API on every login are the other one. In Actions every call needs its own token request first, and Auth0 warns that Management API calls on a busy login path can cause failed logins at peak times.

Metadata updates get easier. A rule had to call the Management API to save app_metadata, while an Action can set several metadata changes and Auth0 sends them in one call. That's also a chance to stop writing data into user profiles that keeps growing them toward the new 10KB limit.

We plan and run Auth0 migrations, including this one, and compare tokens before and after every step so you can see nothing changed for users. Our Auth0 page shows what we do. If you'd rather keep the work in-house, you can hire Auth0 engineers to join your team, or start with a short identity assessment that counts what your tenant still runs.