Auth0 Guardian

Auth0 Guardian is a mobile app for completing multi-factor authentication on iOS and Android. Users can approve a login push notification on an enrolled device or generate a temporary one-time password, which is valid for 30 seconds by default. The app supports multiple languages and dialects, defaults to the device language, and offers system, light, and dark themes. Users can protect it with a passcode or passphrase and device biometrics. Organizations can use Guardian SDKs to build similar apps or add Guardian capabilities to their own applications. Push notifications can use AWS SNS, Firebase Cloud Messaging, or Apple Push Notification service. Auth0 MFA API endpoints can enforce MFA at token endpoints and manage enrollment or factors. A limitation applies to custom SDK apps: they cannot approve web login attempts when push notifications are disabled, and they do not display login attempt details in a native-device dialog. Auth0 describes Guardian provider configuration as a legacy option and generally recommends the any provider setting. Auth0's pricing lists Pro Multi-Factor Authentication in Essentials at $35 a month for up to 500 monthly active users.

Auth0 Guardian supports push-based login approval and temporary OTPs, with language, theme, and app-protection options. Organizations using its SDK should account for the restrictions on web login approvals and displayed login details.

Guardian suits people completing MFA on an iOS or Android device and organizations adding Guardian capabilities to their own apps. It may also suit users who prefer temporary codes to push approval.

Auth0 Guardian is a mobile app for completing multi-factor authentication with push approvals or temporary one-time passwords. It suits organizations using Auth0 that want a mobile factor for employees or customers, especially when they can use the standard Guardian app rather than build around its SDK limitations. Its language, theme, and app-protection options are useful, but teams should weigh the login approval constraints before adopting a custom app.

Overview

Guardian gives enrolled users two ways to complete MFA: approve a login notification on their device or enter a short-lived OTP from the app. The push route can make routine sign-ins quicker; OTPs offer another option when a push approval is not the chosen method. Organizations can also use the MFA API to enforce MFA at token endpoints and enroll or manage factors.

For teams extending the experience, Guardian SDKs can add Guardian capabilities to an existing app or support a custom Guardian-like app. That flexibility comes with meaningful limits: custom SDK apps cannot approve web login attempts when push notifications are disabled, and they do not display login attempt details in a native-device dialog. Auth0 also treats the Guardian provider setting as legacy and recommends the any provider setting in most cases, so new implementations should account for that guidance.

Key features

Push approval and temporary codes

Users approve a notification on an enrolled device to complete a login. This is a direct fit for organizations that want users to confirm sign-ins on a phone. Guardian also generates OTPs that are valid for 30 seconds by default, giving users a code-based MFA method within the same app.

App protection and personalization

Users can protect Guardian with a passcode or passphrase and device biometrics. Support for multiple languages and dialects, with the device language selected by default, helps organizations serving users across language preferences. System, light, and dark themes are supported on both iOS and Android.

Custom app integrations

Organizations can send push notifications through AWS SNS, Firebase Cloud Messaging, or Apple Push Notification service. SDKs allow Guardian capabilities to be built into an organization’s app, but the web-login restrictions and missing login details make that route a weaker fit when users need clear context before approving a sign-in.

Pricing

Auth0 uses a freemium model, with a free plan and a 22-day trial. The Essentials plan is $35 a month, billed monthly, and includes 500 monthly active users and 10 organizations; Auth0 lists Pro Multi-Factor Authentication in this plan. That makes Essentials the stated starting point for teams that need this paid MFA offering, though its 500-user allowance is a key planning limit.

The Free plan costs nothing, billed monthly, and allows 25,000 monthly active users, one custom domain, five organizations, and one enterprise connection. It offers a much larger active-user allowance than Essentials, but the plan details do not include the Pro MFA entitlement. Professional costs $240 a month, billed monthly, with 500 monthly active users; it may suit organizations considering a higher-tier Auth0 plan, but the stated user cap is the same as Essentials. Enterprise has custom pricing and a 99.99% SLA.

Platforms

Guardian is available on Android and iOS through Google Play and the Apple App Store. These are the supported mobile platforms for the app; the MFA API and SDKs provide options for organizations implementing MFA in their own Auth0 flows or applications.

Who it's for

Guardian is best suited to organizations already using Auth0 that want mobile push approval and OTPs as MFA options, with localization and app-protection controls for end users. It is a less convincing choice for teams whose custom app must approve web logins without push or show users login attempt details before approval.

Pros and cons

Pros

• Push approvals and 30-second OTPs provide two ways to complete MFA from one mobile app.
• Passcode or passphrase protection and device biometrics give users options for guarding access to the app.
• Multiple languages, dialects, and system, light, or dark themes support varied user preferences.
• The MFA API supports enforcement at token endpoints and management of enrolled factors.

Cons

• Custom SDK apps cannot approve web login attempts when push notifications are disabled.
• Custom SDK apps do not show login attempt details in a native-device dialog, limiting the context users get at approval time.
• The Guardian provider setting is legacy, and Auth0 recommends the any provider setting in most cases.
• Essentials includes 500 monthly active users, while the Free plan’s 25,000-user allowance does not include the stated Pro MFA entitlement.

Alternatives

For a broader identity product with customer IAM, a free plan, and 2–3 social logins, consider miniOrange Identity and Access Management. AWS IAM Access Analyzer is a free alternative for IAM policy validation and policy generation, rather than mobile MFA approvals. Consider Descope if open-source SDKs matter; its free plan includes 7,500 MAUs, 10 monthly active tenants, and three SSO connections.

Frontegg offers a free Pay as you go plan with 7,500 monthly active users, five enterprise connections, unlimited organizations, and a custom domain, which may fit teams prioritizing those allowances. FusionAuth has a free self-hosted Community plan with unlimited core authentication, making it a candidate for teams seeking self-hosting. Google Cloud Identity may suit organizations seeking enterprise security features and automated provisioning; its Premium annual or fixed-term plan is $6 a month.

WorkOS offers up to one million users free through AuthKit, which may fit teams prioritizing that user allowance. Zoho Directory has a free plan for 10 users with three third-party cloud apps, two directory stores, and 10 device authentications. Readers comparing adjacent categories can also browse Single Sign-On Software, Passwordless Authentication Software, Passkey Authentication Software, Identity and Access Management Software, and Authenticator apps.

Verdict

Auth0 Guardian is a strong fit for Auth0 organizations that want users to approve sign-ins by push or use temporary OTPs, with mobile app protection and language and theme choices. Choose it when the standard mobile app and Auth0 MFA flows meet your needs. Look elsewhere or reconsider a custom SDK implementation if web approvals without push or visible login details are essential.