Auth0
When a leak is confirmed, the active sessions of the matching Auth0 account are terminated.
How it works
The connection uses a Machine to Machine application. Only two scopes are granted: read:users to read the target account and delete:sessions to terminate its sessions.
Whether the permission was granted is read from inside the access token. If it is missing the connection is not treated as verified.
Auth0 processes the request with a short delay; the session list empties within a few seconds. Refresh tokens are not affected and are revoked by a separate operation.
Limits
Passwords are not changed, accounts are not deleted and roles are not assigned.
Accounts whose identity comes from another provider are out of scope; closing a session in Auth0 does not cut access at the source provider.
The leaked value itself is never placed in a request.
Setup
The setup steps are in the panel, on the integration’s own screen. What to do on the provider side and which value goes where is written there.