> ## Documentation Index
> Fetch the complete documentation index at: https://docs-staging-quickstart-revamp.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

> Describes how to enable third-party applications for your tenant.

# Enable Third-Party Applications

You can enable third-party applications for your tenant. See [First-Party and Third-Party Applications](/docs/get-started/applications/confidential-and-public-applications/first-party-and-third-party-applications) for details on the differences between the two types of applications.

1. [Update your application's ownership to third-party](/docs/get-started/applications/confidential-and-public-applications/update-application-ownership) in Auth0.

   By default, applications registered in Auth0 are first-party applications. If you want your application to be a third-party application, you must update its ownership.
2. [Promote the connections you will use with third-party applications to domain level](/docs/authenticate/identity-providers/promote-connections-to-domain-level) in Auth0.

   Third-party applications can only authenticate users from [connections](/docs/authenticate/identity-providers) flagged as domain-level connections. Domain-level connections can be enabled for selected first-party applications while also being open to all third-party application users for authentication.
3. Update your application's login page. If you use [Lock](/docs/libraries/lock) in the [Universal Login Page](/docs/authenticate/login/auth0-universal-login/universal-login-vs-classic-login/classic-experience), you must also:

   1. Upgrade to Lock version 11 or later.
   2. Set the `__useTenantInfo: config.isThirdPartyClient` flag when instantiating Lock.
   3. For Private Cloud users only: Set the [`configurationBaseUrl` option](/docs/libraries/lock/lock-configuration#configurationbaseurl-string-) to `https://{config.auth0Domain}/` when instantiating Lock.

## Access token current\_user\_\* scopes

Neither first- nor third-party applications can use <Tooltip tip="ID Token: Credential meant for the client itself, rather than for accessing a resource." cta="View Glossary" href="/docs/glossary?term=ID+tokens">ID tokens</Tooltip> to invoke <Tooltip tip="ID Token: Credential meant for the client itself, rather than for accessing a resource." cta="View Glossary" href="/docs/glossary?term=Management+API">Management API</Tooltip> endpoints. Instead, they should get <Tooltip tip="Access Token: Authorization credential, in the form of an opaque string or JWT, used to access an API." cta="View Glossary" href="/docs/glossary?term=access+tokens">access tokens</Tooltip> with the following `current_user_*` scopes required by each endpoint:

<table class="table">
  <thead>
    <tr>
      <th>Scope</th>
      <th>Endpoint</th>
    </tr>
  </thead>

  <tbody>
    <tr>
      <td><code>read:current\_user</code></td>
      <td>List or search users</td>
    </tr>

    <tr>
      <td />

      <td>Get a user</td>
    </tr>

    <tr>
      <td />

      <td>Get user MFA enrollments</td>
    </tr>

    <tr>
      <td><code>update:current\_user\_metadata</code></td>
      <td>Update a user</td>
    </tr>

    <tr>
      <td />

      <td>Delete a user's multi-factor provider</td>
    </tr>

    <tr>
      <td><code>create:current\_user\_device\_credentials</code></td>
      <td>Create a device public key</td>
    </tr>

    <tr>
      <td><code>delete:current\_user\_device\_credentials</code></td>
      <td>Delete a device credential</td>
    </tr>

    <tr>
      <td><code>update:current\_user\_identities</code></td>
      <td>Link a user account</td>
    </tr>

    <tr>
      <td />

      <td>Unlink a user identity</td>
    </tr>
  </tbody>
</table>

## Script example

```html lines expandable
<script src="https://cdn.auth0.com/js/lock/11.x.y/lock.min.js"></script>
...
<script>
  // Decode utf8 characters properly
  var config = JSON.parse(decodeURIComponent(escape(window.atob('@@config@@'))));

  var connection = config.connection;
  var prompt = config.prompt;
  var languageDictionary;
  var language;
  if (config.dict && config.dict.signin && config.dict.signin.title) {
    languageDictionary = { title: config.dict.signin.title };
  } else if (typeof config.dict === 'string') {
    language = config.dict;
  }

  var lock = new Auth0Lock(config.clientID, config.auth0Domain, {
    auth: {
      redirectUrl: config.callbackURL,
      responseType: config.callbackOnLocationHash ? 'token' : 'code',
      params: config.internalOptions
    },
    assetsUrl:  config.assetsUrl,
    allowedConnections: connection ? [connection] : null,
    configurationBaseUrl: 'https://' + config.auth0Domain + '/', // for PSaaS only
    rememberLastLogin: !prompt,
    language: language,
    languageDictionary: languageDictionary,
    closable: false,
    __useTenantInfo: config.isThirdPartyClient // required for all Tenants
  });

  lock.show();
</script>
```

## Learn more

* [First-Party and Third-Party Applications](/docs/get-started/applications/confidential-and-public-applications/first-party-and-third-party-applications)
* [User Consent and Third-Party Applications](/docs/get-started/applications/confidential-and-public-applications/user-consent-and-third-party-applications)
* [Promote Connections to Domain Level](/docs/authenticate/identity-providers/promote-connections-to-domain-level)