Connect Auth0
For centers that already run an Auth0 tenant and want staff signing in through it.
Who this is for
Centers that already operate an Auth0 tenant — usually multi-site groups with their own IT, or operators whose other systems already sit behind it. If you don't run one today, this isn't a reason to start; JumpCloud or Okta are more usual for a single center.
Setting it up
Open More → Marketplace and choose Auth0. Paste the Auth0 domain, Client ID and Client secret from an application you create in Auth0 for RoundUp. Once connected, staff see Sign in with Auth0 on the sign-in screen. Use Test Auth0 sign-in before you tell anyone.
Staff email addresses must match between Auth0 and the address their RoundUp invitation went to — that's the identifier RoundUp matches on.
While Auth0 is connected, every staff member at the center — directors included — signs in through it, and a password is refused. Families aren't affected. Keep the client secret current, and run Test Auth0 sign-in after any change on the Auth0 side.
If the secret expires or is rotated in Auth0 without being updated here — or a SAML certificate runs out — you aren't locked out: the first time Auth0 refuses it, RoundUp puts your center back on passwords until the credential is replaced. For anything else that breaks sign-in, email support@roundupece.com and we'll re-enable passwords at your center for a few hours so you can get in and fix it.
A connection belongs to one center, and a sign-in through it can only land in that center. A group running several centers connects each one, which is what keeps a sign-in at one site from reaching another site's roster.
One provider at a time
A center signs its staff in with one identity provider. While Auth0 is connected, the Okta and OpenID Connect tiles explain that rather than offering to connect — and the same in reverse. To switch, disconnect the one you have with Disconnect Auth0, then connect the new one.
A center that connected two before this restriction existed keeps working: Okta takes precedence, and disconnecting it promotes the other rather than locking anyone out.
Accounts still come from invitations
Signing in never creates an account. Someone authenticating through your tenant without a staff invitation at the center is refused and told to ask their director. An invitation they haven't opened yet is enough — their first Auth0 sign-in activates the account.
This is deliberate: it keeps a directory identity, on its own, from opening access to children's records. See Roles and permissions.
Troubleshooting
The button doesn't appear
The connection isn't finished. RoundUp only shows the button once the client secret — or, for a SAML connection, the certificate — has been saved, and while that credential still works. Until then, staff sign in with their passwords. If the button disappeared from a connection that used to work, the secret or certificate has expired: replace it and the button comes back.
"No account is linked to your Auth0 email"
RoundUp has no staff account under the email Auth0 sent. (An invitation that hasn't been opened isn't the cause.) Compare the two addresses character by character before looking anywhere else.
"Your Auth0 account isn't linked to a staff account at this center"
They have a RoundUp account, but not at the center whose Auth0 connection they used. Check they were invited to that center.
"This account isn't registered for this app"
The center belongs to a different RoundUp app from the one they opened. Check they're using the RoundUp app your center is set up in.
More: All director guides