import auth0

Streams a CMF file, chunks it to Auth0’s 500KB Bulk User Import job limit, submits and polls each chunk, and merges the per-user results into import-report.json. If organizations.cmf.jsonl and/or roles.cmf.jsonl sit alongside the users file, the organizations/roles/memberships phase runs automatically afterward, through a bounded, rate-limit-aware worker pool.

Usage

export AUTH0_DOMAIN=your-tenant.us.auth0.com
export AUTH0_TOKEN=...
# or let iamigrate get (and renew) the token from a Machine-to-Machine application:
# export AUTH0_CLIENT_ID=... AUTH0_CLIENT_SECRET=...

iamigrate import auth0 --in users.cmf.jsonl.gz --connection-id con_xxx
# or, with a token that has read:connections:
iamigrate import auth0 --in users.cmf.jsonl.gz --connection my-database

The target database connection is chosen in this order: --connection-id, then --connection (looked up by name), then connection_id from --mapping. If none is given, the tenant’s only database connection is used. Looking up a connection, by name or automatically, needs the read:connections scope. Without that scope, pass --connection-id.

Authenticate with either a Management API token (--token) or a Machine-to-Machine application’s client ID and secret (--client-id/--client-secret). Flags take precedence over environment variables; if both $AUTH0_TOKEN and $AUTH0_CLIENT_ID/$AUTH0_CLIENT_SECRET are set, the token is used.

Flags

Flag	Description
`--in`	CMF `users.cmf.jsonl.gz` path (required)
`--mapping`	`mapping.yaml` path (optional; can supply `--connection-id` instead)
`--connection-id`	Auth0 database connection ID
`--connection`	Auth0 database connection name, resolved to its ID (needs `read:connections`). Can’t be combined with `--connection-id`. If both are omitted and `--mapping` has no `connection_id`, the tenant’s only database connection is used.
`--upsert`	Allow re-running this import against existing users. Forces the password translator to always use `custom_password_hash` (updatable) instead of the simpler, write-once `password_hash` field.
`--domain`	Auth0 tenant domain (or `$AUTH0_DOMAIN`)
`--token`	Auth0 Management API token (or `$AUTH0_TOKEN`)
`--client-id`	Machine-to-Machine application client ID (or `$AUTH0_CLIENT_ID`). With `--client-secret`, iamigrate gets the Management API token itself through the `client_credentials` grant and renews it before it expires. Can’t be combined with `--token`.
`--client-secret`	Machine-to-Machine application client secret (or `$AUTH0_CLIENT_SECRET`)
`--report`	`import-report.json` output path (default: alongside `--in`)