How to create a programmatic user in Auth0? - node.js

Question

I am building a CLI tool and want to create a new programmatic user for each end user.
I.e. Joe Bloggs signs up with username and password but also has a client_id and client_secret which can be used in the CLI.
Is it possible to create this kind of user in Auth0 and if so, how can I create it programmatically?
It looks like I can use this to create users via the API and do something like:
axios({
method: "POST",
baseUrl: "https://<tenant>.eu.auth0.com,
uri: "/api/v2/users",
body: {
"email": "john.doe#gmail.com",
"phone_number": "[phone]",
"user_metadata": {},
"blocked": false,
"email_verified": false,
"phone_verified": false,
"app_metadata": {},
"given_name": "John",
"family_name": "Doe",
"name": "John Doe",
"nickname": "Johnny",
"picture": "https://secure.gravatar.com/avatar/15626c5e0c749cb912f9d1ad48dba440?s=480&r=pg&d=https%3A%2F%2Fssl.gstatic.com%2Fs2%2Fprofiles%2Fimages%2Fsilhouette80.png",
"user_id": "abc",
"connection": "Initial-Connection",
"password": "secret",
"verify_email": false,
"username": "johndoe"
}
})
However, this appears to be for creating an end user: Create a new user for a given database or passwordless connection. as opposed to a CLI type user which can use a client_id / secret.
Does anybody know if I can create this kind of user in Auth0?

Answer 1

The client_id and client_secret that Auth0 issues to Applications (known in the API as /Clients) are for machine-to-machine interactions with Auth0, not with your own service. They allow a trusted backend service to manage the users within Auth0. Or, they allow an Application to initiate a user's OAuth2 authentication flow.
It sounds like you are looking to avoid an OAuth2 authentication flow and provide a static API key, not for Auth0, but for your own service. Auth0 may be overkill in this case, but you can roll your own solution using Auth0, or any user store. One suggestion is to manually generate an API token for new Auth0 users and store them in the users' app_metadata. When your CLI provides a username and API key to your backend service, your trusted backend service can use its Auth0 client_id and client_secret look up the user in Auth0 and confirm that the API key in the app_metadata matches.
Also note the existence of the Resource Owner Password Flow. It would allow your CLI to provide a username and password directly to Auth0 on behalf of your CLI user. The API token that you generate can be set as the user's password.