// auth0 integration
Auth0 OAuth callback against your localhost (https required)
Auth0 requires the OAuth callback URL to be HTTPS. http://localhost:3000 won't work for some social providers. Tunnel through lrok and you have a real cert at the edge — Auth0 + every social IDP accept it.
1 · Set up the lrok tunnel
1. Reserve
$ lrok reserve auth-dev2. Run app
$ npm run dev # http://localhost:30003. Tunnel
$ lrok http 3000 --hint auth-dev
2 · Configure Auth0
1. Auth0 → Applications → your app → Settings
Allowed Callback URLs: add https://auth-dev.lrok.io/callback (and your prod URL).
2. Allowed Logout URLs
https://auth-dev.lrok.io
3. Allowed Web Origins
https://auth-dev.lrok.io — required for silent auth from the browser.
// auth0-specific gotcha
Some social IDPs (Apple Sign-In, Twitter) reject any localhost / .local URL even via tunnel; lrok's lrok.io subdomain is real-public so they accept it. Auth0 itself doesn't care — its hosted-page redirect logs the lrok URL.