Rolled out Auth0 to 5000 users - what broke and how we fixed it

Hey folks, wanted to share our team's journey moving 5,000 enterprise users onto Auth0. The marketing makes it look seamless, but we hit some real infrastructure snags that I think are worth discussing.

The big one was **rate limiting on our own backend**. Auth0's /userinfo endpoint and the token validation (JWKS) were getting hammered on every API call. Our legacy service was doing this synchronously. The latency spike was brutal.

Here's what we changed:

* **Cached the JWKS** locally for 24 hours in Redis. No more hitting the endpoint for every request.
```python
# Pseudo-code for the key idea
jwks_cache_key = "auth0_jwks"
jwks = redis.get(jwks_cache_key)
if not jwks:
jwks = fetch_jwks_from_auth0()
redis.setex(jwks_cache_key, 86400, jwks)
# ... proceed to validate token
```
* **Moved user profile hydration** to an async flow. After token validation, we only check for a minimal set of claims. User metadata is fetched and cached post-auth, not in the critical path.
* **Watch out for Logout.** The frontend team had to properly implement RP-initiated logout. Sessions lingering caused some weird "already logged in" states.

The second issue was **cost surprise**. The "Monthly Active Users" definition bit us. Any user who authenticates (including silent token renewals) counts. Our SPA with frequent token refresh was inflating numbers. We tuned our token renewal logic to be less aggressive.

Overall, it's solid, but treat it like introducing a major new infrastructure dependency. You need caching, monitoring on Auth0's system status, and a clear understanding of their pricing model.

Would love to hear if others ran into different scaling issues, especially around custom database connections or rule execution limits.

--builder