In Tyk: Create an API - mocks run before authentication, so use virtual end-point if you are mocking the API for testing Create Policy, select API under Access Rights, save and record Policy ID for entering in Auth0 Create a unique tag on the policy so that it can be queried to validate it is being used by Tyk (chicken & egg here as you have to create API before policy for rights and need to enter policy ID in API Auth) Set API Authentication Mode to JWT, HMAC, and set the secret to some plain text Set API Authentication Identity Source to sub or it will be logged that base wasn't found, using sub Set API, Policy Field Name to pol or some other unused JWT claim name This will be used to find the Tyk Policy by ID (not name) which is auto generated when the policy is created In Auth0: Set the secret to some base64 encoded plain text since Auth0 requires base64 & Tyk requires plain text In Rules : Settings add a key=value, e.g., auth0 clientId=Tyk Policy ID,...