37590801?s=460&v=4

A software engineer who dreams about non-electric sheep and autonomous vehicles and likes to champion security.

Software Engineer

Dan Arias

Learn how to use TypeScript to build a feature-complete Fastify API. Tutorial on how to use TypeScript with Fastify to create, read, update, and delete data.

Fastify and TypeScript Tutorial: Build a CRUD API

deepu-sasidharan

Deepu is a polyglot developer, Java Champion, and OSS aficionado. He mainly works with Java, JS, Rust, and Golang. He co-leads JHipster and created the JDL Studio and KDash. He's a Staff Developer Advocate at Okta. He is also an international speaker and a published author.

Staff Developer Advocate

Deepu K Sasidharan

Learn how to build a tool-calling AI agent using LangGraph, Vercel AI SDK, and Next.js. Integrate different kinds of tools into them. Use Google services like Gmail, Calendar, and Drive as tools secured using Auth0 Token Vault.

**AI agents** and **Operators** are the next big things in software development. In a [previous post](https://auth0.com/blog/genai-tool-calling-intro/), we discussed how AI agents are taking center stage by seamlessly integrating with multiple digital tools to be more efficient. In this post, we will build a personal assistant that can use different types of tools. Both simple unauthenticated tools and more complex authenticated tools like Gmail, Calendar, and Google Drive.

If you haven't read the previous post, I recommend you do so before continuing to better understand tool calling in AI agents and how security is currently handled.

<include
 src="LinkCard"
 title="Tool Calling in AI Agents: Empowering Intelligent Automation Securely"
 link="https://auth0.com/blog/genai-tool-calling-intro/"
 description="Discover how AI agents are taking center stage by seamlessly integrating with multiple digital tools to be more efficient. Learn why it is important to secure them."
 img="https://images.ctfassets.net/23aumh6u8s0i/4LrNhImjPcdPVpmCIrhlG9/4efed8dfb26630e6cf48b4a478a1f550/genai-tool-calling-intro.png"
/>

To keep this post focused on tool calling, we will only focus on the AI agent part, not the UI. Each tutorial step, including building the UI, can be found as a distinct commit in the [GitHub repository](https://github.com/auth0-samples/auth0-assistant0).

## Technology Stack

We will use a [Next.js](https://nextjs.org/) application called **Assistant 0** as the base. Assistant 0 is an AI personal assistant that consolidates your digital life by dynamically accessing multiple tools to help you stay organized and efficient.

Apart from Next.js, we mainly use the following technologies:

- [LangGraph.js](https://langchain-ai.github.io/langgraphjs/) and [LangChain's JavaScript framework](https://js.langchain.com/docs/introduction/) for building agentic workflows.
- [LangChain community tools](https://js.langchain.com/docs/integrations/tools/).
- Vercel's [AI SDK](https://github.com/vercel-labs/ai) to stream response tokens to the client and display the incoming messages.
- The [Auth0 AI SDK](https://github.com/auth0-lab/auth0-ai-js) and [Auth0 Next.js SDK](https://github.com/auth0/nextjs-auth0) to secure the application and call third-party APIs.

## Prerequisites

> **You will need the following tools and services to build this application**:
>
> - [Bun v1.2](https://bun.sh/) or [NodeJS v20](https://nodejs.org/en/download)
> - An Auth for GenAI account. [Create one](https://a0.to/ai-content).
> - An OpenAI account and API key. [Create one](https://platform.openai.com) or use any [other LLM provider supported by LangChain](https://js.langchain.com/docs/integrations/llms/).
> - A SerpAPI account and API key. [Create one](https://serpapi.com/).
> - A Google account for Gmail, Calendar, and Drive. Preferably a new one for testing.

## Getting Started

First clone [the repository](https://github.com/auth0-samples/auth0-assistant0) and install the dependencies:

```bash
git clone https://github.com/auth0-samples/auth0-assistant0.git
cd auth0-assistant0
git switch step-1 # so that we skip building the UI and get straight to the AI agent

bun install # or npm install
```

Next, you'll need to set up environment variables in your repo's `.env.local` file. Copy the `.env.example` file to `.env.local`. To start, you'll just need to add your OpenAI API key.

Now, start the development server:

```bash
bun dev # or npm run dev
```

Open `http://localhost:3000` with your browser to see the result! Ask the agent something, and you'll see a streamed response.

![Assistant 0](https://images.ctfassets.net/23aumh6u8s0i/ePzgV9PLYqmwdsqdJC2VU/3507e783ee8199b6a5599742ef81fed7/assistant-0.png)

### A Peek into the Code

The application is structured as follows:

- `src/app`: Contains the Next.js application routes, layout, and pages.
- `src/app/page.tsx`: Home page with chat interface.
- `src/app/api/chat/route.ts`: API route for handling chat requests. This is where the AI agent is defined.
- `src/components`: UI components used in the application.
- `src/lib`: Services and configurations. This is where custom tools will be defined.
- `src/utils`: Utility functions

Let's take a look at the `src/api/chat/route.ts` file where the AI agent is defined.

```js
// src/api/chat/route.ts
// ...
const AGENT_SYSTEM_TEMPLATE = `You are a personal assistant named Assistant0.
You are a helpful assistant that can answer questions and help with tasks.
You have access to a set of tools, use the tools as needed to answer the user's question.`;

export async function POST(req: NextRequest) {
  // ... Process the request and get messages
  // Create a new OpenAI chat model
  const llm = new ChatOpenAI({ model: "gpt-4", temperature: 0 });
  const tools = [];
  // Use a prebuilt LangGraph agent.
  const agent = createReactAgent({
    llm,
    tools,
    messageModifier: new SystemMessage(AGENT_SYSTEM_TEMPLATE),
  });
  // Stream back all generated tokens and steps from their runs.
  const eventStream = agent.streamEvents({ messages }, { version: "v2" });
  // Log tool calling data. Only in development mode
  const transformedStream = logToolCallsInDevelopment(eventStream);
  // Adapt the LangChain stream to Vercel AI SDK Stream
  return LangChainAdapter.toDataStreamResponse(transformedStream);
}
```

The route uses a prebuilt LangGraph agent and OpenAI chat model. No tools are defined yet; we will add them in the next section.

Here is a high-level architecture of the application with the tools we will be adding in this post.

![Assistant 0 architecture](https://images.ctfassets.net/23aumh6u8s0i/6ZTtsivmBOPUmKGWx479Xm/d8d90c3bf3f24f1c8ce99ff703a1ba7d/architecture.jpg)

Now that the base application is running, let's start building our personal assistant with tool-calling capabilities.

## Add Tools to the Assistant

If you recall the previous post, we discussed authenticated and unauthenticated tools. Let's start with an unauthenticated tool and then proceed to add more complex tools like Gmail, Calendar, and Google Drive.

### Add a Calculator Tool

We will start with a simple calculator tool from the LangChain community tools to perform basic arithmetic operations.

Install the `@langchain/community` package.

```bash
bun add @langchain/community # or npm i @langchain/community
```

Update the `src/api/chat/route.ts` file with the following code.

```js
// src/api/chat/route.ts
import { Calculator } from "@langchain/community/tools/calculator";
// ...
export async function POST(req: NextRequest) {
  // ...
  const tools = [new Calculator()];
  // ...
}
```

It's that simple! Now, try asking the assistant to perform some calculations. For example, `what is (2+56) x 200`. You should see the answer in the UI. If you check the console where Next.js dev server (`bun dev`) is running, you should see the tool calling data like below.

```bash
Tool calls state: {
 "call_E3Za9klJcJ5TADWiMj8XfjdB": {
   "name": "calculator",
   "args": "{\n  \"input\": \"(2+56) * 200\"\n}"
 }
}
POST /api/chat 200 in 8382ms
```

### Add a Web Search Tool

Now let's add a web search tool to search the web for information. Let's use [SerpAPI](https://serpapi.com/) for this. It's an authenticated tool. But since this is going to be API usage and not a user impersonation, we can simply use an API key.

First, get an API key from SerpAPI and add that to your `.env.local` file.

```bash
SERPAPI_API_KEY=your-api-key
```

Now, update the `src/api/chat/route.ts` file with the following code.

```js
// src/api/chat/route.ts
import { SerpAPI } from "@langchain/community/tools/serpapi";
// ...
export async function POST(req: NextRequest) {
  // ...
  const tools = [new Calculator(), new SerpAPI()];
  // ...
}
```

Again, quite simple! Now try asking the assistant to search the web for information. For example, `What is the top 10 news today?`. You will see the response in the UI.

![Assistant 0 web search](https://images.ctfassets.net/23aumh6u8s0i/h4hWDQwBBTUiDh6gdaVET/137647c87dd51c6cc34ec0a44d6e453d/assistant-0-web-search.png)

If you check the console, you should see the tool calling data like the one below.

```bash
Tool calls state: {
 "call_e8vqAPW45vMsUbFiIF9SW5Yn": {
   "name": "search",
   "args": "{\n  \"input\": \"top 10 news today\"\n}"
 }
}
POST /api/chat 200 in 15443ms
```

This corresponds to the `step-2` branch in case you want to double-check your code.

```bash
git switch step-2
```

### Add Gmail Tools

Now, let's get into business. I know you are here for this part, not to learn about adding calculators and web search tools. But before we can add a Gmail tool, we need to add Auth0 authentication to the application since we will be using Auth0's [Token Vault](https://auth0.com/docs/secure/tokens/token-vault) feature to get access tokens to call the Gmail API via a tool.

#### Add Auth0 Authentication

First, let's add Auth0 as the authentication provider to the application.

Follow the [Auth0 Next.js quickstart guide](https://auth0.com/ai/docs/user-authentication) to set up the application.

> If you want to create the Auth0 application manually, create a new application (Type: **Regular Web App**, Callback URL: `http://localhost:3000/auth/callback`) and get the **client ID** and **client secret**.

Update the `.env.local` file with credentials, and create the `src/lib/auth0.ts` and `src/middleware.ts` files.

If you want to skip to the next step, check out the `step-3` branch. The [full changelog for this step is on GitHub](https://github.com/auth0-samples/auth0-assistant0/commit/9a6db1ec49511afa7c361080c3f5a1854ee8efe5).

```bash
git switch step-3
```

#### Configure Auth0 for Gmail

To use Gmail API with Auth0 via a Google Social Connection, you need to do the following:

- Create Google OAuth 2.0 credentials
- [Enable Gmail API](https://console.cloud.google.com/apis/library/gmail.googleapis.com) for the credentials
- Configure Gmail social connection in Auth0

You can follow the [Google Sign-in and Authorization](https://auth0.com/ai/docs/google-sign-in-and-auth) guide from Auth0 to configure this.

#### Configure Auth0 AI SDK

First, install the `@auth0/ai-langchain` package from [Auth0 AI SDK](https://github.com/auth0-lab/auth0-ai-js).

```bash
bun add @auth0/ai-langchain # or npm i @auth0/ai-langchain
```

Update `src/lib/auth0.ts` with the following code.

```js
// src/lib/auth0.ts
// ...
export const auth0 = new Auth0Client({
  // this is required to get federated access tokens from services like Google
  authorizationParameters: {
    access_type: "offline",
    prompt: "consent",
  },
});

// Get the refresh token from Auth0 session
export const getRefreshToken = async () => {
  const session = await auth0.getSession();
  return session?.tokenSet?.refreshToken;
};
```

Create a new `src/lib/auth0-ai.ts` file with the following code.

```js
// src/lib/auth0-ai.ts
import { Auth0AI } from "@auth0/ai-langchain";
import { getAccessTokenForConnection } from "@auth0/ai-langchain";
import { getRefreshToken } from "@/lib/auth0";

// Get the access token for a connection via Auth0
export const getAccessToken = async () => getAccessTokenForConnection();

const auth0AI = new Auth0AI();

// Connection for Google services
export const withGoogleConnection = auth0AI.withTokenForConnection({
  connection: "google-oauth2",
  scopes: [],
  refreshToken: getRefreshToken,
});
```

#### Add Gmail Search Tool

We can add Gmail tools now that we have Auth0 authentication in place. Let's start with a Gmail search tool. This tool will allow the assistant to search for emails in the user's Gmail account.

First, we need to get an access token for the Gmail API. We can get this using the [Auth0 Token Vault](https://auth0.com/docs/secure/tokens/token-vault) feature.

Update `src/lib/auth0-ai.ts` with the required scopes.

```js
// src/lib/auth0-ai.ts
// ...
export const withGoogleConnection = auth0AI.withTokenForConnection({
  // ...
  scopes: ["https://www.googleapis.com/auth/gmail.readonly"],
  // ...
});
```

Install the `googleapis` package.

```bash
bun add googleapis # or npm i googleapis
```

Import the `GmailSearch` tool from LangChain community tools and update the `src/api/chat/route.ts` file with the following code.

```js
// src/api/chat/route.ts
import { GmailSearch } from "@langchain/community/tools/gmail";
import { withGoogleConnection, getAccessToken } from "@/lib/auth0-ai";
// ...
export async function POST(req: NextRequest) {
  // ...
  // Update the LLM model to gpt-4o-mini to support a larger context window
  const llm = new ChatOpenAI({
    model: "gpt-4o-mini",
    temperature: 0,
  });
  // Provide the access token to the Gmail tools
  const gmailParams = {
    credentials: {
      accessToken: getAccessToken,
    },
  };
  const tools = [
    // ... existing tools
    withGoogleConnection(new GmailSearch(gmailParams)),
  ];
  // ...
}
```

We are all set! Now, try asking the assistant to search for emails. For example, `What is the latest unread email?`. You should see the response in the UI.

![Assistant 0](https://images.ctfassets.net/23aumh6u8s0i/14n2drq2woolLeJybBMWk6/3bbc575f92493dc2322f485a6b4f4ac9/assistant-0-gmail-search.png)

If you check the console, you should see the tool calling data like the one below.

```bash
Tool calls state: {
 "call_rCzcZRjueyD8p2kzTmeZMiSK": {
   "name": "search_gmail",
   "args": "{\"query\":\"is:unread\",\"maxResults\":1,\"resource\":\"messages\"}"
 }
}
POST /api/chat 200 in 10892ms
```

#### Add Gmail Draft Tool

We will add a Gmail draft tool next. This tool will allow the assistant to draft emails on behalf of the user.

Update `src/lib/auth0-ai.ts` with the required scopes.

```js
// src/lib/auth0-ai.ts
// ...
export const withGoogleConnection = auth0AI.withTokenForConnection({
  // ...
  scopes: [
    // ... existing scopes
    "https://www.googleapis.com/auth/gmail.compose",
  ],
  // ...
});
```

Update the `src/api/chat/route.ts` file with the following code.

```js
// src/api/chat/route.ts
import { GmailCreateDraft } from "@langchain/community/tools/gmail";
// ...
export async function POST(req: NextRequest) {
  // ...
  const tools = [
    // ... existing tools
    withGoogleConnection(new GmailCreateDraft(gmailParams)),
  ];
  // ...
}
```

Now, ask the assistant to draft an email. For example, `Draft an email to John Doe about the meeting tomorrow.` You should see the response in the UI.

![Assistant 0](https://images.ctfassets.net/23aumh6u8s0i/hWz4f6iUXTacbCNoqxwLz/c16c70d786027012b4c4944639339999/assistant-0-gmail-draft.png)

If you check the console, you should see the tool calling data like the one below.

```bash
Tool calls state: {
"call_pPAk6rFYJSSyAuYkNWFf5KYX": {
  "name": "create_gmail_draft",
  "args": "{\"message\":\"Hi John,\\n\\nI hope this message finds you well. I wanted to … [Your Name]\",\"to\":[\"john.doe@example.com\"],\"subject\":\"Meeting Reminder\",\"cc\":[],\"bcc\":[]}"
}
}
POST /api/chat 200 in 7594ms
```

You can find the [full changelog of these two steps on GitHub](https://github.com/auth0-samples/auth0-assistant0/commit/020f90f9ca85824f9cf99a82986a91bf72625041).

This corresponds to the `step-4` branch in case you want to double-check your code.

```bash
git switch step-4
```

## Learn more about AI Agents and Auth for GenAI

You have successfully built an AI personal assistant that can search the web, search your emails, and draft emails. In the next chapters, we will switch to a more production-ready architecture and add more tools like User Info, Google Calendar, Google Drive, and Slack to the assistant.

This tutorial is part of a series of posts on tool-calling Agents with [Auth for GenAI](https://a0.to/ai-content). We learned how to add tools to an AI agent and how to secure them using Auth0.

Sign up for [Auth for GenAI in Developer Preview](https://a0.to/ai-content).

Before you go, we have some great news to share: we are working on more content and sample apps in collaboration with amazing GenAI frameworks like [LlamaIndex](https://www.llamaindex.ai/), [LangChain](https://www.langchain.com/), [CrewAI](https://www.crewai.com/), [Vercel AI](https://vercel.com/ai), and [GenKit](https://firebase.google.com/docs/genkit). [Auth for GenAI](https://auth0.com/blog/introducing-auth-for-genai-launching-identity-for-ai-agents/) is our new product to help you protect your user's information in GenAI-powered applications. Make sure to join the [Auth0 Lab Discord server](http://a0.to/auth0-lab-discord) to hear more and ask questions.


Build an AI Assistant with LangGraph, Vercel, and Next.js: Use Gmail as a Tool Securely

jess-author

Jessica Temporal is a Senior Developer Advocate at Auth0 and co-founder of the first Brazilian data science podcast called <a target='_blank' href='https://pizzadedados.com'><strong>Pizza de Dados</strong></a>. She’s the author of <a target='_blank' href='https://www.amazon.com/dp/B0CDNX6NS7/ref=sr_1_1?&_encoding=UTF8&tag=jesstempora0e-20&linkCode=ur2&linkId=efc4229f6b816609dfce4f185781d99a&camp=1789&creative=9325' ><strong>The Big Git Microbook</strong></a>, creator of <a target='_blank' href='https://gitfichas.com/en'><strong>GitFichas.com</strong></a>, and a part of <a target='_blank' href='https://www.linkedin.com/learning/instructors/jessica-temporal'><strong>LinkedIn Learning</strong></a> instructors team. Jessica helped develop the AI that identifies possible unlawful expenses from Brazilian politicians. She is part of the PyLadies initiative that works to improve diversity and inclusion in technology. In her free time, she likes to knit, play video games, use her 3D printer, and is learning to create 3D models.

Sr. Developer Advocate

Jessica Temporal

Generative AI is everywhere, and since not every user has access to all data, learn how to use retrieval-augmented generation with fine-grained authorization to ensure that private information stays private.

Build Trustworthy AI: Implementing Access Control for RAG Systems Using FGA

Mira Sharma

Mira is a Product Manager on Auth0’s Enterprise Federations team. She is passionate about building connections, whether they involve OIDC tokens, puzzling out the shape of new product features, or frustrating New York Times games. When she’s not working, she’s probably writing intergalactic stories, out on a run, or in a pool somewhere.


Associate Product Manager

At DeveloperWeek 2025, AI took center stage—highlighting trust issues, security gaps, and transparency challenges as companies push for more reliable AI.

![Developer Week 2025](https://images.ctfassets.net/23aumh6u8s0i/5eSfirnEouOlpOO8dXMdhr/839499a4d80d00dd6278d0cdab94b2df/developer-week-header.jpg)

[DeveloperWeek 2025](https://www.developerweek.com/) was an AI-lover’s dream, a cornucopia of AI-driven innovation emerging from small startups to established industry leaders. There were dancing robot dogs, a plethora of cyber trucks, and a robot so intent on shaking human hands that it alarmed a few passersby as it scuttled speedily toward them. Attendees were privy to demos of voice cloning, roundtables with people from a diverse array of expertise, an enthusiastic DJ, and a small inflatable slide that lay in bouncy disuse. Any spies would be alarmed at the number of “agents” being openly discussed around them.

There is no denying that AI is the future. Yet like any nascent relationship, there are looming hurdles that must be navigated on the road to a happily-ever-after.

## Trust Issues 


While many envision the ultimate AI solution as an autonomous agent capable of reasoning and handling complex tasks independently, today’s reality spans a wide range of autonomy. Most of the AI tools displayed at DeveloperWeek still require significant human input, with only a few pushing toward greater independence.  

<img src="https://images.ctfassets.net/23aumh6u8s0i/LxsZn0xN57pNGGo4iZZAv/ed74ed928f1c281636b91ceb8093c8c8/developer-week-bot.jpg" width="200" align="left" style="padding: 10px; alt="Bot" /> After attending several popular speaker sessions, it became clear that a central challenge in achieving true autonomy is trust: how can AI-based products be designed to deliver reliable, accurate outputs? Many of today’s successful AI tools—such as GitHub Copilot and Cursor.ai—are B2B products used by trained developers, inherently relying on human oversight for verification. Rules and procedures for proper usage can be created and followed systematically, reducing the risk of hallucinated code or other errors impacting production environments. 


<br>
B2C products, on the other hand, have fewer means of imposing usage rules on customers. AI tools may work as expected with prompts provided for testing, but there is an infinite number of prompts that customers could inadvertently create. Attempting to circumvent things like hallucination and training data bias may superficially appear to act as guardrails, but they are hardly guaranteed. 

[Generative AI never doesn’t have an answer](https://www.ibm.com/think/topics/ai-hallucinations): This is wildly appealing in some use cases and terrifyingly misleading in others. The wild west of unreliable AI products, however, will not last forever; technology is improving at exponential rates, and people are learning how to interact with AI in more effective ways. In one of the most well-attended sessions, “Give Your LLM a Left Brain,” Neo4j’s Stephen Chin highlighted GraphRAG as a powerful tool to enhance the creativity of LLMs by incorporating actual data and helping models generate more logical and relevant outputs. Limiting AI expertise and function is also a simple way to enable more comprehensive output testing and promote greater transparency in acknowledging the model's limitations. The work to refine and balance these capabilities—much like connecting the left and right hemispheres of the brain—is already in motion.

## All Talk?  

Augmenting AI prompts with real data to enhance results–going from RAGs to riches, if you will–is not a new concept, and neither were many of the ideas bubbling around the booths. Although AI is still new in terms of its technical revolution, it is no longer shiny and novel to the wider world–we’ve been hearing about it since 2022. And while all sorts of flashy demos have been presented to show off the glittering promise of the AI-led future, where is that future now? 

A slide from Auth0’s keynote, delivered by Shiv Ramji, was particularly apt for describing the lifetime of an AI product. Getting a product ready to demo is not the same as shipping it; many AI products are in the liminal stretch between demo and shipping, as illustrated below. 

![Auth0’s keynote](https://images.ctfassets.net/23aumh6u8s0i/1jzUQMIWfPiBNrTwG3vBNj/c3b485195c0d6e8d9bb28f9692f410c5/developer-week-phases.png)

In short, this means that an explosion in AI technology is still imminent, with increasing numbers of ready-to-use, publicly available tools released regularly. As more companies push beyond [Gartner’s "trough of disillusionment"](https://www.gartner.com/en/articles/what-s-new-in-artificial-intelligence-from-the-2023-gartner-hype-cycle), we’re witnessing a shift from skepticism to real, tangible progress, signaling that AI’s potential is beginning to be fully realized in ways that were once thought far off.

![Gartner](https://images.ctfassets.net/23aumh6u8s0i/7JCZEDrbN3IC0gOEF7KGcj/b020910303fb75dfb8f721093712a95e/hype-cycle-for-artificial-intelligence-2023.png)
_Source_: [Gartner](https://www.gartner.com/en/articles/what-s-new-in-artificial-intelligence-from-the-2023-gartner-hype-cycle)

## Lack of Transparency 

Part of AI’s sparkling allure is its ability to abstract away the nuisances of code and technicalities under the familiar veil of natural language. It’s this very abstraction, however, that turns AI into a black box that makes modification, testing, and usage more complicated. There is a growing gap between those who create AI models—the engineers and researchers developing the foundational architectures—and those who design AI-powered products—the product managers, UX designers, and business strategists shaping how AI is integrated into real-world applications. In one session, the presenter asked the packed audience if any of them had ever built an AI agent themselves, seeing as agents were the subject of the 25-minute session. Not a single hand was raised. 

This audience may have been particularly bashful, but this was a clear indicator of the opaqueness that still surrounds the AI space. Everyone wants AI, but how many truly understand it—from the theory behind it to its actual development and proper usage? As no-code solutions become more common, this gap in practical knowledge will inevitably increase–and while this enables accessibility, another broadly beneficial aspect of the natural language abstraction, it also leaves room for oversights in development and usage. 

Another consequence of the growing opaqueness of AI products is the simultaneous demand for increased visibility. Many companies at the event showcased products aimed at improving clarity through visualization, while others acknowledged that this need for visibility was a pressing concern. In some cases, companies leveraged the black box nature of AI to their advantage, using its opacity to conceal underlying deficiencies – like when it came to product security.

## Insecurities 

Security is often a shocking afterthought in the development of many AI products despite [widespread overlapping security concerns across the industry](https://auth0.com/blog/the-rise-of-ai-agents-and-the-security-challenges-ahead/). Companies working with solutions involving RAG highlighted [Fine-Grained Authorization (FGA)](https://auth0.com/blog/streamline-your-authorization-workflow-with-auth0-fga/) and [Role-Based Access Control (RBAC)](https://auth0.com/docs/authorization/rbac) as key focuses, while others using AI agents to call APIs pointed to issues around [permissions and scope](https://auth0.com/blog/permissions-privileges-and-scopes/) as their most pressing security concerns. To address these challenges, companies took several different approaches.

### 1. Implementing FGA or RBAC Internally
This approach, which was the most commonly mentioned in ad-hoc interviews during the event, involves companies handling security frameworks themselves. While this can be an effective way to ensure that sensitive data is protected, it raises an important question: why continue reinventing the wheel? Much like AI tools often build on the same foundational models, it seems inefficient for every company to address the same security challenge individually when much of the industry will ultimately tackle it in similar ways. Standardized solutions could save time and resources and enhance overall security across the board.

### 2. Offloading Security to Customers
Some companies initially reduce their security overhead by offloading the responsibility to their customers. This might seem like an attractive strategy early in product development, as it enables faster go-to-market timelines. However, this approach is unlikely to scale in the long term. As AI products mature, customers expect products to include robust, built-in security features, not to carry the burden themselves. 

### 3. Implementing Guardrails to Limit AI Functionality
Another approach companies are taking involves creating restrictions on what AI can and cannot do. Some limit AI to read-only access or severely restrict its interaction with APIs. One company took the latter approach even further, disabling the AI’s ability to make API calls altogether. Instead, the AI would leave placeholders where API calls should be made, requiring a human to fill in the gaps. This “human-in-the-loop” method reflects a cautious approach to security, recognizing that while AI is powerful, there are still areas where human oversight is indispensable. It also underscores the ongoing debate around [AI autonomy](https://auth0.com/blog/secure-human-in-the-loop-interactions-for-ai-agents/)—how much trust can we place in an AI to perform tasks traditionally handled by humans? (Also, should AI developers be counted as legitimate attendees at developer conferences?)

### 4. Proceeding Without Considering Security
Finally, the most concerning approach—still alarmingly common—entails moving forward without proper security measures in place. As AI continues to be integrated into production environments, neglecting security becomes an even greater risk, particularly with the rise of malicious actors leveraging AI capabilities. Security is most effective when it’s built-in from the start, not added as an afterthought or band-aid to patch vulnerabilities later on.

## An Exciting Future   

So, AI has some issues, and so do we. The challenges we face today—trust issues, security concerns, and the need for transparency, along with others—are simply part of the process of building a long-term, reliable partnership with this incipient technology. DeveloperWeek 2025 highlighted the significant progress made in the span of just a few years but also underscored the importance of addressing these challenges as we move forward. As we refine our approach to AI development, it will be crucial to balance innovation with responsibility. 

Security, in particular, remains one of the most pressing concerns. As AI systems become more capable and deeply integrated into business operations, ensuring secure authentication and access control will be critical to preventing vulnerabilities. Products like Auth0 are already tackling this challenge, offering insights into securing Generative AI applications with stronger identity and authorization frameworks. AI security is something that is most effective built-in from the start, enabling developers and businesses alike to balance AI innovation with robust safeguards. 

> Explore how you can integrate robust AI security strategies with Auth0: [Auth for GenAI](https://auth0.com/blog/auth-for-genai/).

The future of AI holds tremendous promise, and with continued collaboration and thoughtful problem-solving, the potential for positive, transformative impact is within reach. 

## AI Resources

* [Building a Secure RAG with Python, LangChain, and OpenFGA](https://auth0.com/blog/building-a-secure-rag-with-python-langchain-and-openfga/)
* [Build a Secure RAG Agent Using LlamaIndex and Okta FGA on Node.js](https://auth0.com/blog/genai-llamaindex-js-fga/)
* [Identity Challenges for AI-Powered Applications](https://auth0.com/blog/identity-challenges-for-ai-powered-apps/)
* [Secure “Human in the Loop” Interactions for AI Agents](https://auth0.com/blog/secure-human-in-the-loop-interactions-for-ai-agents/)
* [The Rise of AI Agents and the Security Challenges Ahead](https://auth0.com/blog/the-rise-of-ai-agents-and-the-security-challenges-ahead/)

Developer Week 2025: Building a Long-Term Relationship with AI

I stream, blog, and make youtube videos about tech stuff. I love coding, I love AI, and I love building stuff!

Juan Cruz Martinez

Learn how to use Okta FGA to secure your LangChain RAG agent in Python.

Retrieval-Augmented Generation (RAG) is a great way to create AI-driven applications that deliver more accurate, context-rich answers. Instead of relying purely on pre-trained knowledge, a RAG system retrieves domain-specific data (like PDFs, knowledge bases, or markdown files) and passes it into a language model. This is *awesome* when your data is public or freely shareable. But what happens if some of that data is *restricted* or *confidential*? That’s where fine-grained authorization comes in!

In this post, we’ll walk through:

1. **Why** authorization is crucial in RAG
2. **What** OpenFGA is, and how it helps you enforce fine-grained permissions
3. **How** to build a secure pipeline that filters out unauthorized documents **before** they reach your language model

## The Challenge of Authorization in RAG Systems

RAG systems retrieve relevant information from large datasets and use that information to enhance the AI model responses. While this functionality is powerful, it raises a significant challenge: **ensuring that each user only accesses the information they are authorized to see**. Authorization must be:

* **Accurate**: Only correct data gets through.
* **Performant**: Works quickly, even with large datasets.
* **Adaptive**: Updates with dynamic organizational changes, role updates, or any changes in the relationship between the information and the users.

A secure RAG system needs to enforce fine-grained access control without sacrificing speed or scalability. Roles might change, projects can be reassigned, and permissions could evolve over time. Handling all this efficiently is key to building a truly secure and robust RAG application.

## Proposed Solution: Secure Retrieval with LangChain, OpenAI, and OpenFGA

The solution employs a workflow that integrates document retrieval, user-specific authorization filtering, and Large Language Model (LLM) response generation.

We’ll build a pipeline that uses:

* **LangChain**: A helpful toolkit for chaining the steps of a RAG pipeline (loading data, embeddings, retrieval, prompting).
* **LLMs** (OpenAI or any other): For both embeddings (similarity search) and text generation.
* **OpenFGA**: A fine-grained authorization service that checks, for each document, if a user has the “can_view” relationship.

### LangChain

LangChain is a library that streamlines building LLM applications by assembling different components—like loading documents, vector stores, and prompt templates. This structure makes it easier to read, maintain, and modify your RAG pipeline.

### LLMs

Although we’ll demonstrate OpenAI’s embeddings and Chat APIs, you can easily replace them with other providers (e.g., Anthropic, LLaMA, or Azure OpenAI). The main tasks here are:

1. **Embedding** documents so you can do similarity searches.
2. **Generating** text from the retrieved documents to answer the user’s query.

### FGA and Okta FGA

**FGA (Fine-Grained Authorization)** is about controlling _who can do what_ with _which resources_, down to an individual level. In a typical role-based system, you might say, “Admins can see everything, and Regular Users can see some subset.” But in a real-world app—especially one that deals with many documents—this might not be flexible enough.

**OpenFGA (and Okta FGA)** addresses this by letting you define authorization _relationships_. The relationships defined in the authorization model can be either direct or indirect. Simply put, direct relationships are directly assigned between a consumer and a resource (we call them user and object) and stored in the database. Indirect relationships are the relationships we can infer based on the data and the authorization model.

If you would like to learn the basics of using FGA for RAG, check out this blog post on [RAG and Access Control: Where Do You Start?](https://auth0.com/blog/rag-and-access-control-where-do-you-start/).

<include
 src="LinkCard"
 title="RAG and Access Control: Where Do You Start?"
 link="https://auth0.com/blog/rag-and-access-control-where-do-you-start/"
 description="Learn how to get started with Okta FGA for a RAG application."
 img="https://images.ctfassets.net/23aumh6u8s0i/79NCborGcFIrAMeaV7G8oi/f9c588c2d05f0828d447e72e1fe825cc/Latam01.jpg"
/>

## Implementation: Step-by-Step

Below is a sample setup in Python. We’ll keep it simple so you can see the big picture. Feel free to adapt for your chosen LLM or a more robust data store.

### Set Up Prerequisites

To follow this tutorial and secure your application, you’ll need the following:

* Python 3.8.1 or newer.
* An Okta FGA account. If you don’t have one, you can [create one for free](https://dashboard.fga.dev/).
* An [OpenAI account and API key](https://platform.openai.com/).

### Download and install the sample code

To get started, clone the[ auth0-ai-samples](https://a0.to/auth0-ai-samples) repository from GitHub:

```
git clone https://github.com/auth0-samples/auth0-ai-samples.git
cd auth0-ai-samples/authorization-for-rag/langchain-python
# Create a virtual env
python -m venv venv
# Activate the virtual env
source ./venv/bin/activate
# Install dependencies
pip install -r requirements.txt
```

The application is written in Python and is structured as follows:

* `main.py` &mdash; The main entry point of the application, and it is where we define the RAG pipeline
* `docs/*.md` &mdash; Sample markdown files to be used as context for the LLM. There are two types of docs, public and private. Private documents are only accessible to certain individuals.
* `helpers/memory_store.py` &mdash; Creates an in-memory vector store that acts as the base retriever in the chain.
* `helpers/read_documents.py` &mdash; Utility to read the markdown files from the `docs` folder.
* `scripts/fga_init.py` &mdash; Utility to initialize the OktaFGA authorization model and sample data.

### RAG Pipeline

The `main.py` file defines the RAG pipeline using `Langchain` to interact with the underlying LLM model and retrieve data from our context. In your project, your data may be sourced from different platforms and systems, make sure you check the proper documentation about [loaders in the Langchain ecosystem](https://python.langchain.com/v0.1/docs/modules/data_connection/).

The following diagram represents the RAG architecture we are defining:

![LangChain RAG architecture](https://images.ctfassets.net/23aumh6u8s0i/4ReiQ2qnjzYRR18KujkHwe/4c4738866ad275b26aed2d7b9c8d3661/langchain-rag.png)

Now let’s talk Python:

```python
class RAG:
    def __init__(self):
        documents = read_documents()
        self.vector_store = MemoryStore.from_documents(documents)
        self.prompt = ChatPromptTemplate.from_template(
            """You are an assistant for question-answering tasks. Use the following pieces of retrieved context to answer the question. If you don't know the answer, just say that you don't know. Use three sentences maximum and keep the answer concise.\\nQuestion: {question}\\nContext: {context}\\nAnswer:"""
        )

        self.llm = ChatOpenAI(model="gpt-4o-mini")

    def query(self, user_id: str, question: str):
        chain = (
            {
                "context": FGARetriever(
                    retriever=self.vector_store.as_retriever(),
                    build_query=lambda doc: ClientBatchCheckItem(
                        user=f"user:{user_id}",
                        object=f"doc:{doc.metadata.get('id')}",
                        relation="viewer",
                    ),
                ),
                "question": RunnablePassthrough(),
            }
            | self.prompt
            | self.llm
            | StrOutputParser()
        )

        return chain.invoke(question)
```

Let’s break that down.

The `RAG` class first initializes a vector store and reads the documents using the helper functions. It also defines a system prompt for our use case and the LLM model in use, in our case, `gpt-40-mini`.

The class also defines a method query that builds the chain by piping the `FGARetriever` instance with the prompt and the LLM model. `FGARetriever` is provided by the [Auth0 AI SDK for Python](https://github.com/auth0-lab/auth0-ai-python).

The `FGARetriever` is designed to abstract the base retriever from the FGA query logic. The `build_query` argument lets us specify how to query our FGA model, in this case, by asking if the user is a viewer of the document.

```python
build_query=lambda doc: ClientBatchCheckItem(
    user=f"user:{user_id}",
    object=f"doc:{doc.metadata.get('id')}",
    relation="viewer",
),
```

With this design, you can plug any Langchain retriever, combined with checks for any FGA model query.

### Create an OktaFGA Account

If you already have an [Auth0 account](https://auth0.com/), you can use the same credentials to log in to the Okta FGA dashboard at [https://dashboard.fga.dev](https://dashboard.fga.dev/). If you don't have an Auth0 account, hop over to [https://dashboard.fga.dev](https://dashboard.fga.dev/) and create a free account.

Once you are logged in, you should see a dashboard similar to the one below.

![The Okta FGA Dashboard getting started page](https://images.ctfassets.net/23aumh6u8s0i/38P8Vu4qsBvCGrZ4ePew3C/090d068c68b785311a00aa788b92579b/fga-get-started.png)

> When you log into the Okta FGA dashboard for the first time, you may be asked to create a new store. This store will serve as the home for your authorization model and all the data the engine requires to make authorization decisions. Simply pick a name and create your store to get started.

### Create an OktaFGA Client

Once you are in the dashboard, you’ll need a client to make API calls to OktaFGA. To create a client, navigate to **Settings**, and in the **Authorized Clients** section, click **Create Client**. Give your client a name, mark all three client permissions, and then click **Create**.

![Create FGA client](https://images.ctfassets.net/23aumh6u8s0i/2KQc8ACR0MDTqftUgUSXpX/5b779bcece07a69ac775de0fc760c208/Uploaded_from_RAG_and_Access_Control__Where_Do_You_Start)

When you create the client, OktaFGA will provide you with some data like a Store ID, a Client ID and a Client Secret. Don’t close that yet, you’ll need those values next.

At the root of the project, there’s a `.env.example` file. Copy the file and paste it as `.env`. Then, open the file and edit the three FGA-related variables with the values provided by OktaFGA. When you are ready, click continue, and the modal will display the values for the missing variables (`FGA_API_URL` and `FGA_API_AUDIENCE`).

At this step, you can also add your [OpenAI API Key](https://help.openai.com/en/articles/4936850-where-do-i-find-my-openai-api-key), which you’ll need to run the demo.

### Configure the OktaFGA model

Now that the application is set up, you can run the provided script to initialize the model and some sample data. To set things up, run:

```
python ./scripts/fga_init.py
```

You can verify that the script worked by navigating to the model explorer page in OktaFGA. The following model should now have been created:

```
model
 schema 1.1

type user

type doc
 relations
   define owner: [user]
   define viewer: [user, user:*]
```

> You can visit the OktaFGA documentation to learn more about [modeling OktaFGA and creating an authorization model](https://docs.fga.dev/modeling).

On top of the model, the script also created two tuples. Tuples in OktaFGA define the relationships between the types.

First, it defined a tuple to give all users access to the public doc:

- **User** :` user:*`
- **Object** : `public-doc`
- **Relation** : `viewer`

Then, it created a second tuple to give the admin user access to the private doc:

- **User** :` user:admin`
- **Object** : `private-doc`
- **Relation** : `viewer`

> You can visit the OktaFGA documentation to learn more about [tuples and how to create them](https://docs.fga.dev/content/getting-started/new-getting-started#add-tuples).

### Query the Chain

Invoke the chain to process a query and generate a response.

```python
rag = RAG()

question = "What is the forecast for ZEKO?"

# Juan only has access to public docs
response = rag.query("juan", question)
print("Response to Juan:", response)

# Admin has access to all docs
response = rag.query("admin", question)
print("Response to Admin:", response)
```

Fantastic! You now know how to build and scale a secure RAG with Python and LangChain. It’s time to test things out.

To run the chain, simply call the `main.py` file:

```
python main.py
```

If you follow the steps, you’ll see a response like the following:

```
Response to Juan: The retrieved context does not provide any specific forecast or predictions for ZEKO (Zeko Advanced Systems Inc.). It mainly outlines the company's mission, technologies, and products without detailing any financial or market forecasts. Therefore, I don't know the forecast for ZEKO.

Response to Admin: The forecast for Zeko Advanced Systems Inc. (ZEKO) for fiscal year 2025 is generally bearish. Projected revenue growth is expected to remain subdued at 2-3%, with net income growth projected at 1-2%, primarily due to margin pressures and competitive challenges. Investors should be cautious, given the potential headwinds the company faces.
```

As you can see, `Juan` couldn’t retrieve any “protected” data, while the user `admin` got an accurate response to the prompt.

## Conclusion

You’ve seen how to build a **secure** RAG system that respects user permissions at the **document level** using **OpenFGA**. This approach prevents data leaks, meets security and compliance requirements, and stays flexible—perfect for businesses dealing with a large pool of sensitive information.

Feel free to adapt this flow for other vector stores, different LLM providers, or your own organizational rules. By coupling RAG’s retrieval power with fine-grained authorization, you’ll build AI-driven apps that are both insightful and safe.

Before you go, we have some great news to share: we are working on more content and sample apps in collaboration with amazing GenAI frameworks like [LlamaIndex](https://www.llamaindex.ai/), [LangChain](https://www.langchain.com/),[ CrewAI](https://www.crewai.com/), [Vercel AI](https://sdk.vercel.ai/), and others. 

[Auth for GenAI](https://a0.to/ai-content) is our upcoming product to help you protect your user's information in GenAI-powered applications.

Make sure to join the [Auth0 Lab Discord server](http://a0.to/auth0-lab-discord) to hear more and ask questions.

Happy coding!

Building a Secure RAG with Python, LangChain, and OpenFGA

Learn how to use Auth0 FGA to secure your LlamaIndex RAG agent on Node.js.

Generative Artificial Intelligence (GenAI) has massively changed the software landscape and AI agents are all the rage now. AI agents can also be used for complex Retrieval-Augmented Generation (RAG) systems where additional context can be provided to the Large Language Model (LLM) by retrieving updated or domain-specific data from a database or a search engine. This technique can reduce hallucinations and improve accuracy of the LLM. AI agents can also use RAG as a tool to perform complex workflows.

[Sensitive Information Disclosure](https://genai.owasp.org/llmrisk/llm022025-sensitive-information-disclosure/) is a common issue that plagues RAG-based systems. We don't want the LLM to accidentally access or expose sensitive data from a database. Traditional Role-Based Access Control (RBAC) systems are not enough to secure RAG applications and agents. This is where [Fine-Grained Authorization (FGA)](https://fga.dev/) shines as a solution.

If you would like to learn the basics of using FGA for RAG, check out this blog post on [RAG and Access Control: Where Do You Start?](https://auth0.com/blog/rag-and-access-control-where-do-you-start/).

<include
  src="LinkCard"
  title="RAG and Access Control: Where Do You Start?"
  link="https://auth0.com/blog/rag-and-access-control-where-do-you-start/"
  description="Learn how to get started with Auth0 FGA for a RAG application."
  img="https://images.ctfassets.net/23aumh6u8s0i/79NCborGcFIrAMeaV7G8oi/f9c588c2d05f0828d447e72e1fe825cc/Latam01.jpg"
/>

In this tutorial, we will build a simple RAG agent using the [LlamaIndex.TS](https://ts.llamaindex.ai/), which is the JavaScript version of the popular [LlamaIndex](https://www.llamaindex.ai/) framework, and secure it using Auth0 FGA.

## Prerequisites

> **This tutorial was created with the following tools and services**:
>
> - [NodeJS v20](https://nodejs.org/en/download)
> - An Auth0 FGA account. [Create one](https://dashboard.fga.dev).
> - An OpenAI account and API key. [Create one](https://platform.openai.com).

## What Does LlamaIndex Do?

[LlamaIndex](https://www.llamaindex.ai/) is a flexible framework for building AI agents and RAG applications. It provides Python and JavaScript SDKs to interact with a variety of LLMs and databases. LlamaIndex can be used to build AI agents and workflows that can interact with the user, retrieve data from a database, and generate responses using an LLM. It also provides tools like [LlamaParse](https://www.llamaindex.ai/llamaparse) to transform unstructured data into LLM-optimized formats and LlamaCloud to store and retrieve LLM-ready data from the cloud.

## Set up a LlamaIndex RAG Application

To get started, clone the [**auth0-ai-samples**](https://a0.to/auth0-ai-samples) repository from GitHub:

```bash
git clone https://github.com/auth0-samples/auth0-ai-samples.git
cd auth0-ai-samples/authorization-for-rag/llamaindex-agentic-js
# install dependencies
npm install
```

The application is written in TypeScript for the Node.js platform and is structured as follows:

- `index.ts`: The main entry point of the application that defines the RAG pipeline.
- `assets/docs/*.md`: Sample markdown documents that will be used as context for the LLM. We have public and private documents for demonstration purposes.
- `scripts/fga-init.ts`: Utility to initialize the Auth0 FGA authorization model.

Let us look at the important bits and pieces before we run the application.

### RAG pipeline

The RAG pipeline is defined in `index.ts`. It uses LlamaIndex Agents to interact with the underlying LLM and retrieve data from the database. The pipeline is defined as follows:

```typescript
/** index.ts **/
const user = 'user1';
// 1. Read and load documents from the assets folder
const documents = await new SimpleDirectoryReader().loadData('./assets/docs');
// 2. Create an in-memory vector store from the documents using the default OpenAI embeddings
const vectorStoreIndex = await VectorStoreIndex.fromDocuments(documents);
// 3. Create a retriever that uses FGA to gate fetching documents on permissions.
const retriever = FGARetriever.create({
  // Set the similarityTopK to retrieve more documents as SimpleDirectoryReader creates chunks
  retriever: vectorStoreIndex.asRetriever({ similarityTopK: 30 }),
  // FGA tuple to query for the user's permissions
  buildQuery: (document) => ({
    user: `user:${user}`,
    object: `doc:${document.metadata.file_name.split('.')[0]}`,
    relation: 'viewer',
  }),
});
// 4. Create a query engine and convert it into a tool
const queryEngine = vectorStoreIndex.asQueryEngine({ retriever });
const tools = [
  new QueryEngineTool({
    queryEngine,
    metadata: {
      name: 'zeko-internal-tool',
      description: `This tool can answer detailed questions about ZEKO.`,
    },
  }),
];

// 5. Create an agent using the tools array and OpenAI GPT-4 LLM
const agent = new OpenAIAgent({ tools });

// 6. Query the agent
let response = await agent.chat({ message: 'Show me forecast for ZEKO?' });
```

Here is a visual representation of the RAG architecture

![LlamaIndex RAG architecture](https://images.ctfassets.net/23aumh6u8s0i/lGssMbzaSU4J0zXG4bFcC/21f2abbda55a13640350d637609469f7/llamaindex-rag.jpg)

### FGA retriever

The `FGARetriever` class filters documents based on the authorization model defined in Auth0 FGA and will be available as part of the [**auth0-ai-js**](https://github.com/auth0-lab/auth0-ai-js) SDK. This retriever is a post-search filter ideal for scenarios where you already have documents in a vector store and want to filter the vector store results based on the user's permissions. Assuming the vector store already narrows down the documents to a few, the FGA retriever will further narrow down the documents to only the ones to which the user has access.

The alpha version of the retriever can be installed using the following command:

```bash
npm install "https://github.com/auth0-lab/auth0-ai-js.git#alpha-2" --save
```

The build query function is used to construct the query to the FGA store. The query is constructed using the user, object, and relation. The user is the user ID, the object is the document ID or the document name, and the relation is the permission that the user must have on the document.

```typescript
buildQuery: (document) => ({
  user: `user:${user}`,
  object: `doc:${document.metadata.file_name.split(".")[0]}`,
  relation: "viewer",
}),
```

### Retrieval Agent

1. The `queryEngine` is created from the vector store index and configured to use our custom FGA retriever. The query engine handles searching through documents and retrieving relevant information based on user queries.

2. The `tools` array contains a `QueryEngineTool` that wraps our query engine. The tool provides a structured interface for the agent to access the query engine's capabilities.

3. The `agent` is created using OpenAI's GPT-4 model and the tools array. The agent acts as an intelligent interface between the user and the tools - it understands natural language queries, determines when to use the query engine tool, and formulates responses based on the retrieved information.

```typescript
/** index.ts **/
const queryEngine = vectorStoreIndex.asQueryEngine({ retriever });
const tools = [
  new QueryEngineTool({
    queryEngine,
    metadata: {
      name: 'zeko-internal-tool',
      description: `This tool can answer detailed questions about ZEKO.`,
    },
  }),
];

// 5. Create an agent using the tools array and OpenAI GPT-4 LLM
const agent = new OpenAIAgent({ tools });
```

## Set up an FGA Store

In the [Auth0 FGA dashboard](https://dashboard.fga.dev/), navigate to **Settings**, and in the **Authorized Clients** section, click **+ Create Client**. Give your client a name, mark all three client permissions, and then click **Create**.

![Create FGA client](https://images.ctfassets.net/23aumh6u8s0i/2KQc8ACR0MDTqftUgUSXpX/5b779bcece07a69ac775de0fc760c208/Uploaded_from_RAG_and_Access_Control__Where_Do_You_Start)

Once your client is created, you’ll see a modal containing Store ID, Client ID, and Client Secret.

Add `.env` file with the following content to the root of the project. Click **Continue** to see the `FGA_API_URL` and `FGA_API_AUDIENCE`.

```
# OpenAI
OPENAI_API_KEY=<your-openai-api-key>

# Auth0 FGA
FGA_STORE_ID=<your-fga-store-id>
FGA_CLIENT_ID=<your-fga-store-client-id>
FGA_CLIENT_SECRET=<your-fga-store-client-secret>
# Required only for non-US regions
FGA_API_URL=https://api.xxx.fga.dev
FGA_API_AUDIENCE=https://api.xxx.fga.dev/
```

[Check the instructions here to find your OpenAI API key](https://help.openai.com/en/articles/4936850-where-do-i-find-my-openai-api-key).

Next, navigate to **Model Explorer**. You’ll need to update the model information with this:

```text
model
  schema 1.1

type user

type doc
  relations
    define owner: [user]
    define viewer: [user, user:*]
```

Remember to click **Save**.

> Check out [this documentation to learn more about creating an authorization model in FGA](https://docs.fga.dev/modeling).

Now, to have access to the public information, you’ll need to add a tuple on FGA. Navigate to the **Tuple Management** section and click **+ Add Tuple**, fill in the following information:

- **User** : `user:*`
- **Object** : select doc and add `public-doc` in the ID field
- **Relation** : `viewer`

A tuple signifies a user’s relation to a given object. For example, the above tuple implies that all users can view the `public-doc` object.

> Alternatively, you can use the `scripts/fga-init.ts` script to initialize the FGA store with the model and tuple.
> Run the `npm run fga:init` command after setting up the `.env` file.

## Test the Application

Now that you have set up the application and the FGA store, you can run the application using the following command:

```bash
npm start
```

The application will start with the query, `Show me forecast for ZEKO?` Since this information is in a private document, and we haven't defined a tuple with access to this document, the application will not be able to retrieve it. The FGA retriever will filter out the private document from the vector store results and, hence, print a similar output.

```text
The provided context does not include specific forecasts or projections for Zeko Advanced Systems Inc. ...
```

If you change the query to something that is available in the public document, the application will be able to retrieve the information.

Now, to have access to the private information, you’ll need to update your tuple list. Go back to the Auth0 FGA dashboard in the **Tuple Management** section and click **+ Add Tuple**, fill in the following information:

- **User** : `user:user1`
- **Object** : select doc and add `private-doc` in the ID field
- **Relation** : `viewer`

Now click **Add Tuple** and then run the script again:

```bash
npm start
```

This time, you should see a response containing the forecast information since we added a tuple that defines the `viewer` relation for `user1` to the `private-doc` object.

Congratulations! You have run a simple RAG application using LlamaIndex and secured it using Auth0 FGA.

## Learn More about Auth for GenAI, Auth0 FGA and GenAI

In this post, you learned how to secure a LlamaIndex-based RAG application using Auth0's [Auth for GenAI](https://a0.to/ai-content) and [Auth0 FGA](https://fga.dev/). Auth0 FGA is built on top of OpenFGA, which is open-source. We invite you to check out the [OpenFGA code on GitHub](https://a0.to/fga_repo).

Before you go, we have some great news to share: we are working on more content and sample apps in collaboration with amazing GenAI frameworks like [LlamaIndex](https://www.llamaindex.ai/), [LangChain](https://www.langchain.com/), [CrewAI](https://www.crewai.com/), [Vercel AI SDK](https://sdk.vercel.ai/), and [GenKit](https://firebase.google.com/docs/genkit). [Auth for GenAI](https://auth0.com/blog/auth-for-genai/) is our upcoming product to help you protect your user's information in GenAI-powered applications. Make sure to join the [Auth0 Lab Discord server](http://a0.to/auth0-lab-discord) to hear more and ask questions.

Build a Secure RAG Agent Using LlamaIndex and Auth0 FGA on Node.js

Learn how to use Auth0 FGA to secure your LangChain RAG agent on Node.js

Like it or not, Generative Artificial Intelligence (GenAI) has massively changed the software landscape. Retrieval-Augmented Generation (RAG) is a cornerstone of GenAI-powered applications. It is an architecture that improves the accuracy of Large Language Models (LLMs) by providing more context to the model. This is done by retrieving updated or domain-specific data from a database or a search engine. This is a powerful technique that can be used to improve the accuracy of LLMs in a variety of applications.

Security is even more paramount when it comes to RAG-based systems, as we don't want the LLM to accidentally access or expose sensitive data. Traditional Role-Based Access Control (RBAC) systems are not enough to secure RAG applications. This is where [Fine-Grained Authorization (FGA)](https://fga.dev/) comes to the rescue.

If you would like to learn the basics of using FGA for RAG, check out this blog post on [RAG and Access Control: Where Do You Start?](https://auth0.com/blog/rag-and-access-control-where-do-you-start/)

<include
  src="LinkCard"
  title="RAG and Access Control: Where Do You Start?"
  link="https://auth0.com/blog/rag-and-access-control-where-do-you-start/"
  description="Learn how to get started with Auth0 FGA for a RAG application."
  img="https://images.ctfassets.net/23aumh6u8s0i/79NCborGcFIrAMeaV7G8oi/f9c588c2d05f0828d447e72e1fe825cc/Latam01.jpg"
/>

In this tutorial, we will build a simple RAG agent using the [LangChain](https://www.langchain.com/) framework and secure it using Auth0 FGA.

<AmpContent>
<amp-youtube
    data-videoid="u81b6nsDoPA"
    layout="responsive"
    width="480" height="270">
</amp-youtube>
</AmpContent>

<NonAmpContent>
<div
  className='embed-container'
  style="position: relative; padding-bottom: 56.25%; height: 0; overflow: hidden; max-width: 100%;margin-bottom:40px;">
    <iframe
      style="position: absolute; top: 0; left: 0; width: 100%; height: 100%;"
      src='https://www.youtube.com/embed/u81b6nsDoPA'
      frameborder='0' allowfullscreen>
    </iframe>
</div>
</NonAmpContent>


## Prerequisites

> **This tutorial was created with the following tools and services**:
>
> - [NodeJS v20](https://nodejs.org/en/download)
> - An Auth0 FGA account. [Create one](https://dashboard.fga.dev).
> - An OpenAI account and API key. [Create one](https://platform.openai.com).

## Why LangChain?

[LangChain](https://www.langchain.com/) is one of the leading frameworks for building context-aware reasoning applications, including RAG applications. It is open-source and provides a simple API to interact with the underlying LLMs. It supports a variety of LLMs, including OpenAI's GPT models, Google VertexAI, Anthropic, and more. It also provides a simple way to retrieve data from a database or a search engine to provide more context to the LLM. For this tutorial, we will use [LangGraph](https://www.langchain.com/langgraph) from LangChain to build an agentic RAG application. LangGraph is a powerful tool that allows you to build agents that can handle complex tasks, including RAG applications. It provides advanced features like workflows, persisted context, and streaming support.

## Set up a LangGraph RAG application

To get started, clone the [**auth0-ai-samples**](https://a0.to/auth0-ai-samples) repository from GitHub:

```bash
git clone https://github.com/auth0-samples/auth0-ai-samples.git
cd auth0-ai-samples/authorization-for-rag/langgraph-agentic-js
# install dependencies
npm install
```

The application is written in TypeScript for the Node.js platform and is structured as follows:

- `index.ts`: The main entry point of the application that defines the RAG pipeline.
- `assets/docs/*.md`: Sample markdown documents that will be used as context for the LLM. We have public and private documents for demonstration purposes.
- `helpers/read-documents.ts`: Utility to load markdown files as documents.
- `helpers/langchain.ts`: Defines the LangGraph retrieval agent.
- `scripts/fga-init.ts`: Utility to initialize the Auth0 FGA authorization model.

Let us look at the important bits and pieces before we run the application.

### RAG pipeline

The RAG pipeline is defined in `index.ts`. It uses the LangGraph framework to interact with the underlying LLM and retrieve data from the database. The pipeline is defined as follows:

```js
/** index.ts **/
const user = 'user1';
// 1. Read and load documents from the assets folder
const documents = await readDocuments();
// 2. Create an in-memory vector store from the documents for OpenAI models.
const vectorStore = await MemoryVectorStore.fromDocuments(
  documents,
  new OpenAIEmbeddings({ model: 'text-embedding-3-small' }),
);
// 3. Create a retriever that uses FGA to gate fetching documents on permissions.
const retriever = FGARetriever.create({
  retriever: vectorStore.asRetriever(),
  // FGA tuple to query for the user's permissions
  buildQuery: (doc) => ({
    user: `user:${user}`,
    object: `doc:${doc.metadata.id}`,
    relation: 'viewer',
  }),
});
// 4. Convert the retriever into a tool for an agent.
const fgaTool = retriever.asJoinedStringTool();
// 5. The agent will call the tool, rephrasing the original question and
// populating the "query" argument, until it can answer the user's question.
const retrievalAgent = RetrievalAgent.create([fgaTool]);
// 6. Query the retrieval agent with a prompt
const answer = await retrievalAgent.query('Show me forecast for ZEKO?');
```

Here is a visual representation of the RAG architecture:

![LangChain RAG architecture](https://images.ctfassets.net/23aumh6u8s0i/707VuhSJ2FqDBTrQNP6rTl/0fcd90a881441369e1466b109c02686c/langgraph-rag.jpg)

### FGA retriever

The `FGARetriever` class filters documents based on the authorization model defined in Auth0 FGA and will be available as part of the [**auth0-ai-js**](https://github.com/auth0-lab/auth0-ai-js) SDK. This retriever is ideal for scenarios where you already have documents in a vector store and want to filter the vector store results based on the user's permissions. Assuming the vector store already narrows down the documents to a few, the FGA retriever will further narrow down the documents to only the ones that the user has access to. 

The alpha version of the retriever can be installed using the following command:

```bash
npm install "https://github.com/auth0-lab/auth0-ai-js.git#alpha-1" --save
```

The build query function is used to construct the query to the FGA store. The query is constructed using the user, object, and relation. The user is the user ID, the object is the document ID, and the relation is the permission that the user has on the document.

```typescript
buildQuery: (doc) => ({
  user: `user:${user}`,
  object: `doc:${doc.metadata.id}`,
  relation: 'viewer',
}),
```

### Retrieval Agent

The `RetrievalAgent` class configures a LangGraph retrieval agent that uses the FGA retriever tool and an OpenAI model to answer the user's question. The agent will call the tool to get context documents in this case.

```typescript
/** helpers/langchain.ts **/
static create(tools: StructuredToolInterface[]) {
  // Create a retrieval agent that has access to the retrieval tool.
  const retrievalAgent = createReactAgent({
    llm: new ChatOpenAI({ temperature: 0, model: 'gpt-4o-mini' }),
    tools,
    stateModifier: [
      "Answer the user's question only based on context retrieved from provided tools.",
      'Only use the information provided by the tools.',
      'If you need more information, ask for it.',
    ].join(' '),
  });
  return new RetrievalAgent(retrievalAgent);
}
```

## Set up an FGA store

In the [Auth0 FGA dashboard](https://dashboard.fga.dev/), navigate to **Settings**, and in the **Authorized Clients** section, click **+ Create Client**. Give your client a name, mark all three client permissions, and then click **Create**.


![Create FGA client](https://images.ctfassets.net/23aumh6u8s0i/2KQc8ACR0MDTqftUgUSXpX/5b779bcece07a69ac775de0fc760c208/Uploaded_from_RAG_and_Access_Control__Where_Do_You_Start)


Once your client is created, you’ll see a modal containing Store ID, Client ID, and Client Secret.

Add `.env` file with the following content to the root of the project. Click **Continue** to see the `FGA_API_URL` and `FGA_API_AUDIENCE`.

```
# OpenAI
OPENAI_API_KEY=<your-openai-api-key>

# Auth0 FGA
FGA_STORE_ID=<your-fga-store-id>
FGA_CLIENT_ID=<your-fga-store-client-id>
FGA_CLIENT_SECRET=<your-fga-store-client-secret>
# Required only for non-US regions
FGA_API_URL=https://api.xxx.fga.dev
FGA_API_AUDIENCE=https://api.xxx.fga.dev/
```

[Check the instructions here to find your OpenAI API key](https://help.openai.com/en/articles/4936850-where-do-i-find-my-openai-api-key).

Next, navigate to **Model Explorer**. You’ll need to update the model information with this:

```text
model
  schema 1.1

type user

type doc
  relations
    define owner: [user]
    define viewer: [user, user:*]
```

Remember to click **Save**.

> Check out [this documentation to learn more about creating an authorization model in FGA](https://docs.fga.dev/modeling).

Now, to have access to the public information, you’ll need to add a tuple on FGA. Navigate to the **Tuple Management** section and click **+ Add Tuple**, fill in the following information:

- **User**: `user:*`
- **Object**: select doc and add `public-doc` in the ID field
- **Relation**: `viewer`

A tuple signifies a user’s relation to a given object. For example, the above tuple implies that all users can view the `public-doc` object.

> Alternatively, you can use the `scripts/fga-init.ts` script to initialize the FGA store with the model and tuple.
> Run the `npm run fga:init` command after setting up the `.env` file.

## Test the application

Now that you have set up the application and the FGA store, you can run the application using the following command:

```bash
npm start
```

The application will start with the query, `Show me forecast for ZEKO?` Since this information is in a private document, and we haven't defined a tuple with access to this document, the application will not be able to retrieve it. The FGA retriever will filter out the private document from the vector store results and, hence, print a similar output.

```text
The provided context does not include specific forecasts or projections for Zeko Advanced Systems Inc. ...
```

If you change the query to something that is available in the public document, the application will be able to retrieve the information.

Now, to have access to the private information, you’ll need to update your tuple list. Go back to the Auth0 FGA dashboard in the **Tuple Management** section and click **+ Add Tuple**, fill in the following information:

- **User**: `user:user1`
- **Object**: select doc and add `private-doc` in the ID field
- **Relation**: `viewer`

Now click **Add Tuple** and then run the script again:

```bash
npm start
```

This time, you should see a response containing the forecast information since we added a tuple that defines the `viewer` relation for `user1` to the `private-doc` object.

Congratulations! You have run a simple RAG application using LangChain and secured it using Auth0 FGA.

## Learn more about Auth0 for GenAI, Auth0 FGA and GenAI

In this post, you learned how to secure a LangChain-based RAG application using Auth0's [Auth for GenAI](https://a0.to/ai-content) and [Auth0 FGA](https://fga.dev/). Auth0 FGA is built on top of OpenFGA, which is open-source. We invite you to check out the [OpenFGA code on GitHub](https://a0.to/fga_repo).

Before you go, we have some great news to share: we are working on more content and sample apps in collaboration with amazing GenAI frameworks like [LlamaIndex](https://www.llamaindex.ai/), [LangChain](https://www.langchain.com/), [CrewAI](https://www.crewai.com/), [Vercel AI SDK](https://sdk.vercel.ai/), and [GenKit](https://firebase.google.com/docs/genkit). [Auth for GenAI](https://auth0.com/blog/auth-for-genai/) is our upcoming product to help you protect your user's information in GenAI-powered applications. Make sure to join the [Auth0 Lab Discord server](http://a0.to/auth0-lab-discord) to hear more and ask questions.


Build a Secure LangChain RAG Agent Using Auth0 FGA and LangGraph on Node.js

Learn how to use Auth0 FGA to secure your LangGraph RAG agent in Python.

Building Retrieval-Augmented Generation (RAG) applications are all the rage, and for a good reason. They let you tap into vast knowledge bases to answer questions, generate content, and power all sorts of AI-driven experiences. But what happens when you need to control who can access what information? That's where things get interesting.

We're diving deep into building a secure RAG pipeline using LangGraph, Python, and Auth0 FGA. Forget simple vector lookups; we're talking about a graph-based approach that lets you orchestrate complex workflows, integrate tools, and enforce fine-grained access control.

## Proposed Solution: Secure Retrieval with LangGraph, OpenAI, and Auth0 FGA

The solution employs a workflow that integrates document retrieval, user-specific authorization filtering, and LLM response generation.

We’ll build a pipeline that uses:

* **LangChain & LangGraph**: A helpful toolkit for chaining the steps of an RAG pipeline (loading data, creating embeddings, retrieving, and prompting).
* **LLMs** (OpenAI or any other): For both embeddings (similarity search) and text generation.
* **Auth0 FGA**: A fine-grained authorization service that checks, for each document, if a user has the “viewer” relationship.

### LangChain & LangGraph

LangChain and LangGraph are two complementary tools that simplify the development of LLM applications, each bringing unique strengths to the table.

LangChain is a library that streamlines the assembly of components—such as document loaders, vector stores, and prompt templates—into a robust and cohesive framework. This makes it easier to build, maintain, and scale your RAG pipeline efficiently.

LangGraph takes a different approach by enabling you to visualize and construct your workflows as a graph. With its ability to handle **complex graphs, branching logic, and advanced flow structures**, LangGraph empowers developers to design sophisticated pipelines that go beyond linear processes. By mapping out the connections between components visually, it enhances modularity and simplifies debugging and optimization. Read more here to get started: [https://langchain-ai.github.io/langgraph/](https://langchain-ai.github.io/langgraph/).

### LLMs

Although we’ll demonstrate OpenAI’s embeddings and Chat APIs, you can easily replace them with other providers (e.g., Anthropic, LLaMA, or Azure OpenAI). The main tasks here are:

1. **Embedding** documents so you can do similarity searches.
2. **Generating** text from the retrieved documents to answer the user’s query.

### FGA, OpenFGA and Auth0 FGA

**FGA (Fine-Grained Authorization)** is about controlling *who can do what* with *which resources*, down to an individual level. In a typical role-based system, you might say, “Admins can see everything, and Regular Users can see some subset.” But in a real-world app—especially one that deals with many documents—this might not be flexible enough.

**OpenFGA (and Auth0 FGA)** addresses this by letting you define authorization *relationships.* The relationships defined in the authorization model can be either direct or indirect. Simply put, direct relationships are directly assigned between a consumer and a resource (we call them user and object) and stored in the database. Indirect relationships are the relationships we can infer based on the data and the authorization model.

If you would like to learn the basics of using FGA for RAG, check out this blog post on [RAG and Access Control: Where Do You Start?](https://auth0.com/blog/rag-and-access-control-where-do-you-start/).

<include
   src="LinkCard"
   title="RAG and Access Control: Where Do You Start?"
   link="https://auth0.com/blog/rag-and-access-control-where-do-you-start/"
   description="Learn how to get started with Auth0 FGA for a RAG application."  img="https://images.ctfassets.net/23aumh6u8s0i/79NCborGcFIrAMeaV7G8oi/f9c588c2d05f0828d447e72e1fe825cc/Latam01.jpg"
/>

## Implementation: Step-by-Step

Below is a sample setup in Python. We’ll keep it simple so you can see the big picture. Feel free to adapt for your chosen LLM or a more robust data store.

### Set Up Prerequisites

To follow this tutorial and secure your application, you’ll need the following:

* Python 3.9 or newer.
* An Auth0 FGA account. If you don’t have one, you can [create one for free](https://dashboard.fga.dev/).
* An [OpenAI account and API key](https://platform.openai.com/).

### Download and install the sample code

To get started, clone the[ auth0-ai-samples](https://a0.to/auth0-ai-samples) repository from GitHub:

```
git clone https://github.com/auth0-samples/auth0-ai-samples.git
cd auth0-ai-samples/authorization-for-rag/langgraph-agentic-python
# Create a virtual env
python -m venv venv
# Activate the virtual env
source ./venv/bin/activate
# Install dependencies
pip install -r requirements.txt
```

The application is written in Python and is structured as follows:

* `main.py` &mdash; The main entry point of the application, and it is where we define the RAG pipeline
* `docs/*.md` &mdash; Sample markdown files are to be used as context for the LLM. There are two types of docs, public and private. Private documents are only accessible to certain individuals.
* `helpers/memory_store.py` &mdash; Creates an in-memory vector store that acts as the base retriever in the chain.
* `helpers/read_documents.py` &mdash; Utility to read the markdown files from the `docs` folder.
* `scripts/fga_init.py` &mdash; Utility to initialize the Auth0 FGA authorization model and sample data.

### RAG Pipeline

The `main.py` file defines the RAG graph using `LangGraph` to interact with the underlying LLM model and retrieve data from our context. In your project, your data may be sourced from different platforms and systems, make sure you check the proper documentation about [loaders in the Langchain ecosystem](https://python.langchain.com/v0.1/docs/modules/data_connection/).

The following diagram represents the RAG architecture we are defining:

![LangGraph RAG architecture](https://images.ctfassets.net/23aumh6u8s0i/NwbnsTvKszhWZIng1VjwH/b8b5d467787cbdbb0ac6a850738f4922/langgraph-python-example.png)

## Python Implementation

Let’s now explore the code at `main.py`, which is where all the magic happens. We’ll start splitting the code into relevant chunks, so it will be easier to follow and understand.

Let’s start by defining a LangChain tool that is responsible for querying the RAG for context by querying the vector database and filtering the relevant documents based on the user access:

```python
@tool
def agent_retrieve_context_tool(query: str):
    """Call to get information about a company, e.g., What is the financial outlook for ZEKO?"""
    documents = read_documents()
    vector_store = MemoryStore.from_documents(documents)

    user_id = "admin"

    retriever = FGARetriever(
        retriever=vector_store.as_retriever(),
        build_query=lambda doc: ClientBatchCheckItem(
            user=f"user:{user_id}",
            object=f"doc:{doc.metadata.get('id')}",
            relation="viewer",
        ),
    )

    relevant_docs = retriever.invoke(query)

    if len(relevant_docs) > 0:
        return "\n\n".join([doc.page_content for doc in relevant_docs])

    return "I don't have any information on that."

tools = [agent_retrieve_context_tool]
```

The `FGARetriever` defined in the `retrieve` node is designed to abstract the base retriever from the FGA query logic. The `build_query` argument lets us specify how to query our FGA model, in this case, by asking if the user is a viewer of the document.

```python
build_query=lambda doc: ClientBatchCheckItem(
    user=f"user:{user_id}",
    object=f"doc:{doc.metadata.get('id')}",
    relation="viewer",
),
```

Then we need to define the nodes in the Graph, each node will process unique functions, so we will explore them separately, starting with the `agent_node`, which is responsible for querying the LLM model based on the user’s input.

Each node in LangGraph receives state as an object and can return state updates, for example:

```python
def agent_node(state: State):
    """
    Generate the response from the agent.
    """
    llm_response = llm.invoke(state["messages"])
    return {"messages": [llm_response]}
```

After the `agent_node` runs, we are using a conditional edge to determine the next step. In our particular case, the node` agent_should_continue` will finalize the execution of the graph if the LLM response didn’t trigger a tool call. But if we detect a tool call, then we continue the graph execution with the `tools` node.

```python
def agent_should_continue(state: State):
    """
    Determines whether the conversation should continue based on the user input.
    """
    last_message = state["messages"][-1]
    if last_message.tool_calls:
        return "tools"

    return END
```

The `tools` node is a bit different from the others, as it builds on top of the Tool we declared at the start and uses the `ToolNode` method to simplify the logic. This method will wrap our tool into a node that adds a response from the tool into the chat messages state.

But that’s not all, as after we process the tool call, and we retrieve the proper context to answer the user’s input, we need to call, once again, the LLM model to generate an answer.

```python
def generate_response_node(state: State):
    """
    Generate the response from the agent based on the result of the RAG tool.
    """
    prompt = PromptTemplate(
        template="""You are an assistant for question-answering tasks. Use the following pieces of retrieved-context to answer the question. If you don't know the answer, just say that you don't know. Use three sentences maximum and keep the answer concise. Question: {question}. Context: {context}. Answer:""",
        input_variables=["question", "context"],
    )

    question = state["messages"][0].content
    context = state["messages"][-1].content

    chain = prompt | llm

    llm_response = chain.invoke(
        {"question": question, "context": context}, prompt=prompt
    )

    return {"messages": [llm_response]}
```

If you read the previous article, this may be familiar, but this is a simple chain that uses a prompt with a question and context to provide a good and relevant answer to the user.

Now, with all the parts in place, we can build the graph:

```python
# Create the OpenAI chat tool
llm = ChatOpenAI(model="gpt-4o-mini").bind_tools(tools)

# Build the graph
graph_builder = StateGraph(State)
tool_node = ToolNode(tools)

# Define the nodes
graph_builder.add_node("agent", agent_node)
graph_builder.add_node("tools", tool_node)
graph_builder.add_node("generate_response", generate_response_node)

# Define the edges
graph_builder.add_edge(START, "agent")
graph_builder.add_conditional_edges(
    "agent",
    agent_should_continue,
    ["tools", END],
)
graph_builder.add_edge("tools", "generate_response")

# Compile the graph
graph = graph_builder.compile()
```

That’s awesome! Now, if you set up all the environment variables, you could run the code. If you are not sure how to set them up, don’t worry; we will do that next.

### Create an Auth0 FGA Account

If you already have an [Auth0 account](https://auth0.com/), you can use the same credentials to log in to the Auth0 FGA dashboard at [https://dashboard.fga.dev](https://dashboard.fga.dev/). If you don't have an Auth0 account, hop over to [https://dashboard.fga.dev](https://dashboard.fga.dev/) and create a free account.

Once you are logged in, you should see a dashboard similar to the one below.

![The Auth0 FGA Dashboard getting started page](https://images.ctfassets.net/23aumh6u8s0i/38P8Vu4qsBvCGrZ4ePew3C/090d068c68b785311a00aa788b92579b/fga-get-started.png)

> When you log into the Auth0 FGA dashboard for the first time, you may be asked to create a new store. This store will serve as the home for your authorization model and all the data the engine requires to make authorization decisions. Simply pick a name and create your store to get started.

### Create an Auth0 FGA Client

Once you are in the dashboard, you’ll need a client to make API calls to Auth0 FGA. To create a client, navigate to **Settings**, and in the **Authorized Clients** section, click **Create Client**. Give your client a name, mark all three client permissions, and then click **Create**.

![Create FGA client](https://images.ctfassets.net/23aumh6u8s0i/2KQc8ACR0MDTqftUgUSXpX/5b779bcece07a69ac775de0fc760c208/Uploaded_from_RAG_and_Access_Control__Where_Do_You_Start)

When you create the client, Auth0 FGA will provide you with some data like a Store ID, a Client ID and a Client Secret. Don’t close that yet, you’ll need those values next.

At the root of the project, there’s a `.env.example` file. Copy the file and paste it as `.env`. Then, open the file and edit the three FGA-related variables using the values provided by Auth0 FGA. When you are ready, click continue, and the modal will display the values for the missing variables (`FGA_API_URL` and `FGA_API_AUDIENCE`).

At this step, you can also add your [OpenAI API Key](https://help.openai.com/en/articles/4936850-where-do-i-find-my-openai-api-key), which you’ll need to run the demo.

### Configure the Auth0 FGA model

Now that the application is set up, you can run the provided script to initialize the model and some sample data. To set things up, run:

```
python ./scripts/fga_init.py
```

You can verify that the script worked by navigating to the model's page in Auth0 FGA. The following model should now have been created:

```
model
 schema 1.1

type user

type doc
 relations
   define owner: [user]
   define viewer: [user, user:*]
```

> You can visit the Auth0 FGA documentation to learn more about[ modeling Auth0 FGA and creating an authorization model](https://docs.fga.dev/modeling).

On top of the model, the script also created two tuples. Tuples in Auth0 FGA define the relationships between the types.

First, it defined a tuple to give all users access to the public doc:

- **User** &mdash; `user:*`
- **Object** &mdash; `public-doc`
- **Relation** &mdash; `viewer`

Then, it created a second tuple to give the admin user access to the private doc:

- **User** &mdash; `user:admin`
- **Object** &mdash; `private-doc`
- **Relation** &mdash; `viewer`

> You can visit the Auth0 FGA documentation to learn more about [tuples and how to create them](https://docs.fga.dev/content/getting-started/new-getting-started#add-tuples).

### Query the Graph

Invoke the graph to process a query and generate a response.

```python
# Run the graph
result = graph.invoke(
    {"messages": [("human", "What is the financial outlook for ZEKO?")]}
)
print(result["messages"][-1].content)
```

Fantastic! You now know how to build and scale a secure RAG with Python and LangGraph. It’s time to test things out.

To run the graph, simply call the `main.py` file:

```
python main.py
```

If you follow the steps, you’ll see responses like the following:

```
Example with no access:
The retrieved context does not provide any specific forecast or predictions for ZEKO (Zeko Advanced Systems Inc.). It mainly outlines the company's mission, technologies, and products without detailing any financial or market forecasts. Therefore, I don't know the forecast for ZEKO.

Example with access:
The forecast for Zeko Advanced Systems Inc. (ZEKO) for fiscal year 2025 is generally bearish. Projected revenue growth is expected to remain subdued at 2-3%, with net income growth projected at 1-2%, primarily due to margin pressures and competitive challenges. Investors should be cautious, given the potential headwinds the company faces.
```

Depending on the user you use in the `agent_retrieve_context_tool`, you’ll see different results, experiment also by adding and removing privileges from the Auth0 FGA dashboard.

## Learn More about Auth for GenAI, Auth0 FGA, and GenAI

Before you go, we have some great news to share: we are working on more content and sample apps in collaboration with amazing GenAI frameworks like [LlamaIndex](https://www.llamaindex.ai/), [LangGraph](https://www.langchain.com/), [CrewAI](https://www.crewai.com/), [Vercel AI](https://sdk.vercel.ai/), and others. 

[Auth for GenAI](https://a0.to/ai-content) is our upcoming product to help you protect your user's information in GenAI-powered applications.

Make sure to join the [Auth0 Lab Discord server](http://a0.to/auth0-lab-discord) to hear more and ask questions.

Happy coding!

Building a Secure Python RAG Agent Using Auth0 FGA and LangGraph

Calah Vargas

Calah Vargas is the Associate Manager of Product Led Growth, focusing on nonprofits, startups, and partnerships. She works on product marketing and customer marketing initiatives. Outside work, you can find her cooking, trying new restaurants, and traveling with friends and family.

Associate Manager, PLG

Shreya Gupta

Shreya is the Developer Advocate for Auth0 for Startups. She previously founded a non-profit called Bit Project, worked at a YC-backed Startup as a Developer Advocate, and currently hosts The Developer Diaries podcast. Through each experience, she has found her love for building resources and tools that help move the needle for developers. Outside of work, she enjoys traveling, watching K-Dramas, and drinking boba.

Developer Advocate, Startups

emma-gray

Sr. Manager, Product-Led Growth Marketing

Emma Gray

How Auth0 can support your product at any stage in your journey

A secure login experience and access management are at the core of any application with users at any stage of development. At a high level, it’s helpful to bucket product development into one of three stages—**build, launch, and grow**—each with different needs for managing user access. Decisions made at any stage can have long-term benefits and ramifications.

Auth0 is a comprehensive solution built for developers with evolving needs. Let’s walk through how Auth0 solves your needs at each stage – whether your app’s just an idea, in development, or already trusted by millions.

*Which stage does your product fall into?*

![Build, Launch and Grow](https://images.ctfassets.net/23aumh6u8s0i/2JjH4oi3LSWvay1FOri8Tl/9a8dcb4936464f3a54f35fe83815e7e6/2557215_BuildLaunchGrowBlogImages_Img1_022825.png)

## Build

Whether it’s a product that uses generative AI to create the perfect meal plan or a product that helps businesses analyze and act upon their data, your users will need the ability to sign up and log in seamlessly and safely.

You’ve started building your product, and now you’re developing how users interact with it:

* How does a user register for your app?
* How does a user authenticate securely every time?
* For a B2B use case, how do you set up multiple environments for each business/team?

Time is of the essence. The quickest path forward is to integrate a tool that satisfies your basic auth requirements for your MVP while iterating as needed. With Auth0, you can add a login screen, update your logo or brand, and access your user data [within minutes](https://auth0.com/docs/quickstarts). Up to 25,000 monthly active users can log into your application for free. We’re not counting accounts that register but never use the app again; we only count your captive audience.

If you’re depending on internal testing or an early access launch, you’ll be set up with Single Sign-On (SSO), branded forms, a custom domain, and more. You aren’t limited to a specific language or framework. And, if you want to move even faster, we offer [30+ SDKs & Quickstarts](https://auth0.com/docs/libraries) to help. For those building a B2B SaaS app, we released [SaaStart](https://auth0.com/blog/speed-up-your-customer-identity-journey-with-auth0-saastart/) last year, a reference B2B SaaS application built using Next.js and Auth0.

Your tools must integrate seamlessly to capitalize on the work you’ve already done. Auth0 is built to be extensible—you can use Integrations, Actions, and Connections to expand your use case and user experience. Start at the [Marketplace](https://marketplace.auth0.com/) to explore your options, and head to [Docs](https://auth0.com/docs) to start implementing them.

We’re partnering with some of your favorite developer tools to launch integrations within their ecosystems. The [Auth0 integration is now in the Vercel marketplace](https://vercel.com/integrations/auth0), so you can build scalable, secure, and compliant applications with an enhanced user experience by leveraging the strengths of these two best-in-class platforms.

![What can be extended](https://images.ctfassets.net/23aumh6u8s0i/2MzNCdyRT7dta4ua898x1g/1992516d3f5086aa87b943469ecd3c17/2557215_BuildLaunchGrowBlogImages_Img2_022825.png)

## Launch

Congrats on launch day! At this point, you’re eager for users to start interacting with your product so they can enjoy the fruits of your labor. However, you want to ensure that a fragmented or inconsistent login experience doesn’t deter them from exploring or, even worse, choosing an alternative app just because their login experience is better than yours. Features like [Enterprise MFA](https://auth0.com/docs/secure/multi-factor-authentication), so your users can use OTP Apps like Duo and Google or WebAuthn with Security Keys, can help create an accessible and secure experience.

At this stage, it’s also important to be able to handle your growing user base and collect data and insights to enhance your user experience. Our integration with [Datadog](https://marketplace.auth0.com/integrations/datadog-log-streaming) allows you to easily monitor your auth workflow logs, metrics, and request traces. Or, if your customers prefer a [passwordless connection](https://auth0.com/docs/authenticate/passwordless) (let’s face it, we all have too many passwords) or prefer to log in with GitHub over Gmail, our [Social Connections](https://marketplace.auth0.com/features/social-connections?_gl=1*1h59xrj*_gcl_aw*R0NMLjE3MzgwOTY5NTUuQ2p3S0NBaUFuZUs4QmhBVkVpd0FveTJIWVYtdjdFbENLNFVqeFpOT3lOaXN6dU5Va25IYmNWb3ZMWHBQUmlkc0ZlY2ZqNUFIOWxjRjZob0NORmdRQXZEX0J3RQ..*_gcl_au*OTU0MDY3ODU2LjE3MzcxNTg3Nzg.*_ga*MTQ1NzkzOTgwMy4xNzM2OTczNzM0*_ga_QKMSDV5369*MTczODEwNzI0MS4yNi4xLjE3MzgxMDk5NjguNDYuMC4w) have you covered. 

As you analyze the data surrounding your users’ preferences, you may realize that a one-size-fits-all approach doesn’t work. By using [Actions](https://auth0.com/docs/customize/actions), you can customize and extend Auth0’s capabilities with custom logic. If you need some extra support to set your business up for success, we offer programs and discounts for eligible [early-stage startups](https://auth0.com/startups) and [nonprofits](https://auth0.com/nonprofits). 

## Grow

Your app is a success — dare we say viral? You have loyal users, and your goal is to maintain your product's functionality while not spending too many resources on maintenance. However, you still want to invest in features that help you grow so your app stays competitive. As you’re looking to expand your customer base, either to include more countries if you’re building a B2C app or large enterprises if you’re building a B2B app, you may be held to new expectations. 

The good news is that if you built with Auth0 in any of the previous phases, you’ve already enhanced the security of your customer’s journey. If you didn’t, don’t worry; you can always [migrate your users automatically from your database](https://auth0.com/docs/manage-users/user-migration/configure-automatic-migration-from-your-database). You’re not just implementing an auth solution; you’ve enlisted a squad of invested security experts to do the heavy lifting for you. With the option to enable [Bot Detection](https://auth0.com/docs/secure/attack-protection/bot-detection) to mitigate scripted attacks and [Fine Grained Authorization](https://auth0.com/fine-grained-authorization) (FGA) to manage complex authorization scenarios efficiently, your security posture can only get stronger as you scale. 

![Grow](https://images.ctfassets.net/23aumh6u8s0i/5Vvup8eSuFUwpqPK8a6vzh/e9b1d62e2104764b6bce73b61100f359/Screenshot_2025-02-13_at_5.11.18_PM.png)

Another evolving area that requires constant maintenance if you’re not using Auth0 is data privacy and compliance. When expanding to other geographies, especially ones with stricter data privacy regulations, it can seem impossible to maintain compliance when you’re moving quickly. Auth0 maintains and meets the requirements for [multiple compliance frameworks and certifications](https://auth0.com/docs/secure/security-center). 

If you’re looking to test how enterprise-ready your app is, Auth0 can help. The [OpenID Foundation’s Interoperability Profiling for Secure Identity in the Enterprise (IPSIE)](https://openid.net/wg/ipsie/) working group is creating an open industry standard to enhance the end-to-end security of enterprise SaaS products. A few Auth0 capabilities that meet IPSIE’s proposed standards include SSO, SCIM, FGA, and Universal Logout. Read more about the new Identity security standard [here](https://www.okta.com/resources/datasheet-preparing-for-the-new-identity-security-standard/thankyou/).

As you're looking towards the future, Auth0 is right there with you. We just announced [Auth for GenAI](https://auth0.com/blog/auth-for-genai/), an upcoming Auth0 product for developers building applications with Generative AI, like chatbots and AI agents. This capability will enable you to confidently work alongside these chatbots and AI agents to build easily and securely. Head to [demo.auth0.ai](http://demo.auth0.ai/) to try the demo. 

![Auth for GenAI](https://images.ctfassets.net/23aumh6u8s0i/4sG1sozcoE745smr4WSKeB/d27692935da1e2ed836b221bea36ac9e/Screenshot_2025-03-04_at_11.21.22_AM.png)

### Try it for yourself today

If you care about:

- Getting your app to market faster than your competitors by having the ability to turn on core features quickly while also promising 99.99% uptime;
- Enabling a secure experience for your users;
- Having the ability to customize experiences when your app’s needs change or your site goes viral, and you get many more monthly active users.

Auth0 may be just what you’re looking for. [Try it out for yourself today](https://auth0.com/signup?utm_source=blog&utm_medium=auth0&utm_campaign=buildlaunchgrow).

![Auth0](https://images.ctfassets.net/23aumh6u8s0i/4AKQiO1r6bbVsVTYYFDLxV/cb1f61b1c6e10ac17ffcd153fddd1e3f/2557215_BuildLaunchGrowBlogImages_Img3_022425.png)

_These materials and any recommendations within are not legal, privacy, security, compliance, or business advice. These materials are intended for general informational purposes only and may not reflect the most current security, privacy, and legal developments or all relevant issues. You are responsible for obtaining legal, security, privacy, compliance, or business advice from your own lawyer or other professional advisor and should not rely on the recommendations herein. Okta is not liable to you for any loss or damages that may result from your implementation of any recommendations in these materials. Okta makes no representations, warranties, or other assurances regarding the content of these materials. Information regarding Okta's contractual assurances to its customers can be found at [okta.com/agreements](http://okta.com/agreements)._


Build, Launch, and Grow with Auth0

For developers tasked with building global applications, choosing the right authentication solution is crucial. Auth0's ability to bridge the gap between enterprise and consumer needs makes it a standout choice in the crowded authentication landscape.

In today's multi-platform world, identity management isn't a one-size-fits-all solution. As developers, we need an authentication system that not only secures enterprise-level applications (B2B) but also delivers a seamless, user-friendly experience for consumer-facing products (B2C). That's why developers across the world turn to Auth0 when they feel it's time to delegate the task of building and maintaining ***authentication and authorization*** to a vendor with deep security expertise and adaptable technical capabilities. 

## The Challenge of Global Scale

Global companies with multifaceted portfolios face a unique set of challenges:

- **Multiple Platforms:** Users access their services via smartphones, PCs, consoles, and more.

- **Diverse Regulatory Requirements:** Compliance with international data privacy and security regulations is non-negotiable.

- **Customization Needs:** Every organization has its own unique workflows and integration requirements, such as compatibility with legacy authentication systems or [support for protocols like SCIM](https://auth0.com/docs/authenticate/protocols/scim).

For developers building at a global scale, the solution needs to be robust enough to handle high security and regulatory demands while remaining flexible for rapid development and global expansion.

## Why Auth0 Stands Out

Auth0's strength lies in its ability to effectively serve both B2B and B2C needs across geographical regions. Here's what makes it a compelling choice:

### Dual capability

Auth0 is built to handle both enterprise-grade integrations and consumer-friendly interfaces. While many competitors specialize in one or the other, Auth0 offers the best of both worlds.

### Robust security

With advanced features like multi-factor authentication (MFA), threat detection, and continuous monitoring, Auth0 meets stringent global security standards—critical for protecting sensitive user data and adhering to mandatory compliance requirements. Don't let regulation get in the way of expansion.

### Scalability

Whether you're serving thousands or millions of users across different regions, Auth0 scales seamlessly. This is vital for companies that operate in a global marketplace.

### Flexible customization

Auth0 allows extensive customization through robust APIs that support multiple programming languages and frameworks. This flexibility means you can tailor the authentication process to meet your specific needs, ensuring a smooth user experience regardless of the platform. Whether you are building the next top-ranking mobile game, a desktop AI application, or a streaming service, Auth0 has a solution that adapts to the user experience you want to attract, convert, and retain paying customers.

### Comprehensive support
 
Transitioning to a new authentication system can be complex. Auth0's professional services and support ensure that even challenges like regulatory compliance or cloud infrastructure migrations (e.g., AWS) are managed efficiently.

## Auth0 Is Ahead of the Competition

While there are strong contenders in the IDaaS space, they often excel in more niche areas. A competitor may be a strong option for enterprise integrations but may require extra effort to tailor it for consumer-facing applications. Some competitor platforms often focus on streamlined, developer-friendly solutions for either simple consumer apps or internal enterprise tools. However, they might not offer the same depth of customization and B2B/B2C functionality required for complex global environments or operations.

Auth0's proven track record in both B2B and B2C scenarios makes it uniquely suited for organizations that need a versatile, scalable, and secure authentication solution.

## See Auth0 in Action

Seeing is believing. Experience Auth0's power firsthand by diving into our developer resources. There, you can quickly set up secure authentication flows for both business and consumer scenarios.

### Interactive demo
   
Try out [our reference B2B SaaS application](https://saastart.app/) to experience features of multi-tenancy support, user management and access controls, security policies, self-service Single Sign-On configuration, and more out-of-the-box. Follow our [guided walkthrough](https://auth0.com/blog/speed-up-your-customer-identity-journey-with-auth0-saastart/) to see how easily Auth0 can secure B2B SaaS applications. If you prefer to learn while reading code, check out the [Auth0 B2B SaaS Starter open-source repo](https://github.com/auth0-developer-hub/auth0-b2b-saas-starter).

### Step-by-step developer guides

Check out our [detailed developer guides](https://developer.auth0.com/resources/guides) on integrating strong authentication using Auth0 with different frameworks and languages. These guides will show you how to implement everything from simple login pages to role-based access control in Single-Page Applications (SPAs), APIs, and web applications. Once you are done with the basics, explore our [developer labs](https://developer.auth0.com/resources/labs) to learn how to extend your authentication solution to include features such as Single-Sign On (SSO) for end-users using Google, GitHub, or X/Twitter, as well as enhancing your authorization models with Fine-Grained Authorization.

### Code samples

[Clone any of our starter projects](https://developer.auth0.com/resources/code-samples) and see practical examples of how Auth0 streamlines the implementation of authentication and authorization. Experiment with the code, tweak it to suit your needs, and accelerate your development process.

## Conclusion

For developers tasked with building global applications, choosing the right IDaaS solution is crucial. Auth0's ability to bridge the gap between enterprise and consumer needs—coupled with its robust security, scalability, and flexibility—makes it a standout choice in the crowded authentication landscape. 

If you're developing a platform that must meet both B2B and B2C demands on a global scale, Auth0 is definitely worth a closer look. [Global companies like SEGA have chosen Auth0](https://www.okta.com/jp/press-room/press-releases/sega-auth0/) as a comprehensive and compliant yet flexible authentication solution that not only enhances security and user experience but also streamlines development and operational efficiency: by opting for a ready-to-use IDaaS solution rather than maintaining an in-house system, SEGA was able to lower development friction, allowing their teams to focus more on core game development and innovation.

Authentication and Authorization For Developers Who Build at Global Scale

Demo Auth0 - a series where we explore auth use cases and demonstrate how to build them using Auth0

<AmpContent>
<amp-youtube
    data-videoid="fjzahoZQjLs"
    layout="responsive"
    width="480" height="270">
</amp-youtube>
</AmpContent>
<NonAmpContent>
<div class='embed-container' style="position: relative; padding-bottom: 56.25%; height: 0; overflow: hidden; max-width: 100%;margin-bottom:40px;"><iframe style="position: absolute; top: 0; left: 0; width: 100%; height: 100%;" src='https://www.youtube.com/embed/fjzahoZQjLs' frameborder='0' allowfullscreen></iframe></div>
</NonAmpContent>

Welcome to Demo Auth0, where we discuss different identity use cases proposed by our customers and developers and how they each used Auth0 to solve their specific needs. If you missed our first episode, we featured our good friends at Vercel, where we discussed [our Vercel integration](https://auth0.com/blog/auth0-vercel-integration/), multi-tenancy, and boba; feel free to check it out [here](https://www.youtube.com/watch?v=aU9DWD1RLiM).

In this episode, we sat down with the [Mindfuel](https://www.mindfuel.ai/) team’s CPO and Co-founder, [Max Könnings](https://www.linkedin.com/in/mkoennings/), and Director of Software Engineering, [Anton Reindl](https://www.linkedin.com/in/anton-reindl/). Mindfuel is an [Auth0 for Startups](https://auth0.com/startups/profiles) graduate who helps their customers drive business value from their AI and data. By using Auth0, Mindfuel was able to get up and running quickly and securely. Read on to learn about their implementation journey and where they’re headed next.

## Mindfuel and Delight’s Origin Story

The Mindfuel team started as a consultancy leveraging data science, AI, and product management to support businesses. This resulted in helping clients build data and AI into their services, products, and internal processes, serving many different stakeholders.

“This year, about $150B was invested worldwide in AI and data, and 80% of the technologies never made it to production.” - Max Könnings, Founder and CPO, Mindfuel. To help tackle this problem, the Mindfuel team launched an application called Delight to bridge what they call the “AI business gap” — the gap between what a business needs and how teams can deliver on those needs using AI and data. Delight is a data impact platform that identifies AI opportunities aligned with business needs, assesses them, prioritizes them based on strategic fit, and builds visualizations and reporting to help ensure data-driven decisions. Mindfuel’s biggest competitor is Microsoft Excel. Just as sales teams use CRMs to manage deals, many AI and data leaders manage their projects using Excel. Mindfuel believes in a future where their product will help customers make the right business decisions and will highlight the impact these teams are creating.

<include src="QuoteCard" body="If we come back to the 80% [of technologies] that never make it into production. It’s mostly not because the technology isn’t there, it’s mostly because we have missing management capabilities." name="Max Könnings" title="Founder and CPO" team="" company="Mindfuel" children="" />

## How Mindfuel Leveraged Auth0

Delight is a tool built for businesses that need to collaborate within their teams. The customer base is primarily large enterprises. These enterprises, especially those in Germany and the EU, have very strict data privacy and protection laws that the Mindfuel team must adhere to, and Auth0 helped them navigate this challenge.

<include src="QuoteCard" body="Auth0 is a super partner because it offers flexible configuration options. We have support for multi-factor authentication, and we allow single sign-on for some of our customers. You can set this up instead of investing weeks of development into those features. We can really focus on the core product and not worry about authentication." name="Anton Reindl" title="Director of Software Engineering" team="" company="Mindfuel" children="" />

Many of the backend functions that Delight needed, like resetting passwords or changing a person's email or username, were available out of the box with Auth0. They didn’t have to worry about building their own backups or the overhead needed when you’re not using an out-of-the-box solution.

> Delight leveraged [**Auth0 Organizations**](https://auth0.com/docs/manage-users/organizations) to best support their enterprise customers within the early days of implementation. With Organizations, they created a secure flow for their business users, set up multi-tenancy, added MFA, and integrated SSO for certain customers—this cut weeks' worth of engineering resources down to hours.

Another feature the engineering team leveraged was [Actions](https://auth0.com/docs/customize/actions). Actions are secure, tenant-specific, versioned functions written in Node.js that execute at certain points within the Auth0 platform. The team was able to build Actions that would happen once the customer approached an event, like logging in. This was a real enabler for customization and allowed the team to add this information to each user’s account, for example, to manage users’ MFA settings and Roles.

When evaluating solutions, the ability to monitor logs and workflows was a priority for the Mindfuel team. With Auth0’s[ integration with Datadog](https://marketplace.auth0.com/integrations/datadog-log-streaming) and a few clicks, the team could see all of the data from Auth0 streamed into Datadog. For example, if one of their users has trouble signing in, the team receives a Slack alert so their customer success team can immediately reach out and help.

Pivoting from the development perspective, Auth0 also supported Mindfuel with its GTM motion. Since they are a small startup that sells to larger enterprises, the sales process is very complex, especially because more regulatory and compliance topics are surfacing in Europe and elsewhere. By using a trusted and well-known solution and leveraging features like SSO, Mindfuel was able to instill confidence in its enterprise buyers and seamlessly adapt to their requirements.

## What’s Next for Mindfuel

Mindfuel is launching its new product, Delight Spark, soon. With Delight Spark, the business side of a company can interact conversationally with AI and data teams. For example, if someone on the team wants to increase a conversion rate, the tool will extract information from the business users and ideate with them about more opportunities. This helps extend the Delight product and makes it more approachable for the entire company, meaning fewer Slacks and emails that block the data and AI teams from building and maintaining their products.

If you want to dig deeper into Mindfuel’s interview and hear their insightful advice to other startup founders, check out the video [here](https://www.youtube.com/watch?v=fjzahoZQjLs\&list=PLshTZo9V1-aFWgshQYa0w80tcv8HLffc6). If you’re interested in joining Mindfuel and 4000+ other startups that have been a part of Auth0 for Startups, apply [here](https://auth0.com/startups/profiles). Happy building!


How Mindfuel Builds and Monitors Auth with Organizations, Actions, and Datadog

Matthew Pereira

Principal Product Designer

Making reliable and scalable decisions in Identity and Access Management using Auth0

## Introduction and Overview

At Auth0, we understand the importance of choosing the right architecture for applications,** especially for security-focused business customers.** The choice between single-tenant and multi-tenant models significantly impacts scalability, security, and success. Making the choice early is crucial — once customers use the application, change can be tough.

When we talk about software architecture, “tenancy” refers to how resources — like data, application logic, and infrastructure — are allocated and shared among users or customers. Software can be set up in different ways, and each instance (or “tenant”) can be occupied in various ways by customers or user groups. In this article, we’ll use the terms “isolated infrastructure” and “shared infrastructure” to be more specific — more on that in the next section.

Auth0 by Okta is built to support every possible identity and access management (IAM) scenario you might encounter when building SaaS applications. We’re here to make sure your journey is smooth, whether you’re just starting with your first login or scaling to support hundreds of business customers and millions of users around the world. The Auth0 platform can create isolated or shared environments and hybrid architectures. As your customer base grows or your product pivots to meet market demands — like adapting a B2C application to handle B2B sales — Auth0 lets you progressively add IAM capabilities and adjust your identity approach appropriately.

This guide will explore the differences between single-tenant and multi-tenant identity, especially in the context of IAM. We’ll also show you how Auth0 simplifies implementing these models and help you choose the best approach for your B2C or B2B needs.


## Understanding Single-Tenancy vs. Multi-Tenancy

### Making Sense of Single-Tenancy vs. Multi-Tenancy

Different companies, applications, and platforms discuss the topic of ‘tenancy’ in software development in different ways.

* Application developers often describe multi-tenancy as a scenario in which multiple customers (tenants) share a single application and database instance.
* Platform developers often think of a “multi-tenant” scenario as one in which a single customer is accessing multiple instances of their platform (referred to as ‘tenants’).

![Single-Tenancy vs. Multi-Tenancy](https://images.ctfassets.net/23aumh6u8s0i/7oMfZHsVewu8lO6fDudH61/c58098cd910d624d41e76f9344bea51c/single-vs-multi-tenancy.jpg)

Isolation plays a large role in evaluating the pros and cons of different tenancy strategies. Multi-tenancy isn’t usually necessary for isolating between customers or branded experiences. (If you use Auth0 Organizations — we’ll talk about that later.)

### Benefits of Isolation for B2B Applications

Traditionally, isolating each business customer to its own infrastructure in B2B scenarios was a matter of **performance** and **reliability**. But there’s more to the conversation than those two details.

1. **Enhanced Security:** Isolation ensures each organization’s sensitive data is kept separate, reducing breach risks and aiding compliance with regulations like GDPR and HIPAA.
2. **Customizability:** Isolated environments allow tailored setups, enabling unique authentication flows, integrations, and experiences that align with client needs.
3. **Performance Stability:** Isolation prevents one organization’s activities from affecting another’s performance, avoiding issues like the “noisy neighbor” effect.
4. **Dedicated Resources:** Organizations can allocate specific resources, ensuring high availability and reliability for their applications.
5. **Simplified Support:** Troubleshooting is easier in isolated environments, as issues are contained within a single tenant, reducing support complexity.

Signing up for an Auth0 account gives you one “Auth0 tenant”, and you can create additional tenants each for isolating between different:

* Environments (e.g., development, staging, or production)
* Geographic locations (e.g., EU, US, JP) 
* Branded experiences
* Customers

### Drawbacks of Isolation for B2B Applications

1. **Higher Costs**: Traditionally, isolated environments are costlier due to separate resources and infrastructure for each tenant.
2. **Increased Management Complexity**: Managing isolated tenants requires more administrative work, including updates, security compliance, and performance monitoring. Auth0 Teams is a product meant to ease the burden of managing some aspects of your organization across multiple tenants, but there are other aspects that will still be more time-consuming than a shared Auth0 tenant architecture.
3. **Reduced Resource Efficiency**: Isolation can lead to underutilized resources, unlike shared architectures that pool resources efficiently.
4. **Slower Configuration Deployment**: Isolated tenants require separate rollouts or migrating changes across multiple configurations, slowing down the development and operation process. This can also lead to version divergence, when a company has updated one environment but not others, giving different end users different experiences and making debugging and management considerably more difficult.

## Choosing the Right Model for Your Application

### Choosing the Right Model for B2C Applications

Creating a **single shared tenant** for a B2C application offers simplicity, cost-effectiveness, and scalability. Think of it as creating one big, cozy house where all your customers can live together but still have their own private rooms. It’s like magic — you get privacy and security where it matters, but one configuration to manage from one central spot. This means you will have fewer headaches and creates a smoother experience for everyone involved.

The best part? It’s simple. You’re not building and maintaining separate houses for each customer group but one efficient space that can grow as you do. Plus, it’s super flexible: You can easily add new features or tweak settings for every one of your customers at once. Just remember, while this setup is great for many scenarios, make sure it fits your specific needs before diving in. After all, you want your digital home to be just right for you and your customers.

### Choosing the Right Model for B2B Applications

When working on a B2B setup there are different approaches we can take from an architecture perspective. In this section we’ll evaluate different scenarios, and how you can leverage Auth0 to simplify your implementation.

#### Isolated Tenants in a B2B Context

Security is a top priority for business customers in 2024. Imagine giving each of your business customers their own digital fortress. That’s what creating a **separate, isolated tenant** for each business customer is like.

This approach is all about giving your business customers the royal treatment. Each one gets its own space, completely separate from the others, which can be a big selling point for companies that are extra careful about their data and security. It’s like having a series of high-security vaults, each with its own unique key. 

Isolating your business customers to separate tenants also allows for ultimate customization —  each business can have things just the way they like them, from security settings to user management. Plus, if one tenant has an issue, the others aren’t affected. It’s a bit more work on your end to manage multiple tenants, but for businesses that demand top-notch security and personalization, this could be your golden ticket.

Signing up for an Auth0 account gives you one “Auth0 tenant”, and you can create additional tenants each for isolating between different:

* Environments (e.g., development, staging, or production)
* Geographic locations (e.g., EU, US, JP) 
* Branded experiences
* Customers

#### Auth0 with Organizations in a B2B Context

Let’s chat about a useful middle-ground approach using [Auth0 Organizations](https://auth0.com/docs/manage-users/organizations) to manage B2B users in a single Auth0 tenant. This is like having a massive, secure office building where each of your business customers gets their own floor. Every floor can have its own layout, look, and feel, but as the application owner, you enjoy the simplicity of managing one building, not a whole city block. 

With this approach, B2B customers get customizable security, branding, and identity provider connections while you get to keep all the perks of managing a single tenant. It's simpler to oversee, and you can still roll out cool new features to everyone at once. Plus, you've got the flexibility to customize each “floor” to fit that particular business needs. Every customer can have their own SSO connection and their own members (or, in more complex use cases, their own distinct databases of members), managed within a single Auth0 tenant. It’s a win-win.

### Choosing a Hybrid Model with Shared B2C Tenant and Isolated B2B Tenants

Modern product development is complicated, and our software often has to play multiple roles. If you’re exploring a combination of B2C and B2B usage, you can also approach a hybrid solution to your IAM needs.

Imagine you’ve got a bustling community center (your B2C shared tenant) where all your individual consumers hang out. It’s vibrant, cost-effective, and easy to manage. But right next door, you’ve got a row of private clubhouses (your B2B isolated tenants), each tailored for a specific business client.

This hybrid approach lets you seamlessly cater to both worlds. Your B2C users get a unified, streamlined experience in their shared space — and you get the perks of managing it in a centralized fashion. Meanwhile, your B2B clients each get their own fortress of solitude, complete with custom security and features.

This setup is perfect if your product needs to juggle the different demands of individual consumers and business clients. You get to optimize your resources for the B2C crowd while still offering that extra layer of isolation and customization that B2B clients often crave.

## Implementation with Auth0

### Creating Isolated Tenants Using Auth0

In Auth0, single-tenancy can be implemented by creating separate Auth0 tenants for each customer. This allows for granular control over the IAM needs of each tenant, ensuring their data and configurations remain isolated. These tenants can be deployed to different regions or configured independently to serve different user pools or compliance needs.

[Learn more about creating tenants in the Auth0 Docs](https://auth0.com/docs/get-started/auth0-overview/create-tenants).

### Creating a Shared Tenant Using Auth0 — Introducing Organizations

Organizations in Auth0 is a feature that allows you to manage and group users who should have access to particular applications. By managing multiple organizations within one Auth0 tenant, you can:

1. Centralize user management and authentication
2. Reduce administrative overhead
3. Maintain consistent security policies
4. Simplify billing and licensing
5. Leverage shared resources and configurations to work faster without working harder

[Learn more about how Organizations work in the Auth0 Docs](https://auth0.com/docs/manage-users/organizations/organizations-overview).

## Conclusion

Whether you opt for a single shared tenant, isolated tenants for each business customer, or a hybrid approach using something like Auth0 Organizations, choosing the right tenancy model for your application is crucial for long-term success. Remember, the best solution depends on your specific needs, balancing factors like security, customization, scalability, and management complexity.

Auth0 provides the flexibility and tools to support you, whatever you choose. As you embark on your journey to build robust B2B or B2C applications, consider exploring Auth0’s comprehensive offerings:

* Learn about [Auth0 Public Cloud and Private Cloud offerings](https://auth0.com/platform/cloud-deployment) to find the right fit for your infrastructure needs.
* Try [Auth0 Organizations](https://auth0.com/organizations) to experience multi-tenancy with built-in security and scalability in an all-in-one centralized management environment.
* Kickstart your B2B SaaS development with [Auth0’s B2B SaaS Starter](https://auth0.com/blog/speed-up-your-customer-identity-journey-with-auth0-saastart/), which includes advanced B2B identity capabilities from the get-go.

By leveraging Auth0’s powerful IAM solutions, you can focus on creating value for your customers while ensuring secure, scalable, and efficient user management.

Building Single-Tenant vs. Multi-Tenant Apps with Auth0

Perspectives of a Builder, a Buyer, and a Founder

Security Considerations in the Time of AI for Startups

paulo-nascimento

Paulo Nascimento is a Machine Learning Engineer at Okta, spearheading AI development for the Customer Identity Cloud (CIC). He brings expertise from AI startups to create innovative solutions powering the CIC organization. Paulo's work focuses on integrating AI technologies to strengthen enterprise security, enhance user experience, and drive intelligent automation across Okta's identity platform.

Machine Learning Engineer

Paulo Nascimento

Learn how to make your AI system more safe and reliable.

Learn how to make your AI system safer and more reliable.

In this tutorial, you'll improve a chatbot's reliability by learning how to:

- Improve your prompt engineering.
- Reduce AI hallucinations.
- Create prompt engineering test suites.

To make your learning experience more engaging, we’ll use the demo application we used in [Okta Developer Day](https://developerday.com/): an online learning platform called “Identiflix”. The web app has a chatbot system for users to ask questions about identity and security topics. However, this chatbot sometimes answers unrelated topics and provides information that’s not accurate or even real. Let’s fix that throughout this tutorial.

## Why Use AI Reliability Techniques?

AI systems' output is not always accurate. It may depend on many factors: the initial training data, the lack of context, or other reasons. Inaccuracy may have bad consequences, including loss of customers, damage to the brand, and legal problems.

To improve the accuracy of your AI system's output, you should consider using AI reliability techniques such as content filters, fact-checking mechanisms, and prompt testing suites.

These are common techniques used by AI practitioners and have a significant impact on AI-based applications:

- **Improved Accuracy**. By implementing content filters and fact-checking mechanisms, you can reduce hallucinations and unexpected responses, leading to more accurate and trustworthy AI outputs.
- **Enhanced User Experience**. Reliable AI systems provide consistent and appropriate responses, resulting in better user satisfaction and engagement with your chatbots or AI applications.
- **Risk Mitigation**. Implementing guardrails helps prevent potential reputational damage or legal issues that could arise from inappropriate or false AI-generated content.
- **Quality Assurance**. A prompt testing suite allows you to systematically verify your AI's performance, ensuring it meets your standards and expectations across various scenarios.
- **Scalability**: As your AI applications grow, these techniques provide a foundation for maintaining reliability, making it easier to expand and improve your systems over time.
- **Competitive Edge**: Mastering these techniques sets you apart in the AI development field, as reliability is becoming increasingly crucial in AI applications.

By adopting these reliability techniques, you'll be better equipped to ship powerful, safe, and trustworthy AI systems.

## Project Setup

Start by cloning the project into your local machine:

```bash
git clone https://github.com/oktadev/devday-24-labs-demo-app.git
```

Make the project directory your current working directory:

```bash
cd devday-24-labs-demo-app
```

Next, install the Next.js project dependencies:


```bash
npm install
```

To start the development server, and reload the applications whenever you make changes to the codebase, run the following comand. It will show the url (localhost + port) your application is running on, so you can open it in your browser.

```bash
npm run dev
```

The application's chatbot was designed to work with two different LLM models. You can choose which one you'd like to use based on the following:

### Xenova/Qwen1.5-0.5B-Chat

By default, the application will download and install a local LLM model, this way, you won't be needing to configure any API keys, however there are some considerations for using this model:

- The model was trained with 620M parameters, which makes it a relatively small LLM, thus the results you'll obtain from this model will not be the most optimal.
- The model will still require high processing power and could take some time to produce any response depending on the hardware is running.

### Open AI

You can opt to use OpenAI instead of running a local model. By using OpenAI, you'll access state of the art models that will respond effectively to your prompts without sacrificing on performance. If you decide to use OpenAI, follow the next steps:

- Get an [OpenAI API key](https://help.openai.com/en/articles/4936850-where-do-i-find-my-openai-api-key)
- Edit the `.env.local` or `.env` file in your application's project and add a new environment variable: `OPENAI_API_KEY`. Assign your OpenAI API key as its value.
- The application will automatically switch to use OpenAI when the environment variable is assigned.

> Depending on whether you are using the `Xenova/Qwen1.5-0.5B-Chat` or the OpenAI model, you will be modifying different parts of the code. If you are using the OpenAI model you will be editing parts of the code that uses the `useOpenAI` conditional statements.

## Reducing Hallucinations Through Prompting

Hallucinations are responses generated by an AI system that contain false or misleading information presented as facts. There can be many reasons for hallucinations: from the initial training data to the very nature of the model. However, one of the main reasons is a lack of context.

You will learn how to define a context to a prompt in order to mitigate the risk of hallucinations.

Go to the `/data` folder of the project and open the `ai.ts` file, which contains the code that interacts with the AI model. The code in this file defines the `systemMessage` constant, which is our system prompt:

```typescript
const systemMessage = {
  role: "system",
  content: `You are a chatbot that answers questions about identity, authentication, and authorization.`,
};
```

A system prompt is a fixed prompt providing instructions to the model. The user can't change this prompt, so you can use it to define a set of constraints within which the model can respond.

The prompt you see in the code snippet above defines the topics the model can respond to, but it lacks robustness. Let's improve it step by step.

### Step 1: Adding Context and Citation Requirements

The first step is to define a context and some rules. Let's start by modifying the `content` property of our system prompt as shown below:

```typescript
const systemMessage = {
  role: "system",
  content: `You are a chatbot that answers questions about identity, authentication, and authorization. Rules:
  1. Use ONLY the information from the numbered context below.
  2. Cite sources using [1], [2], etc. after EACH piece of information.
  Context:
  ${numberedContext}
  Remember to cite your sources and only use the information provided above.`,
};
```

You added two rules and a context.

The first rule forces the model to take the context defined below as the only source of information. This ensures that you are in control of the source of information that the model can provide.

The second rule asks the model to provide the references to the sources it used to formulate the answer.

Then, after the `Context:` string, there is a variable bound to a list of resources about the topic on which we specialize our model, i.e., identity, authentication, and authorization. The value of the `numberedContext` variable is a string with the actual content that the model must consider.

The last sentence simply reinforces the two rules defined earlier.

### Step 2: Implementing Response Constraints

In this second step, you will refine the system prompt to include a couple of additional constraints:

```typescript
const systemMessage = {
  role: "system",
  content: `You are a chatbot that answers questions about identity, authentication, and authorization. Rules:
  1. Use ONLY the information from the numbered context below.
  2. Cite sources using [1], [2], etc. after EACH piece of information.
  3. Your response MUST be 50 words or less.
  4. Your response MUST contain at least one citation in square brackets, like [1].
  Context:
  ${numberedContext}
  Remember to cite your sources and only use the information provided above.`,
};
```

You see that two new rules were added.

The third rule limits the length of responses, while the fourth rule ensures that at least one citation is used and defines its format.

### Step 3: Fine-tuning Response Behavior

Let's complete the improvement of the system prompt to reduce hallucinations by adding two more rules that tell the model how to behave when it does not find an answer. Change the prompt as follows:

```typescript
const systemMessage = {
  role: "system",
  content: `You are a chatbot that answers questions about identity, authentication, and authorization. Rules:
  1. Use ONLY the information from the numbered context below.
  2. Your response MUST be 50 words or less.
  3. Cite sources using [1], [2], etc. after EACH piece of information.
  4. If you can't answer using the context, try to provide a partial answer or related information.
  5. Do not add any information not present in the context.
  6. Your response MUST contain at least one citation in square brackets, like [1].
  Context:
  ${numberedContext}
  Remember to cite your sources and only use the information provided above.`,
};
```

This final step adds instructions for handling incomplete information and explicitly prohibits adding information not in the context, further reducing the likelihood of hallucinations.

By implementing these incremental improvements, we significantly enhance the reliability and trustworthiness of the AI's responses while maintaining its focus on the provided context.

## Citation Processing

The current solution has the desired behavior, but unfortunately it simply provides citations numbers in square brackets, which is not that meaningful. You need a way to associate the links of the cited documents to these numbers.

Let's create a `processCitations` function that implements this citation processing:

```typescript
function processCitations(
  assistantResponse: string,
  searchResults: any[],
): string {
  let processedResponse = assistantResponse.replace(
    /\[(\d+)\]/g,
    (match, p1) => {
      const index = parseInt(p1) - 1;
      if (index >= 0 && index < searchResults.length) {
        return `[${p1}: ${searchResults[index].metadata.source}]`;
      }
      return match;
    },
  );
  return processedResponse;
}
```

This function uses a regular expression to find citation numbers in square brackets (e.g., [1], [2]). It then replaces each citation with an expanded version that includes the source URL. In detail:

1. The regex `/\[(\d+)\]/g` matches citation numbers in square brackets.
2. For each match, it calculates the index in the `searchResults` array (subtracting 1 as array indices start at 0).
3. If a corresponding result exists, it replaces the citation with `[number: source_url]`.
4. If no matching result is found, the original citation is left unchanged.

The processed response with expanded citations is then returned and used as the final output of the AI assistant.

## Creating a Prompt Engineering Test Suite

This section is more about explaining the code in the existing test suite files. Not sure if it fits the general goal of a lab (i.e., building something)

To ensure consistent AI response quality, we'll create a robust Prompt Engineering Test Suite using unit tests. This suite will systematically evaluate the AI's responses against predefined criteria.

### Step 1: Define Test Cases

In the `/tests` folder of the project, create a `testPrompts.json` file with a variety of test cases. You will find the file already in place with the test cases defined ar an array of objects as follows:

```json
[
  {
    "name": "Basic Authentication Definition",
    "input": "What is authentication?",
    "expectedOutput": "authentication verifying identity",
    "criteria": "contains"
  },
  {
    "name": "Authorization Definition",
    "input": "Define authorization in the context of security.",
    "expectedOutput": "authorization determines access resources actions",
    "criteria": "contains"
  }
  // ... more test cases ...
]
```

The `name` property indicates a description of the test case.

The `input` property contains the input for the AI assistant.

The `expectedOutput` property is a sequence of keywords related to the expected answer for the input.

The `criteria` property describes the criteria that make the output valid. The keyword `contains` indicates that the keywords in the `expectedOutput` property must be included in the answer.

### Step 2: Implement the Test Runner

The `promptTestingSuite.js` file in the `/tests` folder implements the test runner for the test cases defined in the previous step. Let's analyze two functions implemented in this file to get a high-level idea of how the test runner works: `evaluateResponse` and `runTests`.

The code of the `evaluateResponse` function is as follows:

```typescript
function evaluateResponse(actualOutput, expectedOutput, criteria) {
  const normalizeText = (text) => {
    return text
      .toLowerCase()
      .replace(
        /\b(the|a|an|and|or|but|in|on|at|to|for|of|with|by|from|up)\b/g,
        "",
      )
      .replace(/[^\w\s\[\]]/g, "")
      .trim();
  };

  const normalizedActual = normalizeText(actualOutput);
  const normalizedExpected = normalizeText(expectedOutput);

  switch (criteria) {
    case "exact":
      return normalizedActual === normalizedExpected;
    case "contains":
      const keywords = normalizedExpected
        .split(/\s+/)
        .filter((word) => word.length > 3);
      const matchCount = keywords.filter((keyword) =>
        normalizedActual.includes(keyword),
      ).length;
      return matchCount / keywords.length >= 0.7;
    case "length":
      return actualOutput.split(/\s+/).length <= parseInt(expectedOutput);
    case "citation":
      const openBrackets = (actualOutput.match(/\[/g) || []).length;
      const closeBrackets = (actualOutput.match(/\]/g) || []).length;
      return openBrackets > 0 && openBrackets === closeBrackets;
    default:
      return false;
  }
}
```

It first normalizes actual and expected outputs for comparison by converting to lowercase and removing certain words and punctuation.

Then it evaluates the test output by evaluating the following criteria:

- **'exact'**: Checks if normalized outputs are identical.
- **'contains'**: Ensures a significant portion of keywords in expected output are present in actual output (at least 70%).
- **'length'**: Verifies that the word count of actual output does not exceed the expected length.
- **'citation'**: Checks for balanced square brackets in actual output to ensure proper citations.

The `runTests` function is shown below:

```typescript
async function runTests() {
  try {
    const prompts = JSON.parse(fs.readFileSync(PROMPTS_FILE, "utf8"));
    const results = [];

    for (const [index, prompt] of prompts.entries()) {
      console.log(
        `Running test ${index + 1}/${prompts.length}: ${prompt.name}`,
      );

      const startTime = Date.now();
      const response = await getAIResponse([
        { role: "user", content: prompt.input },
      ]);
      const endTime = Date.now();

      const result = {
        name: prompt.name,
        input: prompt.input,
        expectedOutput: prompt.expectedOutput,
        actualOutput: response,
        passed: evaluateResponse(
          response,
          prompt.expectedOutput,
          prompt.criteria,
        ),
        executionTime: endTime - startTime,
      };

      results.push(result);
      console.log(`Test ${index + 1} completed. Passed: ${result.passed}`);
    }

    fs.writeFileSync(RESULTS_FILE, JSON.stringify(results, null, 2));

    const passedTests = results.filter((r) => r.passed).length;
    console.log(`\nTest Summary:`);
    console.log(`Total Tests: ${results.length}`);
    console.log(`Passed: ${passedTests}`);
    console.log(`Failed: ${results.length - passedTests}`);
    console.log(`\nDetailed results saved to ${RESULTS_FILE}`);
  } catch (error) {
    console.error("Error running tests:", error);
  }
}
```

To run the test suite, it:

- Reads prompts from the specified `PROMPTS_FILE`.
- Initializes an empty results array to store test outcomes.
- Iterates through prompts, logging progress and measuring response time for each test.
- Evaluates the actual response against the expected output using `evaluateResponse`.
- Stores results, including pass/fail status and execution time.
- Writes summarized results to `RESULTS_FILE` and logs a summary of total, passed, and failed tests.

### Step 3: Run the Test Suite

Now, all we have to do is run the tests with the following command:

```shell
node tests/promptTestingSuite.js
```

You will get a summary of the result on the screen and the details in the `testResults.json` file.

### Step 4: Analyze Results

Review the generated `testResults.json` file to identify areas for improvement in your system prompt. Look for patterns in failed tests and adjust your prompts or AI model accordingly.

### Step 5: Iterate and Improve

Based on the test results:

1. Refine your prompts to address any consistently failing tests.
2. Add new test cases to cover edge cases or newly identified scenarios.
3. Adjust the evaluation criteria if necessary to better capture the desired response quality.

Keep in mind, unlike traditional testing, you're not aiming for a 100% passing score because depending on the model, that is unlikely to achieve every time.

By systematically testing and iterating on your prompts, you can ensure consistent and high-quality AI responses across various scenarios. This approach helps maintain reliability and prevents regression as you continue to develop and refine your AI system.

## Recap

Throughout this tutorial, you learned a few techniques to improve the reliability of your AI-based application and prevent hallucinations. In particular, you learned:

- How to add context and constraints to your system prompt in order to make the underlying AI model more focused on the specific topics you provided.
- How to process the output generated by the AI model to make it more helpful for the user. Specifically, you expanded the citations by adding the URL of the source document.
- How to create automatic tests to ensure that the output generated by the AI model is what you expected.

By applying the strategies you learned, you can ensure that AI models not only perform accurately but also align with ethical standards and user expectations through fact-based checking.

Thanks!

Build Safe and Reliable AI Systems

diegopoza

System Engineer, geek, foodie, technology lover, speaker.

Sr Manager, Developer Advocacy

Diego Poza

Build the future of identity: join developers around the world at Oktane Online 2024

**Oktane 24** is just around the corner, happening from October 15-17, 2024, with a lineup built specifically for developers. Whether you're joining us in person or virtually, we've designed an experience tailored to your needs.

Can’t make it to Las Vegas? No problem! **Oktane Online** on October 16 delivers a full day of live-streamed keynotes, deep technical sessions, and hands-on demos to help you stay ahead in identity and access management.

As a developer, you understand how crucial identity is to building secure, scalable, and seamless applications, whether it’s for B2B, B2C, or internal users. That’s why Oktane Online is your perfect chance to learn from the experts, gain hands-on insights, and see how Okta’s solutions can elevate your development process.

## Why Should Every Developer Attend?

You’ll hear directly from engineers, developer advocates, and product leaders who will guide you through real-world use cases, cutting-edge identity solutions, and the latest innovations. Plus, you’ll get the chance to ask questions, join live demos, interact with other developers, and enjoy some surprises along the way!

## Agenda Overview

Here are a few developer sessions you won’t want to miss:

### 🗓 Wednesday, October 16

**🕗 8:05 AM PDT - Navigating the Path to Packaged Business Capabilities**

Learn from Cigna Group's journey of simplifying health data access with Okta's Customer Identity Cloud (CIC), showing how developers can build packaged business capabilities to streamline customer identity and onboarding experiences.

**🕘 9:00 AM PDT - Keynote: The Future of Identity Security**

Join this keynote to explore how developers can play a critical role in securing today’s complex identity ecosystems. From passwordless authentication to unified identity, see how Okta’s product innovations are shaping the future.

**🕙 10:15 AM PDT - The Art of Zero Trust Identity: A Unified Approach Towards Secure Access Management**

Zero Trust starts with identity. In this session, you’ll learn how to shape security measures from initial access to ongoing threat mitigation. This talk is a must for developers focused on securing applications and infrastructure.

**🕛 12:15 PM PDT - Keynote: Reaching New Heights with Alex Honnold**

Get inspired by rock climbing legend Alex Honnold as he talks about overcoming challenges, taking risks, and his mission to advance solar energy. A motivational session every developer will appreciate!

**🕛 2:30 PM PDT - Keynote: Secure, Engaging, Developer-Friendly Customer Identity. It’s Possible.**

This keynote will dive into how Okta's **Customer Identity Cloud** is transforming the way developers build secure, seamless customer experiences. Discover how Okta’s latest innovations help you build apps faster and better while ensuring world-class security for your users.

**🕓 3:45 PM PDT - Insights on Delivering IT Modernization for Enhanced Security**

Join Chemist Warehouse as they discuss their journey with IT modernization and how developers can leverage identity solutions to streamline workflows and secure their infrastructure.

**🕔 4:30 PM PDT - Get Started with Using GenAI for Efficient Okta API Integration**

In this session, you’ll see how to harness the power of Generative AI and Okta APIs together to fast-track your integration process. Learn how to go from concept to working code in record time.

Want to see the full agenda? Check out all the sessions [**here**](https://www.okta.com/oktane/online/#:~:text=up%20to%20you.-,See%20all%20sessions,-Channel%201%20I).

## Don’t Miss Out – Register for Free!

Oktane Online is completely free to attend and provides great opportunities to enhance your knowledge, sharpen your skills, and build better, more secure applications. With access to live sessions, on-demand content, and real-time interaction with Okta experts, it’s the event of the year for developers working with identity or willing to learn more about identity.

Register now [**here**](https://reg.okta.com/flow/okta/oktane24/reg/) and get ready to take your identity management skills to the next level.


Why Developers Should Attend Oktane Online

peterfernandez_360

As an Architect, Consultant, and Engineer, I have more than 30 years of experience designing and developing secure and robust software solutions. When not helping teams deal with the complexities of Customer Identity, you can usually find me working behind the scenes, acting in or directing a show at my local theatre.

Principal Developer Advocate

Peter Fernandez

A guide to building B2B SaaS applications using Auth0 and the Auth0 Organizations feature.

A B2B SaaS Application Primer Using Auth0

andrea-chiarelli

I have over 20 years of experience as a software engineer and technical author. Throughout my career, I've used several programming languages and technologies for the projects I was involved in, ranging from C# to JavaScript, ASP.NET to Node.js, Angular to React, SOAP to REST APIs, etc.

In the last few years, I've been focusing on simplifying the developer experience with Identity and related topics, especially in the .NET ecosystem.

Andrea Chiarelli

A new release of the package Auth0 Templates for .NET is out with new project templates and other improvements.

A new awesome version of the [Auth0 Templates for .NET package](https://www.nuget.org/packages/Auth0.Templates/) has been released! It brings you new templates and other improvements, which we will discover in a moment. Install now the latest release of the templates by running the following command in a terminal window:

```bash
dotnet new install Auth0.Templates
```

> ⚠️ Make sure you have uninstalled any previous version of the package from your machine before installing the new one.

Ready to learn what's new in the latest release? Let's go!

## New Project Templates

The first big news is that two new templates are now available: the Blazor Web App and the MAUI templates.

### The Blazor Web App template

The Blazor Web App template allows you to create a web application using the .NET 8 Blazor application model. As you may know, this new type of Blazor application has some complexities in properly supporting authentication. Take a look at [this article](https://auth0.com/blog/auth0-authentication-blazor-web-apps/) to learn more about it. Now you can have a starting point for your new Blazor application with Auth0 embedded in a snap by simply running the following command:

```bash
dotnet new auth0blazor -o MyNewBlazorApp
```

As usual, if you also have the [Auth0 CLI](https://github.com/auth0/auth0-cli) installed on your machine and logged in, you can automatically register your app with Auth0. Of course, you can still use the templates with Visual Studio:

![Auth0 Blazor Web App template in Visual Studio](https://images.ctfassets.net/23aumh6u8s0i/1fmXTCgaPVzvKGGiW0QPon/edd5f2a979472be788c9c6d448dc1ed0/auth0-blazor-web-app-vs.png)

Read [more about the Blazor Web App template here](https://github.com/auth0/auth0-dotnet-templates/blob/main/docs/auth0blazor.md).

### The MAUI template

With the MAUI template, you can build desktop and mobile applications with Auth0 authentication for Windows, macOS, iOS, and Android using a single code base. In this case, the command to use is as follows:

```bash
dotnet new auth0maui -o MyNewMauiApp
```

Building your new MAUI app using this template will save you a lot of time, as you can see from reading [this article](https://auth0.com/blog/add-authentication-to-dotnet-maui-apps-with-auth0/).

Check out [this document to learn more about the MAUI template](https://github.com/auth0/auth0-dotnet-templates/blob/main/docs/auth0maui.md).

## Other Improvements

In addition to the new templates, the new package brings you other internal and external improvements. To mention just a few of them:

- The Blazor WebAssembly template now supports .NET 8.
- The program that registers your application with Auth0 is no longer tied to .NET 7.0.
- A few issues with the auto-registration script have been fixed.

These improvements help provide a better experience when scaffolding and registering your application with Auth0.

<include src="ebook-ads/dotnetIdentity" />

## JetBrains Rider Support

Now you can use the Auth0 Templates with JetBrains Rider! Starting with [version 2024.1](https://www.jetbrains.com/rider/whatsnew/), Rider fully supports custom templates, so now you can choose your preferred IDE to build your .NET applications with Auth0 integrated, regardless of your operating system. This is especially important now that [Visual Studio for Mac is close to its retirement](https://learn.microsoft.com/en-us/visualstudio/mac/what-happened-to-vs-for-mac?view=vsmac-2022).

Previously, Rider [didn't support parameters for custom templates](https://youtrack.jetbrains.com/issue/RIDER-16759), which was a clear barrier to using the Auth0 Templates. Now you can use them just like in Visual Studio!

![Auth0 Blazor Web App Template in JetBrains Rider](https://images.ctfassets.net/23aumh6u8s0i/2wWfc13e4He4h6Ob3H7Eyu/d4fcd35aab3ae5a1ed41f6ec25fc486b/auth0-blazor-web-app-rider.png)

## A Look Back and a Glimpse Forward

The first version of the package was released one year ago. Since then, the project has grown with new templates and integration with the Auth0 CLI for automatic registration of your applications. During this year, the package has been downloaded over 8,000 times, and we have received suggestions and contributions.

We want to continue improving the current templates by adding features and improving the developer experience. Your feedback is very important. Share your thoughts by leaving a message below, or by opening a [new issue](https://github.com/auth0/auth0-dotnet-templates/issues/new/choose) to report problems and request new features.
If you like the project, don't forget [to star it on GitHub](https://github.com/auth0/auth0-dotnet-templates).

New Templates for Building .NET Apps with Auth0 Authentication

Build Python CLI applications secured by using the device authorization flow with Auth0.

Securing a Python CLI application with Auth0

Learn how to create customizable and secure login pages that match your branding to enhance user experience and conversion rates.

So, you've built an outstanding application. Your landing page is meticulously designed, compelling, and has a high conversion rate. You've carefully crafted every detail of the user experience, but what about the entry points to your app – the signup and login pages?

Often overlooked in the design process, these critical touchpoints serve as the users’ gateways into your application. They should be as compelling, user-friendly, and beautiful as the rest of your application. Just as the landing page captures the user's attention, the login and signup pages are where you can truly start to engage users, encouraging them to join your application.

In this article, we'll explore how Auth0 makes it easy to build login and signup experiences that not only align seamlessly with your branding but also provide a superior user experience. A poorly designed login page can lead to user frustration and higher abandonment rates, whereas a well-designed one establishes trust and encourages engagement. Because every aspect of your application, even the seemingly mundane, should be nothing short of beautiful.

Let's dive into how Auth0 can elevate your login experience, covering the importance of UI and UX, and offering practical tips to create extraordinary login flows.

## The Importance of the Login Page Design

The login page is often the first impression a user has of your application. It sets the tone for the entire user experience and can make or break a user's decision to continue using your app.

The design of a login page encompasses both UI and UX. It should not only be pretty but also easy to use while conveying a sense of security and trustworthiness to the user.

If you need inspiration or to learn some tips on what makes good login pages extraordinary, check out these [ten tips](https://www.invisionapp.com/inside-design/login-page-design/).

## Getting Started

Auth0 offers a variety of [customization options to match your application's branding and design](https://auth0.com/blog/customize-auth0-universal-login-with-auth0-cli/). With Auth0, you can rest assured that your login and signup pages will be not only beautiful and match your brand but also secure and reliable.

In many scenarios, those out-of-the-box settings are all you need to make your login and signup pages match your brand and style. But in case you want a completely customized page, Auth0 offers the possibility to create your own styles and designs using [HTML, CSS, and JavaScript templates](https://auth0.com/docs/customize/universal-login-pages/universal-login-page-templates). 

> Custom templates require enabling [custom domains](https://auth0.com/docs/customize/custom-domains), which is a paid feature.

In this article, we’ll focus on creating our own template to have full control over the login experience. However, if you would like to know how to set up your branding settings instead, you can refer to this article on [Customize Auth0 Universal Login with Auth0 CLI](https://auth0.com/blog/customize-auth0-universal-login-with-auth0-cli/).

You can work with templates either through the [Auth0 Dashboard](https://manage.auth0.com/#/login_page) with an integrated code editor and preview mode, or you can use the [Auth0 CLI](https://github.com/auth0/auth0-cli) with your editor of choice and [Storybook](https://storybook.js.org/) to preview your designs.

Throughout the article, we'll use the Auth0 CLI to customize the templates as it provides a rich developer experience.

## Setting up the Auth0 CLI

The Auth0 CLI is a powerful tool that allows you to manage your entire Auth0 tenant from the command line. The Auth0 CLI helps you simplify your workflows and set up automation on your Auth0 account.

### Install the Auth0 CLI

The Auth0 CLI is available for macOS, Linux, and Windows. To install it on your preferred OS, please follow [these installation instructions](https://github.com/auth0/auth0-cli#installation).

After your installation completes, you can verify the installation by running the following command:

```bash
auth0 -v
```

### Connect the CLI to your Auth0 Account

To connect the CLI to your Auth0 account, you'll need to log in. Run the following command in your terminal and follow the instructions to authenticate:

```bash
auth0 login
```

First, the CLI will prompt for one of two authentication methods, `As a user` or `As a machine`. For now, we’ll select `As a user` since it is the recommended option for a personal computer. However, for automation scenarios, it is recommended to select the latter.

Next, we need to authenticate in the browser using [device authorization flow](https://auth0.com/docs/get-started/authentication-and-authorization-flow/device-authorization-flow). The Auth0 CLI will show a code on the screen and will open a browser session, where the code should match, and after verification, you’ll have to authorize the CLI on all the requested scopes.

## Activate a Custom Domain

As mentioned before, a requirement for editing custom templates is to activate custom domains, which is a good practice for production. Since custom domains come in different configurations and multiple steps, I won’t be covering them in this article. Instead, I can refer you to the [custom domains documentation](https://auth0.com/docs/customize/custom-domains), where you can find all the information you’ll need with step-by-step instructions.

Once you have a custom domain set up on your account, you can continue with the rest of the article.

## Customizing the Universal Login UI

To start customizing the Universal Login UI, run the following command on your terminal:

```bash
auth0 universal-login customize
```

This will open the Auth0 customization editor on your browser which will allow you to change any visual settings in Universal Login, from colors, logo, texts, and you can design your own templates with live preview in this app.

![Auth0 Universal Login Editor Preview](https://images.ctfassets.net/23aumh6u8s0i/5YNs9FYoGfPXrMon6OMpkY/88008ca9b492268c60724883011271f0/Screenshot_2024-04-18_at_09.41.25.png)

Any changes that you make locally can then be deployed to your Auth0 tenant from the same UI.

### Exploring the UI

The UI customization tool is divided into three sections:

- **Navigation bar**: It allows you to work on different areas of customization, from settings, theme, page template and custom texts. It also allows you to navigate through the different prompts like login, signup, etc.
- **Editor**: On the left side, it's the editor. It will display information about the current state of your page in either JSON for settings or HTML code for the page template editor.
- **Preview window**: The preview window gives you a live preview of your changes and how your UL page will look like when deployed to your tenant.

## Building a Beautiful Template

If you jump into the **Page Template** section, the editor will load the current template available for your tenant. If you have never customized your template, it will display the default template which looks like this:

```html
<!DOCTYPE html>
<html>
  <head>
    {%- auth0:head -%}
  </head>
  <body>
    {%- auth0:widget -%}
  </body>
</html>
```

There's some custom code in that template, let's explore what each of those sections do:

- `{%- auth0:head -%}`: This will set all the head elements that are required for universal login to work, like importing scripts, basic styles, etc.
- `{%- auth0:widget -%}`: This will place the login widget on the screen.

Templates use [Liquid syntax](https://shopify.github.io/liquid/basics/introduction/), with variables you can use to further customize your experience. You can read about all variables available [here](https://auth0.com/docs/customize/universal-login-pages/universal-login-page-templates).

One of the benefits of using Auth0's rich templating system is the ability to customize logic depending on the current prompt. For example, you could have some parts of the UI shown on the signup screen but not on the login or other prompts. The term prompt is used to refer to a specific step in the login flow. Each prompt can have one or more screens. For example, the `reset-password` prompt would have multiple screens for resetting password requests, checking your email, entering a new password, and confirming your change. You can find the complete list of prompts and screens on the [official template variables documentation](https://auth0.com/docs/customize/universal-login-pages/universal-login-page-templates#:~:text=screen%20being%20rendered.-,The%20term%C2%A0prompt,-is%20used%20to).

You can do that by implementing conditionals over the variable `prompt.name`. Here's an example that renders additional content when the user is signing up.

```text
{% if prompt.name == "signup" %}
Show this only if the user is signing up
{% end %}
```

As part of templating, you can also set custom brand parameters, such as the brand's primary color, background, and logo, which you can use throughout the template by accessing the `branding` variable.

For example, if you need a button that aligns with the branding's primary color, you could implement it as follows:

```html
<button style="background-color: {{branding.colors.primary}}" ...>My Button</button>
```

Now that we know what we can do with the templating system, it's time to build your own.

Here's what I'll build. Feel free to copy and paste this template and customize it to your application or use it as a baseline for your own.

- Signup screen:
	![Custom Signup Screen](https://images.ctfassets.net/23aumh6u8s0i/5u5pK7O3FLMInWmakSjRAr/99dce5b115abc63d90ea271440f1afa6/custom-template-signup.png)
- Login screen:
	![Custom Login Screen](https://images.ctfassets.net/23aumh6u8s0i/3dzWx5rQ3xiIgqUTyBTqXT/0fee59fa6b4f593f5771ed4e25d8100d/custom-template-login.png)

What’s interesting about this design is that the signup page looks different from the rest as it provides additional information about the product, so users know what they are signing up for. I also make use of variables to set the branding color on custom elements and I added some responsive elements for tablets and mobile devices.

Here is my template for your reference:

```html
<!DOCTYPE html>
<html>
  <head>
    {%- auth0:head -%}

    <style>
        body {
            background-color: #fff;
        }

        .wrapper {
            max-width: 80rem;
            margin: 0 auto;
        }

        {% if prompt.name == "signup" %} 
        .container {
            width: 100%;
            height: 100vh;
            display: grid;
            grid-template-columns: 1fr 1fr;
            align-items: center;
        }

        @media screen and (max-width: 720px) {
            .container {
                display: flex;
                flex-direction: column;
            }
        }

        .container > .info {
            max-width: 28rem;
            padding: 1rem;
        }
        {% else %}
        .container {
            width: 100%;
            height: 100vh;
            display: flex;
            align-items: center;
            justify-content: center;
        }

        .container > .info {
            display: none;
        }
        {% endif %}

        .container > .info h2.title {
            font-size: 3rem;
            line-height: 1.2;
            margin-bottom: 1.5rem;
            font-weight: bold;
        }

        .container > .info p.subtitle {
            color: #718096;
        }

        .container > .info ul {
            list-style-type: none;
            margin: 0;
            padding: 0;
        }
        
        .container > .info li {
            color: #1A202C;
        }

        .container > .info li svg {
            color: #5CC98D;
            vertical-align: text-bottom;
            margin-top: 1.5rem;
        }

        .container > .login-box {
            position: relative;
            display: flex;
            align-items: center;
            justify-content: center;
            padding: 0 4rem;
        }

        .container > .login-box svg {
            position: absolute;
            width: 100%;
        }
    </style>
  </head>
  <body>
    <div class="wrapper">
        <div class="container">
            <div class="info">
                <h2 class="title">My Product</h2>
                <p class="subtitle">My product is awesome and it offers the following features:</p>
                <ul role="list">
                    <li>
                        <svg stroke="currentColor" fill="currentColor" stroke-width="0" viewBox="0 0 24 24" focusable="false" role="presentation" height="1em" width="1em" xmlns="http://www.w3.org/2000/svg"><path d="m10 15.586-3.293-3.293-1.414 1.414L10 18.414l9.707-9.707-1.414-1.414z"></path></svg>
                        Feature 1
                    </li>
                    <li>
                        <svg stroke="currentColor" fill="currentColor" stroke-width="0" viewBox="0 0 24 24" focusable="false" role="presentation" height="1em" width="1em" xmlns="http://www.w3.org/2000/svg"><path d="m10 15.586-3.293-3.293-1.414 1.414L10 18.414l9.707-9.707-1.414-1.414z"></path></svg>
                        Feature 2
                    </li>
                    <li>
                        <svg stroke="currentColor" fill="currentColor" stroke-width="0" viewBox="0 0 24 24" focusable="false" role="presentation" height="1em" width="1em" xmlns="http://www.w3.org/2000/svg"><path d="m10 15.586-3.293-3.293-1.414 1.414L10 18.414l9.707-9.707-1.414-1.414z"></path></svg>
                        Feature 3
                    </li>
                    <li>
                        <svg stroke="currentColor" fill="currentColor" stroke-width="0" viewBox="0 0 24 24" focusable="false" role="presentation" height="1em" width="1em" xmlns="http://www.w3.org/2000/svg"><path d="m10 15.586-3.293-3.293-1.414 1.414L10 18.414l9.707-9.707-1.414-1.414z"></path></svg>
                        Feature 4
                    </li>
                    <li>
                        <svg stroke="currentColor" fill="currentColor" stroke-width="0" viewBox="0 0 24 24" focusable="false" role="presentation" height="1em" width="1em" xmlns="http://www.w3.org/2000/svg"><path d="m10 15.586-3.293-3.293-1.414 1.414L10 18.414l9.707-9.707-1.414-1.414z"></path></svg>
                        Feature 5
                    </li>
                </ul>
            </div>
            <div class="login-box">
                <svg width="1013" height="890" viewBox="0 0 1013 890" fill="none" xmlns="http://www.w3.org/2000/svg">
                    <path d="M180.462 795.681L40.8315 567.776C19.5801 533.09 8.95466 515.747 4.64446 497.091C0.831363 480.586 0.608543 463.413 3.99145 446.712C7.81567 427.835 17.9843 409.924 38.3214 374.102L184.235 117.101C203.682 82.8483 213.405 65.722 227.028 52.9648C239.084 41.6743 253.303 32.9153 268.81 27.225C286.332 20.7958 306.003 19.8141 345.345 17.8502L644.507 2.91668C685.874 0.851143 706.557 -0.18069 725.22 4.94606C741.731 9.48141 757.023 17.479 770.074 28.4042C784.827 40.7544 795.51 58.1913 816.877 93.066L955.838 319.878C977.009 354.434 987.595 371.712 991.91 390.3C995.728 406.747 995.98 423.86 992.649 440.515C988.883 459.337 978.815 477.215 958.678 512.969L811.011 775.156C791.315 810.127 781.466 827.612 767.593 840.563C755.316 852.023 740.811 860.86 724.997 866.515C707.127 872.905 687.074 873.638 646.968 875.103L350.229 885.943L350.228 885.944C309.449 887.433 289.06 888.178 270.689 882.944C254.434 878.313 239.396 870.318 226.557 859.48C212.045 847.23 201.517 830.047 180.462 795.681Z" fill="{{branding.colors.primary}}"/>
                    <path d="M179.711 769.196L58.7659 539.848C40.3585 504.942 31.155 487.489 28.2839 469.088C25.744 452.808 26.7984 436.065 31.3778 419.97C36.5543 401.778 47.9229 384.859 70.66 351.022L233.792 108.259C255.534 75.9041 266.405 59.7266 280.801 48.0099C293.543 37.6402 308.23 29.8499 323.963 25.1169C341.74 19.7693 361.233 19.8416 400.221 19.9857L696.692 21.0815C737.687 21.2325 758.184 21.3089 776.23 27.2798C792.194 32.562 806.699 41.1538 818.774 52.4806C832.423 65.2849 841.676 82.8321 860.183 117.928L980.548 346.176C998.887 380.95 1008.06 398.337 1010.94 416.674C1013.49 432.897 1012.46 449.584 1007.94 465.636C1002.82 483.778 991.558 500.669 969.023 534.451L803.775 782.175C781.734 815.216 770.713 831.737 756.054 843.629C743.084 854.153 728.106 862.004 712.074 866.687C693.957 871.978 674.104 871.643 634.398 870.973L340.624 866.016L340.623 866.016C300.251 865.335 280.065 864.994 262.316 858.934C246.611 853.572 232.358 844.996 220.486 833.765C207.067 821.072 197.948 803.779 179.711 769.196Z" fill="{{branding.colors.primary}}"/>
                </svg>
                {%- auth0:widget -%}
            </div>
        </div>
    </div>
  </body>
</html>
```

## Explore Your Own Designs

By the end of this article, you can now design and customize signup and login experiences with Auth0 that are as beautiful and user-friendly as the rest of your application. With the power of custom templates, you can integrate your brand's color palette, unique fonts, and more. I'd love to see the unique and effective login experiences you create! Please share screenshots or links in the comments below.

Thanks for reading!

Building Beautiful Login Pages with Auth0

How to authenticate and manage your business users in a multi-tenant app with Organizations.

<div class="alert alert-info alert-icon">
  <i class="icon-budicon-487"></i>
  <b>This tutorial uses the Auth0 Organizations feature, which is <a href="https://auth0.com/startups/vip"> available to early-stage startups </a>through our Auth0 for Startups program, free for one year.</b><br> 
</div>

## The Challenge

Developers on a tight schedule need to quickly implement a secure solution. You need to build a product with scalable infrastructure that can be iterated on weeks/months/years down the line. And you need to adhere to ever-changing industry standards and regulations.

<AmpContent>
<amp-youtube
    data-videoid="8s14Nhvgnb0"
    layout="responsive"
    width="480" height="270">
</amp-youtube>
</AmpContent>
<NonAmpContent>
<div class='embed-container' style="position: relative; padding-bottom: 56.25%; height: 0; overflow: hidden; max-width: 100%;margin-bottom:40px;"><iframe style="position: absolute; top: 0; left: 0; width: 100%; height: 100%;" src='https://www.youtube.com/embed/8s14Nhvgnb0' frameborder='0' allowfullscreen></iframe></div>
</NonAmpContent>

Building B2B applications comes with many technical challenges, not least of which is how to set up [multi-tenancy](https://auth0.com/docs/get-started/auth0-overview/create-tenants/multi-tenant-apps-best-practices). [Multi-tenancy](https://auth0.com/docs/get-started/auth0-overview/create-tenants/multi-tenant-apps-best-practices) is when a single instance of software runs on a server that is accessible to multiple groups of users – managing this across various business communities can be broken down into three different considerations:

* Customizing the login experience for each business, from branding to SSO options,
* Managing users for each business with restricted access based on specific permissions,
* And giving businesses the ability to manage their own members.

## The Solution

Auth0 Organizations is our solution to multi-tenancy from an auth perspective – it’s a feature for developers to manage business users. **Simply put, each business is an Organization. Each Organization has members. Each member can have roles that define their permissions.**

When users log into your application, how they log in depends on the requirements defined by each business. For example, let’s say you have three customers with varying needs:

* Organization A is a small business, so they’re comfortable with letting their members log in with Google or another preferred[ Social identity provider (IdP)](https://marketplace.auth0.com/features/social-connections);
* Organization B is a larger corporation, so they’re expecting to leverage not only[ Enterprise IdPs](https://marketplace.auth0.com/features/enterprise-connections) but also multi-factor authentication (MFA) as an additional layer of security;
* Organization C is a brand new startup with only one employee – the founder – and all they want is a seamless experience.

The typical app user needs to be able to log in to the app and do some basic tasks. All of your business customers also want to distinguish a role for Admins who have additional permissions, like sending invites to cool new members or kicking problematic members out.

![Your App](https://images.ctfassets.net/23aumh6u8s0i/4y486Q5HiJbXmlVq5k71pc/57ab4fbab5c49c769a442b8e781d624e/shreyapost.jpg)

## The Process

Let’s explore what a potential solution with Organizations would look like. (Check out the video for a visual walkthrough.)

### Get Started

1. Open your [Auth0 Dashboard](https://manage.auth0.com/dashboard)
2. Select your Application (left menu) and [configure it for business users](https://auth0.com/docs/manage-users/organizations/configure-organizations/define-organization-behavior)
3. [Create Organizations](https://auth0.com/docs/manage-users/organizations/configure-organizations/create-organizations) for each business customer
4. Enable Social and Enterprise [Connections](https://auth0.com/docs/manage-users/organizations/configure-organizations/enable-connections) and [MFA](https://auth0.com/docs/secure/multi-factor-authentication/enable-mfa)
5. [Create roles](https://auth0.com/docs/manage-users/access-control/rbac), [invite members](https://auth0.com/docs/manage-users/organizations/configure-organizations/invite-members) and [assign roles](https://auth0.com/docs/manage-users/organizations/configure-organizations/add-member-roles)

### Get Technical

Integrate this login experience into your React app (or [explore other SDKs](https://auth0.com/docs/libraries)). Follow the[ React SDK quickstart](https://auth0.com/docs/quickstart/spa/react/interactive) for detailed instructions.


1. Install the Auth0 React SDK

```
cd <your-project-directory>
npm install @auth0/auth0-react
```

2. Configure the Auth0 provider component

```js
import React from 'react';
import { createRoot } from 'react-dom/client';
import { Auth0Provider } from '@auth0/auth0-react';
import App from './App';

const root = createRoot(document.getElementById('root'));

root.render(
<Auth0Provider
    domain="{yourDomain}"
    clientId="{yourClientId}"
    authorizationParams={{
      redirect_uri: window.location.origin
    }}
  >
    <App />
  </Auth0Provider>,
);

```

3. Add login to your Application

```js
import { useAuth0 } from "@auth0/auth0-react";
import React from "react";

const LoginButton = () => {
  const { loginWithRedirect } = useAuth0();

  return <button onClick={() => loginWithRedirect()}>Log In</button>;
};

export default LoginButton;
```

4. Add logout to your Application

```js
import { useAuth0 } from "@auth0/auth0-react";
import React from "react";

const LogoutButton = () => {
  const { logout } = useAuth0();

  return (
    <button onClick={() => logout({ logoutParams: { returnTo: window.location.origin } })}>
      Log Out
    </button>
  );
};

export default LogoutButton;
```

5. Show user profile information

```js
import { useAuth0 } from "@auth0/auth0-react";
import React from "react";

const Profile = () => {
  const { user, isAuthenticated, isLoading } = useAuth0();

  if (isLoading) {
    return <div>Loading ...</div>;
  }

  return (
    isAuthenticated && (
      <div>
        <img src={user.picture} alt={user.name} />
        <h2>{user.name}</h2>
        <p>{user.email}</p>
      </div>
    )
  );
};

export default Profile;
```

6. If you need to retrieve the organization the user belongs to, you can use the property [`org_id` in the user object](https://auth0.com/docs/manage-users/organizations/using-tokens), for example you can add the following line of code:

```
<p>{user.org_id}</p>
```

### Go Beyond

Eventually, you may want to do more. You could:

1. [Require multi-factor authentication for users outside their corporate network](https://auth0.com/docs/customize/actions/flows-and-triggers/login-flow#enforce-custom-mfa-policy) to increase security,
2. [Assign default roles to users on sign-up](https://auth0.com/blog/assign-default-role-on-sign-up-with-actions/) or at another point in the identity flow,
3. And allow customers to self-manage their Organizations using an [admin portal](https://auth0.com/docs/get-started/architecture-scenarios/business-to-business/profile-management#admin-portal).

## The Next Step

Multi-tenancy is a common feature requirement for most B2B apps, but you shouldn’t have to spend all your time on building it. This is just the tip of the iceberg for what you can accomplish using Organizations. [Try it yourself for free](https://auth0.com/signup?utm_source=blog&utm_medium=auth0&utm_campaign=b2bsaas), and [let us know if you have any questions](https://community.auth0.com/)!

Are you an early-stage startup? [Apply now](https://auth0.com/startups/vip) to the Auth0 for Startups program, which is **free for one year** and supports 100 Organizations in prod (and much more).

## More Resources

* Get started with our [React quickstart](https://auth0.com/docs/quickstart/spa/react/interactive)
* Dive deep into the [Organizations docs](https://auth0.com/docs/manage-users/organizations)
* Read about [Solving Digital Identity Management for Your SaaS Application](https://auth0.com/blog/digital-identity-management/)
* Learn more about [Auth0 for Startups](https://auth0.com/startups)
* Ask questions in our [Community forum](https://community.auth0.com/)
* Don't have an app? Check out our [sample B2B app](https://github.com/auth0-developer-hub/auth0-b2b-saas-starter/)

[Open a ticket](https://support.auth0.com/tickets/new) for technical support (available for customers in the Startup plan or other paid plans)


Build a Secure and Scalable B2B SaaS App in React

Martin Walsh

As an Engineering Leader in Identity, Martin Walsh builds diverse, resilient, and high-performing Engineering teams that deliver great outcomes for customers. He spends his spare time with friends and family, working out, and reading.

Director, Engineering

How to create a better developer experience with SDKs that delight developers

When it comes to building SDKs, particularly in authentication and identity management, it’s not just about the code; it’s about crafting an experience. This is critical for SDKs aimed at popular programming languages and frameworks like Swift, Kotlin, .NET, Ruby, PHP, Javascript, React, Angular, Vue, and NextJS. A delightful developer experience revolves around providing an intuitive, idiomatic experience that allows for seamless integration with minimal code. 

At Auth0 by Okta, we have over 45 Auth0 open source [SDK Libraries](https://auth0.com/docs/libraries) and 35+ Quickstarts with samples, and we support 12 programming languages. In NPM alone, we have over 90 Million package downloads a month!

Having been part of that journey for seven years in roles ranging from Engineer to Director, I’ve compiled some guiding principles we use to create a developer experience that allowed us to achieve that spectacular growth – and keep growing.

## Understand the Developer's Mindset

Building a robust and powerful SDK is a good start, but it's far from the endgame. To truly support developers, you must deeply understand their perspectives, challenges, and aspirations. This level of empathy requires a nuanced approach, one that goes beyond engineering excellence to focus on delivering an intuitive and delightful user experience. Let's delve deeper into two essential aspects that help you connect better with developers: building empathy and applying contextual awareness.

### Empathy Over Engineering

Engineering is about solving problems, but empathy is about understanding which problems matter to developers and why. This awareness is fundamental when your target audience includes developers who engage with complex issues and often have to juggle multiple tools and SDKs.

#### Knowing the community

To offer something truly valuable, spend time embedded in the communities around each target programming language and framework. For example, participate in forum discussions, attend developer events or webinars, or engage with online communities. These avenues provide a wealth of information on developer needs, wants, and dislikes. If you’re fortunate enough to have a Developer Relations team, they can be a great partner in helping you learn more about the developers using your SDKs.

#### The developer signal

Listening to your developer community will help give you insight into pain points you should be mindful of, such as:

* **Complex installation:** Developers often dread complicated setup processes because they want to get started quickly.
* **Poor documentation:** A lack of clear, well-written documentation can turn an otherwise good SDK into a developer's nightmare.
* **Non-idiomatic APIs:** An API that does not conform to the common practices of a language can be challenging to work with.
* **Non-intuitive APIs:** An API that uses a lot of domain-specific jargon and assumes the developer must be an expert creates unnecessary barriers to use.
* **Cryptic errors:** Unclear errors make it difficult for the developer to troubleshoot issues effectively.
* **Lack of flexibility:** SDKs that are rigid in their functionality can force developers into workarounds, creating unnecessary friction.
* **Inadequate support:** Slow or non-responsive support channels can be a serious obstacle, especially when developers are under deadlines.
* **Security concerns:** With authentication SDKs, unclear methods for handling tokens or encryption can generate distrust.

It’s important to acknowledge your pain points. We take a holistic approach to tackling the overall developer experience. We quickly fix issues while deliberately evolving each SDK to reflect on the previous version and move the needle with the next version.

### Contextual awareness

It's easy to underestimate the importance of feeling "native" to a particular programming language or framework. Developers are often deeply connected to the languages they work with. Beyond appreciation, developers are already familiar with the idioms and patterns of their native language or framework, which they use daily. A library that does not speak that same "language" and uses different ways of doing things requires a higher cognitive load. Reduce the load and be idiomatic.

#### Adapting to language conventions

When working with one language, your SDK might employ higher-order functions and optional types to align with the focus on safety and expressiveness. In contrast, another language of the same SDK might prioritize asynchronous methods and leverage dynamic typing.

#### Design patterns

Understanding common design patterns in each language can guide the architecture of your SDK. For instance, the [Observer pattern](https://en.wikipedia.org/wiki/Observer_pattern) is prevalent in JavaScript frameworks, while we often see the [Model-View-View Model](https://en.wikipedia.org/wiki/Model%E2%80%93view%E2%80%93viewmodel) (MVVM) in Swift and Android Kotlin.

#### Testing and tooling

Remember to provide tools and scripts familiar to developers in their environment. For example, integrating with popular tools like Webpack or Babel is almost a given if you're targeting Javascript ecosystems.

By applying contextual awareness, you show developers that you speak their language—literally. It fosters a sense of belonging and trust, key ingredients in turning users into advocates for your SDK.

### Listen to developers. Don’t assume

Empathy and contextual awareness are not mere buzzwords but guiding principles for creating SDKs that resonate with developers. They bridge the gap between what is technically possible and genuinely useful, creating an environment where both the SDK and the developers can thrive.

#### Example: Authenticating and returning an access token

A typical scenario for mobile developers in identity is an end user authenticating and an Access Token being returned. It seems simple enough, so, in theory, it shouldn’t be a problem for the developer.

Let’s add another step: you want to authenticate once and forget with mobile. To achieve this, we use refresh tokens to retrieve a fresh access token. Okay, this seems simple enough and perhaps something the developer should do, shouldn’t they? I’m an identity developer, and it seems simple to me.

We got feedback that it wasn’t as simple as we thought. Developers were creating solutions that may not be high-performing and, worse, lacked security best practices. 

We hadn’t set our developers up for success because we assumed a certain level of identity knowledge. Why should our developers have to know about identity? They shouldn’t.

To simplify the process, I created a utility class as an experiment and bundled it with the SDK to take care of the Token Management life cycle and securely store all tokens. All the developer had to do was say, “Give me an AT (Access Token),” and have confidence in returning a valid AT without being concerned with what was happening under the hood.

This experiment became one of our most beloved SDK features because it addressed developer pain points.

![Create Quickstart Guides and Boilerplate Code](https://images.ctfassets.net/23aumh6u8s0i/4CwkOwiiy1BCqn6ujWqcHH/869a036997c632bd7ec1d5a05d013a56/what_is_an_sdk_sep1.jpeg)

## Create Quickstart Guides and Boilerplate Code

When it comes to working with SDKs, common pain points for developers include:

* Having to sift through poorly organized or overly verbose documentation.
* Being overwhelmed with options and ending up with analysis paralysis.
* Encountering inconsistencies in guides, code examples, or SDK interfaces.

[Quickstart guides](https://auth0.com/docs/quickstarts) and easy-to-follow code samples can help address these pain points and create a positive developer experience.

A quick start guide serves as a brief, focused introduction to your SDK. It aims to take developers from zero to their first successful authentication call as swiftly as possible. You should create specific guides for each programming language and framework your SDK supports.

### How to craft a successful quick start guide

Here are a few points to consider when creating tutorial content:

* **Provide language-specific instructions**: Tailor your guide to the idioms and best practices of the target programming language.
* **Create step-by-step walkthroughs**: Break down the process into easy-to-follow steps, preferably accompanied by screenshots or GIFs.
* **Include boilerplate code**: Provide snippets of functional code that the developer can copy-paste to see immediate results.
* **Validate, don’t assume**: Test the quick start guide in real-world conditions. Ask for feedback from internal developers or, even better, from external community members. You are not your customer.

### Sample code: Your SDK's first impression

Sample code is usually the first interaction a developer has with your SDK. It should be:

* **Minimal**: Only the essentials to get started.
* **Functional**: It should compile and run without errors.
* **Commented**: Brief comments explaining each line or section can be invaluable.

When thoughtfully crafted and easy to use, sample code can reduce the time it takes developers to learn how to integrate your SDK and use it effectively.

## Simplify Dependency Management

> It’s essential to ensure easy access to your SDK with a simple entry point.

When working with dependencies, common challenges that developers face include:

* Complex installation processes involving multiple steps.
* Dependency conflicts with existing libraries or versions.
* Unclear or outdated instructions for package management.

Here are some tips to simplify dependency management:

* **Leverage native package managers**: Native package managers such as CocoaPods for Swift, npm for JavaScript, or NuGet for .NET  resolve dependencies automatically and are familiar tools for developers.
* **Use simple import statements**: Initializing your SDK should be as straightforward as importing a single line of code once installed.
* **Use clear version management**: Make it easy to switch between different versions of the SDK – clearly state which versions are stable, in beta, or deprecated.

By tackling these pain points head-on and simplifying the entry point to your SDK, you'll delight developers and foster faster adoption and more meaningful engagement with your product. After all, a happy developer is a productive developer, so aim to make their life easier from the start.

![Minimize Friction through Excellent Documentation](https://images.ctfassets.net/23aumh6u8s0i/3ovyxvZGWIfQm234oYlkgN/f3c2daac9bdb0d4873e80e0f978facf8/what_is_an_sdk_sep2.jpeg)

## Minimize Friction through Excellent Documentation

Well-crafted documentation effectively reduces the learning curve, enabling developers at all levels to integrate the library into their projects with greater ease and efficiency. 

### Well-documented methods and functions

While self-explanatory code is essential, having well-documented methods and functions elevates an SDK's usability, especially in the sensitive authentication realm. Documentation should go beyond mere comments in the code. Each method and function should be clearly described in the official documentation, outlining its purpose, parameters, return values, and possible exceptions or errors. This level of instruction provides developers with a comprehensive understanding of how to best utilize each piece of the SDK, ensuring functional and secure implementations.

### Comprehensive API documentation within the SDK

Rather than relying solely on external resources, integrate high-quality API documentation directly within the SDK itself. This documentation should be easily accessible and navigable, allowing developers to quickly find relevant information without having to switch contexts. Features could include examples of API requests and responses. By embedding this level of detail into the SDK, you offer developers a one-stop shop for all the knowledge they need to integrate and troubleshoot effectively, enhancing their overall experience and productivity.

## Leverage the Power of the Community

The community around an SDK can be as critical as the SDK itself. You can optimize this symbiotic relationship for everyone's benefit.

### Open Source contributions

Creating an SDK that delights developers is a technical challenge and a community-building exercise. By simplifying the entry point and actively involving the community, you make your SDK more robust and user-friendly and cultivate a loyal following that can last for years. The result is a continuously refined product, widely adopted and highly respected.

Here are some tips to increase developer engagement:

* **Use an easily accessible repository: **Your GitHub or GitLab repository should be easy to find, fork, and contribute to. Well-structured README files and documentation should guide newcomers.
* **Create clear contributor guidelines: **Explain how developers can contribute, what coding standards to follow, and how pull requests are reviewed.
* **Implement a robust review process:** This ensures the quality of community contributions while providing educational value back to the community. Effective code reviews can become learning opportunities for everyone involved.
* **Be curious**: If a developer raises an issue, get curious and figure out the problem they are trying to solve. Is someone doing something unexpected? That could be a gap in documentation vs presuming developer error.

## Streamline Developer Onboarding

When you invest time and resources into understanding your developer audience's sources of frustration, you can use that knowledge to build a better SDK onboarding experience for them that avoids common pitfalls.

### Exception handling and debugging

Developers expect to deal with error messages and debugging. Giving them the information and context to do something with the error messages makes debugging significantly easier and more intuitive.

#### Common Pain Points

* **Cryptic error messages**: Obscure, generic, or overly technical error messages are frustrating and can hinder debugging efforts
* **Lack of debugging information**: Often, error logs don’t provide enough contextual data, making it difficult for developers to identify the root cause.
* **Inconsistent exception types**: Different types of exceptions thrown for similar kinds of errors can be confusing.

#### The Opportunity

* **Descriptive error messages**: Provide a human-readable and explicit error message whenever an exception is thrown. For example, instead of saying "Authentication failed," say "Authentication failed: Invalid OAuth token."
* **Contextual information**: Along with the error message, provide additional details like which function or API call caused the exception, relevant IDs, timestamps, etc. This context can help developers debug issues much faster.
* **Exception handling guidelines**: Maintain consistent exceptions and document them thoroughly. Include examples showing how to catch and handle these exceptions in various programming languages.

#### Code Modularity and Flexibility

* **Modular design:** Structure the SDK to enable selective import of modules, reducing bloat and optimizing performance.
* **Loose coupling: **Architect components to minimize dependencies, simplifying updates and maintenance.
* **Extensibility:** Design the SDK for adaptability, with hooks and interfaces for developers to customize and extend functionalities, aligning with specific project needs.

In essence, the effectiveness of an SDK is significantly enhanced by focusing on accessible, real-world tutorials and by designing for modularity and flexibility, catering to the diverse needs of the developer community and fostering an environment of innovation and efficiency.

![Developer Experience is Worth the Investment](https://images.ctfassets.net/23aumh6u8s0i/10vNfM1MrOlWCv6uHP2gtG/0d77df8932d739e39e1548ed5ab035f5/what_is_an_sdk_sep3.jpeg)

## Developer Experience is Worth the Investment 

The concept of "delighting" developers is not merely an aesthetic or superficial goal. A well-crafted SDK becomes a significant strategic asset in a landscape where developer attention and mindshare are increasingly valuable commodities. Investing in a delightful developer experience is mutually beneficial and impactful for developers and businesses.

### Builds brand ambassadors

A delighted developer is more likely to share their positive experience within their network. In a community where word-of-mouth has tremendous value, these developers become natural ambassadors for your SDK and, by extension, your brand. A recommendation from a trusted peer can often have a more significant impact than any marketing strategy.

### Facilitates rapid adoption and innovation

A well-designed, intuitive SDK accelerates the onboarding process, allowing developers to go from discovery to integration swiftly. This saves time and makes it easier for developers to innovate, fueling a faster development and deployment cycle. The quicker developers integrate and deploy, the faster they can respond to market demands and opportunities, giving businesses a competitive edge.

### Decreases support costs

A clear, intuitive developer experience minimizes errors, leading to fewer support tickets and reduced burden on customer service. Comprehensive documentation and community engagement further alleviate these costs. With developers able to find answers quickly on their own or through community channels, the business can allocate support resources to more complex, high-priority issues.

### Improves SDK quality and lifecycle

Being open source means developers can actively contribute to your SDK, pointing out flaws, suggesting enhancements, and even fixing bugs. This crowdsourced approach to quality assurance can be incredibly beneficial. The developer community becomes an extension of your QA team, resulting in a more robust and reliable product over time.

### Attracts and retains talent

If your SDK gains a reputation for its excellent developer experience, it will also reflect positively on your organization. Talented engineers are more likely to want to work for a company that clearly values high-quality code and a user-centric approach, which will help you attract and retain top talent in the long run. It’s one of the reasons I joined Auth0 7 years ago.

### Drives revenue and growth

While an SDK might be open source and free to use, it can often be a gateway to other monetizable services and features. A user-friendly SDK can be a compelling entry point for developers who may transition to using your company's other premium or enterprise-level offerings.

Investing in a delightful developer experience is not just about making a good impression; it's about forging lasting relationships with the developer community. By providing an SDK that meets developers on their terms — intuitive, idiomatic, and integrated — you're creating a robust ecosystem that makes developers' lives easier and contributes directly to your business objectives. The aim is to create a win-win situation where developers are empowered and the business thrives — a compelling reason to make your SDK as delightful as possible.

Guiding Principles for Building SDKs

jimena-garbarino

Jimena is an experienced result and value-oriented programmer with a strong engineering background. She excels with Ruby on Rails, Java, and Scrum development. She has worked in web development for 10+ years in many industries and has a master's degree in software engineering from Universidad de Buenos Aires.

Spring Cloud Developer

Jimena Garbarino

A step-by-step guide for building a secured GraphQL API with Spring Boot and Auth0 authentication in React

How to Build a GraphQL API with Spring Boot

matt-raible

Matt Raible is a well-known figure in the Java community and has been building web applications for most of his adult life. For over 20 years, he has helped developers learn and adopt open source frameworks and use them effectively. He's a web developer, Java Champion, and Developer Advocate at Okta. Matt is a frequent contributor to open source and a big fan of Java, IntelliJ, TypeScript, Angular, and Spring Boot. 

Developer Advocate

Matt Raible

Learn how to build a secure CRUD app with Spring Boot and Angular. You'll use Auth0 for authentication and authorization and Cypress to verify it all works.

Build a Beautiful CRUD App with Spring Boot and Angular

This tutorial shows you how to build a microservices architecture with Spring Boot and Spring Cloud.

Java Microservices with Spring Boot and Spring Cloud

A walk-through of building a microservices architecture with JHipster, Keycloak, Auth0, and Google Kubernetes Engine (GKE) deployment.

Identity in Spring Boot with Kubernetes, Keycloak, and Auth0

apollo (1)

I am a Software Engineer who has taught over 1,000 developers how to code.

I love learning about new technology and making things!

Mark Halpin

Learn the basics of FastAPI, how to quickly set up a server and secure endpoints with Auth0.

Build and Secure a FastAPI Server with Auth0

React is one of the most popular JavaScript frameworks, and Spring Boot is wildly popular in the Java ecosystem. This article shows you how to use them in the same app and secure it all with Okta.

Use React and Spring Boot to Build a Simple CRUD App

Learn how to build a Spring Boot application that authenticates against Okta and Auth0 with Spring Security's SAML support.

Get Started with Spring Boot and SAML

andrew-hughes

Andrew is a senior web app developer with 15+ years of experience and solid expertise with React, Node, and React Native, as well as tons of SQL/NoSQL knowledge. He has performed complicated back-end API integrations for clients, including payment platforms like Stripe and PayPal along with InfusionSoft and WordPress. His extensive professional background also includes working with PHP, Laravel, Java, and Swift/iOS.

Andrew Hughes

Create a CRUD (create, read, update, and delete) application using Spring Boot and Vue.js.

Build a Simple CRUD App with Spring Boot and Vue.js

This tutorial will guide you in building a React application protected by Auth0 following a tests-first approach.

Testing your React application is important to ensure your code works as intended. But what if you're using Auth0 to protect your application?

In this blog post, you'll learn to follow TDD (Test-Driven Development) to protect a React application with Auth0. We'll go over what you need to do to set up your tests and provide some tips on how to get the most out of them.

So if you're ready to learn how to unit test your Auth0-protected React app, read on!

## Why Should You Use Auth0 to Protect Your React Application?

Auth0 is an identity and access management service that helps you protect your application by providing user authentication, authorization, and security.

Auth0 eliminates needing to be an expert on identity protocols such as [OAuth 2.0](https://auth0.com/docs/protocols/protocol-oauth2) or [OpenID Connect](https://auth0.com/docs/protocols/openid-connect-protocol) and helps you secure your web application stack. With Auth0, integrating authentication and authorization with your app is a breeze - users are redirected to a [customizable login page](https://auth0.com/docs/authenticate/login/auth0-universal-login) when they want to log in. Once successful authentication occurs, [JWTs](https://auth0.com/docs/tokens/concepts/jwts) containing user information is sent back for verification.

Since Auth0 handles all of the authentication and authorization processes on the back end, you don't have to worry about coding your own login system. This makes it much easier to unit test your protected application as well.

## Bootstrap a React Application

Before the actual testing, you'll need to bootstrap a React application. To do this, you'll use Create React App. This tool is great for quickly getting a React development environment up and running.

To get started, open a terminal window and run:

```bash
npx create-react-app react-auth0-tdd
```

While NPM does its thing, you can start with the next step.

## Connect React with Auth0

The best part of using Auth0  is the ease of use. All you have to do to secure your application is follow these steps:

### Sign up and create an Auth0 application

If you haven't already, <a href="https://a0.to/blog_signup" data-amp-replace="CLIENT_ID" data-amp-addparams="anonId=CLIENT_ID(cid-scope-cookie-fallback-name)">sign up for a free Auth0 account</a>.

A free account offers you the following:

- 7,000 free active users and unlimited logins.
- [Auth0 Universal Login](https://auth0.com/universal-login) for Web, iOS & Android.
- Up to 2 [social identity providers](https://auth0.com/docs/identityproviders) like Google, GitHub, and Twitter.
- Unlimited [Serverless Rules](https://auth0.com/docs/rules/current) to customize and extend Auth0's capabilities.

During the sign-up process, you create something called an [Auth0 Tenant](https://auth0.com/docs/getting-started/the-basics#account-and-tenants), an isolated environment representing the product or service to which you are adding authentication.

After that, you need to create an Auth0 application.

Go to the Applications tab in your [Auth0 Management Dashboard](https://manage.auth0.com/) and click the "Create Application" button. Select "Single Page Web Applications" as the type of application you want to create.

### Configure your application

Once you create the application, go to its Settings tab. You'll need to configure three URLs in there:

- **Allowed Callback URLs**: The URL of your React app that users will be sent after they authenticate. This is typically `http://localhost:3000/` for local development. 
- **Allowed Logout URLs**: The URL where users will be redirected after they log out. This is usually `http://localhost:3000` for local development.
- **Allowed Web Origins**:  If you don't register your application URL in this field, your application will be unable to silently refresh the authentication tokens, and your users will be logged out the next time they visit the application or refresh the page. For development, you'd typically add `http://localhost:3000`

Once you save these settings, you can move on to the next step.

### Install the Auth0 React SDK

Now, we're ready to install the Auth0 React SDK. To do this, open a terminal window, navigate to your project directory, and run:

```bash
npm install @auth0/auth0-react
``` 

Now you're all set to start writing your application's code and tests.

## Using TDD to Build Your Application

Test-driven development (TDD) is a powerful and popular methodology for building software. It's based on the idea that you should write tests first, then write code to ensure those tests pass. This process helps developers create better code by designing test cases up front and streamlining the coding process.

In this section, you'll use TDD to build a simple application that uses Auth0 to authenticate and display information about a user.

You'll start by checking the UI renders a "Log In" button, so head to your `App.test.js` file and replace it with the following code:

```javascript
// src/App.test.js

import { render, screen } from '@testing-library/react';
import App from './App';

test('When the app starts it renders a log in button', () => {
  render(<App />);
  const loginElement = screen.getByText("Log In");
  expect(loginElement).toBeInTheDocument();
});
```

Next, you'll run the tests using the following command:

```bash
npm run test
```

And it should be no surprise if the test fails; after all, you haven't implemented the "Log In" button yet. But no worries, you'll do that next.

Replace the file `App.js` with the following content:

```javascript
// src/App.js

import './App.css';

function App() {
  return (
    <div className="App">
      <header className="App-header">
        <button>
          Log In
        </button>
      </header>
    </div>
  );
}

export default App;
```

With the button implemented, you can re-run the tests. This time the result should be `1 passed, 1 total`.

But the "Log In" button isn't doing anything yet. Let's make sure it works by using Auth0.

Head back to your `App.test.js` and replace the file with the new contents:

```javascript
// src/App.test.js

import { render, screen, waitFor } from "@testing-library/react";
import App from './App';

import { useAuth0 } from "@auth0/auth0-react";

jest.mock("@auth0/auth0-react");

describe("The Application Component in logged out state", () => {

  beforeEach(() => {
    useAuth0.mockReturnValue({
      loginWithRedirect: jest.fn(),
    });
  });

  afterEach(() => {
    jest.clearAllMocks();
  });

  test('When the app starts it renders a log in button', () => {
    render(<App />);
    const loginElement = screen.getByText("Log In");
    expect(loginElement).toBeInTheDocument();
  });

  test('It redirects the user to the Auth0 Universal Login page when the Log In button is pressed', async () => {
    const { loginWithRedirect } = useAuth0();

    render(<App />);
    const loginElement = screen.getByText("Log In");
    loginElement.click();

    // Expect that if we click the "Log In" button, the loginWithRedirect function gets called
    await waitFor(() => expect(loginWithRedirect).toHaveBeenCalledTimes(1));
  });
});
```

This time we added a new test "It redirects the user to the Auth0 Universal Login page when the Log In button is pressed", which validates that the function `loginWithRedirect` from the Auth0 React SDK is called at least one time after pressing the "Log In" button.

In this code snippet, we introduced a few new concepts; I recommend the following read if you want to familiarize yourself with [jest and mocking functions](https://jestjs.io/docs/mock-functions).

As it is required by `jest`, we had to first mock the Auth0 API using `mockReturnValue` at the beginning of each test suite.

Now if you run the test, you'll receive:

```text
The Application Component in logged out state
    ✓ When the app starts, it renders a log-in button (15 ms)
    ✕ It redirects the user to the Auth0 Universal Login page when the Log In button is pressed (1015 ms)

  ● The Application Component in logged out state › It redirects the user to the Auth0 Universal Login page when the Log In button is pressed

    expect(jest.fn()).toHaveBeenCalledTimes(expected)

    Expected number of calls: 1
    Received number of calls: 0
```

Which is exactly what we expected. Next, you'll make that "Log In" button work.

## Implementing Login with Auth0

Under the hood, the Auth0 React SDK uses [React Context](https://reactjs.org/docs/context.html) to manage the authentication state of your users. One way to integrate Auth0 with your React app is to wrap your root component with an Auth0Provider that you can import from the SDK.

Head to your `index.js` file and update its content as the following:

```javascript
// src/index.js

import React from 'react';
import ReactDOM from 'react-dom/client';
import './index.css';
import App from './App';
import reportWebVitals from './reportWebVitals';
import { Auth0Provider } from "@auth0/auth0-react"; // 👈 New code

const root = ReactDOM.createRoot(document.getElementById('root'));
root.render(
  <React.StrictMode>
    {/* 👇 New code */}
    <Auth0Provider
      domain="{auth0-domain}"
      clientId="{auth0-clientid}"
      authorizationParams={{
        redirect_uri: window.location.origin
      }}
    >
    {/* 👆 New code */}
      <App />
    {/* 👇 New code */}
    </Auth0Provider>
    {/* 👆 New code */}
  </React.StrictMode>
);

// If you want to start measuring performance in your app, pass a function
// to log results (for example reportWebVitals(console.log))
// or send to an analytics endpoint. Learn more: https://bit.ly/CRA-vitals
reportWebVitals();
```

The `Auth0Provider` requires you to provide the domain for your Auth0 tenant and the clientId for your Auth0 application. Both values are present in your [Auth0 Application's Dashboard](https://manage.auth0.com/#/applications), as shown below:

![You can retrieve the Auth0 domain and client id from the application's settings](https://images.ctfassets.net/23aumh6u8s0i/3y36XLQcKi70jWZBbROCBj/a4d6e4584cc7d29159893f9a7c56e51b/react-tdd-config.png)

After setting those two values in the code, all we have to do is to change the "Log In" button to enable the `onClick` event.

```javascript
// src/App.js

// 👇 New code
import { useAuth0 } from "@auth0/auth0-react";
// 👆 New code
import './App.css';

function App() {
  // 👇 New code
  const { loginWithRedirect } = useAuth0();
  // 👆 New code

  return (
    <div className="App">
      <header className="App-header">
        {/* 👇 Updated code */}
        <button onClick={() => loginWithRedirect()}>
        {/* 👆 Updated code */}
          Log In
        </button>
      </header>
    </div>
  );
}

export default App;
```

Now if you run your tests once more, you'll see both of them passing.

```text
 PASS  src/App.test.js
  The Application Component in logged out state
    ✓ When the app starts, it renders a log in button (11 ms)
    ✓ It redirects the user to the Auth0 Universal Login page when the Log In button is pressed (4 ms)

Test Suites: 1 passed, 1 total
Tests:       2 passed, 2 total
```

## Displaying the User’s Profile

So far, we have been able to test the application while in a logged-out state, but how would we go about testing the application after the user signs in, for example, to test if the user name is displayed correctly on the screen?

The simple answer is to continue mocking the `useAuth0` hook, altering the different properties we need for our test.

Let's start by writing a new test to validate if the "Log Out" button is present after the user signs in. Change the content of your `App.test.js` file by adding the following code:

```javascript
// src/App.test.js

...
// 👇 New code
describe("The Application Component in logged in state", () => {
  beforeEach(() => {
    useAuth0.mockReturnValue({
      isAuthenticated: true,
    });
  });

  afterEach(() => {
    jest.clearAllMocks();
  });

  test('When the app starts it renders a log out button', () => {
    render(<App />);
    const logoutElement = screen.getByText("Log Out");
    expect(logoutElement).toBeInTheDocument();
  });
});
// 👆 New code
```

Running the tests will now fail until we add the new "Log Out" button to the screen.

```javascript
// src/App.js

import { useAuth0 } from "@auth0/auth0-react";
import './App.css';

function App() {
  const { loginWithRedirect, logout, isAuthenticated } = useAuth0(); // 👈 Updated code

  return (
    <div className="App">
      <header className="App-header">
        {/* 👇 Updated code */}
        {isAuthenticated ? (
          <button onClick={() => logout()}>
            Log Out
          </button>
        ) : (
          <button onClick={() => loginWithRedirect()}>
            Log In
          </button>
        )}
        {/* 👆 Updated code */}
      </header>
    </div>
  );
}

export default App;
```

And when you check the tests again, all of them are passing.

```text
 PASS  src/App.test.js
  The Application Component in logged out state
    ✓ When the app starts, it renders a log in button (11 ms)
    ✓ It redirects the user to the Auth0 Universal Login page when the Log In button is pressed (4 ms)
  The Application Component is logged in the state
    ✓ When the app starts, it renders a log-out button (1 ms)

Test Suites: 1 passed, 1 total
Tests:       3 passed, 3 total
```

Finally, we'll validate that the user's name and email address are shown on the screen.

```javascript
// src/App.test.js

...
  beforeEach(() => {
    useAuth0.mockReturnValue({
      isAuthenticated: true,
      // 👇 New code
      user: {
        name: "Juan",
        email: "jc@example.com",
        picture: "https://avatar.com",
      },
      // 👆 New code
    });
  });
  
  ...

  test('When the app starts it renders a log out button', () => {
    render(<App />);
    const logoutElement = screen.getByText("Log Out");
    expect(logoutElement).toBeInTheDocument();
  });

  // 👇 New code
  test('It renders the user name and email address', () => {
    render(<App />);
    const userNameElement = screen.getByTestId("user-name");
    expect(userNameElement).toHaveTextContent('Juan');

    const userEmailElement = screen.getByTestId("user-email");
    expect(userEmailElement).toHaveTextContent('jc@example.com');
  });
  // 👆 New code
});
```

For the logged-in state, not only do we need to mock the authentication status with the `isAuthenticated` flag, but we also need to set the user information.

Once that's done, we can fix the UI to display such values and get the test passing.

```javascript
// src/App.js

import { useAuth0 } from "@auth0/auth0-react";
import './App.css';

function App() {
  const { loginWithRedirect, logout, isAuthenticated, user } = useAuth0(); // 👈 Updated Code

  return (
    <div className="App">
      <header className="App-header">
        {isAuthenticated ? (
          // 👇 Updated code
          <div>
            <h2>User:</h2>
            <p data-testid="user-name">{user.name}</p>
            <h2>Email:</h2>
            <p data-testid="user-email">{user.email}</p>
            <button onClick={() => logout()}>
              Log Out
            </button>
          </div>
          // 👆 Updated code
        ) : (
          <button onClick={() => loginWithRedirect()}>
            Log In
          </button>
        )}
      </header>
    </div>
  );
}

export default App;
```

Now the application displays the user name and email as well as the logged-out button.

Let's run the tests and see the final results.

```text
 PASS  src/App.test.js
  The Application Component in logged out state
    ✓ When the app starts, it renders a log in button (12 ms)
    ✓ It redirects the user to the Auth0 Universal Login page when the Log In button is pressed (4 ms)
  The Application Component is logged in the state
    ✓ It renders a log-out button (2 ms)
    ✓ It renders the user name and email address (3 ms)

Test Suites: 1 passed, 1 total
Tests:       4 passed, 4 total
```

Congrats! But before you leave this tutorial, there's another more thing you'll have to do, and that is user testing.

So far, all tests you run on the application are unit tests. Even though they are great for validating functionality, they don't verify that the integrations are working or set up correctly. For example, we mocked the Auth0 API to return the data we would expect if everything was fine. Still, we don't validate if the given Auth0 Domain or Client ID is correct or if the configuration on the Auth0 dashboard is appropriately set.

For that, you can write integration tests or perform manual tests by running the application on the browser.

To test your application manually, go to your terminal and start the app by running the following:

```bash
npm run start
```

Visit `http://localhost:3000`, click the login button, and sign up for a new test user if you don't have one. After you're done, you'll be redirected back to the application where your name is displayed.

| ![Application's start page](https://images.ctfassets.net/23aumh6u8s0i/1ueiE6uYH8ig9Vs6EJ0HVd/5a5f5598a90b091c68ced31c0c163cfe/react-tdd-1.png)|![Auth0 Universal Login Screen](https://images.ctfassets.net/23aumh6u8s0i/7h6l4mzkJvj4SMgIPxqq8J/12ee1f571be10baf746ba5404e0232d2/react-tdd-2.png) | ![Application's user information screen](https://images.ctfassets.net/23aumh6u8s0i/1ZUiCCpbIYKAtsKapLnSB5/9a623efc3daa63d0018be195808a5b7e/react-tdd-3.png) |
| --- | --- | --- | 

## Conclusion

In this tutorial, you have implemented user authentication to identify your users and get user profile information in React following the TDD process to ensure that our code is well-tested.

This tutorial covered the most common authentication use case for a React application, and to keep it simple, we took some shortcuts, like working off a single component.

If you want to learn more about the possibilities of Auth0 with React, please check the [React Authentication by Example Guide](https://developer.auth0.com/resources/guides/spa/react/basic-authentication).

Let me know in the comments below what you think of this tutorial.

Thanks for reading!

Unit Testing Your Auth0 Protected React Application

Use Jakarta EE 10 to build a secure Java web application using OpenID Connect and Auth0.

Use Jakarta EE 10 with OpenID Connect Authentication

joey devilla headshot 900px

I’m a Senior Developer Advocate at Auth0, and I like to work on various technologies. I’ve developed software for all sorts of platforms, from CD-ROM and the PalmPilot to my current area of focus, mobile phones, IoT devices, and AI. When I’m not looking for strange new platforms to write software for, I’m playing a strange old instrument — the accordion!

Senior Developer Advocate

Joey deVilla

Learn how to build a basic app using Android’s Jetpack Compose UI toolkit.

Get Started with Jetpack Compose Authentication, Part 1: Jetpack Compose Basics

Use JHipster to build a photo-sharing app for web and mobile that has a React front-end with OIDC authentication and a Spring Boot back-end with OAuth2 authorization.

Integrate React Native and Spring Boot Securely

Learn about the essential features of the Auth0 Flutter SDK and how it helps developers build and secure Flutter iOS and Android applications.

Today we are announcing the release of the [Auth0 Flutter SDK](https://pub.dev/packages/auth0_flutter), a new SDK that makes it easy to secure Flutter applications with Auth0. Whether you need to secure access to an iOS or Android application, the Auth0 Flutter SDK got you covered!

The new Flutter SDK builds on a strong foundation by wrapping our existing and robust [Auth0.Android](https://github.com/auth0/Auth0.Android) and [Auth0.swift](https://github.com/auth0/Auth0.swift) libraries while focusing on the developer experience first.

Our SDK team optimized the Auth0 Flutter SDK for quick integration into your applications and for flexibility to accommodate simple and advanced use cases.

Since the introduction of [Flutter 3](https://medium.com/flutter/introducing-flutter-3-5eb69151622f), the framework allows for building cross-platform applications, extending from mobile applications to desktop applications and platforms. Our SDK allows for extension in such platforms by leveraging federated plugins, which means you can easily add support for other platforms without forking the SDK.

## Auth0 Flutter SDK Features

The new SDK offers features for multiple use-cases and complexity, going from magically getting the job done to providing a rich set of APIs enabling you to build your authentication flow per your specific requirements.

Let's explore the essential features of the Auth0 Flutter SDK that enable developers to do more:

- ⚡️ Quick implementation of login, logout, and automatic storage and renewal of tokens functionality into Flutter apps using WebAuth and the [Auth0 Universal Login](https://auth0.com/docs/authenticate/login/auth0-universal-login) page.
- ⚙️ For more advanced use-cases, developers have access to the [Authentication API](https://pub.dev/documentation/auth0_flutter/latest/auth0_flutter/AuthenticationApi-class.html), which at the time of release supports:
	- Logging in with a username or email and password
	- Signing up new users
	- Getting user information from `/userinfo`
	- Renew tokens
	- Reset passwords
- 🔐 Auth0 provides a default instance of [Credentials Manager](https://pub.dev/documentation/auth0_flutter/latest/auth0_flutter/DefaultCredentialsManager-class.html) that automatically stores the user's credentials. If you need your own solution for handling credentials, you can create your own [custom credentials manager](https://pub.dev/documentation/auth0_flutter/latest/auth0_flutter/CredentialsManager-class.html).
- ➕ And more [advanced features](https://pub.dev/packages/auth0_flutter#advanced-features) like accepting user invites, login into organizations, and bot detection.

## Requirements

The Auth0 Flutter SDK doesn't require any other library to work. However, there are SDK version and platform requirements for your project:

<table style="width:100%" cellspacing="2" cellpadding="5">
    <thead>
        <tr style="border-bottom: solid 1px">
            <td>**Flutter**</td>
            <td>**Android**</td>
            <td>**iOS**</td>
        </tr>
    </thead>
    <tbody>
        <tr>
            <td>SDK 3.0+</td>
            <td>Android API 21+</td>
            <td>iOS 12+</td>
        </tr>
        <tr>
            <td>Dart 2.17+</td>
            <td>Java 8+</td>
            <td>Swift 5.3+</td>
        </tr>
        <tr>
            <td></td>
            <td></td>
            <td>Xcode 13.x / 14.x</td>
        </tr>
    </tbody>
</table>

Check the [project on GitHub](https://github.com/auth0/auth0-flutter/tree/main/auth0_flutter#requirements) to for the most up-to-date set of requirements.

## Installing the SDK

The Auth0 Flutter SDK is distributed via [pub.dev](https://pub.dev/packages/auth0_flutter).

To add the SDK, run the following command from the root directory of your project:

```bash
flutter pub get auth0_flutter
```

## Adding Universal Login to Your Flutter Application

Adding the full-featured [Auth0 Universal Login](https://auth0.com/docs/authenticate/login/auth0-universal-login) authentication page to your application is easy with the SDK.

Please explore the [Flutter Quickstart guide](https://auth0.com/docs/quickstart/native/flutter/interactive) to see in detail how to set up your Flutter application to use the Auth0 SDK. For now, let's take a quick peak at how the Flutter SDK integration goes!

### Add login to your app

Integrate Auth0 Universal Login in your Flutter app by using the Auth0 class. Redirect your users to the Auth0 Universal Login page using `webAuthentication().login()`. This is a `Future` and must be awaited for you to retrieve the user's tokens.

```dart
await auth0.webAuthentication(scheme: 'YOUR CUSTOM SCHEME').login();
```

### Add logout to your app

Logging out users is as easy as calling the Auth0 Flutter SDK `webAuthentication().logout()` function. The `logout()` function is responsible for calling the `logout` endpoint to clear their login session and to clear the user login state from the device session.

```dart
await auth0.webAuthentication(scheme: 'YOUR CUSTOM SCHEME').logout();
```

## Next Steps

There are a lot of options to work with with the SDK, and in this post, we only barely scratch the surface of it. If you want to learn more about the SDK, please check out the [quick start guide](https://auth0.com/docs/quickstart/native/flutter/interactive) and the [SDK documentation](https://pub.dev/packages/auth0_flutter).

Thanks for reading!

Introducing the Auth0 Flutter SDK

Oliver Wang

A product manager at Auth0 focuses on  Ecosystem and Extensibility.  With an engineering background, Oliver always puts developers' experience first.  He has mixed industrial experience as a Product Manager, Software Engineer and Data Analyst. This diverse profile unites different team members to deliver value to our customers. Besides work, you can catch him up on a ski hill in the Canadian Rockies.

Product Manager, Ecosystem

Geoffrey Goodman

I am a curious and driven person. Until my early twenties, I was one of the top-ranked Canadian slalom skiers. While still competing, I pursued dual business majors at a Liberal Arts college in Nevada, funded by academic and athletic scholarships. I then joined EY in Montreal, where I worked with all of the four major service lines and earned my CA title. I now work with the Valuations and Business Modelling group and I am pursuing my CBV designation. 
<br>
I am also a self-taught computer programmer. I am comfortable in any number of programming languages. I built a website and steward a community of thousands of people across the world who rely on and benefit from its services every day.

Staff Engineer

Customers can now add custom prompts or factors in their post-login flow

We are excited to share that our customers that use Actions -  Auth0’s flagship extensibility product - can now add custom prompts or factors in their post-login flow. This enables developers and partners to confidently record the completion of a factor upon returning after a custom redirect. Auth0 delivers more tools, features, and options for developers to give them the support and capabilities they need to customize their customer’s experience through pro-code flexibility.

We have introduced a new method to the API of post-login Actions when continuing the flow after a successful custom redirect. This method allows a customer and/or partner to store the completion of that custom factor right in the user’s session. What is powerful about this is that they can then check whether that customer record is in a user session in each login and skip that prompt if it’s there already. Because it’s stored in the user session itself, it benefits from any current and future session management features within the Auth0 product offering.

## What Is the Problem We Are Solving?

Historically, there was no good way for customers to use Actions to securely implement custom prompts or custom factors in a user-friendly way. They could use user metadata or application metadata, but those objects exist across all user sessions. There was also no good way for customers or partners to see whether a user on a specific device had completed the necessary factors to login. This meant forcing users to re-perform the custom prompt or factor more often than necessary.

As an example, let's say you’re a developer for a banking app that has a special requirement to use a custom multi-factor authentication service, and you want that authentication to be associated with a user's session and or device for added security. That is where the ability to add a custom prompt enables you to build that customer experience and address that need.

## See It in the Real Example!

Let's take a look at a real example! Below is a sample Actions code for a Partner Integration implementing a custom authentication factor.

On the `onExecutePostLogin`, we trigger the custom authentication method by using Actions Redirect to send users to the customer method URL with session token information.

```js
const CUSTOM_METHOD_URL = "https://path.to.prompt";
const PROMPT_TTL = 1000 * 60 * 60 * 24; // 24h

exports.onExecutePostLogin = async (event, api) => {
    if (
        !event.authentication?.methods.some((record) => {
            // Timestamps are rendered as IS08601 strings
            const timestamp = new Date(record.timestamp);

            return (
                record.name === CUSTOM_METHOD_URL &&
                timestamp.value0f() >= Date.now() - PROMPT_TTL
            );
        })
    ){
        const sessionToken = api.redirect.encodeToken({
            payload: {
                user_id: event.user.user_id,
            },
            secret: event.secrets.SESSION_TOKEN_SECRET,
        });

        // Trigger our custom authentication method
        api.redirect.sendUserTo(CUSTOM_METHOD_URL, {
            query: { session token: sessionToken }
        });
    }
};
```

Continue with `onContinuePostLogin`, we validate the session token secret and record the completion of our custom authentication method.


```js
exports.onContinuePostLoqin = async (event, api) => {
    const payload = api.redirect.validateToken({
        secret: event.secrets. SESSION_TOKEN_SECRET,
        tokenParameterName: 'session_token'
    });

    if (!validateSessionToken(payload)) {
        return api.access.deny('Unauthorized');
    }

    // Record the completion of our custom authentication method.
    // THIS NEW API IS ONLY AVAILABLE IN 'onContinuePostLogin'
    api.authentication.recordMethod(CUSTOM_METHOD_URL);
};

function validateSessionToken(payload) {
    // Custom validation logic would go here
    return true;
}
```

Actions is an iterative platform we continually improve upon. [Start creating your Auth0 Actions](https://auth0.com/docs/customize/actions/write-your-first-action) today and customize your logic flow with the seamless low-code integration with Auth0!

New Actions Feature: Build Your Own Custom Factor

Nathan Chan

Nathan is a Sr. Solutions Engineer at Okta connecting the dots between technology and GSI partners. When not working, he is an avid fan of the New York Yankees.

Senior Solutions Engineer

Auth0 Actions and Integrations can combine to increase security and improve visibility

**TL;DR:** Last-mile customization can transform an out-of-the-box solid solution into the one you need for your business right now. But did you know that the same extensibility (the ability to write custom authentication workflows and integrate no-code third-party applications) can be used to increase security? You can use extensibility to create a layered defense. This post will show you how.

## Why You Should Build In Security

According to [the 2022 Verizon Data Breach Investigation Report (DBIR)](https://www.verizon.com/business/resources/reports/dbir/), 82% of security incidents involved a human element. Threat actors overwhelmingly rely upon social engineering and phishing attacks, not to mention simple everyday errors, in their quest to plunder company data. And so, identity is now the first line of defense. 

Identity plays a massive role in security. Customer Identity Access Management (CIAM) solutions like Auth0 are designed to strengthen your defensive posture with out-of-the-box security features, like the ability to detect brute force attacks and warn users when their credentials have been leaked. 

These features address the security needs of many companies. But no two businesses are the same. Some, particularly those in highly-regulated markets, need even higher levels of vigilance. Their threat profile requires them to introduce additional friction into the authentication process beyond what their CIAM platform offers by default. 

Auth0 makes it easy to add that protection. Because it's designed for extensibility, users can build custom functionality or create custom workflows by writing their own Actions or installing no-code integrations from the Auth0 Marketplace. In turn, businesses can create a robust, layered defense, allowing them to meet their own security needs.

This post will focus on the concept of a layered defense. We'll explain it on a high level and then look at the practical side of things. You'll learn how Auth0's extensibility features allow for the custom authentication workflows and rules that are fundamental to a layered defense. 


## What is a Layered Defense?

It's often useful to describe technical concepts with a real-world metaphor. Let's imagine you just bought a new house. It's beautiful. Your dream home, even. But there's a catch. It's a big one. As you unloaded your possessions from the moving truck, your new neighbor warned you about a recent spate of break-ins. You want to keep your family safe, so you begin adding new security features. 

Fortunately, the front door is made of thick, solid wood. Your windows are the strong double-glazed kind. And so, you look elsewhere to make changes. 

With boxes piled around your feet, you begin to install locks on your internal doors. A video doorbell and CCTV cameras come next. You deploy motion detectors around the ground-floor windows and even start thinking seriously about buying a dog. With each new security feature, your home becomes more resistant to burglars. You started from a good place, thanks to your solid wood doors and double-glazed windows. But you know that no security system is invulnerable. And so, you built upon those strong beginnings. 

In a business technology context, a layered defense involves taking the strong underpinnings of a product and enhancing them further. No security product is perfect. Risk levels vary between businesses, and some may be enticing enough to convince an attacker to systematically test your defenses in the hope of finding a weakness they can exploit.

As you add additional layers of security, introducing new surveillance and mitigation measures, you reduce the likelihood of an attacker finding a loophole. You introduce redundancies. If an attacker circumvents one protection, they're blocked by another. 

Let's return to the home example. Suppose a burglar smashes their way through your sturdy, double-glazed windows. They must still face the motion detection sensors, the CCTV system, and the dog. Their odds of successfully robbing your home while remaining undetected are still vanishingly thin. 


## Protect The Gateway, Protect the Application 

Risk varies wildly between industries. But it's also contextual. 

A logistics company might want to re-authenticate users when they perform a potentially-unauthorized action — like changing the delivery address of a package whilst it's in transit. Banks often will challenge users when they add a new payee or send a wire transfer to a new account. Many applications add friction when they detect suspicious behavior, like when a user logs in from a new location or from a new previously-unseen device.

There's a reason for this. Identity is the most logical place to add extra protections. It's a necessary component for accessing an application. It's the part responsible for session management. Identity is how you can block and revoke access.

CIAM tools like Auth0 make this process even easier, as they're inherently centralized. There's one place to look for suspicious login activity and one place to act. If you rely on a custom identity system, which in turn relies on several external components, it becomes a lot harder to take swift action against the potentially-harmful activity and even more time-consuming to add new security features. 

If you're curious, we've explored this issue at length in the past. On so many levels — but especially security — it makes more sense to [use a purpose-built CIAM tool over an in-house identity system](https://auth0.com/resources/whitepapers/build-vs-buy-evaluating-identity-management). For a deeper look into the build-vs-buy debate, check out [this white paper](https://auth0.com/resources/whitepapers/build-vs-buy-evaluating-identity-management).

Okta provides low-code and pro-code tools to build a robust, multi-layered, and context-aware defense. We also make it really easy. Read on to learn more about Auth0 Actions and Integrations and how they can combine to bolster your security posture.


## How Actions Power Your Layered Defense

Actions are small, tenant-specific scripts written for the Node.js framework that execute at specific points during the authentication workflow. They're a quick, effective, and versatile way to add custom functionality to the stock Auth0 platform. 

The Auth0 platform defines several contexts where an Action can be executed. We call these flows. Put simply; flows describe linear user interactions within an authentication context. Things like changing a password, creating a new user account, or logging in. 

Flows define the broader authentication and access control pipeline. They represent a linear user or machine interactions within an authentication. Examples include account creation, password changes, or logging in.

Within flows, you'll find something called 'triggers.' These identify specific parts of the pipeline where you can introduce custom business logic.

Flows are either blocking (synchronous) or non-blocking (asynchronous), depending on the context. In practice, the vast majority of the Actions-based layered defense measures will be blocked as you halt the authentication process until a specific condition is met. 

For a good example of this, look at the login flow. It's here you'll check the location or IP range of the user or ask them to verify their identity with multi-factor authentication (MFA).


## Putting Code First

The Auth0 platform treats code like a first-class citizen. In practice, this means we deliver a modern developer experience and try to limit the number of restrictions placed on customer Actions. 

Because Actions are proper node.js applications, they can use the majority of third-party libraries available within the public NPM registry, provided they don't rely on any native add-ons. In short, if a dependency doesn't require you to compile anything, it'll likely work. We support two ways of adding dependencies to an Action: through our web interface or via the Auth0 Management API. 

Developers can build Actions using their preferred text editor (Vim or Emacs, we don't judge). We also provide a browser-based editor with native syntax highlighting. And, because version control is at the heart of good software development, the Auth0 platform allows you to track changes over time and quickly revert to the last known good version of an Action. 

We designed Actions to be easy to test, debug, and audit throughout the entire lifecycle. Using the browser-based editor (or the Auth0 Management API), developers can test their actions using dummy payloads. This feature simulates real-world usage without the need to deploy the action to a live environment. 

The Auth0 platform also lets developers test the more granular elements of their application. Developers can run unit tests using the framework of their choice. Our documentation primarily focuses on Jest, the most popular JavaScript unit testing tool. This makes it easy to verify the bits of your code that don't primarily interact with the Auth0 platform, like custom logic that posts a Slack notification when a user fails to authenticate. 

Once an action is live, administrators and developers have access to tenant logs, allowing them to easily identify and debug failed interactions. Logs are hugely valuable from a security perspective. They act as the canary in the coal mine, warning when a third party is attempting to gain unauthorized access and providing valuable intelligence when investigating a security incident. 

But logs can also provide useful clues with respect to your application's usability and stability. We record failed sign-ups and machine-to-machine messages, along with the other typical user interactions, to provide engineers with vital diagnostic information. 


## The Rules for Writing Actions

In short, Actions are a really powerful way to introduce custom business logic to your identity. That said, to make sure everyone can take advantage of them, we have a few basic rules. 

We limit Actions to ten external dependencies, and each action should be no more than 100kb in size. This size limit excludes any external NPM modules. Additionally, each flow cannot exceed more than 20 attached actions. 

These rules are intended to ensure your users have a smooth experience. That's because larger, more complicated scripts add latency to your application. We, therefore, require every flow to complete in under ten seconds. Flows that exceed this limit are executed and will return an error.

Additionally, each Auth0 tenant is limited to a maximum of 100 actions. This number includes both deployed and undeployed actions. We also limit the number of versions to 50 per action. Should you exceed this figure, Auth0 will automatically delete the oldest available version. For more information, check out our guidelines.

Remember: Actions are designed to be small, purpose-built scripts. As any software engineer can (and will) tell you, simplicity is always better than complexity.


## A Look at Integrations

We've already introduced Actions. They're great for adding custom business logic to identity workflows. But what if you don't want to reinvent the wheel? Fortunately, Auth0 has a solution for that, allowing you to incorporate third-party services while limiting the need for custom code. 

Integrations are ready-to-use extensions that allow you to integrate third-party applications and services into your identity workflows. 

Let's put it another way. As a developer, you use libraries to work more effectively. These pre-written packages of code allow you to focus on building value. Libraries solve problems that millions of programmers face — like interfacing with databases, generating data visualizations, or sending emails and texts to customers. 

Integrations work the same way. They solve problems that you, and countless other engineers, face. Problems like how to share access logs with Splunk or Sumo Logic or how to verify identity documents and passwords. Like a programming library, Integrations are ready to use and, in many cases, can be implemented with just a click. 

You can find and install integrations from the Auth0 Marketplace. Each comes with helpful guidance on how to activate them within your tenant and the best practices for use. If you get stuck, you can find more information on our documentation page. 


## Building a Layered Defense Strategy with Actions

Okay, so we've explained what a Layered Defense strategy means and learned how to customize identity workflows within Auth0. Now let's look at some scenarios for how this could work in practice. 

The stock Auth0 experience comes with several security features by default. It automatically blocks suspected brute force attacks, as well as suspected bot activity. It warns users when their passwords appear on the dark web. It makes it easy to add features like multi-factor authentication (MFA), including biometric-based MFA.

Like the house in the earlier metaphor, Auth0 offers strong foundations to build upon. But what if you wanted to expand further?

A good start would be to require MFA for all users accessing your application beyond the confines of the company network. You also decide to block login attempts from specific countries where your business doesn't have a presence and are often the source of attempted attacks. After writing a few lines of code, you have an action that's ready and waiting to be attached to the login flow. 

You also decide to limit the potential window when a successful attack could occur by blocking authentication attempts that take place overnight. Again, this can be accomplished with just a few lines of code.

Context matters. It's the thing that lets you distinguish between legitimate and malicious activity. It's the tool that lets you evaluate risk. Just like a bank may temporarily block your debit card if you withdraw cash from a country you've never visited before, a layered defense strategy allows you to add friction based on the criteria that you define.

And because Auth0 Actions are JavaScript applications, you have the flexibility to define the circumstances where you may wish to add friction or even deny access. 


## Bringing Integrations Into the Mix

Auth0 is one of many security tools your business relies on. You use a SIEM platform to manage, retain, and analyze logs. As your application is built with a microservices architecture, you rely upon a gateway to manage API requests and identify malicious activity. You use a mobile device management (MDM) system to keep track of company-issued laptops and smartphones. 

Naturally, you want to integrate these tools into your identity platform. And so, you head to the Auth0 marketplace. With just a few clicks, the security tools you use are working together in harmony. 

And, because Auth0 allows you to customize most parts of the identity lifecycle, from registration to authentication, developers quickly add additional functionality and quickly onboard new third-party products and services. For example, they could implement sophisticated behaviors that minimize the risk of fraudulent or malicious account creation. 

We make it easy to integrate your application with tools like Deduce, a behavioral intelligence platform that detects suspicious user activity in real-time. And, with a few lines of code, developers can redirect flagged accounts to services like ID DataWeb, where users are asked to prove their identity with their passport or driving license.

With each step, you add another layer to your defensive posture. You become stronger. More resilient. Better able to withstand threats. Less attractive to a would-be attacker. 


## You Know Your Risk Best

Don't get us wrong — Auth0 is designed to deliver the best security outcomes from Day One. Its [out-of-the-box security features](https://auth0.com/blog/how-auth0-makes-your-apps-more-secure/) can protect against brute force and credential stuffing attacks, and we actively monitor for suspicious or anomalous behaviors. 

But we also know that every company is different, with different risks and compliance requirements. And so, we make it easy to customize the included security features and add new functionality and friction beyond that. Flexibility goes hand-in-hand with security. Only you know the risks you face and the measures you need to take in order to protect your application, your data, and your users. 

Want to keep the conversation going? [Reach out to our team](https://auth0.com/contact-us) to learn more about how Actions and our network of integrations can help secure your business while delivering an unbeatable user experience for your customers and employees.

How To Build A Layered Defense By Extending Auth0

asehmi

I work with a few tech start-ups providing technical strategy and product development advice and seed investment. I've rediscovered the joys of hands-on software development and actively engage with various developer communities to learn myself and educate sharing what I know. Previously, I was CIO at Oxford Economics for 10 years bringing 25 years’ prior experience in capital markets and high-technology software industries, enterprise software architecture and solutions development. Before that I spent eight years at Microsoft as a global business manager and award-winning software architect and technical evangelist. <br>
Earlier in my career, I was CTO at a start-up building advanced social media analytics products followed by a couple of years as an executive coach and mentor, and IT change management and strategy consulting to a number of small and medium sized businesses.

Startups Strategy Advisor

Arvindra Sehmi

In this article, I will show you how to build a Streamlit Component to authenticate users in Streamlit applications and external APIs with Auth0.

Streamlit User and API Authentication with Auth0 Next.js SDK

alexa-bio

Alexa is a Product Marketing Manager on the Auth0 platform team. With a partner and product marketing background, she is focused on growing our marketplace ecosystem working closely with new and existing partners.

Product Marketing Manager

Alexa Jacky

See all the exciting integrations our ecosystem partners are building

We’re excited to continue adding new partner integrations to our Marketplace. Our catalog is continuing to grow, meaning you have more options to choose from for integrating with Auth0. Our partners are continuing to discover and explore opportunities to build and solve a growing list of use cases and scenarios.

Check out the latest to hit our Marketplace this month. 

![DataGrail](https://images.ctfassets.net/23aumh6u8s0i/1bBFkW3AgNb2IFDYnCiwB5/05578365948862ca866434fb0635ab83/01_DataGrail.png)

## DataGrail
**[DataGrail](https://www.datagrail.io/)** is a privacy management platform for building consumer trust and eliminating risky business. The DataGrail integration enables continuous data discovery, automated data subject requests, and unified preference management, making it easier for brands to automate and scale their privacy programs. Using the integration, data stored in Auth0 can be acted on to quickly process DSRs (access, deletion, and do-not-sell requests) and comply with global privacy regulations like GDPR, CCPA, and CPRA. 

![Iuncta](https://images.ctfassets.net/23aumh6u8s0i/6SeszEUG2Z4nNf06fTvyGg/a0a3c6b14389f273eeab8b3b333587dc/02_Iuncta.png)

## Iuncta
**[Iuncta](https://iuncta.io/)** is a privacy-first social login that gives users more control over the access and sharing of their profile data. Its decentralized identity implementation allows users to act as their own identity provider online, which introduces a more transparent profile data sharing model. With its hybrid architecture, users can quickly and easily offer an enterprise-grade password-less authentication solution with an intuitive consumer-ready experience supported by the mobile app. The Iuncta platform enables user identity on demand, which streamlines onboarding and facilitates effortless digital interactions between users and integration partners. 

![MDR ONE](https://images.ctfassets.net/23aumh6u8s0i/7tWp2TgVztBTmeyQlJYKKw/30738b78ecf9a810386452f03687c284/03_MDR_ONE.png)

## MDR ONE
[Kudelski Security’s](https://kudelskisecurity.com/services/mdr-one/) **[MDR ONE](https://marketplace.auth0.com/integrations/mdr-one)** integration uses an advanced set of detection rules to provide widely recognized threat hunting and detection and response capabilities for Auth0. Kudelski Security is a global provider of tailored cybersecurity solutions for large enterprise and public sector clients. By offering a unique combination of consulting, technology, and managed services, the MDR ONE integration enables organizations to continuously evaluate security posture and recommends solutions that reduce business risk, maintain compliance, and increase overall security effectiveness.

![Snow Atlas](https://images.ctfassets.net/23aumh6u8s0i/6WiPsDji9U58nKxQUrl4Bu/21166544a6ab0ac5dcada099052c04a6/04_Snow_Atlas.png)

## Snow Atlas
The **[Snow Atlas](https://marketplace.auth0.com/integrations/snow-software-snow-atlas-sso)** integration—the technology intelligence platform from Snow Software—provides comprehensive visibility and contextual insight across software, SaaS, hardware, and cloud. The Snow Atlas SSO integration enables customers to sign in using Auth0 for single sign-on. For Snow Atlas customers, enabling single sign-on is as easy as adding Auth0 to their tenant and entering credentials, with the option to configure additional items such as organizational restrictions and automatic user provisioning.

![Web3Auth](https://images.ctfassets.net/23aumh6u8s0i/6QVaPFNZhamiPtICV1AwOr/1dcf279df66357e2b8eb9f34467dbe12/05_Web3Auth.png)

## Web3Auth
The **[Web3Auth](https://marketplace.auth0.com/integrations/web3auth)** integration on Auth0 allows organizations to provide and connect their users with self-custodial wallets, enabling applications to connect to any blockchain. Customers can use existing Auth0 login flows in a self-customizable manner, with no need for seed phrases or directly interfacing with vulnerable public-private key pairs. Web3Auth allows existing crypto-native users to connect or use their key management of choice. 

![WunderGraph](https://images.ctfassets.net/23aumh6u8s0i/1M6e9O4u8GgLd8xRFe8ZFI/bfdbf34181dd86ba94185c76d7f2f8b3/06_WunderGraph.png)

## WunderGraph
**[WunderGraph](https://marketplace.auth0.com/integrations/wundergraph)**, a secure developer-focused framework, provides a single solution for application integrations. The WunderGraph integration on Auth0 allows organizations to quickly integrate services, databases, and third-party APIs into a secure, unified, and extensible API using a declarative approach. WunderGraph is open source and built upon standards like GraphQL, OpenAPI, OAuth2, and S3. The integration standardizes the way how authentication, authorization, caching, and more are applied to applications.

![YooniK SSO - Face Login](https://images.ctfassets.net/23aumh6u8s0i/KzZUbBntqmG1PsUeZH04B/14d1f4b8e0bd7cd2dc5914a803a0d3f6/07_YooniK_SSO.png)

## YooniK SSO - Face Login
**[YooniK SSO - Face Login](https://marketplace.auth0.com/integrations/yoonik-yooni-k-sso-face-login)** SSO login simplifies customer interactions with secure, passwordless authentication. With this integration, after users log in to an identity provider, they are prompted to grant specific data access to the application, and an ID token with that user information is generated and sent to the application. This simple and secure authentication allows users to register once and access services anywhere, using facial login rather than passwords. 

We’ll be back next month with our latest releases. In the meantime, check out our [Marketplace catalog](http://marketplace.auth0.com/) for the current list of partner integrations and see who launched in Marketplace last month. 

Interested in becoming an Auth0 ecosystem partner? Visit [auth0.com/integrate](http://auth0.com/integrate) to get started. 

Marketplace Partner Spotlight: What’s New from June and July

See all the awesome integrations our ecosystem partners are building

Our [Marketplace](http://marketplace.auth0.com/) ecosystem is continuing to grow. Over the past couple of months, we’ve been showcasing partner integrations from early 2022 and into the spring. We’re excited to announce that our catalog is only getting better and better as more partners are discovering new use cases and opportunities for integrating with Auth0. 

Check out the latest releases from our Marketplace partners: 

![AE](https://images.ctfassets.net/23aumh6u8s0i/ZUsuJvUmSmCpfNOtLyc2u/23724e8ac513a24fad9f331b7c8cbc1c/01_AE.png)

## AE

**[AE - Idence Access Management](https://marketplace.auth0.com/integrations/idence-access-management)** <br>
The [Idence](https://www.ae.be/idence) integration enriches Auth0 with a brandable, user-friendly portal and customizable workflows through which you can delegate access management to admin users of your B2B partners and customers. Idence makes it easy for admins to onboard and manage the identities and access of their colleagues on your platform. This integration greatly reduces the time and technical complexity of managing access policies for your customer’s users.

![Tealium](https://images.ctfassets.net/23aumh6u8s0i/5bMcDi56pRkrCHwPZ7X8qk/44d837edc0f9e4c7cdfdf0e11abf3df9/02_Tealium.png)

## Tealium

**[Tealium - User Login](https://marketplace.auth0.com/integrations/tealium)** <br>
The [Tealium](https://tealium.com/) customer data platform (CDP) integration connects customer data across the web, mobile, offline, and IoT sources so businesses can better connect with their customers. Tealium creates customer profiles as the foundation of an organization's personalized customer experience. This integration ingests onboarding and login information into the cross-channel Tealium customer profiles for activation. This enables data from Auth0 to be used for customer segmentation and experience rules for engaging customers to drive conversion.

![Netlok](https://images.ctfassets.net/23aumh6u8s0i/4idXQnmvztqbrPLjVHgwBs/35ff87447dd1400f5dc9927bfaddeba6/03_Photolok.png)

## Netlok

**[Netlok - Photolok MFA Login](https://marketplace.auth0.com/integrations/photolok-mfa-login)** <br>
Photolok is a passwordless MFA login that uses secure photos for IAM. In creating the Photolok integration, [Netlok](https://netlok.com/) sought to simplify the login process while providing enhanced security. Photolock eliminates passwords, password rules, and resetting, instead of letting users label a photo for IAM and save it to their profile within seconds. For extra security, photos can be labeled for one-time use and for duress, which acts as a silent alarm to designated IT and security teams when a user is forced to enter their device. 

![Cymatic](https://images.ctfassets.net/23aumh6u8s0i/7qcYanQHkYXsCvbhxnDyfg/5f10770073d8a877a4d03cb18fa07fd2/04_Cymatic.png)

## Cymatic

**[Cymatic - User Risk Analytics](https://marketplace.auth0.com/integrations/cymatic-user-risk-analytics)** <br>
The new [Cymatic](https://cymatic.io/) integration on the Auth0 Marketplace provides organizations with a way to seamlessly understand login risk — without affecting the consumer experience. With Cymatic, you can quickly understand which users put your organization at risk and mitigate ATO before it begins. By adding rich and informative user risk insights and analytics to your Auth0 workflow, you can get a detailed picture of your users’ security hygiene and your organization’s potential risk exposure across logins, sessions, devices, locations, user behaviors, and credentials. 

![443ID](https://images.ctfassets.net/23aumh6u8s0i/6Uli6249QWM2tEY9hT3yor/ba9848e0320ff25b415c691d6845d2c1/05_443ID.png)

## 443ID

**[443ID - Risk Scoring](https://marketplace.auth0.com/integrations/443-id-risk)** <br>
The new [443ID](https://443id.com/) Actions Integration allows you to add OSINT risk to your authentication flows without having to write a single line of code. Using the 443ID integration, you can pair your risk signals with 443ID’s diverse set of OSINT risk signals into your authentication flow right from your Auth0 console. These risk scores let you deny authentication based on risk level or determine when or how a user must MFA. Collecting these risk scores over time allows you to build a unique SignalPrint™, which can be used to recognize and verify legitimate identities while limiting the need for expensive KYC or captchas.

![Kong](https://images.ctfassets.net/23aumh6u8s0i/5xATH8UPcuvZNXN6avTG44/91bc1b418d46930cd80327ed1f57c2ab/06_Kong.png)

## Kong 

**[Kong - API Gateway](https://marketplace.auth0.com/integrations/kong-api-gateway)** <br>
[Kong](https://konghq.com/) provides full lifecycle API management to design, test, and document APIs and microservices, connect services across any infrastructure and automate the API lifecycle. The new Kong integration on the Auth0 Marketplace delivers a customer identity and API management solution based on OpenID Connect (OIDC) standards. Both Kong and Auth0 fully support OIDC and provide seamless integration to implement all flows and grants defined in the standard to give flexibility to the authentication and authorization processes.

Make sure you check each month as we announce the latest releases from our partners. In the meantime, explore our [Marketplace catalog](http://marketplace.auth0.com/) for the current list of partner integrations, and be sure to check out the [last month’s integrations](https://auth0.com/blog/marketplace-partner-spotlight-what-s-new-from-february-and-march/) as well. 

Interested in becoming an Auth0 ecosystem partner? Visit [auth0.com/integrate](http://auth0.com/integrate) to get started.

Marketplace Partner Spotlight: What’s New from May and June

Jon May

Jon May is a Principal Security Engineer at Auth0 where he is responsible for securing the platform and infrastructure of the Auth0 Identity Platform. He has over 10 years experience in cybersecurity and technology and holds a bachelor’s degree in economics from Brown University. Prior to joining Auth0, Jon was a Security Architect at Bridgewater Associates where he was responsible for designing and implementing cloud and enterprise security controls.

Principal Security Engineer, Platform Security

Architecting and building a new platform that is secure by design.

**TL;DR:** Auth0 replatformed our private cloud offering into a multi-cloud Kubernetes architecture. This large architectural change brings with it new threats and new security challenges. We took the opportunity to design and integrate security into the platform from the start, as opposed to "bolting it on" at the end.

In this post, we'll discuss how we approached securely replatforming the Auth0 Identity Platform into a large, multi-cloud architecture. We'll walk through the risks that most concern Auth0's Security team and the threats that could result in those risks becoming real, tangible, negative outcomes. After that, we'll discuss the challenges our team encountered while addressing those threats in a multi-cloud environment alongside the principles we applied to address them. Finally, we'll review the controls Auth0 put in place to mitigate the identified threats.

If you haven't read the previous posts yet, [A Technical Primer of Auth0's New Private Cloud Platform](https://auth0.com/blog/a-technical-primer-of-auth0-s-new-private-cloud-platform/) and [The Architect's View of Auth0's New Private Cloud Platform](https://auth0.com/blog/the-architect-s-view-of-auth0-s-new-private-cloud-platform/), I encourage you to check them out first. They provide foundational knowledge and context which will help you better understand this post.  

## Understanding What Risks Affect Us

At the highest level, Auth0's Security team is responsible for identifying, assessing, and mitigating risks to our business and, in effect, our customers. It's our job to reduce the impact and/or likelihood of undesirable business outcomes caused by security events. Specifically, we're interested in mitigating security and privacy risks, such as those involving:

1. **Product/platform compromises**: bad actors gaining control of a product or platform component
2. **Customer or Auth0 data loss**: unintended deletion or unauthorized access to customer or Auth0 data
3. **Service disruptions and outages**: disrupting the Auth0 service and causing an outage for our customers

There are more risks than the three listed above and more nuance as well, but we'll use them for brevity. These high-level risks help us enumerate our list of threats.

## Identifying How the Platform Will be Attacked

This new Kubernetes-native, multi-cloud architecture is large and complex, which makes it challenging to secure. Our approach is to start by enumerating the areas of the architecture most likely to be targeted and how they can be attacked. This process, called threat modeling, helps us determine where to focus our resources and implement countermeasures (also known as security controls). These "areas to focus on," or threats, are circumstances or events that could cause one of the risks highlighted above to occur.

![Platform](https://images.ctfassets.net/23aumh6u8s0i/3kEf7N3gMeLfxUtIOqqEZP/5a7ee4be2c16df0549cdf2528eb1749e/01_private_cloud.png)

The threat modeling process results in a long list of threats of varying severity. For the purposes of this post, we'll focus on a short list of significant ones:

1. **Employee account takeover**: an attacker compromises or gains access to employee credentials and utilizes them to access Auth0 systems
2. **Malicious insiders**: an internal employee abuses existing authorized access to Auth0 systems 
3. **Service or application compromise**: an attacker gains control of an Auth0 product or platform service, third-party managed service, or a cloud provider service
4. **Software supply chain compromise**: an attacker tampers with or exploits misconfigurations/vulnerabilities in software dependencies used by the Auth0 product or platform

This list of threats informs what secure design patterns and security controls we deploy into the platform's architecture.

## Securing Multi-Cloud Architecture is Hard

Now that we have defined the list of threats we're protecting against (the "what"), we can start determining the design changes, secure design patterns, and security controls that will address those threats (the "how"). But first, before jumping into that, let's take a step back and understand the challenges with securing a platform that utilizes multiple cloud providers. In Auth0's case, we use both Amazon Web Services (AWS) and Microsoft Azure.

### Increased complexity

Using multiple cloud providers increases the architecture's overall complexity. Each cloud provider has similar general capabilities such as computing, networking, storage, and logging. However, each cloud provider implements these capabilities in their own ways. What we end up with are multiple implementations of the same core capability, like virtual machines or blob storage. These nuances between cloud providers introduce complexities that are challenging to secure.

Let's use an example to illustrate these differences. The Auth0 product requires [blob storage](https://auth0.com/blog/azure-storage-introduction/), so let's compare AWS S3 and Azure Storage Accounts and only focus on the different access methods.

![AWS S3 and Azure](https://images.ctfassets.net/23aumh6u8s0i/6DKlibDUAMicDy2oQaUKez/a66838c5086a3e1203d513dc7c3d1eef/table.png)

Another example is AWS Security Groups (SG) vs. Azure Network Security Groups (NSG) and how each handles rule evaluation. AWS SG rules are additive (i.e., allow the superset of all applicable rules), while Azure NSG rules are assigned a priority value and evaluated in that order. These are only two examples of the many differences between AWS and Azure we accounted for in the new platform's architectural design. 

### Larger attack surface

Using multiple clouds means potentially securing multiple, similar services for each cloud provider, e.g., AWS S3 _and_ Azure Storage Accounts. The complexity mentioned above and an increased number of services result in a larger attack surface. Today, for instance, we need to secure two cloud service providers (AWS and Azure), and that means securing two sets of each cloud-specific service required to run Auth0. It also means our Detection and Response team needs to ingest and monitor multiple sets of cloud-specific log sources to properly monitor and investigate the activity. That's a large surface area to secure.

### Cross-cloud connectivity

Communication between services within the same cloud is straightforward. We simply need to use the cloud provider's own mechanisms, and it should "just work." However, there are different points in our new platform's architecture that require some form of communication between AWS and Azure. Network connectivity, for example, needs to be established between Azure Points-of-Presence (PoPs) and Auth0 Central (which runs in AWS). We don't have the ability to use either cloud's PrivateLink service in this scenario (which would be preferred). In another example, Azure Spaces need to upload usage metrics into Auth0 Central (AWS). In single cloud architecture, we could simply use Azure RBAC configured with the proper role assignments. However, that's not possible in this scenario; the Azure Kubernetes Service (AKS) cluster/pod will need to authenticate using AWS S3 authentication methods.

## Addressing Multi-Cloud Challenges

So far, we reviewed the risks Auth0 is most worried about, enumerated a short list of threats to help guide our security decision-making, and discussed some of the challenges Auth0 experienced securing a multi-cloud architecture. Next, let's walk through the principles we applied to determine how we address those threats in the context of those multi-cloud challenges.

### View all security-related decisions through a risk-based and threat-centric lens.

That means all secure design decisions or security controls implemented were directly related to the risk and threats we enumerated during the previous sections. Prioritization is key, and using this lens influences where we need to spend available resources and which countermeasures would be most effective.

### Apply secure design principles and integrate security into the platform early and often. 

The Auth0 Security team is involved throughout the product life cycle, from ideation to design to build to operation and finally to deprecation. We are heavily involved in the design and build phases. This is important because it's easiest to make architectural changes before the technology is built.

### Establish clear, enforceable trust boundaries.

These trust boundaries inform how we implement various countermeasures such as access controls. They also encapsulate areas of risk, making them easier to manage. For example, our development and production environments are completely isolated and separate from one another. Operators cannot use development access to affect any part of the production environment.

### Balance cloud-native and cloud-agnostic capabilities.

This is a tricky one because each has its own benefits and challenges. Cloud-native capabilities (e.g., AWS managed databases) are tightly integrated with the cloud provider, which means you'll get those integrations — like GuardDuty or Microsoft Defender — out-of-the-box. On the other hand, cloud-native services are tightly coupled to their cloud, and deploying them for _both_ AWS and Azure increases the complexity and attack surface (as we discussed above). Compare that to cloud-agnostic capabilities, which can provide a single pattern and enable a simpler architecture with less attack surface. However, integrating with cloud provider services tends to require more work or "glue" to stitch them together. For example, our Auth0 product consists of Kubernetes workloads (cloud agnostic). We use managed Kubernetes services (AKS and EKS), and it's very easy to use the same services across both clouds. That means less complexity (i.e., one change to the Auth0 product will be applied to both clouds) and less attack surface (i.e., one service to secure).

## Selecting the Right Set of Security Capabilities

Finally, let's review the various security capabilities Auth0 implemented into the new platform to address the threats and multi-cloud challenges mentioned above. In addition to our own security capabilities, Auth0 takes advantage of the cloud's shared responsibility model. The shared responsibility model allows us to focus on securing other areas of the platform instead of worrying about the underlying cloud service provider infrastructure.

### Cloud Governance

All Auth0 Spaces, PoPs, Central, and Control Plane technology stacks are isolated into their own AWS Account or Azure Subscription. This provides clean and clear resource isolation, especially for single-tenant Spaces. We used AWS Organizations to create an Organization Unit (OU) hierarchy based on environment and functionality and add each account to a specific OU. We used Azure Management Groups to create a similar hierarchy for Azure Subscriptions. The hierarchies we created enable scalable, granular access controls and policy enforcement; we grant access or apply policies (Azure Policy and AWS Service Control Policies) to specific Management Groups / OUs or Spaces. For AWS, we grant access based on OU conditions and assign SCPs to OUs. For Azure, we assign roles and policies scoped to specific Management Groups. The access and policies are then inherited by the intended accounts or subscriptions.

![Cloud Governance](https://images.ctfassets.net/23aumh6u8s0i/ovvm1JDueXMwiN8ZKQThA/8f1684125fcc76f224b5e9329d5aa0fb/02_private_cloud.png)

### Identity and Access Management

Auth0 was built to secure identities, so we leverage Auth0 + Okta to secure authentication and authorization to our platform tooling. We manage all cloud providers and support application access using a least privileged RBAC model. We also require Multi-factor authentication (MFA) for all operator access to the platform; this includes cloud providers and all supporting applications. Operators are required to use Azure Privileged Identity Management (PIM) - which provides just-in-time access - for any administrative activities. Azure AD Identity Protection identifies and blocks any risky Azure tenant sign-ins.

### Network Security

All single-tenant and multi-tenant Spaces are logically isolated from one another with no interconnectivity between them. This strong isolation drastically reduces an attacker's ability to pivot into other Spaces or PoPs and further their attack. We further restrict inbound connectivity to spaces by using AWS and Azure PrivateLink to connect outbound from Spaces to a PoP. All traffic is encrypted in transit using TLS 1.2+. This includes network traffic between all cloud services, Kubernetes pod-to-pod traffic, and Kubernetes cluster-to-cluster traffic. For some workloads, we utilize mutual TLS (mTLS). On the network edge, we protect against DDoS attacks on our infrastructure, identify and block bots, enforce rate limiting, and block malicious traffic with web application firewall (WAF) rules. Operators must use VPN to access platform infrastructure, adding another layer to our defense-in-depth strategy.

![Network Security](https://images.ctfassets.net/23aumh6u8s0i/2DQcFgwaIkylGFaN479rmz/4a28c57f312f42a25052f84ae788b7b1/03_private_cloud.jpeg)

### Data Protection

All data is encrypted at rest using AES-256 or better, and encryption occurs at multiple layers (e.g., disk, file, database, and application layers). All data in transit is encrypted using TLS 1.2+. Auth0 encrypts platform secrets using HashiCorp Vault and takes full advantage of Azure Key Vault and AWS KMS for encrypting data in cloud services.

![Data Protection](https://images.ctfassets.net/23aumh6u8s0i/1XOTfQ1STNV4y9rTo7FcHf/3fd90c1fd4c3317f63804562e892d5e5/04_private_cloud.png)

### Detection and Response

Auth0 monitors the platform using a combination of cloud services and our own monitoring tools. We take advantage of AWS GuardDuty and Microsoft Defender for Cloud in addition to our own tooling. Auth0 ingests a vast amount of AWS and Azure platform logs for all of the cloud services used by the platform. These logs are ingested into a security data lake and monitored with detections defined as code.

![Detection and Response](https://images.ctfassets.net/23aumh6u8s0i/3aH0JsipzpNkdNubtfYwWN/6123b09fe51ae344fd4537e777081a22/05_private_cloud.png)

### Kubernetes Security

The [4C's of Cloud Native security](https://kubernetes.io/docs/concepts/security/overview/) is a good framework to use when thinking through Kubernetes security. We are, in varying aspects, responsible for security in the clouds we're using, the clusters we're running, the containers running on those clusters, and the code running within the containers. Auth0 uses the managed Kubernetes services Azure Kubernetes Service (AKS) and AWS' Elastic Kubernetes Service (EKS). These offerings from Azure and AWS are security feature-rich. Our worker nodes meet Kubernetes CIS Level 1 Benchmarks. Cluster access is restricted to operators, and least privilege is enforced using specific RBAC roles. We use Kubernetes NetworkPolicy objects to restrict pod network ingress and egress to authorized sources and destinations.

![Kubernetes Security](https://images.ctfassets.net/23aumh6u8s0i/48mIINcAPiqFzHe39D2I53/eeb1592c93f41b01ed465d6abd7bf349/06_private_cloud.png)

### Vulnerability Management

Our build and deploy pipelines continuously scan our cluster, containers, and code for vulnerabilities. Our security capabilities include the usual controls: static application security testing (SAST) on both code and infrastructure-as-code, dynamic application security testing (DAST) on our application and API endpoints, and software composition analysis (SCA) on our software dependencies and containers. Cloud Security Posture Management (CSPM) tooling identifies and responds to cloud misconfigurations (e.g., publicly accessible S3 buckets). Patching is a foundational security control; we continuously upgrade our containers and software dependencies. In the shared responsibility model, Azure/AWS are responsible for building upgraded node images, and Auth0 is responsible for deploying the images to our nodes. We accomplish this by rebuilding our Kubernetes nodes with the latest image during each Auth0 product release cycle.

### Automation is a must

We are dealing with a scale that makes it impossible to configure all of these security capabilities manually. To address his challenge, the Auth0 Security team created an in-house service that automates AWS account and Azure subscription creation and configuration. Similar to a production line, when new Spaces and PoPs are needed, this service creates AWS accounts and Azure subscriptions to meet our strict security standards using predefined templates. It effectively "stamps out" completely configured new accounts/subscriptions on-demand. When the account or subscription is no longer needed, the service will remove all resources, revoke all access, and decommission it.

## Continuously Improving Auth0's Security Posture

All of this work has culminated into a more secure, scalable platform that continues to meet or exceed the many requirements needed to achieve ISO 27001/27018, SOC 2, PCI, STAR, and HIPAA compliance.

The threat landscape is ever-changing and constantly evolving. The Auth0 Security team's job is never done, and a core principle is a continuous improvement. There are always ways to mitigate more risk and enhance our security posture, and we continually investigate additional security capabilities to make our platform and product even more secure for our customers.

We are publishing a series of technical posts on how and why we re-platformed. They'll be linked at the bottom of this post as they publish and are also findable on our blog. If you have technical questions or ideas for future posts, please reach out to us via the [Auth0 Community](https://community.auth0.com/). (Our marketing team also tells us we would be remiss if we didn't include a link to talk to Sales, so that is [here](https://auth0.com/contact-us), too.)

<include src="asides/AboutAuth0" />

Securing Auth0's New Private Cloud Platform

Check out the latest integrations our ecosystem partners are building

With extensibility at the core of our platform, it's no surprise that our partners are discovering endless opportunities for integrations to help our joint customers customize their solutions. Through the [Auth0 Marketplace](http://marketplace.auth0.com/), we've made it easy for you to explore partner integrations that will allow you to extend and customize your Auth0 solution. 

Our list of partners continues to grow, and we're excited to announce some of the most recent integrations to hit our marketplace: 

![Deduce](https://images.ctfassets.net/23aumh6u8s0i/3bt2DmuOaG27pzb33Cvxh1/c782a53b76a835b0e7170f690ec66007/1_Deduce.png)

## Deduce

**[Deduce - Intelligence MFA](https://marketplace.auth0.com/integrations/deduce-intelligent-mfa)** <br>
The [Deduce](https://www.deduce.com/) Intelligent MFA integration acts as a first line of defense against consumer-facing Account Takeover (ATO) and registration fraud. Inform every authentication, account creation, and password reset with identity-backed behavioral intelligence powered by the Deduce Identity Network. The Deduce Identity Network is a consortium of over 150,000 websites and applications that delivers a comprehensive range of both risk and trust signals that help stop fraud, and reduce false-positive challenges, via a no-code integration with Auth0.

![Haventec](https://images.ctfassets.net/23aumh6u8s0i/5KFFwBrRD6DFfNwEsoIW51/a729ba1993027bd10939384310cb179e/2_Haventec.png)

## Haventec

**[Haventec - Single-step passwordless multi-factor authentication](https://marketplace.auth0.com/integrations/haventec-authenticate)** <br>
The [Haventec](https://www.haventec.com/) Authenticate integration is a decentralized identity provider that enables a single-step passwordless multi-factor authentication experience and reduces the risk of credential theft. Single-step passwordless MFA is invisible to the user, does not require switching devices or applications for a second authentication factor, and provides a seamless and consistent experience across all digital channels. Once enabled, the Haventec Authenticate integration can provide single-step passwordless MFA for any application registered with Auth0.

![Elastic](https://images.ctfassets.net/23aumh6u8s0i/3bnzTWy2aUCmcP04rOf1Vq/43cdcb135e8035a44e2d8c61a6860a0a/3_Elastic.png)

## Elastic

**[Elastic - Event ingestion and log streaming](https://marketplace.auth0.com/integrations/elastic-security)** <br>
[Elastic](https://www.elastic.co/) Security enables security teams to stop threats quickly and at scale, with a platform for prevention, detection, and response. The newly launched Elastic Security integration in the Auth0 Marketplace enables the collection, analysis, and correlation of Auth0 events and alerts, leveraging Elastic to ingest events from Auth0's log streaming service. With this integration, Auth0 events can be searched and visualized with predefined mappings, detection rules, and dashboards to aid with threat detection and incident response. 

![Trust Swiftly](https://images.ctfassets.net/23aumh6u8s0i/4yilZ4nXdxZoSZmdWcFXoY/dba6176c1951d8f5f29870f7be8fa3c9/4_Trust_Swiftly.png)

## Trust Swiftly

**[Trust Swiftly - Flexible, secure identity verification](https://marketplace.auth0.com/integrations/trust-swiftly-identity-verification)** <br>
The new [Trust Swiftly](https://urldefense.com/v3/__https://trustswiftly.com/__;!!PwKahg!_cpZ3DY8Ufr8f21at6zHQ5ztKuEEyW9K8YQRrC11gTaCOansr9C1oBhSnRnvXRoEyHIjOPTm8GrceA4bXLT6zsc$) integration in the Auth0 Marketplace provides an adaptive identity proofing platform with over 15 ways to verify user identities. The integration dynamically verifies Auth0 logins and sign-ups with minimal friction for the end user. Example identity verification checks include government-issued IDs, utility statements, video, banking, geolocation, voice, and credit card authorizations. The integration offers configurable settings to support multiple use cases and meet unique verification requirements.

![Spruce ID](https://images.ctfassets.net/23aumh6u8s0i/1H2npZohsE2NF8UQps7BkI/b291f5098d2fd1e4c1ee49407fb019e1/5_Spruce_ID.png)

## Spruce ID

**[Spruce ID](https://marketplace.auth0.com/integrations/siwe?_ga=2.68427345.1715226261.1651077745-2109166029.1639592395&_gac=1.120108410.1648222091.Cj0KCQjw0PWRBhDKARIsAPKHFGjo3PjbfIAxFplxzf6cNR80lX_rTDF62HWDg86rRmPMKYqH9ReU2J8aAp5kEALw_wcB&_gl=1*1p54hh5*rollup_ga*MjEwOTE2NjAyOS4xNjM5NTkyMzk1*rollup_ga_F1G3E656YZ*MTY1MTA3Nzc0NC4xNjYuMC4xNjUxMDc3NzQ0LjYw)** <br>
[Spruce](https://www.spruceid.com/) allows users to control their data across the web. The Sign-In with Ethereum integration from Spruce in the Auth0 Marketplace enables any Auth0 client to handle Ethereum account-based authentication. Sign-In with Ethereum was recently standardized in a Web3 login effort led by The Ethereum Foundation, Spruce, and ENS. The integration leverages an identity server hosted by Spruce/ENS to manage the authentication and also incorporates blockchain-hosted ENS profiles if they are available.

Be sure to check each month as we feature the latest integrations from our growing partner ecosystem. Meanwhile, check out our current list of partner integrations at [marketplace.auth0.com](http://marketplace.auth0.com/)

Interested in building an integration with us? Visit [auth0.com/integrate](http://auth0.com/integrate) to get started.

Marketplace Partner Spotlight: What’s New from February and March

Build an Ionic + Angular frontend for your Spring Boot backend, all using the power of JHipster! Secured by OpenID Connect.

Build Secure Ionic Apps with Angular and JHipster

Dan McCorriston

Senior Product Marketing Manager

Build an Actions Integration and connect with Auth0 customers

## Why Should You Become an Ecosystem Partner?

Whether you’re a developer of a newly launched solution, or part of a larger, enterprise-level organization, you want to get your product in front of potential customers. Therefore, developing and growing your reach through an Extensibility Ecosystem strategy is a vital part of any organization’s overall strategy.

At Auth0, we consider extensibility to be one of our essential product capabilities. While our endless options for integrations are an excellent way to customize your own unique solution, it can be difficult and time-consuming for our customers to figure out how to implement them.

Enter the [Auth0 Marketplace](https://marketplace.auth0.com/).

We built the Marketplace as a way to connect our customers with service providers and builders who implement these types of integrations regularly. Listing your integration with Auth0 promotes your company with our customers who are looking to do more with their authentication pipeline.

![Ecosystem](https://images.ctfassets.net/23aumh6u8s0i/5rRXDrFl5g647jL7dPbjR/c7d099307234ef118b05e3c6f1215fda/Marketplace_Partner_Spotlight_Separator_V02A_3x.png)


## What is an Ecosystem Partner?

More and more SasS companies are offering developer customers the flexibility and capability to stay within their own ecosystem as much as possible in order to find solutions that fit their own and their customers’ needs. A rich and diverse catalog of integrations can give developers all the low and no-code capabilities they need to build out their own customer journey.

**Auth0** provides an authentication and authorization service built on open standards like OIDC, OAuth2, SAML, and others. But, more than that, we provide tools so our customers can outsource user centralization and management alongside components of application security, and we also help connect networks of applications to a single source of identity.

An important part of this is enabling partners, such as yourself, to create an ecosystem of integrations that can be used to enhance and extend what we already provide. We do this by providing extensibility points and methods to allow customization. This means more functionality for customers with less maintenance burden for them.

Almost 90% of our customers extend the Auth0 platform for their unique requirements. By working with you to solve common identity problems and use cases, we can expedite the time it takes our customers to implement their identity workflows.

Joining Auth0 as an ecosystem partner by building and marketing your Action Integration has some very important opportunities to take advantage of.

### Opportunities:

#### Audience Reach
Auth0 has more than 90k active tenants in production. Some customers have multiple tenants, and some only have one, but this is a large reach of potential customers for your Action Integration. Once your Action Integration is in the Marketplace, customers will have the opportunity to discover, consider, and install your integration into their customer identification flow.

#### Co-marketing
Once you’ve successfully published your Action Integration into the Marketplace, take the next step to expand your reach through GTM initiatives. While we encourage you to drive some GTM initiatives on your own, we also have many opportunities for you to market your integration with us. From blogs and newsletters to demand generation and webinar programs, we have multiple opportunities to help you market your integration.

#### Early to market
The earlier you create your Action Integration and are published to the Marketplace, the better chance you have of creating your own virtuous cycle of early adopters of your integration, marketing your case study, and growing your customers through the ecosystem.

#### Take advantage of Actions technology
Auth0’s new universal extensibility toolset - Actions - is the latest advancement on our commitment to delivering best-in-class extensibility to developers. Developers can take advantage of the easy-to-use interface, drag and drop functionality, version control, a serverless environment, pre-production testing, and debugging.

## How Do You Start?

If you want to learn more about becoming an ecosystem partner and building an Action Integration, visit [Integrate with Auth0](http://autho.com/integrate) to learn more. Here are the main steps you’ll take on your journey to becoming a partner:

## Develop a Use Case for a Customer Need

Some of the considerations you should make when developing a use case for your integration are:

* What does your service do, and how will this help our end customer? (ex. low conversion rates caused by interrupted security measures like MFA, spam signups and content submission, too much or unhelpful log data).
* Do you target specific industries and customer types? (ex. B2C, B2B)

Some of the most popular categories are:

* Identity proofing where customers need to prove they are who they claim to be
* Multi-Factor Authentication, where customers are required to use more than one step to prove their identity
* Consent Management that asks, records, and stores a customer’s approval or denial to use their information.

<br>
![Ecosystem](https://images.ctfassets.net/23aumh6u8s0i/5J18zBKKTWj49BiFo9cjfz/6363b6e28cf2492c47507b71666e8ca2/Marketplace_Partner_Spotlight_Separator_V02B_3x.png)
<br>

There are dozens of other use cases and perhaps many we haven’t thought of. If you’ve got a great solution that fits into the identity flow, let us know.

#### Start building your Action Integration
Get build support once you have created your solution use case. There are step-by-step instructions on how to develop your Action Integration. As your start building, you can get support from our comprehensive documentation, blogs, and forums. Live developer support is available for certain build scenarios.

#### Get published in the Auth0 Marketplace
Once your code has been tested and gone through the QA process, you are ready to deploy your Action Integration to the Auth0 Marketplace. Your integration will not only be discoverable in the Marketplace but easily found and installed from the developer dashboard.

#### Go To Market Opportunities
Now it’s time to find some customers and get them to install your Action Integration. Auth0 will partner with you on a Go-to-Market plan through newsletter, direct email, and social media marketing, as well as drive customers to webinars and demo content. Your success is our success.

There are more details and information at [Integrate with Auth0](http://auth0.com/integrate), so check it out to find out how to become an Auth0 ecosystem partner.

"build"