deepu-sasidharan

Deepu is a polyglot developer, Java Champion, and OSS aficionado. He mainly works with Java, JS, Rust, and Golang. He co-leads JHipster and created the JDL Studio and KDash. He's a Staff Developer Advocate at Okta. He is also an international speaker and a published author.

Staff Developer Advocate

Deepu K Sasidharan

Join us this October as we celebrate Hacktoberfest 2024 by encouraging developers to contribute to the open-source community.

We are excited to announce our inaugural [Authtoberfest 2024](https://authtoberfest.io/)!

![Authtoberfest 2024](https://images.ctfassets.net/23aumh6u8s0i/XGONROR1fr5aabZYKtkDC/3ef4d233bfbb1e79dcb1fcf755af2bb6/authtoberfest-logo.jpg)

Are you ready for Hacktoberfest? We are excited to participate in [Hacktoberfest 2024](https://hacktoberfest.com/), and we are calling all developers to join us in contributing to the open-source community.

Whether you're new to open source or an experienced contributor, this is your chance to give back, make a difference, and win some cool swag in the process.

At Auth0 by Okta, we believe in the power of community-driven development and open source. That’s why we’re proud to support and celebrate Hacktoberfest and help developers of all levels get involved. Let's code, collaborate, and contribute together!

![Authtoberfest 2024 T-shirt](https://images.ctfassets.net/23aumh6u8s0i/1PWpoxpdJtgsFDs9vx8jJL/118ee5e900b1653da2566238f8b2f60e/t-shirt-image.jpg)

This year, you have the chance to win a cool limited-edition T-shirt from us when you participate in Hacktoberfest and contribute to any of the projects in the Identity and Security space shortlisted by us. The first 100 valid submissions will get the T-shirt.

> A GitHub user with two accepted/merged PRs sending us the confirmation emails and the Hacktoberfest badge will be considered a valid submission.

Visit the [Authtoberfest website](https://authtoberfest.io/) to learn more about the event and how you can participate.

Authtoberfest 2024 is Here!

KonradProfilePicture

Konrad is a Community and Online Support Content Manager at Auth0 by Okta with more than 10 years of experience building, fostering and managing various technical developer communities. Outside of work he enjoys caravanning with his family, doing long distance bikepacking trips and spending time with positively crazy people.

Community and Online Support Content Manager

Konrad Sopala

Join the Auth0 Community and learn directly from the experts with the online AMA series.

The Auth0 Community Team is excited to invite you to our next interactive online AMA session on Thursday, January 18, 2024, featuring Actions, Rules, and Hooks subject matter experts.

## Ask Me Anything - Rules & Hooks and Why Actions Matter!

Have problems migrating from Rules & Hooks to Actions? Want to know more context about the deprecation? Looking for information on best practices, helpers and how to utilize Actions most effectively? No matter what kind of Actions, Rules, or Hooks questions you might have, we’ve got you covered! Oliver Wang, one of our product managers, will answer all your burning questions related to Rules & Hooks and share more why Actions matter!

## How Will the AMA Session Work?

From today to Wednesday, January 17, 2024, you can ask your questions by replying to [this community topic](https://community.auth0.com/t/auth0-community-ask-me-anything-rules-hooks-and-why-actions-matter/124043) using the ‘Reply’ Button. Then, mark your calendars for Thursday, January 18, between 7 am and 9 am PT, when our product experts will provide you with comprehensive written answers.

## Learn About Past AMAs

We kicked off our first AMA in July, all about [how to get the most out of the Auth0 Community and all the self-service resources available at your fingertips](https://community.auth0.com/t/auth0-by-okta-community-ask-me-anything-with-getting-self-help/110551/20). In September, we hosted an [AMA on Auth0 Terraform Provider](https://community.auth0.com/t/auth0-by-okta-community-ask-me-anything-with-auth0-terraform-provider/115670/34) to show you all the capabilities of this tool. The next one was about [self-service subscriptions and billing](https://community.auth0.com/t/auth0-by-okta-community-ask-me-anything-with-self-service-subscriptions-and-billing/119444/17). If you want to read more about previous AMA sessions, you can check them out [here](https://community.auth0.com/c/community/community-interactive-q-a-series/107).

## Stay Tuned for More

This session is part of a bi-monthly AMA online event series that invites Auth0 Community users to engage with various Okta subject matter experts. We will update [this page](https://community.auth0.com/c/community/community-interactive-q-a-series/107) with more events, so bookmark it for future reference. You can also check out recaps from previous AMAs via the link above.

[Hope to see you there!](https://community.auth0.com/c/community/community-interactive-q-a-series/107)

Auth0 Community AMA: Rules & Hooks and Why Actions Matter

The Auth0 Community Team is excited to invite you to our next interactive online AMA session on Thursday, November 16, 2023, featuring the self-service subscription plans and billing subject matter experts.

Have you ever been struggling with figuring out how to modify your Auth0 subscription plans? Lost access to your paid tenant and wondering if you’re going to recover money paid for the unused period? Have a few tenants on the same subscription plan and am wondering if you can somehow combine them to have a more analytical view of how much you spend on Auth0 products. Now is your chance to get your questions in front of our subject matter experts.

## Ask Me Anything -Self-Service Subscription Plans and Billing

### How Will the AMA Session Work?

From today to Wednesday, November 15, 2023, you can ask your questions by replying to [this community topic](https://community.auth0.com/t/ask-me-anything-self-service-subscription-plans-and-billing/119444) using the ‘Reply’ Button. Then, mark your calendars for Thursday, November 16, between 7 am and 9 am PST, when our product experts will provide you with comprehensive written answers.

### Learn About Past AMAs

We kicked off our first AMA in July, all about how to get the most out of the Auth0 Community and all the self-service resources available at your fingertips. In September, we hosted an AMA on Auth0 Terraform Provider to show you all the capabilities of this tool. If you want to read more about previous AMA sessions, you can check them out[ here](https://community.auth0.com/c/community/community-interactive-q-a-series/107).

### Stay Tuned for More

This session is part of a bi-monthly AMA online event series that invites Auth0 Community users to engage with various Okta subject matter experts. We will update[ this page](https://community.auth0.com/c/community/community-interactive-q-a-series/107) with more events, so bookmark it for future reference. You can also check out recaps from previous AMAs via the link above.

[Hope to see you there!](https://community.auth0.com/c/community/community-interactive-q-a-series/107)


Auth0 Community AMA November Edition

The Auth0 Community is proud to announce an exciting addition to the Auth0 Community: an interactive online Ask Me Anything Series (AMA) hosted in [our forum](https://community.auth0.com/c/community/community-interactive-q-a-series/107). This interactive online Q&A session enables Okta experts, developers, and customers to connect, support each other, and provide valuable insights on Auth0’s Customer Identity Cloud. 

## What Are the Benefits for Okta Customers and Developers?

As an Okta customer or developer, joining our interactive online Q&A sessions will help you:

- Enhance your expertise with Auth0 products and solutions 
- Connect with Auth0 experts and peers 
- Earn recognizable Auth0 Community badges 

## Get Involved in This Month’s Ask Me Anything Series

The Community Team is excited to invite you to our next interactive online AMA session on **Thursday, September 28, 2023**, featuring the Auth0 Terraform Provider Product Team.

Did you know that the [Auth0 Terraform Provider](https://auth0.com/docs/deploy-monitor/auth0-terraform-provider) offers a streamlined way to manage Auth0 configurations using Infrastructure as code, allowing for easy version control, automation, and integration into existing DevOps pipelines? Now is your chance to get your questions in front of Kevin Lillybridge, Group Product Manager at Auth0. 

![Ask Me Anything - Auth0 Terraform Provider](https://images.ctfassets.net/23aumh6u8s0i/2pvgd1fkEDIct2dBACFoJW/3feb3d9d2cc5cabfbd8f7757744aa79e/ama-auth0-terraform-provider.jpg)

## How Will the AMA Session Work?

From today to Wednesday, September 27, 2023, you can ask your questions by replying to this [community topic](https://community.auth0.com/t/ask-me-anything-with-auth0-terraform-provider/115670) using the ‘Reply’ Button. Then, mark your calendars for Thursday, September 28, between 7 a.m. and 9 a.m. PST, when our product experts from the Auth0 Terraform Provider team will provide you with comprehensive written answers.

## Learn About Past AMAs

We kicked off our first AMA in July, all about how to get the most out of the Auth0 Community and all the self-service resources available at your fingertips. Learn more in our Community Forum [here](https://community.auth0.com/t/interactive-q-a-session-1-finding-knowledge-getting-help-submitting-feature-requests-and-many-more/110551/20). 

## Stay Tuned for More

This is part of a bi-monthly AMA online event series that invites Auth0 Community users to engage with various Okta subject matter experts. We will be updating [this page](https://community.auth0.com/c/community/community-interactive-q-a-series/107) with more events, so bookmark it for future reference. You can also check out recaps from previous AMAs.

[Hope to see you there!](https://community.auth0.com/t/ask-me-anything-with-auth0-terraform-provider/115670)


Introducing the Auth0 Community Online Ask Me Anything Series

Help grow the Auth0 Community and get recognized for your contributions. Learn more about our new Community Catalysts Program.

Auth0 is happy to announce an exciting new addition to the Auth0 Community: the Community Catalysts program! This private, invitation-only group provides a space for our elite members to share their expertise.

## What Is Auth0 Community?

[Auth0 Community](https://community.auth0.com/) is a place for Auth0 developers, customers, and employees to learn, unlock new skills, and connect with fellow Auth0 users. 

Here, you can ask and answer questions, share expertise, collaborate with fellow developers, submit product feedback, and learn more about implementing and using Auth0 products and solutions.

## What Is the Community Catalysts Program?

The Auth0 Community Catalysts program encourages elite contributors to lead the way by lending their expertise, knowledge, and best practices to our growing online Community. And in doing so, Community Catalysts will be recognized and rewarded for their time and effort. This is a handpicked group of community members selected by the Auth0 Community team.

## Who Qualifies as an Auth0 Community Catalyst?

Key criteria for qualifying as a Community Catalyst include:

- **Being an expert.**
  They have a good understanding of Auth0 and its products.

- **Being an advocate leader.**
  They represent the spirit of the Community, leaving a path for others to follow by sharing knowledge and best practices.

- **Being helpful.**
  They contribute to various topics in the Auth0 Community by answering/asking questions and contributing to Auth0’s product roadmap by submitting feedback or feature requests.

- **Being empathetic.**
  They exemplify a supportive style to help others succeed in maximizing the use of Auth0 products.

## What Benefits Do I Get Being a Community Catalyst?

Member benefits enable you to:

- Elevate your personal brand and reputation with a special community badge and Okta swag.

- Enhance your expertise with exclusive access to Okta Learning and certification programs, and discounts to Okta events.

- Stay connected with Auth0 experts and your peers with private chat discussions, AMAs, virtual meetups, member spotlights, and more.

- Influence Auth0 product roadmap and Community direction by participating in beta testing.



## How Do I Become an Auth0 Community Catalyst?

Here are a few steps to become a Community Catalysts:

- Start by updating your community forum profile. Share a photo of yourself (or an avatar) and information about yourself.
- Ask and answer questions in our forum to learn, share knowledge, and grow your experience with Auth0.
- Engage in the forum by providing solutions, commenting, liking posts, or upvoting feedback cards.

Auth0 Community Catalyst status is awarded for a one-year period. New and renewed Community Catalysts will be handpicked by the Auth0 Community team based on their contributions in the last 12 months.

Want to learn more about our Auth0 Community Catalysts program? Check out the[ Auth0 Community Catalysts community topic](https://community.auth0.com/t/auth0-by-okta-community-catalysts-program/112576), join the conversation, and get engaged in our questions forum. 


Introducing Auth0 Community Catalysts Program

Damian Schenkelman

Damian was one of Auth0's earliest employees. He loves building products for developers and taking things from 0 to 1.
<br><br>
He played key roles in implementing product features and growing the engineering organization in the early stages, and later on defining Auth0's architecture for scale and creating new products. Today he helps shape Auth0's long term strategy and leads Auth0Lab, a small and amazing team doing research and development of forward-looking products.
<br><br>
He spends his spare time with family, and friends, exercising, and catching up on all things NBA.

VP R&D (Auth0Lab)

We are excited to announce the Developer Community Preview for Auth0 Fine Grained Authorization (FGA), our upcoming SaaS to solve authorization-at-scale for developers.

## What Is Fine Grained Authorization?

[Authentication is about who the user is. Authorization is about what they can do.](https://auth0.com/intro-to-iam/authentication-vs-authorization/)

Historically, software applications have, in general, handled [authorization](https://auth0.com/intro-to-iam/what-is-authorization/) in a coarse grained manner. A user has one or more roles in an application, which grants them permissions to perform certain actions across the application. This worked well for a while because users didn't create content in systems. As social and work collaboration applications become mainstream, a different kind of authorization became necessary: fine grained authorization.

An application implements fine grained authorization when it can determine a user's permission to perform actions on any object in the application, and users can create objects in the application and manage permissions to those objects.

This is "fine grained" because there is no lower limit to the granularity at which builders of the system can make authorization decisions. It is up to the builders of the system to determine how granular they want authorization to be, and up to the users of the system to determine who has specific permissions on objects.

## Why Is Fine Grained Authorization Important?

Fine grained authorization is increasingly becoming a critical element in software. For example:

*   **Collaboration and social** features are things users expect, such as the ‘Share’ button you see in so many applications. This applies to both business-related assets, such as documents and project boards, and personal assets like pictures and home IoT devices. Specifically sharing one of these objects with another user is a Fine Grained Authorization use case.
*   **Security, compliance, and privacy** are musts for any software application from day 1, and authorization is a big part of solving those concerns. In fact, the [TOP OWASP 2021 risk is broken access control](https://owasp.org/Top10/).

However, solving authorization in an application is not a trivial matter. We believe applications solve authorization correctly if their authorization solution has the following characteristics:

1.  **Reviewable:** It should be easy to determine "who can access what," essentially understand the rules used to enforce access control.
2.  **Easy to manage change:** Authorization related changes must be explicit and traceable. Change management control for authorization is important.
3.  **Auditable:** It should be possible to know what happened with regards to authorization, in essence "who tried to access what, and when?".
4.  **Reliable:** Authorization decisions are made as part of most flows/requests, so authorization components need to always be running and returning the expected results.
5.  **Fast:** Authorization decisions are made as part of most flows/requests, so they need to be fast. If authorization decisions are slow, then the end-user experience is slow as a whole.

Implementing all of the above is complex, even with expertise. So we looked at how we could solve authorization for our customers, and allow them to focus on their core business. This is what led us to create **Auth0 Fine Grained Authorization.**

## What Is Auth0 Fine Grained Authorization?

Auth0 Fine Grained Authorization (FGA) is a SaaS to solve **fine grained authorization at scale for developers**. It is inspired by [Google Zanzibar](http://zanzibar.academy), the [system Google uses to solve authorization](https://auth0.com/blog/auth0-introduces-zanzibar-academy/) across all their products, such as Google Drive, Youtube, Google Cloud, and others.

Auth0 FGA does not require you to be using Auth0 already. You can use Auth0 FGA with any identity provider: your own user database (e.g. MySQL, PostgreSQL), Auth0, Okta or anything else.

Auth0 FGA centralizes your authorization. It becomes your "authorization (micro)service" if you will. It's a single place for you to define your authorization model, store your authorization data and make your authorization decisions, across all your apps and products.

Centralizing your authorization logic and decisions into a single service that has the flexibility to handle use cases across your different products gives you distinct advantages:

*   **Simplify security auditing:** Explicit authorization rules are easier to audit by internal and external parties.
*   **Lower costs:** Standardizing how authorization is done across your company makes it easier for developers to switch teams.
*   **Deliver faster:** You’ll be able to ship features and products faster, as the system is easily extensible to new requirements.
*   **Security logging:** The Auth0 FGA service generates logs for all operations out-of-the-box, both reads and writes.
*   **Empower your users:** Allow users to take control of granting access to their data directly in your application.
*   **Fast and reliable at scale:** A centralized service dedicated to fine grained authorization should scale as your business and products grow. Since Auth0 FGA specializes in fine grained authorization and nothing else, it can be particularly optimized for access control patterns and use cases, improving the latency and reliability of your authorization approach.

<br>
Auth0 FGA supports granting access at an atomic object level in any system, easily enabling collaboration between users, going far beyond typical role-based access control (RBAC). It also supports building custom roles into any system, empowering your customers to define how to manage access. Auditing capabilities provide fundamental building blocks for security and compliance teams. The more we’ve spoken to customers about it, the more we’ve learned just how many use cases it can solve for.

![Auth0 FGA](https://images.ctfassets.net/23aumh6u8s0i/21LaMJQrrDSNHmIEP2oWhO/17fd5e2a825a937590557973d59678b3/Uploaded_from_Auth0_Fine_Grained_Authorization__Developer_Community_Preview_Release)

Organizations like [AirBNB](https://medium.com/airbnb-engineering/himeji-a-scalable-centralized-system-for-authorization-at-airbnb-341664924574) and [Carta](https://medium.com/building-carta/authz-cartas-highly-scalable-permissions-system-782a7f2c840f) have built [Zanzibar-like](https://zanzibar.academy/) systems to solve their authorization needs. We don’t think organizations should build the same authorization tooling, again and again, so we set out to build one version everyone can use. We developed Auth0 FGA as a service so you don't have to.

## How Do I Get Started?

To start using Auth0 FGA you need to do three things:

1.  Define your authorization model ([docs](https://docs.fga.dev/modeling))
2.  Write authorization data from your system to Auth0 FGA ([docs](https://docs.fga.dev/writing-data))
3.  Add authorization to your API by adding access control checks to your system ([docs](https://docs.fga.dev/integration))


<div class="alert alert-info alert-icon">
  <i class="icon-budicon-487"></i>
  <strong>Note:</strong><br> 
  <b>The Developer Community Preview is meant to help us learn how customers use the product. If you have feedback, reach out on our <a href="https://discord.gg/6jsgXhVBu6">Community Discord</a>.<br> 
</div>

From that point on, all authorization decisions are centralized and made by Auth0 FGA. You can think of it as your "authorization microservice."

![Auth0 FGA](https://images.ctfassets.net/23aumh6u8s0i/tROyM1vl5FzzqImS1xjNU/d6a4a8f07e6aca48aed81f4aafadd821/Uploaded_from_Auth0_Fine_Grained_Authorization__Developer_Community_Preview_Release)

### A brief example

Let's say you were to start from a Node.js API to manage projects. That API doesn't have authorization capabilities yet, but it does have authentication.

You have an endpoint that would return a particular project given its project ID. In that endpoint, you might have code like the one from the following snippet. The second line verifies the [JSON Web Token](https://jwt.io/) (JWT) sent as part of the request to perform [authentication](https://auth0.com/intro-to-iam/what-is-authentication/), using [express-jwt](https://www.npmjs.com/package/express-jwt).

```js
app.get('/project/:id',
    jwt({ secret: PUBLIC_KEY, algorithms: ['RS256'] }),
    // authorize access
    async function(req, res, next) {
        // your business logic
    }
);
```

Now we want to add [authorization](https://auth0.com/docs/authorization) so only users that can **read** a project can call this endpoint.

First, we would install and setup the Auth0 Fine Grained Authorization Node.js SDK. You would need to obtain some data from your Auth0 Fine Grained Authorization account, and follow [these steps](https://docs.fga.dev/integration/getting-your-api-keys) to get it.

```js
const { Auth0FgaApi } = require('@auth0/fga');

const auth0Fga = new Auth0FgaApi({
  environment: AUTH0_FGA_ENVIRONMENT,
  storeId: AUTH0_FGA_STORE_ID,
  clientId: AUTH0_FGA_CLIENT_ID,
  clientSecret: AUTH0_FGA_CLIENT_SECRET,
});

...

app.get('/project/:id',
    jwt({ secret: PUBLIC_KEY, algorithms: ['RS256'] }),
    function(req, res) {
        // your business logic
    }
);
```


You would then add a new middleware that calls Auth0 Fine Grained Authorization to perform authorization on every request, after authentication has taken place. You know who the user is (authentication), now you want to check what they can do (authorization):

```js
app.get('/project/:id',
    jwt({ secret: PUBLIC_KEY, algorithms: ['RS256'] }),
    async function(req, res, next) {
        try {
            const result = await auth0Fga.check({
              tuple_key: {
                user: req.user.sub,
                relation: 'read',
                object: `project:${req.params.id}`,
              },
            });

            if (!result || !result.allowed) {
                return res.status(403)
                	.send({ code: 'missing_permissions', message: `ForbiddenError: Not allowed to access object ${req.params.id}` });
            }

            next();
        }  catch (err) {
            // handle error
            return next(err);
        }
    },
    function(req, res) {
        // your business logic
    }
);
```

The key part of the new middleware is this one, where we call the Auth0 Fine Grained Authorization API:

```js
const result = await auth0Fga.check({
  tuple_key: {
    user: req.user.sub,
    relation: "read",
    object: `project:${req.params.id}`,
  },
});
```

We are conceptually asking the question **"can the {user} read project:{id}"?**:

*   The **user** identifier is obtained from the JWT [sub (subject) claim](https://datatracker.ietf.org/doc/html/rfc7519#section-4.1.2), as the JWT validation middleware sets all claims for the JWT in the **req.user** object as properties. Whatever your existing authentication method is, you can easily integrate it with Auth0 FGA.
*   The **relation** is "read" because the endpoint is a **GET**, it allows the caller to "**read"** one project. For **PUT** or **PATCH** you would use **"write"**.
*   The **object** is made up of the object type (project) and the project ID. The **object** **ID** comes from the request parameters (the path). A full URL for the request might be GET {API\_URL}/projects/1234, so the **object** would be **project:1234**.

You can learn about **CHECK** requests in depth [here](https://docs.fga.dev/intro/auth0-fga-concepts#what-is-a-check-request).

The previous example is intentionally verbose to show you the inner workings of things. You can imagine having SDKs for any web framework, API Gateway, and even policy languages that easily allow you to configure authorization per endpoint. For example:

```js
app.get('/projects/:id',
    jwt({ secret: PUBLIC_KEY, algorithms: ['RS256'] }),
    authorize(req => ({
        user: req.user.sub,
        relation: 'read',
        object: `project:${req.params.id}`
    })),
    function(req, res) {
        // your business logic
    }
);
```

## What's in the Developer Community Preview?

The Auth0 FGA Developer Community Preview is completely free and includes the features below. This is a chance for you and your teams to try the product out, assess how you'd integrate it with your apps, and give us your feedback.


<div class="alert alert-info alert-icon">
  <i class="icon-budicon-487"></i>
  <strong>Note:</strong><br> 
  <b>The rate limits in the API are intentionally set low and there are no SLAs, as the Developer Community Preview is meant to help us learn how customers use the product. For additional inquires, please reach out on the <a href="https://discord.gg/6jsgXhVBu6">Community Discord</a>.<br> 
</div>

### Management dashboard

The management dashboard ([https://dashboard.fga.dev/](https://dashboard.fga.dev/)) allows you to create an account and a store. You can use the dashboard to define your authorization model, write authorization data, and perform authorization checks.

![Management dashboard](https://images.ctfassets.net/23aumh6u8s0i/3BFXmCWtMBx8Bqtrrj2sh0/91674dba44c3c779518b3421a2f16df1/02.jpg)

### Documentation

We have written extensive documentation ([https://docs.fga.dev/](https://docs.fga.dev/)) to help you learn the main concepts, get started, and explore advanced use cases.

![Documentation](https://images.ctfassets.net/23aumh6u8s0i/7wFQjqES9oqiEXTYOpshM1/aa3e08e49cdb20a80d6b24b9ca2639b0/01.jpg)

### HTTP API and SDKs

Auth0 FGA is a product built for developers. We’ve created an API for developers to integrate Auth0 FGA into their systems. Everything you can do with the dashboard you can also do with the API.

At launch, we are shipping with SDKs for [Javascript](https://github.com/auth0-lab/fga-js-sdk) and [Golang](https://github.com/auth0-lab/fga-go-sdk). If you'd like an SDK for another language let us know in [Discord](https://discord.gg/6jsgXhVBu6). We can easily generate it from our OpenAPI definitions.

![Auth0 FGA](https://images.ctfassets.net/23aumh6u8s0i/5Tdtrh6uySJPvMPsH2ms6/54517d4f5b1749909bce5f32c529a806/03.jpg)

## What's Next?

We are excited about the capabilities that Auth0 FGA will unlock for our customers. We want to make sure our roadmap items are driven by customer feedback and input. So if you’re interested in the product, please let us know your thoughts by joining our Auth0 Lab community [here](https://discord.gg/6jsgXhVBu6).

We are also looking forward to the future, especially the "better together" use cases that Auth0 Fine Grained Authorization will enable for both Auth0 and Okta customers.

We hope you'll join us on this journey and are eager to hear your thoughts on what we’ve built so far.

Take a look, try it out at [https://auth0.com/developers/lab/fine-grained-authorization](https://auth0.com/developers/lab/fine-grained-authorization), and let's learn together!

Auth0 Fine Grained Authorization: Developer Community Preview Release

duncan-godfrey

Duncan is a security, engineering, and business leader. His background is in security engineering and, in particular, cloud security.

Sr. Director of Security and Compliance

Duncan Godfrey

A global community of ethical hackers brings new perspectives to the hunt for vulnerabilities



Of all the tools available to stock your app security arsenal with, we have to say — bug bounties might just be the hammer you’re looking for.

Modern application assembly bears only a passing resemblance to the historical development methodologies it inherited its DNA from, often leading to a sort of complacency when it comes to securing the dev cycle. If you determine that it is indeed time to scale your security to keep pace with your developers, consider what we at Auth0 did, we set up a bug bounty program and are already reaping the benefits.

Application development environments today more closely resemble an actual assembly line, with developers picking and choosing where to insert a pre-existing extension or module and where to build from scratch. It’s a lot like a build-your-own-bowl lunch place, where you make it your own by mixing the existing bases with just the right tasty sauce combo. Combine the conveyor belt model with a dispersed workforce of developers who may be sitting on opposite sides of a continent from one another, and you get a new and unprecedented workplace paradigm that puts collaboration front and center. 

Bugcrowd is working at the forefront of this new remote paradigm, blending that collaborative spirit with a crowdsourcing model to bring a diversity of perspectives to the hunt for exploits and vulnerabilities. 

## What Is a Bug Bounty and Who Is Bugcrowd?

TLDR &mdash; A bug bounty is when a company or app developer rewards ethical hackers for finding and safely reporting vulnerabilities in their code. And, [Bugcrowd](http://www.bugcrowd.com) is a company who provides this service through a crowdsourced security platform.

A few brief words about a word &mdash; “hacker.” If your only exposure to this word is based on media reports about data breaches, you probably have a negative image of who “hackers” are. In the world of bug bounties and app security, the word has multiple connotations. A hacker can be either good or bad. An ethical cybersecurity researcher, or an unethical bad actor. The researchers used by Bugcrowd are ethical hackers, meaning they’re using their security knowledge, deep curiosity, and coding skills to help companies like Auth0 secure their digital assets.

OK, back to our story.

A bug bounty program can be implemented by any company with a software product. Whether it faces the public or not, anything written with code and connected to a network can be broken into. Offering a bounty for ethical hackers/researchers to find and document these exploits is the best way to stop bad actors from finding and, well, exploiting them later.

That’s a bug bounty in a proverbial nutshell; now on to Bugcrowd. Their unique model combines traditional pentesting with a cutting-edge crowdsourced bug bounty program to quickly and effectively locate vulnerabilities in their client’s code. The crowdsourcing aspect is used to connect their client companies with carefully curated and vetted cybersecurity researchers from around the world who are ready to bring their individual perspectives to the project of zapping bugs.

Luke Stephens, Manager of Training and Quality Assurance for Bugcrowd, puts it like this, “Bug bounty programs aren’t just about accessing talent; they’re about understanding what your security posture looks like; when a motivated adversary shows up.” By bringing ethical hackers with a variety of backgrounds and a mixed set of skills together with a singular goal, finding the backdoors attackers use to wreak havoc, Bugcrowd sets the security bar that much higher by finding the exploits before the bad guys have a chance to.

## What Role Can Bug Bounties Play in Modern App Assembly?

As mentioned above, [the state of modern app assembly](https://auth0.com/resources/whitepapers/state-app-assembly-2020) is a far cry from the early days of software development. Rather than a piece of software being written and tested by a team of in-house developers from start to finish, today’s apps are an amalgamation of custom code integrated with pre-existing modules written by third-party providers. It’s like the way your burrito-sauce-mixed-with-sriracha creation brings out the tanginess in the adobo pork in that lunch bowl last week.

This model speeds up your development time, makes it very easy to iterate, and leads to a more familiar user experience; however, it also opens up a whole new world of security concerns. It increases the complexity of your attack surface, which now includes a constellation of third-party code and services. 

Consider an app that uses an IAM solution from one provider, residing on a PaaS (platform-as-a-service) from another, with a payment system from a third. This all sits behind a custom UI written in-house. That’s four discrete code sets, multiple programming languages, and untold possibilities for vulnerabilities to slip between the code cracks. Remember the heartburn that bowl gave you last week? Yeah, that.

A bug bounty program brings together researchers from around the world, each with their own unique background and particular expertise, and turns them loose on that amalgam. Your developers know their code, but how well do they know the code used in all those modules? The range of perspectives and specializations brought by a team of crowdsourced bug bounty hunters is unparalleled and means you stand a much stronger chance of vulnerabilities and potential exploits being found before an attacker can get at them. 

All of that said, bug bounties are not a one-and-done solution to all of your testing needs. A program like that offered by Bugcrowd forms one prong of a defensive, in-depth approach to app security. Traditional third-party pentesting still holds a place in the pantheon of security measures, and a solid IAM solution can still find its place alongside bug bounties in a mature security program.

> “Strong internal security practices and compliance need to be accompanied by active, continuous, incentivized security testing, and bug bounty programs are an effective and scalable way to achieve this.”
_-Luke Stephens, Manager of Training and Quality Assurance, Bugcrowd_

## The Business Impact Of a Bug Bounty Program

ROI is king when it comes to business decisions, right? What if you could make one change to your dev ecosystem that could potentially raise ROI by 4x? Well, that’s precisely what our experience has been. Dollar-for-dollar, we see in the range of 3-4x the vulnerabilities with this program than we have in the past. More bugs are found in less time and for less money. With the global average cost of a data breach in 2019 sitting at over [$3.8 million USD](https://www.ibm.com/security/data-breach) &mdash; we think our bug bounty program is a sound investment.

Beyond the purely financial aspect, there’s a team cohesion and training aspect to setting up a bug bounty program that can’t be overlooked. People trust people, so having a living, breathing researcher document a vulnerability has a much stronger impact on the development team than an automated scan or test sequence does. And that’s how you build better security awareness into your next iteration or new product. To go back to Luke at Bugcrowd:

> “Bug bounty programs provide a scalable way to not only identify risk to help the security team but to help impart security awareness to builders within our organization.”
_-Luke Stephens, Manager of Training and Quality Assurance, Bugcrowd_

## Lessons Learned From Our Ongoing Partnership With Bugcrowd

In our time working with Bugcrowd and their researchers, we’ve learned some valuable lessons around app security and the value of discovery. We’ve drilled down and come up with our top two most impactful lessons to share with you:

1. **First and foremost, the bugs identified by Bugcrowd have been far more complex and deeply buried than anything we’ve found in the previous testing**. This dovetails with the quote earlier about bug bounty programs finding 3-4x more vulnerabilities per dollar spent. 

2. **Be ready. You should expect to see a significant increase in the number of vulnerabilities discovered compared to before the program**. That means you need to be sure your security team is ready to triage and mitigate those vulnerabilities, so you ensure they’re dealt with before a malicious actor.

Both of these lessons are reciprocal. We’ve learned a lot about our product, and by having the resources to address issues quickly, we’ve shown the Bugcrowd researchers that we’re responsive and how highly we value the work they do. 

Auth0 Senior Manager of Product Security, Marcin Hoppe, sums it up succinctly:

> “We don’t control what types of vulnerabilities bug hunters are looking for, and they might be looking for things we have not included or prioritized in our own security testing efforts. This gives us a chance of getting reports of vulnerabilities we might have otherwise missed.”

## What Does The Future Hold For Bug Bounty Programs?

Though relatively new to the security scene, official bug bounty programs are seeing a high adoption rate across industries. That’s right; bug bounties aren’t just for the tech sector. According to a [report from Bugcrowd](https://www.bugcrowd.com/resources/reports/priority-one-report/) themselves, 2019 saw an increase of 29% in the number of bug bounty programs launched, along with a 50% increase in public programs. Leading the way were the financial (71%) and retail (50%) sectors, with healthcare (41%) coming in third.

With programs like Bugcrowd showing the way to proactively seek out, document, and mitigate potential vulnerabilities **before** they cost the company millions of dollars — that trajectory shows no signs of slowing down. By answering the formerly unanswerable question, “what is a vulnerability worth?” bug bounty programs are providing a new peace of mind for today’s app devs.

## Auth0 and Bugcrowd: A Security Partnership That Works

Here at Auth0, security is what we do. By partnering with Bugcrowd, we found added peace of mind, further tightened our security perimeter, and have sped up the resolution process when a vulnerability is discovered.

<include src="asides/AboutAuth0" />


Bugcrowd’s Bug Bounty Program: Crowdsource Your App Security

shafiq-shivji

Shafiq leads Product Marketing for Auth0's Ecosystem and Extensibility domains. He brings vast experience from previous roles as a Product Manager and Sales Engineer working in adjacent SaaS industries like machine learning, web/mobile apps, and communications. He especially enjoys the creative process of conceiving and taking high-impact products to market.

Product Marketing Manager

Shafiq Shivji

Learn how Alex Kalyvitis created Auth0 as Code for Terraform


Infrastructure-as-code is a powerful tool to help alleviate the pain of maintaining cloud architecture. DevOps engineers simply have to code a configuration file, feed it into a solution like HashiCorp Terraform, and viola! Changes occur to the appropriate cloud resources. Auth0's Terraform integration came from our developer community, written by Alex Kalyvitis, a software engineer. We sat down with Alex to talk about his experience and what he learned from it.

What Developers and DevOps engineers will learn from this interview:

* Why infrastructure-as-code for authentication
* What it takes to create a successful open-source project

<br>
Shafiq: **How did you first learn about Auth0?**

**Alex**: Like every engineer, you have to deal with the 300-pound authentication gorilla at a certain point. It's not core to your business, but you must get it right or end up with an insecure app. The consensus in the developer world is to let people who it is their core business do that. In my previous experience at Yieldr, we started with basic authentication to ensure only certain people had access. However, we realized early on that we needed more, and it became clear that we had to implement best practices, such as OAuth2 and Open ID connect, and not try to invent our own.

Luckily, some of the best authentication resources come from Auth0. I learned quite a bit from Auth0's documentation and thought that maybe I should use it instead of building one. I gave Auth0 a try, and after exploring features such as social providers, I realized that it was a robust product. I've been happily using it since.

Shafiq: **Why did you write the Auth0 Terraform Provider?**

**Alex**: Creating the Terraform provider started from an internal organizational philosophy of having all of our cloud infrastructures checked in as code. Doing this gives you the ability to manage all the things that support your infrastructures, such as Amazon AWS, Cloudflare, New Relic, Pagerduty, or other infrastructure or service providers. You can treat it with the same level of scrutiny as your product code. So if I make a change to my infrastructure, it's not by signing into a console and toggling the switch off or on. It makes moves more deliberate and safe. 

![terraform-graphic](https://images.ctfassets.net/23aumh6u8s0i/19lCmccl6pWJ2XL2WX0BO6/46384c1eea33b7692e314b9b6ade2588/terraform-graphic)

As an example, once one of our engineers, while developing a new feature, he had toggled a flag in our Auth0 tenant. This broke our login flow. But we didn't immediately make the connection and instead wasted our time looking for a bug in our codebase. It took us about a day to figure out what happened. So at that point, we said, "All right, this has to be managed with code." Unfortunately, there was no Terraform provider for Auth0 at the time. So we decided to build one. I started by looking through the client libraries offered by Auth0, and unfortunately, a Go SDK was not available, so I had to make one as well to support the provider. Fast forward a couple of years, people are using it to provide their authentication infrastructure, with lots of contributions from the community.

Shafiq: **Did you encounter any challenges, and how did you manage them?**

**Alex**: Challenges. Yeah, I mean, there's always a challenge with any project with significant size or complexity. Building the plan, I started by drawing a line in the sand, so to speak, with whatever is supported by Auth0 and whatever is publicly-documented by Auth0. I used Auth0's management documentation, the API documentation, and that was my golden standard. If it wasn't there, it wasn't in the provider. So that's where I based off a lot of the original work.

Later on, of course, people started using it for things that were not necessarily detailed in the API documentation. So with some reverse engineering and by checking out what changes occurred in the dashboard, we managed to add additional functionality. That was challenging in a sense, but it wasn't rocket science, slightly a bit of guesswork. We built an API that, you know, approximates how it should behave.

Also, time, time is critical. I had to balance how much time I could allocate for this project. I had a demanding schedule at work, as we were building a complex product. Therefore building and maintaining the project was done during weekends and afternoons. Balancing that with home-life was a bit of a challenge. I suspect that some users may get frustrated by that, but there's only so much a single person can do, and I've done the best that I could.

Shafiq: **What was your reaction when demand increased for the provider?**

**Alex**: I was thrilled and delighted to see people finding it useful. I had built something people cared about. It's cool. Even though it's not on the level of developing the next Kafka or precious open-source technology, it's building on the shoulders of that. It's super exciting to see people care about your work and finding it so useful that they want to contribute to it. And some people are passionate about it that they feel that it's even their own even though I haven't yet met them in-person.

<p>
<img src="https://images.ctfassets.net/23aumh6u8s0i/uf8X8pIDwiPy3zXcLo2ON/8dffdab99a5612ceb4719a39b1edfe2b/terraform-github" alt="terraform-github" width="410" height="200"/>
</p>

Shafiq: **What did you learn from the experience?**

**Alex**: You always have to be a good host to everybody. It can be easy to get frustrated by a comment or a request that might seem irrational or too far-reaching. But it's important to be level-headed and treat everybody with respect and point them in the right direction. If I think they're wrong, I try to be helpful because, in the end, what you do people see, and they act in kind. So, if you want people to act respectfully, then you'll have to be respectful and earn respect for yourself. And I see that quality in a lot of people, especially around isolated incidents. So, yeah, be a role model in the community that you want to support.

Shafiq: **Why did you decide to make it open-source and not keep it proprietary?**

**Alex**: Well, for starters, it's not something core to our business, as we're focused on building our product. Open-source is a great way to give back to a community as well as enlist the community to contribute. These are two sides of the same coin. So, on the one hand, you put a lot of effort and give something out for free, but you get more eyes and more scrutiny. This is a good thing, especially when you're dealing with something as sensitive as infrastructure. Crowdsourcing via open-source helps to surface issues we would not have foreseen or would not have the time to deal with.

Shafiq: **What would you say to somebody who is considering writing open-source code?**

**Alex**: Do it. Absolutely do it! The process will teach you a bunch of stuff because people, often smarter than you, may find what you do use and be inclined to share their knowledge with you. So in a way, this is a way to learn. For us, engineers, open-source is hugely valuable as we get to read and understand the world's best codebases written by some of the most brilliant people. That's a huge learning opportunity. I don't know why a developer would do something close-sourced unless it's critical to their business. Unless it's a core piece of software that is intellectual property and you wouldn't want your competitors to see, I don't know why not do open-source.

A special thank you to Alex for allowing us to interview him and for the incredible work he's done with Auth0's Terraform Provider. We highly value and appreciate the contribution our developer community continues to make and for the partnership cultivated over the years.

<include src="asides/AboutAuth0" />


Community Developer Brings HashiCorp Terraform to Auth0

ana-cidre

Ana Cidre is a passionate advocate for the developer community and leads the Developer Advocacy team at Auth0. She's committed to fostering a more inclusive and diverse tech world, drawing on her technical background and strategic vision to improve developer experiences and build meaningful connections.

<br>

As the founder of GalsTech, an initiative supporting women in tech in Galicia, and through her active efforts to create welcoming spaces for underrepresented groups, Ana's dedication to diversity and inclusion extends beyond her daily work.

<br>

Ana has a proven track record of building global Developer Relations teams, cultivating active developer communities, and crafting impactful educational content. She maintains a strong connection to the community through speaking engagements and direct interaction with developers.

Sr Manager, Developer Advocacy

Ana Cidre

Sam4-square

I'm an Identity nerd with many years of experience as a developer and advocate. I love explaining complex topics clearly and understandably. You can find me on stage at developer events worldwide or simply having great conversations in the hallway. Google has recognized me as a Google Developer Expert (GDE) in the domains of Web Technologies, Security, Privacy, Payments, and Identity.

Principal Developer Advocate

Sam Bellen

Avocado Labs is a platform where we share expert content about web technologies.



On April 17th, 2020 we launched a new initiative run by the Developer Relations team at Auth0: [Avocado Labs](https://avocadolabs.dev). With this initiative, we are on a mission to bring expert content to you, in the comfort of your own home.

## What is Avocado Labs?

Avocado Labs is a platform where we share expert content about web technologies. Our first approach is through online meetups. We will be hosting bi-weekly meetups which consist of two talks per meetup and each edition will be focussed on one technology. Our first episode was about Angular and more specifically Ivy, the Angular compiler. We had two incredible speakers who are renowned specialists in their fields and Google Developer Experts for Angular: Manfred Steyer and Martina Kraus.

In the future, we want to explore other ways of delivering content and figure out what the community is hungry for! We also want to bring communities closer together and find ways of doing it virtually! If you have any suggestions, please feel free to reach out to us on [Twitter](https://twitter.com/Avocado_Labs).

## Why Avocado Labs?

This question is probably the most important. At Auth0, one of our core values is that “We give a sh^\* t” and we really do! The technological community is important to us and we know that it isn’t always easy to go to a conference or a meetup, no matter what the reason might be. We believe that anyone and everyone should be able to have access to quality content and to be able to be part of a community.

We also know that right now the majority of the world is on lockdown which means that people cannot go to physical events, speakers cannot deliver amazing content, and communities cannot gather. We want to help in these times by providing at least some of this. But like mentioned above, this is an ongoing initiative. We won’t stop once things go back to “normal” - Whatever that new normal might be.

![Avocado Labs](https://images.ctfassets.net/23aumh6u8s0i/7vPhXR3e4hzNxn7XdxN8x1/d97fb8dd11cd30179423535a03240a38/avocado_twitter)

## So, What Now?

Why not join us? To follow up on what we’re up to, you can follow us on [Twitter](https://twitter.com/Avocado_Labs). If you’re interested in attending our online events, we suggest that you join our [meetup group](https://www.meetup.com/avocado-labs-talks/). And if you would like to speak at one of our events, please fill out our [call for papers](https://forms.gle/k6gLQc94xTjSunHXA).
Also, any suggestions are more than welcome! Just send us a direct message on Twitter.

## And… What’s Next?

Avocado Labs just took off 1 week ago, so we’re still at a very early stage, but we have plans to grow! One of the first things we want to do is to have our own website where we share all the content and events we are hosting and have already hosted.

Like mentioned before, we want to start exploring other ways of delivering content. That might happen as a podcast, live streams, or maybe even something completely different! This initiative is for the community, so we are all ears and we want to know what you want.

Another part of Avocado Labs that we want to work on is bringing the community together. One of the most valuable parts of in-person events is meeting friends and making new ones. We want to find ways to mimic those virtually, whether it’s through a Zoom call, demos, or maybe even online escape rooms!

We are very excited to see where this adventure takes us and we would very much like to see you come on this journey with us :)

<include src="asides/AboutAuth0" />


Introducing: Avocado Labs

kerry-ok

Kerry is a marketer that loves to partner with the sales organization. As our SVP for Marketing, she is focused on sharing the Auth0 narrative across the globe. Before Auth0, Kerry spent many years working in B2B Tech at Skytap and F5 Networks. She spends her spare time with her family, dog, working in the yard, and enjoying fantasy football.

Chief Marketing Officer

Kerry Ok

The Auth0 Design team has created a collection of Zoom Backgrounds that we are sharing with the community


  <div class="alert alert-info alert-icon">
  <i class="icon-budicon-500"></i>
  <strong><a href="https://cdn.auth0.com/blog/custom-zoom-backgrounds/new-custom-zoom-backgrounds-by-auth0-design.zip">Download the free Custom Zoom Backgrounds by Auth0 Design</a></strong></div>

In recent weeks, millions of employees have transitioned to remote work and have started to use Zoom video chat to collaborate with team members who are also relegated to their homes — the ‘new normal’ of working. Zoom usage has also expanded greatly with small businesses, students, families, and social groups connecting virtually. 

One popular feature of Zoom that’s getting due attention is its ability to create virtual backgrounds. Whether for fun or to simply hide a messy backdrop, these options transform the room behind you into the majestic Golden Gate Bridge, the expanse of outer space, or a serene field of grass. Users can also upload a photo of their choice to create a more personalized background experience. Limitless and equally fun it its appeal, this has become a very popular diversion for Zoom users. Many companies are even running contests to see who has the most interesting Zoom background image.  

If you want to get started or are already using virtual background images, the Auth0 Design team has created a collection of background images that we are sharing with our community for even more creative options. We hope you enjoy these backgrounds inspired by technology, modern art and film.  

<script src="https://fast.wistia.com/embed/medias/1e1zdgfw9b.jsonp" async></script><script src="https://fast.wistia.com/assets/external/E-v1.js" async></script><div class="wistia_responsive_padding" style="padding:62.5% 0 0 0;position:relative;"><div class="wistia_responsive_wrapper" style="height:100%;left:0;position:absolute;top:0;width:100%;"><div class="wistia_embed wistia_async_1e1zdgfw9b videoFoam=true" style="height:100%;position:relative;width:100%">&nbsp;</div></div></div>
<br>

  <div class="alert alert-info alert-icon">
  <i class="icon-budicon-500"></i>
  <strong><a href="https://cdn.auth0.com/blog/custom-zoom-backgrounds/new-custom-zoom-backgrounds-by-auth0-design.zip">Download the .zip file with all images</a></strong></div>

Once you have downloaded and unzipped the image collection, here are the simple steps for changing your virtual background in Zoom. 

## Steps to Change Your Zoom Background on a Desktop

1. In the Zoom.us, then click preferences (alternatively you can also select the up arrow next to start the video). 

2.  Next  -click Virtual Background (or Choose a Virtual Background). 

![Virtual Background](https://images.ctfassets.net/23aumh6u8s0i/4e6tjs00XgM0haE2kXWyqF/9624d91b768fa781eec0092925c5b9ea/zoom01)

3. You'll see a few default background options provided by Zoom. You can choose one of those by clicking on it, and it will automatically change your screen. There's also an option for if you have a green screen and want to use that. 

![Choose your Auth0 Zoom Virtual Background](https://images.ctfassets.net/23aumh6u8s0i/4iyRJ9ZibIUZJn30IR1g0e/aff7e1a7913dbc3ec6e43ed7ef7709cb/choose-your-auth0-zoom-virtual-background)

4. If you want to upload the photo images you have downloaded to use as your background, on the same Virtual Background Page, click the + icon next to where it says Choose Virtual Background. A box will pop up allowing you to upload one of these images from your computer. Click on the one you want, and it will appear alongside the other pictures as an option for you to choose from. Select that image.

5. To get rid of any photos you upload, tap the X in their top left corner. 

## Steps to Change Your Zoom Background on Mobile

1. When you log into your account and join a meeting, tap the three dots at the bottom right of the screen to open the More menu. 

2. Select Virtual Background. 

3. Select a background from the default options, or upload your own image (see instructions above). 

Enjoy!


Custom Zoom Backgrounds by Auth0 Design

kapehe-jorgenson

Kapehe is an R&D Content Engineer for Auth0 with a passion for learning and teaching. With her primary focus on ReactJS and JavaScript, she is impressed with what code can create for the web. Technology and web development are constantly evolving and naturally bring that need for continual learning. She enjoys writing tutorials, hosting local meetups, and learning with others to expand coding knowledge.

R&D Content Engineer

Kapehe Jorgenson

React Conf 2019 was a success! We learned, we laughed, we connected!



React Conf 2019 happened!

If you found yourself in Lake Las Vegas this past weekend, chances are you saw some of the coolest new UI designs for Facebook, learned about how [React Native](https://facebook.github.io/react-native/) apps are helping change world hunger, and learned loads about [React Suspense](https://reactjs.org/docs/concurrent-mode-suspense.html). React Suspense? That is React’s system for handling the loading of things like code, data, and images. (Don’t worry, we’ll talk about all this stuff!)

![The stage at React Conf](https://images.ctfassets.net/23aumh6u8s0i/1vAxvKEfaEce6dIlvdyEji/933f1c4268b9c684138460a0ae841cd5/stage)

Located about 20 minutes from the famous Las Vegas Strip, Lake Las Vegas sits in a quiet little nook of the valley. Held at the Westin hotel, [React Conf](https://conf.reactjs.org/index.html) had over 600 attendees that came from all over the world to learn about all things React. Facebook sponsored the conference and they put on a great show!

The line up of speakers was fantastic and you could feel the energy in each of them! From [Tejas Kumar](https://twitter.com/TejasKumar_) showing us how to display dogs and gifs using GraphQL all the way to [Sophie Alpert](https://twitter.com/sophiebits) live coding everything from her slides to her demo code to build her own ReactDOM. WHAT?!

Each speaker was on-point. And while I won't go over each speaker, they were all equally fantastic!

<include src="TweetQuote" quoteText="Held at the Westin hotel, React Conf had over 600 attendees that came from all over the world to learn about all things React."/>

## Day 1

## Tom Occhino and Yuzhi Zheng &mdash; Keynote

The day started with the keynote by Tom Occhino and Yuzhi Zheng.

### Tom Occhino

Tom started his talk out by speaking about the first React conference. How at that conference React Native was introduced to the world! React’s goal is to create great developer and user experiences.

He spoke on the DX (Developer Experience) and that it needs three things:

1. Low barrier to entry
2. High productivity
3. Ability to scale

My favorite quote from his talk was: “Learning React does not mean you don’t need to learn about JavaScript or anything about the web and learning React Native does not mean you don’t need to learn iOS, Android, or Windows. What it means is that you don’t need to develop a deep level of understanding of all of these things first. You can get started quickly.”

### Yuzhi Zheng

Yuzhi’s talk covered some of the projects that the React core team has been working on over the past year! Yuzhi is the Engineering Manager for React core team and the Relay team at Facebook.

Some of the exciting projects that the React core team is working on are:

* Accessibility by adding in features so developers can add in accessibility easily
* Improve initial render time by using server-side rendering the team is improving load times
* React Suspense will help improve the user’s experience by handling the loading of different elements.

## Frank Yan and Ashley Watkins &mdash; Building the New Facebook With React and Relay

### Frank Yan

The original Facebook was built with PHP. It soon grew to include CSS, vanilla JS, Flux, React, and Relay.

Facebook wanted a better user experience by adding:

1. Modern Design System
2. Improved Accessibility
3. Faster Page Loads
4. Seamless Interactions

Facebook had to re-think and re-build to add these in. They used [React](https://reactjs.org/), [GraphQL](https://graphql.org/), and [Relay](https://relay.dev/).

## Ashley Watkins

Ashley followed Frank and started with how React, GraphQL, and Relay were going to help Facebook fetch and manage the data. When she talked about data she meant anything needed from an API like the user's name.

She had a lot of awesome videos showing how the data loads on the page for the user and how Facebook is changing that loading experience by utilizing GraphQL and Relay. 

One important concept for facebook is "Time to First Paint." They wanted to have a better view while items loaded for the user so that it was more fluid and effective.

## Tania Papazafeiropoulou &mdash; How Our Team is Using React Native to Save the World

Food waste is a huge problem in our world and Tania is taking the first steps in order to solve that problem. There's a team that built a React Native app in only three months that is intended to help this food waste problem.

1/3 of all food produced is wasted. We can do better. Tania and her team created an app called [OLIO](https://olioex.com/). OLIO allows for people to connect and give away their extra food. 

The team was able to re-use components by using container patterns, they were able to use [Hermes](https://facebook.github.io/react-native/docs/hermes/) that helps with memory usage and creates a smaller app size, and to have the ability to use OLIO on the browser. This is great! You could tell the crowd at React Conf was excited for OLIO.

## Tejas Kumar &mdash; Using Hooks and Codegen to Bring the Benefits of GraphQL to REST APIs

Coming back from the morning break, Tejas started us off. He talked about "REST and GraphQL and Stuff."

He built an app live on stage that pulled data from the Giphy API using React Hooks, automatically generated from an OpenAPI document. These hooks were fully type-safe and enabled predictable code and end-to-end type-safety.

The main takeaway from his talk? 

* Types are your friends
* Tests are your friends
* Nothing is impossible 
* Get creative

## Sophie Alpert &mdash; Building a Custom React Renderer

<blockquote class="twitter-tweet"><p lang="en" dir="ltr">💥 Live Now! 💥 <a href="https://twitter.com/sophiebits?ref_src=twsrc%5Etfw">@sophiebits</a> LIVE CODING! 💥 to a packed room 💥 <a href="https://t.co/WUQxgTUkNk">pic.twitter.com/WUQxgTUkNk</a></p>&mdash; Kapehe @ React Conf (@kapehe_ok) <a href="https://twitter.com/kapehe_ok/status/1187440627346100225?ref_src=twsrc%5Etfw">October 24, 2019</a></blockquote> <script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script>

Have you always wanted to build your own ReactDOM in less than 30 minutes? Well, Sophie did just that.

Her talk was 100% live coded, even the "slides," and she manipulated the default React `App.js` file view to show her DOM in action.

She created a `ReactDOMMini` file where she manipulated her own DOM and allowed for the creative changes. Those changes? 

1. Click on the React spinning logo and make it disappear
2. Created a blinking color effect on the "Edit src/App.js and save to reload" line in the file. 

## Day 2

![The stage at React Conf](https://images.ctfassets.net/23aumh6u8s0i/5OXaV1hnFMhMSqf6yvokcO/c16efde48c3e76c4b1e342f93438b969/stage-2)

## Brian Vaughn &mdash; React Developer Tooling

Focusing on the developer experience, Brian focused on three major things for React Developer tooling:

1. Write code quickly: Speeding up the process of writing components
2. Debug code effectively: Streamlining the process of debugging and performance profiling applications
3. Update code easily: Making it easier to stay up to date on the latest React features

He doesn't want React developers to stop what they are doing but rather speed up what they are doing with these new tools. 

He also showed us how we find the components and inspect them directly in the console. You can also change the type of props and add new props in the React developer tools. 

Big new feature! Hooks are supported at the same level as `props` and `state`! Ok, but what does this mean? Values can now be edited and nested arrays and objects can be expanded! 

There are so many more new and improved updates! [Check them all out](https://reactjs.org/blog/2019/08/15/new-react-devtools.html)!

<include src="TweetQuote" quoteText="React Developer Tools will help developers speed up what they are already doing."/>

## Alexandra Holachek &mdash; Progressive Web Animations

There are a lot of things happening behind the scenes when it comes to mobile animations. Notice how there's a little bounce to some elements when your finger lets it go on the screen? Or a carousel of photos that keep scrolling even after our finger has lifted off the screen?

There are effects like the rubberband effect. It's what I was talking about before where you can pull up on a menu or a footer and it'll bounce in a rubberband way to show its max expanded limit.

Alexandra showed that there are tests they run that will "predict" what the user is trying to do. For example, if you are scrolling through your inbox, you cannot possibly do a perfect up and down swipe every single time. So it predicts that you are not actually swiping to delete when scrolling through your inbox.

<blockquote class="twitter-tweet"><p lang="en" dir="ltr">The talk about animations by <a href="https://twitter.com/alex_holachek?ref_src=twsrc%5Etfw">@alex_holachek</a> was absolutely stunning. Must watch. Demo repository: <a href="https://t.co/h1tc0RAKa7">https://t.co/h1tc0RAKa7</a></p>&mdash; Dan Abramov (@dan_abramov) <a href="https://twitter.com/dan_abramov/status/1187805350944227328?ref_src=twsrc%5Etfw">October 25, 2019</a></blockquote> <script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script>

## Luca Damasco &mdash; Creating Games, Animations, and Interactions with Wick Editor

Wick Editor is an open-source tool that allows you to create things like games and animations. It's a two-person team and they have been working on it for about four years now!

Luca showed us some amazing animations that can be made with Wick Editor! He showed us this cat animation thing where the cat roams the hills, runs into trees, and the user is meant to try and catch the cat.

Developers of all ages can work on Wick Editor! He shows a game that a child had created where you move a rabbit around to collect carrots and crowns!

## Overview

This was my first attendance to a React conference, and I must say, the community was an inviting, energetic, and very intelligent group of humans! The hallway track was valuable! Brand new developers were given opportunities to speak to the React core team, developers from Amazon, or even catch up with their developer heroes.

You can find the YouTube videos from [day one here](https://www.youtube.com/watch?v=UxoX2faIgDQ&t=11558s) and [day two here](https://www.youtube.com/watch?v=JDDxR1a15Yo&t=19919s). I have listed in order, the speakers so you may easily jump around the video to find your desired talked. But trust me, you'll wanna watch them all!

### Day 1

1. [Tom Occhino](https://twitter.com/tomocchino) & [Yuzhi Zheng](https://twitter.com/yuzhiz) &mdash; Keynote
2. [Frank Yan](https://twitter.com/frankyan) & [Ashley Watkins](https://twitter.com/catchingash) &mdash; Building the New Facebook with React and Relay
3. [Tania Papazafeiropoulou](https://twitter.com/_Tany_) &mdash; How Our Team is Using React Native to Save the World
4. [Tejas Kumar](https://twitter.com/TejasKumar_) &mdash; Using Hooks and Codegen to Bring the Benefits of GraphQL to REST APIs
5. [Sophie Alpert](https://twitter.com/sophiebits) &mdash; Building a Custom React Renderer
6. [Nat Alison](https://twitter.com/tesseralis) &mdash; Is React Translated Yet?
7. [Maja Wichrowska](https://twitter.com/majapw) & [Tae Kim](https://twitter.com/taekimjr) &mdash; Building (And Re-Building) the AirBnB Design System
8. [Brittany Feenstra](https://twitter.com/BrittanyIRL) &mdash; Accessibility Is a Marathon, Not a Spring
9. [Becca Bailey](https://twitter.com/beccaliz) &mdash; The State of React State in 2019
10. [Lee Byron](https://twitter.com/leeb) &mdash; Let's Program Like It's 1999

### Day 2 

1. [Brian Vaughn](https://twitter.com/brian_d_vaughn) &mdash; React Developer Tooling 
2. [Joe Savona](https://twitter.com/en_JS) &mdash; Data Fetching with Suspense in Relay
3. [Cameron Yick](https://twitter.com/hydrosquall) &mdash; Automatic Visualizations of the Frontend
4. [Jenn Creighton](https://twitter.com/gurlcode) &mdash; React is Fiction
5. [Alexandra Holacheck](https://twitter.com/alex_holachek) &mdash; Progressive Web Animations
6. [Luca Damasco](https://twitter.com/Lucapodular) &mdash; Creating Games, Animations, and Interactions with the Wick Editor: A UX Talk
7. [Jed Watson](https://twitter.com/JedWatson) &mdash; Building React-Select
8. [Lizzie Salita](https://twitter.com/ebsalita) &mdash; Promoting Transparency in Government Spending with React
9. [Alex Anderson](https://twitter.com/ralex1993) &mdash; Wonder-Drive Development: Using React to Make a Spaceship

<include src="asides/AboutAuth0" />

---


React Conf: An Energetic Reactive Community

auziros:mckenzie-mayer

Customer Identity (CIAM) Product Comms lead, driving collective storytelling across Okta and Auth0. Making technology accessible for everyone.

Customer Identity Product Comms Lead at Okta

McKenzie Mayer

Auth0 provides global community of 30 million developers, educators, and businesses with simple, secure identity management


**LONDON - July 29, 2019 -** [Auth0](https://auth0.com/), a global leader in Identity-as-a-Service (IDaaS), today announced it has been selected as the identity management platform of choice for Arduino®, the world's leading open-source hardware and software ecosystem. With a global community of 30 million "makers", [Arduino](https://www.arduino.cc/) will use Auth0 to replace its own Single Sign On solution for all of its public facing web properties, including Arduino Create and community apps.

Arduino is on a mission to enable anyone to innovate by making complex technology simple to use. Its simple and accessible electronic boards, open-source software, and user community have powered thousands of projects, [from everyday objects to complex scientific instruments](https://create.arduino.cc/projecthub). Educational institutions around the world also use Arduino as a resource for STEAM programmes &ndash; integrating Science, Technology, Engineering, Arts, and Math.

Arduino discovered its homegrown authentication solution would not scale to meet the rapidly developing needs of its growing global community, and reached out to Auth0. In addition to Single Sign On, Arduino will take advantage of Auth0's new [Universal Login](https://auth0.com/docs/universal-login), which enables developers to completely customise their branded authentication experiences quickly, and [Device Flow](https://auth0.com/device-flow/) for browserless or input-constrained devices.

"We wanted a robust platform to replace our SSO solution but also give us the flexibility to do cool, new things in the device authentication space. Auth0 is a brand we admire, and their API-based approach makes it easy to migrate our login data in a way that's completely transparent for the customer," said Gianluca Varisco, CISO at Arduino. "We are excited to welcome them to our global community."

Auth0 and Arduino plan to leverage the combined power of their communities and events, and explore a technical partnership in the IoT domain. Auth0 currently secures more than 2.5 billion logins per month for 21 million users.

"I have been using Arduino for years as the brain for my personal projects, so working with them in a business capacity is really rewarding," said Eugenio Pace, CEO and co-founder of Auth0. "When you empower the developer with simple, powerful tools, the whole business benefits. We are excited by the reach of the Arduino community and aligned in our mission to help the developer in their journey to innovate."

<include src="asides/AboutAuth0" />

### Media Contacts:

Mark Fowler<br/>
Racepoint Global for Auth0, EMEA<br/>
[auth0@racepointglobal.com](mailto:auth0@racepointglobal.com)<br/>
+44 (0) 77 1124 4113


Arduino Selects Auth0 as Standardized Login for Open-Source Ecosystem

jenny-obrien

I'm a former business journalist who's fascinated by the intersection of tech and business strategy — in particular how the right solution can transform an idea into reality. I specialize in ROI, data privacy, and identity.

Business Content Manager

Jenny O'Brien

Community Marketing expert Hideki Ojima shares why he chose to help Auth0 expand in Japan, his 3 principles for community growth, and more!



After helping large tech companies like [Adobe](https://www.adobe.com/) and [AWS](https://aws.amazon.com/) build their Japanese presence, community marketing expert [Hideki Ojima](https://www.linkedin.com/in/hideki-ojima-548032a/?originalSubdomain=jp) turned his attention to doing the same for companies like [Stripe](https://stripe.com/), [CircleCI](https://circleci.com/) and, more recently, Auth0. With nearly two decades in the field, he remains [as fascinated as Marc Andreessen](https://www.wsj.com/articles/SB10001424053111903480904576512250915629460) by how SOFTWARE is eating the world. Riding the wave of cloud computing, everything is getting faster and faster he says, citing the pace of innovation as one of his key reasons for remaining in tech marketing.

![Community Marketing expert Hideki Ojima brings nearly two decades of experience in the field.](https://images.ctfassets.net/23aumh6u8s0i/4KNbxbC9NRSwux4Lpr1eUk/5e66eac38bb59f54749c5f00d1335715/auth0-japan-community-manager-hideki-ojima)

The other fascination is the customer.

When Ojima started in marketing, he says product was king. Since the arrival of the cloud, subscription and pay-as-you-go services have moved the customer onto the throne.

Companies need to listen to communities through carefully run feedback loops to harness the power of customer loyalty that will provide solid, scalable growth, says Ojima.

We talked about why he’s chosen to help Auth0 expand in the region, what companies might find surprising about growing community in Japan, and advice for starting a global movement.

<include src="TweetQuote" quoteText="Companies like @adobe and @aws relied on @hide69oz to grow community in Japan (and @stripe and @circleci still do). Now he’s helping @auth0."/>

**What three aspects of community marketing are critical to a company’s success and why?**  

Well... I think there are 3 principles for community growth: Offline-first, Context-first, and Output-first.

**Offline-first**: Many people tend to think that online communication is the key factor for community growth because it seems to be scalable. However, in many cases, the first ignition point of community growth is offline communication. People tend to adopt the opinions of people they know in person. So the community should start from the offline meetup, then, build the online communication space.

**Context-first**: Just gathering people won’t work well for continuous growth. People need a common reason/goal/vision to keep working together. This applies for community-building as well. We need to build and share the common context of the community with its participants.

**Output-first**: If you have a meetup, what’s discussed including slides, etc. should be shared externally for community growth — essentially, you need to share the output of the meetup. Without such output, people outside of the community may never discover the community and might miss the opportunity to enter. Output often elicits questions, comments, and alternative opinions, creating a cycle of engagement that helps build community. But the  output-input-output cycle is really key thing for expanding the influence of the community. And the cycle should begin with the Output.

**What drew you to Auth0?**

As you may know, I'm working for several cloud services (btw, all services are running on AWS!) and each service is the key element of a subscription cloud business, such as online payments, CI/CD (continuous integration/continuous delivery), collaboration, etc.  An authentication and authorization platform is definitely key for cloud businesses. I think Auth0 is one of the leading platforms in this area, and this is the reason why I have chosen Auth0 as a new company to work with.

**What would companies find surprising about growing community in Japan?**

Especially in the B2B area, the power of community has been getting bigger and bigger. It was proven by AWS Japan and JAWS-UG (Japan AWS User Group). For example, JAWS-UG has just held its own annual conference “JAWS DAYS” on Feb. 23th, 2019 with an impressive 1,900 actual attendees. This annual event was started seven years ago and has been 100% organized by community members. Following this trend, many B2B vendors are trying to make a similar movement for their own services. This is a typical behavior change in Japan’s B2B industry.

<include src="TweetQuote" quoteText="Surprising insights about growing a company’s community in Japan from @hide69oz."/>

**What advice do you have for growing community globally?**

Find the right leaders and followers in each regional market. They should be hiding in your existing customers. Sometimes, they are large companies, and sometimes, they are startups and individual developers. But the company size or title of the person doesn’t matter. Enthusiasm for your service is what’s important. You can find out which customers are enthusiastic about your product through face-to-face meetings, recommendations from the customer success team, and remarks on social networks, etc. Once you find the right customers, you can create a [movement](https://www.ted.com/talks/derek_sivers_how_to_start_a_movement) anywhere you run the business.

<include src="asides/AboutAuth0" />


Auth0 Welcomes Hideki Ojima to the Team

krti_XnE_400x400

At Auth0 we ❤️ developers. Serving & giving back to the community is one of the most rewarding things we do. We want to empower others to join the mission!

Auth0 Ambassador

Find out how the Auth0 Ambassador program achieved its mission of empowering the developer community in 2018.



The [Auth0 Ambassador Program](https://auth0.com/ambassador-program) was founded to empower the developer community, help make the internet safer, and allow passionate individuals to build their personal brand. The program was officially launched back in July of 2017 and to date has over 75 Ambassadors in 32 countries spanning the globe from the United States to Japan.

![Auth0 Ambassador Program astronaut icon](https://images.ctfassets.net/23aumh6u8s0i/1KyRa1D75OF3wQNtVcj9Vg/f36329e84b9da9161bb797f428e8e2ce/wallpaper)

Auth0 Ambassadors contribute by writing blog posts, giving talks at meetups and conferences, hosting workshops and webinars, and organizing local developer events in their communities and abroad. Whether speaking at a generalist conference like [CodeMash](http://www.codemash.org/) or something more specific like [ngAtl](https://ng-atl.org/), Auth0 Ambassadors share knowledge, tips, and best practices on topics relating to identity, security, and authentication.

Our ambassadors come from very diverse backgrounds and skill sets ranging from CTO’s like [Mercedes Wyss](https://twitter.com/itrjwyss?lang=en), entrepreneurs like [Dominik Angerer](https://www.dominikangerer.com/), to experienced software engineers and speakers like [Mehul Patel](https://twitter.com/rowdymehul). Each Auth0 Ambassador possesses a unique skill set that makes them invaluable to the developer community.

2018 was a huge year for the Ambassador Program. I want to share some stats and lessons learned to both celebrate and highlight the hard work and contributions our ambassadors have made. Finally, I hope this post helps others who are interested or running ambassador and evangelism programs within their companies. Collaboration makes us all stronger. Let’s first start with the stats!

## By the Numbers — Ambassadors

The Auth0 Ambassador Program went live in July of 2017. By the end of 2017 we had onboarded a total of **47** ambassadors. By the end of 2018 we had increased our head count to **75**. This represents a ~60% increase in the total number of ambassadors within our program.

![Map of Auth0 Ambassadors worldwide in 2018](https://images.ctfassets.net/23aumh6u8s0i/48XdpxjSTungbnnrBOCDzg/54558bee8de0b8e77f741588cd837b35/ambassadors-2018)

## Lessons Learned — Ambassadors

The Auth0 Ambassador program is primary run by two people, [Ado Kukic](https://auth0.com/blog/authors/ado-kukic/) (me) and [Diego Poza](https://auth0.com/blog/authors/diego-poza/). Together we coordinate the ambassador program, review applications, host training sessions, help ambassadors book travel to events, and everything else that comes with running the program. This is all in addition to our regular day to day duties of being a Developer Evangelist and Head of Content and Evangelism, respectively.

The key takeaways for 2018 for us has been:

* **Nurture** — the ambassador program is a two-way street. Ambassadors represent our company so providing them with tools, guidance, training, and mentorship they may need is key to keeping them engaged.
* **Recognition** — recognizing ambassadors that go out of their way to create contributions creates a positive feedback loop.
* **Organization** — any growing team will experience growing pains, mitigating them is what will make or break morale. Introduce new tools that simplify communication and collaboration.

## By the Numbers — Contributions

In 2017, the Ambassador Program tracked a total of **51** contributions. The majority of these contributions were ambassadors speaking at meetups, which tracked at 24 events, followed by speaking at conferences which we tracked at 23 events. Because the Ambassador Program was launched in the middle of the year, we really only had 6 months of data, but if we were to naively extrapolate that, we could assume that had the program run for the entire year, we’d be sitting at around 100 events total.

![Ambassador chart showing contributions like conferences, meetups, webinars, and more in 2018](https://images.ctfassets.net/23aumh6u8s0i/78PDOvf4iOTiSoqPAO22oq/4b6b6efb96f13e56dc3e6f4b4410b32e/contributions-2018)

In 2018, the Ambassador Program tracked a total of **204** contributions reaching over **25,000** developers in-person. The vast majority of the contributions for 2018 were conference speaking events, which accounted for over 100 contributions. Auth0 Ambassadors spoke at many major conferences this year including AngularUp, DroidCon Berlin, CodeMash, ngAtl, CodeMash, Oracle Code, API Days, FrontEnd Con, and many others.

Our ambassadors didn’t just focus on major conferences. Getting involved with local developer communities also played a pivotal role and our ambassadors participated in giving talks at OrlandoJS, LondonPHP, MadridJS, BA NodeJS, Devs+502, StahlstadtJS, ColomboJS, GDG Sri Lanka, and many other meetups just to name a few.

![Auth0 Ambassador conference and meetup contribution map, worldwide by country in 2018](https://images.ctfassets.net/23aumh6u8s0i/31ZBwQfr71wM7GanWxucqp/c223b640c43b3532611015a488796d09/contributions-by-country-2018)

*Auth0 Ambassadors have attended or organized events in over 40 countries in 2018.*

## Lessons Learned — Contributions

Each one of our ambassadors has a unique voice and preference. Some prefer speaking at large conferences with thousands of attendees, others prefer to focus on their local developer communities, and yet others prefer to write rather than speak. The key takeaways for 2018 when it comes to contributions for us were:

* **Empowerment** — each ambassador has a unique style and approach. Empower them to make contributions on their own terms and find ways to make their contributions beneficial to the overall goal.
* **Simplify** — respect the ambassador’s time. Make it easy for ambassadors to contribute as well as to track their contributions.
* **Compromise** — nothing should ever be set in stone. Be adaptable and willing to compromise to get the best out of people.

## Notable Wins

Finally, before I wrap up this post, I do want to highlight some notable wins our ambassadors achieved this year.

### Ambassador of the Month Winners

Each month we recognize ambassadors that go above and beyond and make significant contributions or do something that really stands out.

Our winners in 2018 include:

* [Anthony Brown](https://twitter.com/awefulBrown)
* [Anthony Chow](https://twitter.com/vCloudernBeer)
* [Alberto Salazar](https://twitter.com/betoSalazar)
* [Biodun Chris](https://twitter.com/biodunch)
* [Ignacio Anaya](https://twitter.com/ianaya89)
* [Md Shahbaz Alam](https://twitter.com/mdsbzalam)
* [Mehul Patel](https://twitter.com/rowdymehul)
* [Mercedes Wyss](https://twitter.com/itrjwyss) — Won Ambassador of the Month six times since the program started.
* [Takahiro Tsuchiya](https://twitter.com/corocn)
* [Vincenzo Chianese](https://vncz.js.org/)

Internally, every Auth0 employee is also eligible to participate in the Ambassador Program, and we also award internal ambassadors as well.

Our internal winners for 2018 include:

* [Jeremy Meiss](https://auth0.com/blog/authors/jeremy-meiss/)
* [Joe Brinkman](https://twitter.com/jbrinkman)
* [Kim Maida](https://auth0.com/blog/authors/kim-maida/)
* [Kim Noel](https://auth0.com/blog/authors/kim-noel/)
* [Luke Oliff](https://auth0.com/blog/authors/luke-oliff/)
* [Prosper Otemuyiwa](https://auth0.com/blog/authors/prosper-otemuyiwa/)

### Auth0 Ambassador turned Auth0 Developer Evangelist

This year we’ve had one ambassador join our company full-time as a Developer Evangelist. Ben Dechrai went from Auth0 Ambassador to Auth0 Developer Evangelist in the APAC region in Q3 of 2018. Congrats Ben!

## Auth0 Ambassador Program in 2019

I am optimistic for the future of the Auth0 Ambassador Program. The contributions our ambassadors have made in 2018 have lived up to our expectations and goals of empowering developer communities and helping make the internet safer.

![Ambassador Program badge icon](https://images.ctfassets.net/23aumh6u8s0i/5oZTne6XJiBcjZaLmq7C8J/670e49032a213a99aa9bfe45e5f13d26/ambassador-badge)

The mission continues in 2019 and we would love to have you join us along for the ride. With new initiatives such as the Identity and Security Meetups there has never been a better time to join. If interested, why not [**Join the Mission?**](https://auth0.com/ambassador-program)

<include src="asides/AboutAuth0" />


Auth0 Ambassador Program in 2018 — By The Numbers

956290?s=200

Luke Oliff

Auth0 is moving to Discourse for blog comments in an attempt to better serve readers with queries, with the combined knowledge from their developer community



## What's Happening?

We’re just finishing up the process of switching away from DISQUS to use an embedded version of our [Discourse](https://www.discourse.org/) forum based [Auth0 Community](https://community.auth0.com) on the blog.

![Auth0 now uses Discourse for blog comments](https://images.ctfassets.net/23aumh6u8s0i/5zRym3AKwoiefILArCLSmM/9c162ed10fec934309d1c4c26abff7f5/discourse-civilized-discussion)

This means that, instead of using DISQUS at the bottom of blog posts for readers to provide feedback and ask questions, we’ll be using Discourse instead.

Engaging our authors and readers in the community will benefit everyone in the long run. The community is quickly fulfilling its goal to become a valuable source of knowledge for developers using Auth0. It makes sense to further focus our efforts on that resource, instead of leaving valuable questions and answers isolated on the blog pages.

## What About My Existing Questions?

Existing blog posts will continue to display and use DISQUS for the foreseeable future. So only future questions will require you to log in.

## What Do I Need to Do?

Nothing, really. As a frequent reader, you could [sign up](https://community.auth0.com) ahead of time, for the Auth0 Community.

<include src="asides/AboutAuth0" />


Auth0 Is Moving to Discourse for Blog Comments

kim-noel

Former Auth0 Employee

Kim Noel

What do apple picking, beer festivals, ghosts and goblins, and open-source all have in common?



We at Auth0 are excited to announce our participation in this years Hacktoberfest!

![Hacktoberfest 2018 logo](https://images.ctfassets.net/23aumh6u8s0i/64mee50TQDaqpOjwCo80bw/02fe61e51cd3a3935267e45bbbc652aa/hacktoberfest_logo)

## Hold up — What's Hacktoberfest?

[DigitalOcean](https://digitalocean.com/), [GitHub](https://github.com/), and - new for this year - [Twilio](https://www.twilio.com/) have partnered up for a month-long celebration of open-source software (OSS). This takes place from October 1st to October 31st inclusive, and you can sign up at any time during the month. This event facilitates the ability to be a part of a growing movement to encourage and contribute to open-source software. 

<include src="TweetQuote" quoteText="If you have never contributed to an open-source project before, there is a #hacktoberfest My-First-PR Starter Project at https://my-first-pr.github.io/hacktoberfest-2018/ available that you can use to practice making changes and creating pull requests"/>

Have you been looking for an opportunity to contribute to an open-source project? Had a hard time getting started? Been searching for a sign? _This is your sign!_ This is your chance to give back to the amazing projects that you and others alike use on a daily basis. Take advantage of this opportunity to help build a stronger product and have your voice heard! No contribution is too small: bug fixes to documentation, updates to translations, and much more are valid ways of participating.  

This month we get to see a lot of extra support to help folks get involved in open-source software and it’s with great enthusiasm we want people to take advantage of this! There are a large number of resources available to help you find a project and make your first contribution. Or, if it’s not your first, your next contribution. There are [many stories to read](https://medium.com/@thepriefy/my-first-github-pull-request-and-hacktoberfest-2017-a83622020390), and articles outlining [ways to get involved](https://medium.freecodecamp.org/i-just-got-my-free-hacktoberfest-shirt-heres-a-quick-way-you-can-get-yours-fa78d6e24307).

And guess what? This event has been taking place, every October, for 5 years!

_Happy five years of Hacktoberfest!_

A huge shoutout to DigitalOcean on a happy 5 years of Hacktoberfest. 

## How Do I Get Involved? 

First of all, sign up to the event on the [DigitalOcean Hacktoberfest site](https://hacktoberfest.digitalocean.com/), then head over to GitHub and take a [look through the projects](https://github.com/topics/hacktoberfest). These are all the open-source projects on GitHub that have the designated ‘hacktoberfest’ label. Another way to get started might be to look at the projects you use every day - they may just be open source!

If you have never contributed to an open-source project before, there is a [Hacktoberfest My-First-PR Starter Project](https://auth0.com/blog/a-first-timers-guide-to-an-open-source-project/) available that you can use to practice making changes and creating pull requests, before progressing to adding real value to other repositories that people depend on every day.

Furthermore, if you’re interested in [hosting your own Hacktoberfest event](https://hacktoberfest.digitalocean.com/eventkit), there is an event kit containing a guide on how to get started and run your event in the best possible way. You don’t have to be an expert or professional to host an event, just the passion and the time to get organized!

## It’s Not Just About the Swag 

Did someone say swag? Yes, there is swag! Swag is great and if you are fortunate enough to be a recipient of one of the exclusive Hacktoberfest t-shirts, we encourage you to wear it with pride knowing you were a part of a great movement for OSS. _That_ is why we encourage you to participate and earn the exclusive 2018 Hacktoberfest t-shirt! 

To qualify for your t-shirt, you just have to make 5 valid contributions as pull requests (PRs) into any public GitHub repository (your pull requests don’t have to be merged in that time). Of note is that it's OK to submit one PR to fix a typo, but submitting 5 PRs to remove extra whitespace here and there is not. T-shirts get sent out after October and can take a few weeks to a few months to arrive. 

Therefore, let’s take a quick look: submit **5 or more pull requests** and get an exclusive Hacktoberfest t-shirt courtesy DigitalOcean, GitHub & Twilio.

<include src="TweetQuote" quoteText="All of our #hacktoberfest projects can be found on our GitHub organization. Join us over in https://community.auth0.com if you have any questions or feedback."/>

## What If I Submit to an Auth0 Project?

At Auth0, [we’re heavily invested in the open-source software movement](https://auth0.com/opensource). Look out for a kickass 2018 Hacktoberfest t-shirt courtesy of the awesome Auth0 team, along with a psychedelic Auth0 sticker pack!

All of our qualifying projects can be found on [our primary GitHub organization](https://github.com/auth0), as well as [our community organization](https://github.com/auth0-community). Join us over in [community.auth0.com](https://community.auth0.com/) if you have any questions or feedback.

To notify us of your contribution(s), please submit your details in this [Google form]( https://goo.gl/forms/sNo604XkIMhCX8i03) and we will follow up at the end of the event with your swag! 

## Share Your Journey!
We want to hear how your Hacktoberfest journey is going, so make sure to use the #Hacktoberfest hashtag and, if you’re working with Auth0 this month, use #Auth0OSS. We will be re-sharing our favorites! 

## Have an Open-Source Project, and Looking for Contributions?
Share it in our [Community Corner](https://community.auth0.com/c/community-corner)! If you built something with Auth0 share it in our [Show Your Auth0 section](https://community.auth0.com/c/auth0-community/show-auth0/16). Inspire others and be inspired! Celebrate your hard work and let your project be shared with other amazing developers. 


Celebrate Hacktoberfest 2018 with Auth0!

jeremy-meiss

Jeremy Meiss

A new chapter for the Auth0 Community begins.



## Gardening 101

Say you want to have a garden. You need to plan it, and plant it. Once that seed gets planted, it’s going to need something else: water. Without that, the seed will struggle to be put in a position to grow. You’re often not going to know how that seed will perform, whether it will yield a lot of fruit, some fruit, or none at all. But you have to give it water - without that it won’t be able to take advantage of the nutrients that are in the soil.

Communities are like gardens. The seed gets planted, often by a company with a fantastic product that people actually want to use, but it needs something else: water. And that’s where the Community Manager comes in.

![South Beach Miami Community Garden.](https://images.ctfassets.net/23aumh6u8s0i/kwEHmhUIwRF9KUqaxDuZo/db4343266c121781630563846420c690/community-gardening)

## Managing the (Garden) Community
The responsibility of the Community Manager is to water it and make sure the ground has the nutrients necessary to facilitate growth. You likely won’t know what the outcome will be, but for me that is part of the excitement of community. Nothing happens though unless people participate - and that’s where you come in!

Over the past year or so we’ve gone through a few iterations of what community looks like at Auth0. We have an already vibrant user base, but the challenge has been bringing together that user base in a way which provides opportunities to collaborate and share with other developers in the Identity and Access Management space. In addition, empowering developers seeking to implement Auth0 into their ideas, platforms, and products has always been our motivation in the community. Today we set out meeting that challenge head-on with the unveiling of our [new Community](https://community.auth0.com).

![Auth0 Community has a new platform.](https://images.ctfassets.net/23aumh6u8s0i/5BTrZ9mFTe5HsC81qd32KI/0c81ee682a15698c2786c88ef747f40e/new_community_platform)

One might say, *“Gee, that looks a lot like what we used to have,”* and they’d be correct. We’re moving away from the Q&A-centric AnswerHub and back to the community- and discussion-centric [Discourse](https://www.discourse.org/), upgraded from our previous iteration. This move provides you with opportunities to share what you’re working on, provide feature requests, be notified of upcoming changes, collaborate on events, and receive support directly from our engineers and others in the community. Plus, I’m sure a cat picture or two and a healthy debate about which movie franchise is best will be found.

The current community will go into read-only mode at 8pm EST on March 1, and we should be back up and ready to go with the new platform by 1am EST on March 2. A few items of note as we transition:

- All threads from our previous platform have been moved over to Discourse.
- You’ll notice that thread ownership still remains, but we do ask that you update your profile as not all of the profile information, like avatars, was migrated over. This is also a good opportunity to tell others in the community about you.
- When creating a new topic, you’ll have options to place into a relevant category (like **SDKs/Frameworks**, **Feature Requests**, and **APIs**) and tag the topic with the relevant technology or subject matter (like **nodejs**, **react-native**, or **roles**). Please make use of them as it helps the community better collaborate and find relevant topics.
- Search is much better now and you’ll be prompted upon topic creation to review other threads which may be relevant before creating the new topic.
- A new category was added, **Show Your Auth0**, where we encourage you to share what you're working on using Auth0 with the rest of the community.

We’re excited to embark on this new direction and look forward to working with you to make Auth0 the identify platform of choice for developers. If you haven't already looked at what Auth0 can do for you, `<a href="https://auth0.com/signup" data-amp-replace="CLIENT_ID" data-amp-addparams="anonId=CLIENT_ID(cid-scope-cookie-fallback-name)">sign up for a free account to get started.</a>

<include src="asides/AboutAuth0" />


Community at Auth0 begins a new chapter

bruno-krebs

I am passionate about developing highly scalable, resilient applications. I love everything from the database, to microservices (Kubernetes, Docker, etc), to the frontend. I find amazing to think about how all pieces work together to provide a fast and pleasurable experience to end users, mainly because they have no clue how complex that "simple" app is.

R&D Content Architect

Bruno Krebs

This article provides a brief explanation of the Java platform and the community process that is responsible for evolving it.

"community"