andrea-chiarelli

I have over 20 years of experience as a software engineer and technical author. Throughout my career, I've used several programming languages and technologies for the projects I was involved in, ranging from C# to JavaScript, ASP.NET to Node.js, Angular to React, SOAP to REST APIs, etc.

In the last few years, I've been focusing on simplifying the developer experience with Identity and related topics, especially in the .NET ecosystem.

Principal Developer Advocate

Andrea Chiarelli

Checking your customers' email addresses is a basic rule for securely onboarding them in your B2B SaaS application. Learn how to do it in your Blazor Web App.

The very first thing to do when a user signs up for your application is to verify that they actually have access to the email address they provide. Although email verification is not the only security measure you should take to ensure the user's identity, this contributes to reducing spam and fraud. Auth0 provides [a few approaches to email verification](https://auth0.com/docs/manage-users/user-accounts/verify-emails), depending on your specific use case. In this article, you will learn how to leverage the built-in email verification process based on verification links to validate the email address provided by the user during their signup for a Blazor Web application.

## The Sample Application

A previous article showed [how to manage the onboarding of a customer](https://auth0.com/blog/enable-self-subscription-in-blazor-b2b-saas-application/) who signs up for a service offered by a B2B SaaS application implemented with Blazor. On that occasion, we did not consider verifying the client's email address as we wanted to focus mainly on self-registration and creating an Organization via code. Now, we will integrate that application by adding the verification step for the self-registering customer's email address.

Download the sample project to start with this command:

```shell
git clone --branch organization-via-code --single-branch https://github.com/andychiare/MyBlazorSaaS
```

Follow the attached README file instructions to register and configure the application with Auth0. If you don't have an Auth0 account, [you can sign up for free](https://a0.to/blog_signup).

## The Email Verification Process

By default, Auth0 sends a verification link to users when they sign up, but it's up to you to check if their email is verified before allowing them to access your application or perform specific actions.

In the context of your Blazor application, you will implement the following email verification process:

1. Once the customer signs up, Auth0 automatically sends an email to the user, and your application shows a message inviting the user to check their inbox.
2. The page showing the message provides a button to resend a new verification link in case the user didn't receive the first email.
3. If the user attempts to access any other application page, your app checks if the user's email has been verified before granting access.
4. Once the email is verified, the customer can create the Organization for their new subscription.

## Wait for Email Verification

The current customer onboarding flow implemented in your Blazor App allows users to create their Organizations as soon as they sign up. From a visual perspective, they pass from the signup form to the Organization creation form. You need to make sure the customer's email has been verified before allowing them to create their new Organization. Let's start by implementing a page that fulfills points 1. and 2. mentioned earlier.

### The verification waiting page

In the `MyBlazorSaaS/Components/Pages/Onboarding` folder, create a new file named `Verify.razor` and add the following code:

```csharp


@page "/Onboarding/Verify"
@rendermode InteractiveServer
@using Auth0.ManagementApi.Models
@using System.Security.Claims

@inject NavigationManager NavigationManager
@inject IAuth0Management auth0Management

<h1>Verify your email</h1>
<p>
 Please check your inbox for a verification link to continue creating your account.
</p>

<div>
  <button class="btn btn-primary" @onclick="ResendVerificationEmail">Resend Verification</button>
</div>

<div>
@Message
</div>

@code {
  [CascadingParameter]
  private Task<AuthenticationState>? authenticationState { get; set; }
  private string Message = "";

  private async Task ResendVerificationEmail()
  {
    if (authenticationState is not null)
    {
      var state = await authenticationState;
      var userId = state?.User?.FindFirst(c => c.Type == ClaimTypes.NameIdentifier)?.Value;

      try {
        var managementClient = await auth0Management.getClient();
        await managementClient.Jobs.SendVerificationEmailAsync(new VerifyEmailJobRequest() { UserId = userId });
        Message = "The verification e-mail has successfully been sent. Please check your inbox";
      } catch (Exception) {
        Message = "Failed to resend verification e-mail.";
      }      
    } else {
        NavigationManager.NavigateTo("/Onboarding/Signup");
    }
  }
}
```

This page will display a message that invites the user to check their inbox and offers a button to resend the verification link if needed. It will be rendered as shown in the following image:

![Verify email screen in your Blazor Web app](https://images.ctfassets.net/23aumh6u8s0i/72gdEry0IJzomAqT4P95gF/a099d96c8531367d3c8b567ac3853081/blazor-verify-email-screen.png)

Since the current onboarding flow shows the Organization creation page after the user signup, you need to change it. Open the `Program.cs` file in the `MyBlazorSaaS` folder and replace the line of code shown below:

```csharp
// MyBlazorSaaS/Program.cs

//...existing code...

app.MapGet("/account/signup", async (HttpContext httpContext, string login_hint) =>
{
  var authenticationProperties = new LoginAuthenticationPropertiesBuilder()
          //.WithRedirectUri("/onboarding/createOrganization") // 👈 old code
          .WithRedirectUri("/onboarding/verify")  // 👈 new code
          .WithParameter("screen_hint", "signup")
          .WithParameter("login_hint", login_hint)
          .Build();

  await httpContext.ChallengeAsync("OnboardingScheme", authenticationProperties);
});

//...existing code...
```

This ensures that the user will be redirected to the verification waiting page instead of the Organization creation page.

### Resend the verification link

The verification waiting page shows a "Resend Verification" button. Let's take a closer look at the code triggered by that button to learn how to resend the verification link:

```csharp

  
//...existing code...

@code {
  [CascadingParameter]
  private Task<AuthenticationState>? authenticationState { get; set; }
  private string Message = "";

  private async Task ResendVerificationEmail()
  {
    if (authenticationState is not null)
    {
      var state = await authenticationState;
      var userId = state?.User?.FindFirst(c => c.Type == ClaimTypes.NameIdentifier)?.Value;

      try {
        var managementClient = await auth0Management.getClient();
        await managementClient.Jobs.SendVerificationEmailAsync(new VerifyEmailJobRequest() { UserId = userId });
        Message = "The verification e-mail has successfully been sent. Please check your inbox";
      } catch (Exception) {
        Message = "Failed to resend verification e-mail.";
      }      
    } else {
        NavigationManager.NavigateTo("/Onboarding/Signup");
    }
  }
}
```

The `ResendVerificationEmail()` method gets the user ID from the authentication state, gets an instance of the management client, and uses the `SendVerificationEmailAsync()` method, passing an instance of `VerifyEmailJobRequest` with the user ID value. This method of the Management API client corresponds to calling [the email address verification endpoint](https://auth0.com/docs/api/management/v2/jobs/post-verification-email), which will generate a new ticket, include it in a verification link, and send it to the user via email.

## Customize the Email Verification Template

The default email message with the verification link sent to the user will look like the following:

![Email verification message](https://images.ctfassets.net/23aumh6u8s0i/6cP7skL9tqxBUnCAwC1cOa/0e31a5311fbd6506e75e010c091218a9/email-verification-message.png)

You can customize this message using your Auth0 dashboard. Go to the [Branding > Email Templates](https://manage.auth0.com/#/templates) page, select the *Verification Email (Link)* template, and apply the changes you want. You can customize the sender address, the subject, and the message body using [HTML and Liquid syntax](https://auth0.com/docs/customize/email/email-templates/use-liquid-syntax-in-email-templates). You can also customize other settings and use [common variables](https://auth0.com/docs/customize/email/email-templates#common-variables) to include some contextual values in your message. Read [this document](https://auth0.com/docs/customize/email/email-templates) to learn more about email template customization.

By default, nothing visible happens on your application when a user clicks the verification link. Auth0 will mark the user's email field as verified and show a page confirming that the email verification process was successful, as you can see in the following image:

![£mail address verified by Auth0](https://images.ctfassets.net/23aumh6u8s0i/4pgKFqZDlk93OnekyTrElS/1b3bf679d107f68279e8c4f711267836/email-address-verified.png)

However, in our self-subscription flow, we would like the user to be redirected to the next onboarding step after their email is verified, which is the organization creation screen. The email verification template provides a *Redirect To* field that allows you to specify the URL of the page you want the user to land after the email verification. You can parametrize the URL using one of the common variables mentioned above. Specifically, enter the following value in the *Redirect To* field and click the *Save* button:

```
{{ application.callback_domain }}/onboarding/createOrganization
```

That's all! Now, your user will be redirected to the Organization creation page after the email verification.

<include src="Auth0TemplatesForDotnetCTA" />

## Require Email Verification

One small piece is missing to complete the customer onboarding flow. You need to ensure that they cannot access the protected pages of your application if their email has not been verified yet. This means that when you check if the user is authenticated, you also need to consider checking that their email is verified too.

### A basic approach

You don't need to check if the user's email is verified when they access the `Home.razor` page, `Signup.razor`, and `Verify.razor` pages: the first two are public pages, and the third one is specifically designed for users who haven't verified their email yet.

You need to check the validity of the user's email on the `CreateOrganization.razor` page. To this purpose, apply the changes highlighted here on the `CreateOrganization.razor` page:

```csharp


//...existing code...

  protected override async Task OnInitializedAsync()
  {
    if (authenticationState is not null)
    {
      var state = await authenticationState;

      // 👇 new code
      var isEmailVerified = state.User?.FindFirst(c => c.Type == "email_verified")?.Value?.ToLowerInvariant() == "true";
      // ☝️ new code

      // 👇 changed code
      if (state.User?.Identity?.IsAuthenticated??false && isEmailVerified)
      // ☝️ changed code
      {
        Email = state.User?.FindFirst(c => c.Type == ClaimTypes.Email)?.Value??String.Empty;
        UserId = state.User?.FindFirst(c => c.Type == ClaimTypes.NameIdentifier)?.Value??String.Empty;
      } else {
        NavigationManager.NavigateTo("/Onboarding/Signup");
      }
    }
  }

//...existing code...
```

You can see that a new variable `isEmailVerified` has been introduced. This variable gets a boolean value coming from the value of the `email_verified` claim. You will use this variable as an additional condition to go ahead with the Organization creation step.

### A more structured approach

You need to apply the email verification check to most of the protected pages of your application. This depends on your application, of course. In our case, you should also apply the same check to the `Weather.razor` page on the server side and the `Counter.razor` and `FetchDat.razor` pages on the client side.

Applying the earlier approach would work, but it's ineffective in terms of code duplication and maintenance. You will use [ASP.NET Core policy-based authorization](https://learn.microsoft.com/en-us/aspnet/core/security/authorization/policies) instead.

First, open the `Program.cs` file in the `MyBlazorSaaS` folder and add the code highlighted below:

```csharp
// MyBlazorSaaS/Program.cs

//... existing code...

// 👇 new code
builder.Services
    .AddAuthorization(options => {
      options.AddPolicy("VerifiedEmail", policy =>
        policy.RequireAssertion(context =>
          context.User.HasClaim(claim =>
            ( claim.Type == "email_verified" &&
              claim.Value?.ToLowerInvariant() == "true")
          )
        )
      );
    });
// ☝️ new code

// Add services to the container.
builder.Services.AddRazorComponents()
    .AddInteractiveServerComponents()
    .AddInteractiveWebAssemblyComponents()
    .AddAuthenticationStateSerialization();

//... existing code...
```

This code defines an authorization policy named `"VerifiedEmail"`. This policy checks if the current user has a claim `email_verified` set to `true`. This is the [standard claim](https://openid.net/specs/openid-connect-core-1_0.html#StandardClaims) coming from the ID token issued by Auth0.

Now, let's create a page to which the user will be redirected when attempting to access a page without the required authorization. By default, Blazor redirects unauthorized users to an `Account/AccessDenied` page. So, create an `Account` folder in the `MyBlazorSaaS/Components/Pages` folder and add an `AccessDenied.razor` page with the following code:

```csharp

  
@page "/account/accessdenied"

<PageTitle>Access Denied</PageTitle>

<h2>You are not authorized to access this page</h2>

<p>@Reason</p>

@code {
  [CascadingParameter]
  private Task<AuthenticationState>? authenticationState { get; set; }
  private string Reason = "";

  protected override async Task OnInitializedAsync()
  {
    if (authenticationState is not null)
    {
      var state = await authenticationState;

      var isEmailVerified = state.User?.FindFirst(c => c.Type == "email_verified")?.Value?.ToLowerInvariant() == "true";

      if (state.User?.Identity?.IsAuthenticated??false && isEmailVerified)
      {
        Reason = "Your email is not verified yet!";
      }
    }
  }
}
```

This page shows a generic message to the unauthorized user and attempts to show a specific message about the actual reason. In particular, it checks if the user has the `email_verified` claim set to `true` and displays a message accordingly.

Finally, specify the policy `VerifiedEmail` in the `Authorize` attribute of your protected pages as shown below:

```csharp

  
@page "/weather"
// 👇 changed code
@attribute [Authorize(Policy = "VerifiedEmail")]
// ☝️ changed code
@attribute [StreamRendering]

//...existing code...
```

Apply this change to the `Counter.razor` and `FetchData.razor` pages in the `MyBlazorSaaS.Client/Pages` folder as well.

That's all! Your customer onboarding flow now includes the email verification step to mitigate the risks of spam and fraud.

<include src="SignupCTA" text="Try out Auth0 authentication for free." linkText="Get started →" />

## Recap

Auth0 always sends an email verification message when a user signs up for your application. However, it's up to you to determine in which scenario to check whether the user's email has been verified.

In the example shown in this article, we took the case of onboarding a customer of a B2B SaaS application developed with Blazor and added the email verification step before allowing them to create a new Organization.

We also saw how to allow the resend of the verification email and prevent access to the application's protected pages when the user's email has not been verified yet.

You can find the final code of the project created during the article on [this GitHub repository](https://github.com/andychiare/MyBlazorSaaS/tree/email-verification).

Enforce Customer Email Verification in Your B2B Blazor Web App

Aliyah Winfrey

I'm Aliyah Winfrey, a staff design researcher who’s passionate about creating clarity and alignment in complex research spaces. I thrive on asking the right questions and uncovering insights that drive meaningful design. Outside work, I tend to my garden, experiment with new baking recipes, or get lost in a classic PS2 game.

Staff Design Researcher

Brandon Simons

Brandon Simons is a Principal Product Manager at Auth0, where he has spent over three years dedicated to empowering customers to build great login experiences. His focus is on providing the right balance between ease of development and maintenance, while ensuring a delightful end user journey. Prior to his role at Auth0, Brandon spent over a decade working in SaaS at companies large and small.

Principal Product Manager

The benefits of leveraging social connections for your customers

Social Login has become a login method across [numerous regions, ages, and community types](https://auth0.com/blog/digital-identity-what-users-think-about-devices-and-logins/). Globally, we are connected through social media, and leveraging social login allows us to fortify those connections through a seamless and secure login. However, many everyday people don’t understand [how social login or social connections work](https://auth0.com/blog/analysis-of-social-connection-data/) or, more importantly, if [social login is a safe way](https://auth0.com/blog/social-login-on-the-rise/) to log in or sign up. 

Social login uses existing social media accounts, such as Google, Facebook, X (Formerly Twitter), Apple, and Microsoft, to sign in or go up for websites. It reduces the cognitive load of users remembering another username and password or, worse… _reusing a password_ 😱 over 70% of general users do. Over thousands of our customers have integrated Social Login in their authentication flow. Social login offers the following.

1. Frictionless and rapid method for users to sign up/log in via a 1-click solution
2. Implementing social login significantly increases the conversion rate.<sup><a href="https://auth0.com/blog/how-to-use-social-login-to-drive-your-apps-growth/#Increase-Your-Sign-Up-Conversion-Rate-by-20-">1 </a></sup><sup><a href="https://www.marketone.com/articles/maximizing-conversion-rates-with-social-sign-in">2</a></sup>
3. Security of social login 

However, internal research of general population users cited the sentiment that social login is the most vulnerable identifier to cyberattacks.

![Social login](https://images.ctfassets.net/23aumh6u8s0i/13wdcxqs5xSsqyzL1bkQjx/2dad6f825cb64537ce2ae1dd1d4884c5/Social_Login.png)

Given this sentiment, let’s break down three common myths about Social Login among general users and share some key points to keep in mind when using it in your applications.

## The Myths of Social Login

> **Myth #1**: Logging in via my social account (Facebook, Google, or Microsoft)  gives away the data in my social account.

Social account hacking is a huge and serious concern for everyday users. However, many social login services such as Google, Facebook, Apple, and Microsoft do not grant full access to your account and share only what’s necessary, such as name and email. Social Login providers share limited information with the application or website users are logging in to. Social login minimizes the data you store when signing up for accounts. The less data you store, _the better_.

This means they are not sharing your data on your social login account. Social login only grants authentication rights to create or log into an account. Additionally, many social login providers allow users to review, control, and revoke access to their account settings, meaning users must grant permission to access _any_ account data. Social login does not give the application or service users a sign-up for access to data such as private messages, browsing history, or other sensitive information.

> **Myth #2**: Social login is less secure than a password.*

Social login is often more secure than using a password for a few reasons. Traditional login methods, such as passwords, are prone to reuse and have general weaknesses, such as hackers guessing simple passwords. Social login reduces the risk by offering a passwordless way to authenticate. Moreover, users' risk of credential theft and phishing is diminished, given they are not creating and storing credentials to log in to third-party sites and services. Social Login often provides built-in Multi-Factor Authentication (MFA) as an added layer of security in comparison to relying on a password, which may or may not offer MFA.

Social login utilizes big companies like Google, Microsoft, and Apple's investment in keeping users’ accounts safe with a team of security experts working 24/7. These companies monitor accounts for unusual and suspicious activity, unauthorized access, and hackers. \

> **Myth #3**: Social Login isn’t safe cause it’s too easy.*

It’s really that simple. Ease of access ≠ lacks security. Social Login simplifies authenticating users as who they say they are while leveraging leading security measures. In other words, it’s simple authentication that does not sacrifice security. Remembering a password is more challenging and less secure. Weak or reused passwords pose a greater risk to personal data and security.

## Let’s Enable Our Users and Build Trust

Building trust with users is about more than just convenience. It requires a strong commitment to security, clear communication, and giving users the tools to protect themselves. Social login makes signing in easier while keeping accounts secure, but users should take extra steps to stay safe. Enabling MFA, reviewing permissions in Google, Microsoft, or Apple account centers, and staying aware of account activity all help strengthen security. When an organization provides these options and offerings, such as Auth0, allow for seamless integration, users take advantage of them, and online interactions become both safer and simpler.

Ready to rethink social login? Start implementing it in your apps, and learn more [here](https://auth0.com/learn/social-login)! Or [review some of our social login Labs](https://developer.auth0.com/resources/labs?topic=authentication)”

Demystifying Social Login

Michelle Agroskin

Michelle Agroskin is a Product Marketing Manager for Okta. She leads the Customer Identity AI, Authorization, and Consumer portfolios, driving go-to-market strategy, messaging, launches, and strategic growth initiatives.

She lives in NYC and in her free time, loves to travel the world and try new restaurants!

Product Marketing Manager, Customer Identity Cloud

Auth0’s latest features enhance user experience with secure, customizable logins, flexible authentication, and improved security—without compromising convenience.

Customer expectations are higher than ever. They want security, convenience, and personalization, all without friction. Businesses need to deliver seamless experiences while keeping user data safe. The challenge? Balancing security with ease of access.

At Auth0, we believe you shouldn’t have to choose between security and experience. That’s why we’re introducing innovations that strengthen security and improve user experience—before, at, and after login.

## Powerful New Features for Secure, Seamless Login

Today’s businesses need to build trust with their users. Customers *expect* engaging experiences, convenient journeys, and secure digital platforms. Before they give you their business, they need to know that you can cater to their unique needs, provide ease of use across multiple channels, and protect their data and sensitive information. When security and user experience are seamlessly integrated, customers engage more, businesses grow, and digital experiences become effortless. And that starts with getting identity right. 

> We’ve updated the authentication journey to help businesses deliver trusted, customized experiences while keeping users safe.

#### **Before login**: greater flexibility with Tenant Access Control

**Security starts before users even log in. **Tenant Access Contro**l (Generally Available, March 2025) helps protect applications and APIs from threats like denial-of-service attacks. Stopping lousy traffic before it reaches your applications prevents disruptions and keeps them running. This feature allows organizations to create granular policies to manage access and mitigate threats, giving them more control over protecting their applications and users.

#### **At login**: Advanced Customization for Universal Login

**The login box is often the first interaction users have with your brand and the one they repeatedly return to as they continue engaging with it. Now, with **Advanced Customization for Universal Login** (Early Access, February 2025), businesses can control every piece of their login experience while leveraging Auth0’s security and built-in authentication process. Create pixel-perfect experiences and tailor every detail to match your brand with the same built-in security Auth0 is known for. 

#### **After login**: strengthen security

**Security doesn’t stop after users are logged in. We’re introducing key enhancements to secure the entire customer journey:

 * **FAPI 2 Certification **(Achieved, March 2025) strengthens API security with financial-grade protections that prevent transaction tampering and data leaks within our Highly Regulated Identity product.
 * **Client-initiated backchannel Authentication** (Limited Early Access, Generally Available Q2 2025) enables a client application (e.g., call center system, POS terminal, autonomous AI agent) to initiate the authentication process on behalf of the customer, making authentication easier.
 * **Native to Web SSO** (Early Access, April 2025) keeps users signed in as they move between mobile and web apps, eliminating unnecessary logins (and frustrated customers!).

## Identity Is the Key to Better Experiences 

In the past, businesses struggled with trade-offs, prioritizing security at the expense of user experience or vice versa. Modern identity removes that compromise, ensuring that security enhances, rather than hinders, customer experience.

Businesses that get identity right can deliver effortless logins, personalized interactions, and enterprise-grade security without slowing growth. These latest innovations make it easier than ever to:

* Protect against fraud and unauthorized access
* Build seamless, branded login experiences
* Maintain compliance with industry standards
* Enable flexible, secure authentication
* Keep users signed in across platforms

## Get Started Today

Auth0 makes identity **simple**, **scalable**, and more **secure.** These latest innovations help businesses stay ahead by offering users the frictionless, secure experiences they expect.

> Stop building identity from scratch. Start building with Auth0.

Learn more about these updates in our [documentation](https://auth0.com/docs/get-started) or [contact our team](https://auth0.com/contact-us) today.

_Any products, features, functionalities, certifications, authorizations, or attestations referenced in this material that are not currently generally available or, have not yet been obtained, or are not currently maintained may not be delivered or obtained on time or at all. Product roadmaps do not represent a commitment, obligation, or promise to deliver any product, feature, functionality, certification, or attestation, and you should not rely on them to make your purchase decisions._

Better User Experiences, Stronger Security

samantha-murphy

Samantha Murphy is a Principal Product Marketing Manager for Okta. She leads the Customer Identity Security portfolio, driving go-to-market strategy, messaging, launches, and strategic growth initiatives. Before Okta, Sam spent over six years in product management roles in Identity and Access Management.

She holds a Bachelor of Commerce degree from Queen’s Smith School of Business and is from Ottawa, Canada.

In her free time, Sam makes the most of winter by playing an awesome ice skating sport called ringette.

Principal Product Marketing Manager, Customer Identity

Samantha Murphy

Find out how you can improve your customers' security and authentication experience using CIBA.

Imagine you're a customer trying to resolve an urgent issue over the phone—for example, a bank transaction, an online order, or a technical support request. Before the agent can help, they need to verify your identity. They ask you for your security passcode, which you’ve forgotten. Then come the security questions: your birthday, your last bank transaction, your best friend's name. These questions are easily compromised and create security concerns.

This frustrating experience is all too common across industries. From financial services to retail, organizations face the challenge of verifying customers securely and efficiently for online, over-the-phone, and in-person interactions. That's where CIBA comes in.

In this blog post, we’ll explore how our new [**Client-Initiated Backchannel Authentication (CIBA**](https://auth0.com/docs/get-started/authentication-and-authorization-flow/client-initiated-backchannel-authentication-flow/user-authentication-with-ciba)**)** feature, part of Auth0, improves customer authentication for call centers and in-person interactions. CIBA makes authentication faster, more secure, and eliminates the need for outdated PINs or security questions.

## Moving Beyond Less Secure Security Questions and OTPs

Call centers are just one out-of-band scenario currently burdened with inconvenient and insecure authentication protocols. Say you’re trying to verify your Identity so you can personalize the settings in your new car, but in order to do so you need to go through a cumbersome process: open the car’s app, scan a QR code, open a browser and log in –all before you can update your personal settings. Or maybe you’re trying to pick up a retail order in person, but in order to do so, you need to authenticate yourself with security questions or personal information. The problem is that these questions are vulnerable to data breaches and phishing attacks (just like passwords) and revealing private information directly to agents creates obvious privacy concerns that customers shouldn’t have to deal with.

Some organizations may try to get around this by using SMS or emailing one-time passwords (OTPs). However, these methods often introduce an additional, cumbersome step into the authentication process and present security challenges. SMS for example is vulnerable to SIM Swapping, which allows attackers to intercept SMS OTPs. Email OTP assumes that the email account is secure, which may not be the case. Plus, both email and SMS OTPs are vulnerable to the typical phishing and social engineering attacks that trick people into compromising their OTP, and they lack biometric authentication methods (e.g. face ID, fingerprint, etc.).

CIBA offers a more consumer-friendly and secure way of authenticating “out-of-band” customers.

## CIBA: A Superior Approach to Out-of-Band Authentication

Safe, seamless brand experiences go beyond the login box. They extend to critical customer touchpoints—like when customers seek support over the phone, online, or in person. CIBA empowers businesses to deliver **both enhanced security and a smoother user experience**, leading to stronger customer satisfaction and better business outcomes. Let’s unpack what CIBA is and how it drives business success:

**Client Initiated Backchannel Authentication (CIBA)**—also known as a **decoupled authentication flow**—is a protocol that enables a client application (e.g., call center systems, POS terminals, in-person service tools, or autonomous AI Agents) to initiate the authentication process on behalf of the customer.

Let’s walk through an example workflow.

A user would like to withdraw from their bank and agrees to initiate the CIBA mobile app verification process.

![Initiate the CIBA verification process](https://images.ctfassets.net/23aumh6u8s0i/4Z2y3Etq6z8cYdxMHwEHDJ/636c00a03bb28fc64e73e1daebff455d/Uploaded_from_Okta_CIBA_blog_v1)

Right away, the user gets a notification on their phone to approve the request and authenticates with biometrics through the app.

![CIBA flow: the user gets a notification on your device](https://images.ctfassets.net/23aumh6u8s0i/3F7yYxI2qaHLys12sLQcuB/dcb6b0227f0388a95f369023b95f69f3/Uploaded_from_Okta_CIBA_blog_v1)

Lastly, the user approves the request and seamlessly and securely continues their withdrawal.

![CIBA flow: User approves the authentication request](https://images.ctfassets.net/23aumh6u8s0i/QOu1PqIN7gV6Bn5Mars8Q/bd13772e469354c82bfb62a0c780c77a/Uploaded_from_Okta_CIBA_blog_v1)

## Achieving Better Business with CIBA

CIBA improves your business and your customer experience with some great features:

### Stronger Security and Privacy

Traditional out-of-band authentication methods, like security questions or email/SMS one-time passwords (OTPs), are insecure and frustrating. CIBA replaces these outdated approaches with **secure, seamless in-app biometric authentication** (e.g., Face ID or fingerprint). A simple push notification lets customers verify their identity effortlessly with **just one tap**, without sharing sensitive personal information.

### A Financial-Grade Protocol

Trusted by financial institutions, CIBA is a **financial-grade protocol** that provides stronger safeguards against phishing and data breaches. By securing highly sensitive customer interactions, CIBA acts as a **robust fraud prevention tool**, protecting both businesses and customers from scams and breaches.

### Non-Repudiation for Trust

A CIBA authentication flow with the [Guardian mobile SDK](https://auth0.com/docs/secure/multi-factor-authentication/auth0-guardian) supports **non-repudiation**—so that neither party in a communication can deny their involvement. For example, in a call center scenario, this prevents customers or agents from disputing that certain information was exchanged. Non-repudiation builds trust and ensures authenticity for sensitive interactions.

### Enhanced Customer Experience (CX)

CIBA delivers smoother CX with **one-tap in-app authentication** —no browser redirects. This simple, efficient flow reduces abandonment rates, increases app engagement, and empowers customer-facing teams to drive satisfaction and business growth.

With [**Auth0 Guardian SDK**](https://auth0.com/docs/secure/multi-factor-authentication/auth0-guardian), you can further enhance CX by customizing every aspect of the CIBA customer journey to reflect your brand and meet unique business needs—creating an experience that’s as secure as it is smooth.

## CIBA in Action: Real-World Examples

A decoupled authentication flow leveraging CIBA adds a much-needed security boost to sensitive interactions, all while supporting seamless customer experiences across a number of different scenarios and use cases:

*   **Call center verification**.
Say you’re a financial services institution, and a customer is calling in to request help with their bank account. Using CIBA, the bank teller can authenticate the customer by sending a push notification to the banking app your customer has installed on their phone. There, they can confirm their identity using the already-enabled biometric sign-in. No more asking customers to share SMS passcodes or make their social security numbers, and (forgotten!) answers to security questions vulnerable by speaking them out loud.

*   **In-person verification**.
In all kinds of in-person scenarios (e.g., withdrawing money at a bank, checking into a hospital, picking up meds at the pharmacy) CIBA gives employees the option of confirming customers’ Identity in real-time by initiating a push notification sent immediately to their phone. The alternative in these situations is often asking customers to present physical documentation such as utility bills or their driver's licenses––an insecure authentication method that can leave customers vulnerable to fraud if they are stolen or compromised.

*   **Connected device verification**.
CIBA also allows internet-connected devices to initiate push notifications in IoT scenarios. For example, if a customer is registering a new car and customizing their settings, CIBA lets them kick off this process in an easy, authenticated manner by confirming their Identity through a push sent directly to a consumer app. Not only is this a more secure means of authentication, it also allows customers to avoid clunky options currently on the market, e.g., scanning a QR code that redirects to the app.

*   **POS terminal**.
In a retail environment that increasingly favors hybrid shopping experiences (e.g. ordering furniture online and picking it up in person) a CIBA flow allows customers to confirm their Identity on-site through self-serve kiosks that initiate a push notification sent to the customer’s phone. This not only keeps the transaction secure, but it also eases any labor constraints retailers might be experiencing by preventing employees from getting roped into the authentication process.

**Better security. Better CX. Better business.**.
CIBA represents a new addition to the security toolbelt for organizations looking for a more secure, more seamless way of authenticating users in call center scenarios and beyond.

Curious about where CIBA can improve your operations––and your bottom line? [Schedule a demo with your account rep](https://auth0.com/contact-us) to see it in action.

CIBA: Authenticate Customers in Call Centers and Other Out-of-Band Scenarios

eric wu

With over 7 years of experience in product marketing, I am passionate about creating and delivering impactful marketing strategies that drive customer value, business growth, and competitive differentiation. I have a strong background in launching new products, especially in Security, Generative AI and Cloud domains, where I have led several successful end-to-end product releases. I currently work as a Senior Product Marketing Manager at Okta, a leading identity and access management platform that empowers organizations to securely connect their people and technology.

Product Marketing Manager - Customer Identity Cloud

Eric Wu

Self-Service Single Sign-On (SSO) reaches General Availability (GA) status

As Independent Software Vendors (ISVs) quickly learn, in addition to building the core functionality of your software-as-a-service (SaaS) apps, you must also provide features that support your business customers’ administration, integration, and security needs.

One of the most challenging features to implement is Single Sign-On (SSO) due to the many competing standards and protocols available. Plus, merely supporting SSO is only one piece of the puzzle — it also has to get deployed:

* **From the perspective of each of your business customers**, setting up SSO for each and every app they’ve adopted can be a tedious process, often involving lots of back and forth with your customer service reps — and perhaps even your developers
* **For you as an ISV**, helping each and every business customer set up SSO for your app is just as tedious and time-consuming

Both parties benefit from a quick and simple deployment approach, which is why we’re excited to announce that our Self-Service SSO feature has reached General Availability (GA) status.

## SSO Is an Enterprise Imperative

Due to its associated benefits, Single Sign-On (SSO) — an Identity solution that allows multiple applications to use the same authenticated session — is an essential element of modern Identity and Access Management (IAM). SSO is so important, in fact, that it’s a foundational element of [the emerging Interoperability Profile for Secure Identity in the Enterprise (IPSIE) security standard](https://www.okta.com/blog/2024/10/oktane-2024-the-future-of-identity-security/).

On top of providing a convenient user experience, SSO dramatically reduces the number of credentials in use and helps to ensure that security policies are consistently applied across all of an organization’s applications, since the policies can be enforced at an organization’s Identity Provider (IdP).

Now that Identity has emerged as the primary enterprise security entry point, and with [organizations deploying more apps than ever before](https://www.okta.com/businesses-at-work/), SSO is needed more than ever.

### Simplifying SSO configuration saves time, reduces errors, and manages information risk

Self-service SSO refers to a flow that allows your business customers to set up and edit SSO connections themselves.

This capability delivers several valuable benefits, including:

* **Saving time for everyone:** Building Identity solutions isn’t your core business, and any time spent doing so pulls your team from product extension and innovation. With Self-Service SSO, your developers can focus more on your product instead of SSO integrations.
* **Reducing the potential for errors:** Manually configuring SSO introduces the risk of errors that impede productivity and undermine security. Self-Service SSO keeps manual tasks to a bare minimum.
* **Eliminating the need to share sensitive information:** Configuring SSO often requires the ISV and the business customer to share sensitive information (e.g., client IDs, SAML certificates, etc.), but Self-Service SSO eliminates these exchanges.

## How Self-Service SSO Works

Self-Service SSO requires minimal configuration in your Auth0 tenant and provides your customers with a setup assistant that guides them through the enablement process. After a customer completes their setup, the SSO integration is automatically added to your tenant as an [Enterprise connection](https://auth0.com/docs/authenticate/enterprise-connections).

Diving a little more deeply, Self-Service SSO uses three components to delegate setup to your customers:

* **Self-Service profile:** Defines key elements of customer SSO implementations, such as the IdPs they can use for SSO and which user attributes they must capture (e.g., email address)
* **Self-Service access ticket:** Grants customer admins access to the SSO setup assistant and sets specific details for their resulting SSO integration
* **SSO setup assistant:** A Self-Service Wizard that guides customer admins through the SSO setup process — enabling your business customers’ administrators to create, edit, and test SSO connections

You also benefit from additional **observability** features, including new tenant logs to monitor ticket consumption and the creation and enablement of connections; you can monitor logs to promptly initiate any tasks once the connection has been created.

At a high level, the Self-Service SSO workflow includes the following tasks:

1. You (the Auth0 by Okta customer) create a self-service profile in your tenant using the Auth0 Dashboard or the Management API.
2. Next, you use the Management API to create a self-service access ticket that allows customer admins to configure SSO.
3. You retrieve the ticket URL from the asset created in Step 2 and send this link to your customer admin.
4. Your customer admin launches the SSO setup assistant and follows the steps provided to create an application with their identity provider.
5. After the customer completes their setup, the SSO integration is automatically added to your tenant as an [Enterprise connection](https://auth0.com/docs/authenticate/enterprise-connections).

<include src="Vidyard" id="UPTUao1LfxdMLrnD38Gsxc" />

## Getting Started

As enterprises continue to adopt best-of-breed tools, IT and security leaders will increase their focus on access management strategies, like SSO, that can simultaneously support productivity and contribute to a strong security posture.

Whether you include SSO within your base product or offer it as a premium add-on, Self-Service SSO enhances your overall value proposition.

By empowering your customers to configure their own SSO integrations with your app, you can streamline your onboarding process and grant them more autonomy over their sign-on experience — while reducing the time and costs associated with managing SSO across your customer base.

**If you’d like to learn more about this new feature**, we invite you to peruse [the Self-Service Single Sign-On documentation](https://auth0.com/docs/authenticate/enterprise-connections/self-service-SSO).

**Want to launch a B2B SaaS application quickly?** Check out our reference application, [SaaStart,](https://auth0.com/blog/speed-up-your-customer-identity-journey-with-auth0-saastart/), a complete, working example of how to implement SaaS Identity with Auth0, built with the most popular frameworks developers use today. You can gain hands-on experience on Self-Service SSO and other essential CIAM features and quickly deploy a sample Auth0 template directly within the SaaStart [repo](https://github.com/auth0-developer-hub/auth0-b2b-saas-starter) or from [our new integration](https://vercel.com/integrations/auth0) in the Vercel marketplace.


Empower Your Enterprise Customers to Set up Their Own SSO Implementations

Nelson Matias

As a Group Product Manager at Auth0, I focus on delivering innovative solutions that enhance security and user experience for both businesses and developers. With hands-on experience as a Developer, Consultant, and Solution Architect, along with years of working in Technical Account Management, I’m passionate about solving complex problems and shaping the future of identity management.
Outside of work, I often watch football, listen to music, or spend quality time with my kids.

Group Product Manager

Continuous Session Protection empowers customers to meet a wide range of session and refresh token security needs, including custom lifetimes and revocation capabilities. Let’s dive deeper into how these features can enhance your security strategy.

Continuous Session Protection Now Available for Enterprise Customers

Nesh Popovic

As a Developer and Solutions Engineer for the past 20+ years, I've been involved in developing and selling secure and robust software solutions. When not helping my sales team deal with the complexities of software platforms, you can usually find me playing pickleball, basketball or backgammon.

Principal Solutions Engineer - CIAM

Learn how to set up an Amazon API Gateway and secure the REST API with Okta Customer Identity Cloud (CIC) Adaptive MFA Risk Score

Protecting REST APIs Behind Amazon API Gateway Using Okta

Ramona-Schwering_square

Ramona, a Developer Advocate at Auth0, bridges roles as a tester and developer. She's a Google Dev Expert in Web Tech, Women Techmaker Ambassador, and Cypress Ambassador, building trust in test automation and identity topics.

Developer Advocate

Ramona Schwering

We're excited to announce the general availability of Auth0 Forms, a powerful visual editor that empowers you to create custom, dynamic forms that integrate seamlessly with your authentication flows.

We are thrilled to announce that Auth0 Forms is now **generally available**. Auth0 Forms is a robust visual editor that enables you to create custom, dynamic forms that seamlessly integrate with your authentication workflows. With [Auth0 Forms](https://auth0.com/features/forms), you can enhance customer experiences and save time by eliminating days or weeks of coding. This no-code visual editor allows developers to create personalized sign-up flows tailored to their company's requirements. Explore pre-built templates, debugger mode, multi-language support, and more.

<iframe width="560" height="315" src="https://www.youtube.com/embed/jkzwN2xwO5w?si=CNJZsw1M2wGPXHmW" title="YouTube video player" frameborder="0" allow="accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture; web-share" referrerpolicy="strict-origin-when-cross-origin" allowfullscreen></iframe>

## What's up with Auth0 Forms?

Auth0 Forms is a new feature of the Auth0 identity platform that allows you to use a visual editor to add custom steps and business logic to your authentication flow. You can now create customizable forms to collect user information that you can conditionally trigger when your users go through the login and authentication flow you've designed for your app.

The platform offers a visual, drag-and-drop editor for creating custom forms within login and signup flows. This allows for easy modifications without needing external redirects, simplifying identity workflows. Developers can use the low-code solution to build and manage forms with minimal coding, adding UI components, logic, and branding. Each form consists of a series of steps. In between the steps, you can trigger custom business logic to perform various actions on the data collected in the form. 

![Auth0 Forms Visual Editor](https://images.ctfassets.net/23aumh6u8s0i/7tAL7osVzrUEHQZ50GCCyz/93b8a7a5f951e56a6bdf9a9f8f0c443c/auth0_forms_01.png)

As a whole, a form behaves much like a state machine, where you can have different nodes that represent a state of the machine. In the context of forms, there are the following nodes: Start, Step, Flow, Router and End screen:

* **Start nodes** for managing hidden fields, as they are not visible to the user
* **Step nodes** are the visual representation of the form, such as visible user data input fields
* **Flow nodes** for defining custom logic and integration flows
* **Router nodes** for setting up rules to create conditional logic jumps between nodes
* **Ending screen nodes** for resuming the authentication flow post-submission

Each form must have a start and an end screen node. Within these two nodes, you can add any number of step, flow or router nodes to define the visual representation of your form and control its business logic. Components are dragged into fields using the drag-and-drop builder. 

The system also includes pre-built templates for common scenarios, making creating workflows for tasks like [progressive profiling](https://auth0.com/docs/manage-users/user-accounts/user-profiles/progressive-profiling) and policy acceptance easier. This means you can define conditions that prompt users to provide additional information as they interact with your product. For instance, upon the user's third login, you could request that they fill out their profile.  

<iframe width="560" height="315" src="https://www.youtube.com/embed/qh1NKbyaaJ4?si=IbT-vWCTw2reLs9V" title="YouTube video player" frameborder="0" allow="accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture; web-share" referrerpolicy="strict-origin-when-cross-origin" allowfullscreen></iframe>

Other use cases may include the following examples:

* **Enforce Policies**: If you need to update your policies, you can create logic to verify if users have accepted the latest policies. Depending on that, a custom form will be displayed for users who need to accept those updated policies.
* **Customize Authentication Flows**: Extend and customize your flows with additional steps and custom logic. For example, you can verify email or phone numbers with OTP and account linking, confirm payment details with Stripe, and more.
* **Trigger Custom Actions**: Initiate backend processes or workflows based on user input.
… and much more! 

## Close-up on Auth0 Form’s Features

Are you excited to use Auth0 Forms? 

* Explore our [comprehensive documentation](https://auth0.com/docs/customize/forms) for detailed information and resources. If you’re looking for guidance on your use cases, you might find it in the [template section](https://developer.auth0.com/resources/templates/forms) of our [Developer Center](https://developer.auth0.com). 
* Looking for a more hands-on approach? Explore the [Auth0 Developer Center Labs](https://developer.auth0.com/resources/labs?topic=forms) to explore a variety of use cases and guides on how to build, e.g., progressive Profiling, custom policies, and custom signup steps. 🤓
* If you're curious about examples and how to get started quickly, find a [demo experience](https://forms.auth0.dev/) and try it out. 🚀

![Auth0 Forms Visual Editor](https://images.ctfassets.net/23aumh6u8s0i/3hlVk0QphKHf2P2yOqV3Ht/6b05d9756123e0a07a84edc3c921581a/auth0_forms_02.png)

With Auth0 Forms, you're not just implementing authentication – you're crafting user experiences.
Happy coding! 🚀


Auth0 Forms Is Now Generally Available!

milan-khan

Milan is the Product Manager for advanced identity security features for customers operating in highly regulated industries. Milan is especially keen on solving consumer identity problems balancing user experience, security and compliance.

Senior Product Manager

Milan Khan

An introduction to Strong Customer Authentication (SCA), a mechanism for providing a higher level of security in sensitive contexts.

Strong Customer Authentication (or SCA for short) is a versatile authorization mechanism that first made waves in the financial services industry for digital payments, and adoption is picking up pace, even for non-financial transactions.

SCA was enacted in 2019 as a requirement of the [revised European Union (EU) Payment Services Directive (PSD2)](https://www.ecb.europa.eu/press/intro/mip-online/2018/html/1803_revisedpsd.en.html). Its main purpose is to raise security standards and reduce fraud for online and contactless payments, and it's now a part of life for millions of consumers in the EU.

PSD2 and its regulatory technical standards (RTS), along with inputs from the European Banking Authority in the form of opinions, questions, and answers, describe how SCA should be implemented by financial services organizations in EU member states. In summary and in relation to user security and authentication, this means:

- The payer needs to authenticate themselves with multi-factor authentication in order to authorize the payment.
- Multi-factor authentication (MFA) must comprise two (or more) of the following elements: knowledge, possession, and inherence.
- The payer (the consumer) gives informed consent to the payment amount and the payee's account.
- The payment transaction must be (cryptographically) linked to an amount and a payee specified by the payer (known as Dynamic Linking – this is what makes SCA different from typical “step-up MFA”).

In this blog post, we'll explore these SCA components and show how you can implement them using Auth0 by Okta! 

## Exemptions from Applying SCA

Strong Customer Authentication takes a risk-based approach, and there is a provision for exemptions to be applied to SCA. Low-risk scenarios that allow service providers not to apply SCA include:

- Payments to existing payees that have been previously authorized using SCA.
- Payments from one account to another account, where both accounts belong to the same account holder and are with the same service provider.
- The service provider has judged the payment transaction to be low risk through real-time risk and fraud analysis. The level of historic fraud will determine the threshold for amounts that can be exempted from SCA; i.e., lower levels of fraud will mean higher payment amounts can be exempt from SCA.
- Payments transactions below EUR 30 (or local equivalent) are considered "low value" and may be exempt from SCA. Service providers will have to request the payer to perform an SCA if the exemption has been used five times since the payer's last successful SCA or if the sum total of previously exempted payments exceeds EUR 100 (or local equivalent).

## Multi-Factor Authentication &mdash; Something You Know, Have, or Are

As discussed earlier, SCA mandates the use of at least two distinct authentication factors out of the three categories: knowledge, possession, and inherence.

- The **knowledge factor** is something the user knows, such as a password, a personal identification number (PIN), or an answer to a security question.
- The **possession factor** is something the user has, such as a telephone SIM card, a mobile device, or a smart card. Each of these typically has a cryptographic key, so the possession factor is essentially possession of a cryptographic key, preferably the private key of an asymmetric key pair.
- The **inherence factor** is something you are and is typically biometric verification where a user's captured biometric is compared to a reference template. This can be, for example, a fingerprint, facial, or voice biometric.

## Consent

Authorizing payments and any other sensitive transaction requires that the user know what they are authorizing and consenting to. SCA requires the user to view the payee and the payment amount before any authorization.

This concept of providing informed consent can also apply outside of payment scenarios for any sensitive transactions such as:

- Changing login and/or security settings
- Changing user profile settings, e.g., home address
- Sharing personal data

![Strong Customer Authentication user consent](https://images.ctfassets.net/23aumh6u8s0i/6kC16xojBEnAQLynhGuUM/bfb4bbeb85b87c2ab28e00faaff2a1a0/strong-customer-authentication-user-consent.jpg)

## Dynamic Linking &mdash; What Makes SCA Different

Dynamic Linking is what sets SCA apart from a regular step-up authentication prompt. Linking transaction details to the approval prompt allows users to double-check accuracy and avoid transaction tampering before approving the transaction.

When a payer (the consumer) initiates a payment, the transaction itself must be linked to the amount and payee specified by the payer. This dynamic linking generates an “authentication code,” which is unique and specific to the transaction (payee and amount). 

The authentication code is transferred through the payment and authorization processes. Any changes to the payment data (amount, payee) will invalidate the authentication code and, thus, the transaction.

> If you want to learn more about the details of SCA, here are some related documents:
>
>- Revised EU Payment Services Directive “PSD2”: [2015/2366 - EN - Payment Services Directive >- EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex%3A32015L2366) 
>- SCA Publication: [Strong customer authentication requirement of PSD2 comes into force - European Commission](https://finance.ec.europa.eu/publications/strong-customer-authentication-requirement-psd2-comes-force_en)
>- Regulatory Technical Standard for SCA: [Delegated regulation - 2018/389 - EN - EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32018R0389) 
>- Amendment on the RTS for SCA: [Final Report on the amendment of the RTS on SCA & CSC](https://www.eba.europa.eu/sites/default/files/document_library/Publications/Draft%20Technical%20Standards/2022/EBA-RTS-2022-03%20RTS%20on%20SCA&CSC/1029858/Final%20Report%20on%20the%20amendment%20of%20the%20RTS%20on%20SCA&CSC.pdf) 
>- Opinion of the European Banking Authority on SCA: [Opinion of the European Banking Authority on the implementation of the RTS on SCA and CSC](https://www.eba.europa.eu/sites/default/files/documents/10180/2137845/0f525dc7-0f97-4be7-9ad7-800723365b8e/Opinion%20on%20the%20implementation%20of%20the%20RTS%20on%20SCA%20and%20CSC%20%28EBA-2018-Op-04%29.pdf) 

## Strong Customer Authentication with Auth0 by Okta

[Highly Regulated Identity](https://auth0.com/docs/secure/highly-regulated-identity) (HRI) is a solution suite on the Customer Identity Cloud powered by Auth0 that delivers Financial Grade Identity™ that helps organizations elevate security, privacy, and user experience beyond login. HRI enables developers to meet the high levels of security required by companies operating within highly regulated industries like banking, insurance, and health care. You can also use HRI for other sensitive operations that require enhanced security, such as users updating their account information, admin or security settings, accessing sensitive data or apps, and more.

Here, we look at how Highly Regulated Identity can be used to build a Strong Customer Authentication solution.

### Solution architecture

The diagram below describes a possible architecture and interactions for a Strong Customer Authentication solution built on Auth0 by Okta using HRI features.

![Strong Customer Authentication flow in Auth0 by Okta](https://images.ctfassets.net/23aumh6u8s0i/31xqfrkhJVa87fbeplvGpz/459e46a7bcb42fd79aafbf1576eebdb6/strong-customer-authentication-flow-in-auth0-by-okta.png)

Important points to note:

- The blue  components are Okta-owned and part of Auth0 and Highly Regulated Identity solution suite.
- The green  components are built and maintained by the customer, e.g., customer mobile apps, applications, and services. 

### Sequence of operations

1. The user has initiated a payment transaction via their web browser at a digital banking web application, e.g., they may be making a payment from their bank account.

2. The digital banking web application sends the transaction request to Auth0:

   a. The transaction request may contain the “authentication code” for the amount and payee as part of the transaction. 

   b. The request is sent to the `/par` endpoint and avoids exposing sensitive transaction details at the browser.

3. Auth0 validates the request and generates: 

   a. A `linking_id` when the Consent Policy is configured as “Transactional Authorization with MFA” and the API audience is configured with this Consent Policy.

   b. A `request_uri` as a reference to the next step in the authorization process.

4. Auth0 sends the request_uri back to the calling web application .

5. The web application redirects the browser with the `redirect_uri`, which opens the login page in Auth0:

   a. The user can perform the login with their knowledge-based factor (i.e. their password). 

   b. This login step can be avoided if there is already a single sign-on session. 

   c. The user will wait here on this “holding page” until the decoupled flow completes.

6. Meanwhile, a [post-login trigger](https://auth0.com/docs/customize/actions/flows-and-triggers/login-flow#login-post-login) can run custom an Action code that extracts the authorization details (e.g., amount, payee, authentication code) from the transaction request.

   a. At this point, the Action code can integrate with third-party risk and fraud engines to determine whether a step-up authentication (i.e., SCA) is needed.

7. The Action writes the `linking_id` and contextual authorization details into a message store, i.e., a data store, for future retrieval.

8. Auth0 performs a lookup for the MFA mechanism to use; here, we will use a mobile push notification to a custom mobile app which embeds the Okta [Guardian SDK](https://auth0.com/docs/secure/multi-factor-authentication/auth0-guardian):

   a. Auth0 sends a mobile push notification to the mobile app, along with the `linking_id`.

   b. No transaction details are sent over the push notification.

9. The customer mobile app receives the push notification with the transaction `linking_id` and calls the message store to retrieve the transaction details for the user to authorize and consent to.

10. The customer mobile app extracts the authorization details for the requested transaction, i.e., payment amount and payee, and displays this to the user for consent.

    a. The user reviews the transaction details and proceeds to accept or decline.

11. The customer mobile app with embedded Guardian SDK calls the Okta MFA endpoint with the result of the user authorization:

    a. Was the MFA action completed successfully or not?

    b. If the MFA was completed successfully, did the user accept or decline?

12. Once the mobile push-based MFA completes, the web browser is redirected from Auth0 and the MFA page back to the digital banking web application:

    a. The digital banking web application receives an authorization code.

13. The digital banking web application exchanges the authorization code for an access token:

    a. The access token contains the details from the original transaction request, including the payment amount and payee and “authentication code”.

14. The digital banking application uses the access token to consume APIs in order to initiate the payment transaction in the appropriate back-end systems.

15. The user is informed of the outcome of the payment transaction.

### Supported authentication mechanisms

The solution architecture describes SCA using a mobile push notification to a customer's mobile app with embedded Guardian SDK. However, there are alternative options that are also compliant with SCA:

- Authentication by one-time passcode (OTP) sent via SMS.
- Authentication by WebAuthn.

For both of these authentication options, the user performs the authentication on the login page and then is shown the transaction details to authorize and consent to.

## Final Words

The Highly Regulated Identity solution suite on Auth0 delivers Strong Customer Authentication for financial services and payments. The SCA solution also applies to non-payment use cases and can be applied to any sensitive operation where step-up authentication, user authorization, and consent are required.

You can read more about [Highly Regulated Identity on the Auth0 by Okta documentation](https://auth0.com/docs/secure/highly-regulated-identity).


Strong Customer Authentication Explained

SaaStart allows devs to easily explore, gain experience with, and demonstrate key Customer Identity functionality

Getting started with Customer Identity and Access Management (CIAM) — especially for B2B SaaS apps — can be intimidating. What began as a fairly straightforward login box has grown into a comprehensive set of capabilities encompassing authentication, authorization, user lifecycle management, federation, and Identity security — all of which must comply with [a daunting array of ever-evolving regulations and standards](https://auth0.com/security).

At the same time, there’s no substitute for learning through hands-on experience. But the reality is that devs are already under enough time constraints and don’t always have the luxury of building sandboxes or proofs-of-concept from scratch.

That’s why we’re excited to unveil [SaaStart](https://saastart.app/), a reference B2B SaaS application built using Next.js and Auth0 by Okta.

Intended primarily for developers building B2B SaaS apps, [SaaStart](https://saastart.app/) provides a fast, safe, and accessible way for devs to explore, experiment, and get up and running with Customer Identity. You can easily deploy a sample Auth0 template from within [the SaaStart GitHub repository](https://github.com/auth0-developer-hub/auth0-b2b-saas-starter).

## Get Hands-on with Customer Identity

In Identity terms, essential features of an effective B2B CIAM solution include:

* **User registration**, to create the record that makes everything else possible
* **Authentication,** to establish with confidence that the users logging into accounts are who they say they are, using one or more factors to do so
* **Authorization,** to help organizations provide a user with the appropriate level of access to resources or applications
* **Delegated administration,** to enable customers and administrators to make updates and changes to users’ data and access

But — just as describing a car as a combination of engine, drivetrain, wheels, and steering mechanism is woefully insufficient at capturing what you can do with one or how to build one — simply summarizing these Identity elements doesn’t come close to telling the CIAM story.

To help fill in the blanks with practical experience, [SaaStart](https://saastart.app/) allows devs to explore CIAM within the look, feel, and functionality of a modern B2B SaaS application.

Using [SaaStart](https://saastart.app/), devs can get hands-on with:

* **Multi-tenant access control,** including administrative roles with control over the app’s configuration

![SaaStart](https://images.ctfassets.net/23aumh6u8s0i/19r62j5wQAyA9WaC03j62T/d4bc78054cbb4e4843d5154a4b8261be/Uploaded_from_Speed_up_Your_Customer_Identity_Journey_with_Auth0_SaaStart)

![SaaStart](https://images.ctfassets.net/23aumh6u8s0i/2g4TA8C7AkVObsBT9LTx4t/57a14e32fb52f571d52db9503c9b0653/Uploaded_from_Speed_up_Your_Customer_Identity_Journey_with_Auth0_SaaStart)

<br>

* **Log-in options for the modern extended workforce,** including Single Sign-On (SSO) for enterprise employees and email-based authentication for early adopters and smaller customers without their own Identity Providers

![SaaStart](https://images.ctfassets.net/23aumh6u8s0i/2HdILnTFaOOb7jfePCuJhG/57087f523ecea46c6a8ee89e5f13d6f0/Uploaded_from_Speed_up_Your_Customer_Identity_Journey_with_Auth0_SaaStart)

* **Security policies,** from enforcing a range of Multi-Factor Authentication (MFA) options and domain-based SSO to configuring session timeouts

![SaaStart](https://images.ctfassets.net/23aumh6u8s0i/35qq2OrUXesaKoxdSyX3ww/5990471670bd41b204cfe0b8d742ba8f/Uploaded_from_Speed_up_Your_Customer_Identity_Journey_with_Auth0_SaaStart)

* **User provisioning,** including just-in-time provisioning or automated user management using the System for Cross-Domain Identity Management (SCIM) - _coming soon_

* **API client management** with self-service create/delete capabilities - _coming soon_

## Everything Developers Need to Implement Customer Identity

SaaStart is just a taste of what’s possible with Auth0 by Okta.

With 10+ years as a pioneer in the CIAM space, we’ve leveraged cutting-edge technologies and architectures to create [a modern solution with an impressive collection of features and functions](https://auth0.com/blog/why-auth0-by-okta/).

Whether you’re building a B2C, B2B, or Hybrid application, Auth0 provides the foundational requirements out of the box with broad support for [open standards](https://auth0.com/learn/how-auth0-uses-identity-industry-standards) and a range of developer resources — including [Quickstarts](https://auth0.com/docs/quickstarts), [APIs](https://auth0.com/docs/api), and [30+ SDKs](https://auth0.com/docs/libraries).

In fact, with a few lines of code, you can integrate Auth0 into any app written in any language and any framework.

Plus, we’re proud to offer a number of discounted offerings that can help you get started and — thanks to a long list of features — are often sufficient for the longer term:

* Self-service options, including a [free trial plan](https://auth0.com/signup) that lets you get off the ground with up to 7,500 active users and unlimited logins — while also including social login, DB connection for securely storing Identity information, branded login, extensibility, and security capabilities (brute force and suspicious IP throttling), support for five regions (US, UK, EU, JP, AUS), and even passkeys
* [Auth0 for Startups](https://auth0.com/startups), which brings the convenience and security of Auth0 to eligible startup customers so they can focus on their core value propositions rather than spending more time than is necessary on Identity
* Our [Nonprofit Offering](https://auth0.com/nonprofits/get-started), which provides preferential pricing that makes the leading Identity service even more accessible to organizations on a mission to make the world a better place

## Speed up Time-to-Market with Auth0

We understand that developers would rather spend their time solving hard problems and leveraging their creative side to build really fun solutions. Auth0 enables you to do those by offloading some of the more mundane and frankly dull parts of creating a standards-based CIAM solution.

And [there’s ample evidence](https://auth0.com/customers) that outsourcing Customer Identity is the prudent approach. For instance, Okta’s 2023 report [How Development Teams Purchase SaaS](https://www.okta.com/resources/whitepaper-how-development-teams-purchase-saas-report/thankyou/) revealed that:

* **Authentication takes the third-most time and work to build and maintain in-house**, behind only “data management and storage” and “DevOps tooling and automation.”
* **Third-party authentication reduces time to market more than any other SaaS component** — 88% of organizations that use a third-party SaaS platform for authentication report reducing time to market

We invite you to visit our [Developer Center](https://developer.auth0.com/) to learn about Auth0, explore tutorials, download code samples, connect with us, find resources, and more.

If you have feedback about SaaStart or suggest other features to explore in future versions or new apps, please drop us a comment or open an issue on [the GitHub repo](https://github.com/auth0-developer-hub/auth0-b2b-saas-starter).

<include 
    src="LinkCard" 
    title="A B2B SaaS Application Primer Using Auth0" 
    link="https://auth0.com/blog/b2b-saas-application-primer-using-auth0/" 
    description="Are you building a B2B SaaS application using Auth0? Then check out our primer for more on delivering IAM functionality using the Auth0 Organizations feature."
img="https://images.ctfassets.net/23aumh6u8s0i/44Jbuzdh6CvHDaCJ6LJNLh/2a8d0114b1bd7b03a92a386cced73e6b/square-hero.jpg"
/>

Speed up Your Customer Identity Journey with Auth0 SaaStart

I stream, blog, and make youtube videos about tech stuff. I love coding, I love AI, and I love building stuff!

Staff Developer Advocate

Juan Cruz Martinez

Learn how to leverage Auth0 Actions to create custom MFA (Multi-Factor Authentication) workflows, enforce enrollment of users based on specific conditions, and validate user authentication.

Multi-factor authentication (MFA) is an essential security measure that helps to protect your organization's data and assets. By requiring users to provide an additional authentication factor, such as a security token or fingerprint, in addition to their username and password, MFA can significantly reduce the risk of unauthorized access.

However, implementing MFA can sometimes create friction in the user experience, potentially leading to frustration and reduced productivity. Additionally, not all users or scenarios may require the same level of security, making a one-size-fits-all MFA approach impractical.

Auth0 Actions is a powerful feature that allows you to customize and extend the functionality of Auth0. With Actions, you can create custom workflows that trigger in response to specific events, such as user login or registration. This enables you to tailor your MFA implementation to meet your organization's specific needs.

For example, you can use Actions to:

- **Enforce MFA based on user roles or permissions**: You can require certain users, such as administrators or those with access to sensitive data, to use MFA while allowing others to bypass it.
- **Implement risk-based authentication**: You can use Actions to assess the risk level of a login attempt based on factors such as the user's location, device, and IP address. If the risk is high, you can then require the user to provide an additional factor of authentication.

## Prepare your Tenant

Before diving into customizing your Multi-Factor Authentication (MFA) flows, let's make sure we have the essentials in place. This quick guide will walk you through the initial setup steps:

- **Activate MFA**: Head over to your Auth0 Dashboard (<a href="https://a0.to/blog_signup" data-amp-replace="CLIENT_ID"  data-amp-addparams="anonId=CLIENT_ID(cid-scope-cookie-fallback-name)">Get a free account</a> if you don't already have one) and navigate to [Security > Multi-factor Auth](https://manage.auth0.com/#/security/mfa). Here, you'll be able to activate MFA for your tenant.

- **Choose Your Factors**: [MFA comes in various forms](https://auth0.com/blog/not-all-mfa-is-created-equal/). Decide which factors suit your security needs and enable them on the same Multi-factor Auth page. You might choose options like push notifications, SMS codes, or even biometrics.
    ![Auth0 Dashboard > Security > Multi-factor Auth](https://images.ctfassets.net/23aumh6u8s0i/5NSKKAcGSjkj40ZkTmUlDD/3165f217e14e7a85b9f0304695fdf9d5/MFA_Auth.png)

- **Enable Customization**: To personalize your MFA flows, toggle on the "Customize MFA Factors using Actions" setting. This is like unlocking a secret level – it opens the door to fully customized experiences for your users.
    ![Auth0 Dashboard > Security > Multi-factor Auth > Additional Settings](https://images.ctfassets.net/cdy7uua7fh8z/2hv0ELTkkka3t230SXfxw/46def5395652b2451cfc9e0ad01a371a/MFA_actions.png)

> Actions with `enrollWith` or `enrollWithAny` commands override any existing policies or rules that enable or disable MFA in a tenant.

## Understand the APIs

Once you've enabled Multi-Factor Authentication (MFA) in your Auth0 tenant, you can go beyond the basic settings and create truly customized enrollment flows using Auth0 Actions. Actions are snippets of code that run at specific points in the user's authentication journey, giving you granular control over your authentication workflow and, in particular, how MFA is presented.

To customize your MFA experiences, Auth0 Actions provides a set of APIs designed for enrollment and requiring authentication challenges. Here's a breakdown of the four key APIs you can use: 

### `enrollWith(factor, options)`

Initiates MFA enrollment for a specific factor (e.g., `otp`, `push-notification`, `webauthn-roaming`, etc. Visit the docs to learn about [all supported values](https://auth0.com/docs/customize/actions/flows-and-triggers/login-flow/api-object#:~:text=api.authentication.enrollWith(factor%2C%20options)).

Example:

```javascript
api.authentication.enrollWith({type: 'otp'})
```

### `enrollWithAny(factors)`

Similar to `enrollWith` but prompts the user to select an MFA factor to enroll in from the supplied list.

Example:

```javascript
api.authentication.enrollWithAny([{type: 'otp'}, {type: 'webauthn-roaming'}])
```

### `challengeWith(factor, options)`

Challenge the user with one or more specified multifactor authentication factors. This method presents the default challenge first, then allows the user to select a different option if additional factors have been supplied. If the user has not enrolled in any of the factors supplied (including both the default and any additional factors), the command fails.

Example:

```javascript
api.authentication.challengeWith({type: 'otp'})
```

### `challengeWithAny(factors)`

Trigger a MFA challenge and allow the user to select their preferred factor from the supplied list.

Example:

```javascript
api.authentication.challengeWithAny([{type: 'otp'}, {type: 'webauthn-roaming'}])
```

## Create a New Auth0 Action

To begin, let's create a new [Auth0 Action](https://auth0.com/docs/customize/actions/actions-overview). Actions are serverless functions that run in a secure Auth0 environment.

To create an Action, log into your [Auth0 Dashboard](https://manage.auth0.com/#/actions/flows), select Actions from the left sidebar menu, then select Flows. This page shows the different flows you can customize. For our use case, we’ll choose the “Login” flow.

![The “Actions” page of the Auth0 dashboard.](https://images.ctfassets.net/23aumh6u8s0i/3Es0FEV0EEyNeKgN6LXEeM/67763781d697663da79113ba381e8610/actions_flows.png)

This will take you to the “Login” flow page, where you can install, create, and add Actions to the flow.

![The “Login” flow page of the Auth0 dashboard.](https://images.ctfassets.net/23aumh6u8s0i/5dveq8h22H0Nje8Rub6sa9/7071335d4db1571af98440e527f1b999/actions_login_flow.png)

The screen has two main sections: the diagram in the center of the page shows the login flow and the Actions panel.

On the diagram, we can see the default login flow, which contains two states.

- **Start:** The user completed the login form and is ready to log in.
- **Complete:** The system issues the user’s credentials (an ID token and, if required, an access token).

You can drag and drop Actions in between these states to add custom logic to the login flow or deny the login request before the tokens are issued.

On the right panel, we have the Actions panel with two tabs.

- **Installed**: Pre-installed Actions from the [Auth0 Actions Marketplace](https://marketplace.auth0.com/features/actions)
- **Custom:** Actions created for this tenant

To create an Action, click the plus icon on the Actions panel and select "Build from scratch".

![Create a custom Action using the Actions panel](https://images.ctfassets.net/23aumh6u8s0i/3TABItaKOdq9dpsUIdQIpx/47d5010f5642123942ba3b7afd710300/actions_login_flow_create_menu.png)

After that, a modal window will appear to enter the information for our Action: you’ll have to provide a name, and you can leave the trigger and runtime as the default values. For my Action, I’ll name it “Require webauthn MFA for admins”.

![Enter the Action name and click create](https://images.ctfassets.net/23aumh6u8s0i/H6zvDcXGyg2a773gW790H/07ce6e74ee07f115d0e58d6e3863642f/actions_login_flow_create_dialog.png)

After clicking on "Create", you’ll be taken to the Action’s code editor, where you can write the code for your Action, install packages, test it, and more:

![Auth0 Actions code editor page](https://images.ctfassets.net/23aumh6u8s0i/6OzG8Oe3XU8lFnzLIr5Ver/4644c79782edaa0d279d4cf2112ae32c/actions_editor.png)

An Action can make use of two JavaScript functions to alter the Login flow:

- `onExecutePostLogin`: defines what should happen immediately after the user provides login credentials that Auth0 verified. This method receives two parameters, `event` and `api`.
    - `event`: contains details about the login request, such as the user and the context.
    - `api`: contains methods to manipulate the login’s behavior.
- `onContinuePostLogin`: defines what should happen when control returns to the Login Action after a redirect to another web page. It’s used only when the user returns after being redirected, which is why it’s commented out by default.

For this tutorial, we’ll focus on the `onExecutePostLogin` method.

## Writing the Actions Code

Next, we'll write the Action's code that will require users under the Admin's group to use `webauthn` as an additional authentication step. If the user isn't already enrolled with `webauthn`, the first time they login they will be prompted to do so.

The action will make use of the APIs `challengeWith` and `enrollWith`, in addition to using the user's property `enrolledFactors` to determine if the user has an MFA factor enrolled already.

Here's the actual code:

```javascript
exports.onExecutePostLogin = async (event, api) => {
    // Check if the user is an admin, enforce webauthn
    if (event.authorization?.roles?.includes('Admin')) {
        // Check if the user is already enrolled with webauthn
        if (event.user.enrolledFactors && event.user.enrolledFactors.some(m => m.type === 'webauthn-roaming')) {
            api.authentication.challengeWith({type: 'webauthn-roaming'})
        } else {
            api.authentication.enrollWith({type: 'webauthn-roaming'})
        }
    }
};
```

## Attach an Auth0 Action to the Login Flow

After coding and testing your Actions, it’s time to deploy and use them as part of the login flow. Once you are ok with your testing results, you can hit the `Deploy` button on the top right corner of the screen. This will take the existing code and settings and generate a function snapshot you can use in your login flow.

If you ever need to change the code on the function, all changes will automatically be saved as a new draft, and if you want the changes to become effective, you’ll have to deploy your latest version once again.

Once your code is deployed, it doesn’t mean it is actively used as part of your login flow. To check for that, please refer back to the [login flow screen](https://manage.auth0.com/#/actions/flows/login/), where the login diagram is shown. If you don’t see your Action as part of the diagram, it means that, even if your Action is deployed, it has not yet been activated. To activate the Action as part of the flow, click on the “Custom” tab on the Actions panel, locate your Action by name, and simply drag and drop the box over the login diagram between the "Start" and "Complete" steps. After that, you can apply changes using the “Apply” button on the top right corner of the screen.

![Apply an Auth0 Action to the Login Flow](https://images.ctfassets.net/23aumh6u8s0i/5IKiEeHy8WharqTOjJnSLh/eb5025dfd22de94c2446ccc22f1b524d/actions_attach_to_flow.gif)

## Test Your New Authentication Flow

Now, you can try your new Action by logging into your Auth0-powered application using both admin and non-admin accounts. When you log using any method (e.g. username/password, or social login) with a non-admin user, you'll get direct access to your application or continue with the authentication flow as you have it specified for your tenant.

When you log in using an admin user (a member of the group "Admin", as we defined it on the Action), you'll be prompted to either register or validate your account with webauthn. The screen may look something like this:

![Auth0 MFA Validation Step](https://images.ctfassets.net/23aumh6u8s0i/7duWHgEkhhz2e7rLgLJV1X/d174ce044c7a8011f660cd83be1cc815/mfa_validate.png)

## Conclusion

Auth0 Actions provides a versatile and powerful toolkit to revolutionize your organization's MFA implementation. By harnessing the flexibility of Actions, you can create personalized, risk-based, and context-aware MFA workflows that enhance security without compromising user experience.

The ability to tailor MFA requirements based on user roles, risk assessments, and specific applications empowers you to implement a layered security approach. This means that you can enforce stricter MFA for high-risk scenarios, such as administrative access or sensitive data handling while offering a streamlined experience for regular users.

As you explore the possibilities of Auth0 Actions, remember that Customization is key. By experimenting with different workflows and conditions, you can fine-tune your MFA implementation to perfectly align with your organization's unique security requirements and user expectations.

Thanks for reading!

Using Actions to Customize Your MFA Factors

auth0_by_okta_hero copy

Auth0 Team

Offering expanded access and optionality for self-service plans and features

**TLDR**: 
Self-service customers have access to Auth0 capabilities that previously required a call with sales. Effective immediately: (1) customers can now upgrade to our B2B Professional Plan directly through the dashboard, (2) the Enterprise Connection limit in the B2B Pro plan has been increased from 3 to 5, and (3) Pro plans customers can now add a single Enterprise MFA factor (called 'Enterprise MFA Lite') via self-service.

In November 2023, we introduced [updated self-service plans and pricing](https://auth0.com/blog/upcoming-pricing-changes-for-the-customer-identity-cloud/) to scale with our customers. As a continuation of this work and based on your feedback, we now offer self-service customers easier access to plans and capabilities that previously required a discussion with sales.

### Here’s what’s new, effective May 2024:

* You can now choose our [B2B Professional Plan](https://auth0.com/pricing) using your dashboard! The B2B Pro Plan includes: 
    * 5,000 M2M Authentications (more available as add-ons)
    * M2M Add-on
    * External Database
    * Cross App SSO
    * 5 Enterprise Connections (increased from 3)
    * 100 organizations
    * And other features included in the B2B Essentials plan.

    _To upgrade: [Dashboard > Settings (Subscription Tab)](https://manage.auth0.com/#/tenant/billing/subscription) > Select Plan & Quota > Click Upgrade or you can continue to purchase this plan through our Sales team._

* **5 Enterprise Connections** for the B2B Professional Plan's Enterprise Connection limits have increased from 3 connections to 5 connections via self-service. This will allow more of our SaaS customers to scale more effectively. As a reminder, there is no limit on [Okta Enterprise Connections](https://auth0.com/docs/authenticate/identity-providers/enterprise-identity-providers/okta) for customers on all of our B2B plans.
* **Enterprise MFA Lite** is now available through self-service for both B2C and B2B Professional. This capability was only available via a contract with Sales, but it can now be added via the dashboard.
    * Enterprise MFA Lite allows you to add either SMS, push, or voice notifications to Professional plans for an additional fee. Fees vary by the amount of MAUs; find more information on [Dashboard > Settings (Subscription Tab.)](https://manage.auth0.com/#/tenant/billing/subscription)
    * This includes the support of push, [SMS, and voice notifications](https://auth0.com/docs/secure/multi-factor-authentication/multi-factor-authentication-factors/configure-sms-voice-notifications-mfa), (SMS charges for MFA are charged separately by carriers supported by Auth0). Under Enterprise MFA Lite, subscriptions will be limited to one MFA factor on the subscription. 

### MFA Offerings Explained

MFA ([Multi-Factor Authentication](https://auth0.com/blog/multifactor-authentication-mfa/)) provides a method to verify a user's identity by requiring them to provide more than one piece of identifying information. For example, **something you know**: a password, PIN, or security question, **something you have**: a smartphone, security token, or smart card, or **something you are**: your fingerprint, face scan, or voice pattern.

Some of our MFA offerings include: 

* **Pro MFA** &mdash; included in B2C Professional, B2B Essentials, B2B Professional, and Enterprise plans 
* **Enterprise MFA Lite Add-on** &mdash; an add-on for B2B and B2C Professional plans and Enterprise plans
* **Enterprise MFA** &mdash; included in our Enterprise Plans 

![Pro Plan Improvements for Self-Service Customers - May 2024](https://images.ctfassets.net/23aumh6u8s0i/sTrHbEBf42kTVlbfp6mRt/2459de4604259c2031a9808dd2111efa/MFA_Table.png)

<div class="alert alert-info alert-icon">
  <i class="icon-budicon-487"></i>
  <b> Please note that upgrading to B2B Professional and adding Enterprise MFA Lite to B2B and B2C Professional plans will incur additional fees. Visit our <a href="https://auth0.com/pricing">pricing page</a> for more information.</b><br> 
</div>

### Which MFA factor(s) are best for my product?

Choosing the right [MFA factor](https://auth0.com/docs/secure/multi-factor-authentication#mfa-factors) is all about striking a balance between security and user experience. Consider the sensitivity of the accounts you're protecting, the technical comfort level of your users, and the accessibility of the MFA factor across different devices. 

![Not All MFA is Created Equal](https://images.ctfassets.net/23aumh6u8s0i/5TgjqFrUJwTDkldGCqov7o/6d80ca9d9c0d29faebea01578a02e0b6/Not_All_MFA_is_Created_Equal.png "Not All MFA is Created Equal")
<p align="center"><i>From blog post: <a href="https://auth0.com/blog/not-all-mfa-is-created-equal/">Not All MFA is Created Equal</a></i></p>

<p align="left"</p>
To help evaluate our MFA offerings, visit this [blog post](https://auth0.com/blog/not-all-mfa-is-created-equal/) to learn about your options and for more details on factor types and authentication assurance levels, check out [this datasheet](https://www.okta.com/resources/datasheet-factor-assurance/).

### Have more questions about your plan or our MFA offerings?

We’re here to help! If you’re on a paid plan, our [Support team](https://support.auth0.com/) can help, and if you’re on a free plan, you can post in our [Community forum](https://community.auth0.com/). Thanks for being a valued customer. We hope this allows for more flexibility and optionality during your auth journey. Happy authenticating!

Pro Plan Improvements for Self-Service Customers - May 2024

Learn how to create customizable and secure login pages that match your branding to enhance user experience and conversion rates.

So, you've built an outstanding application. Your landing page is meticulously designed, compelling, and has a high conversion rate. You've carefully crafted every detail of the user experience, but what about the entry points to your app – the signup and login pages?

Often overlooked in the design process, these critical touchpoints serve as the users’ gateways into your application. They should be as compelling, user-friendly, and beautiful as the rest of your application. Just as the landing page captures the user's attention, the login and signup pages are where you can truly start to engage users, encouraging them to join your application.

In this article, we'll explore how Auth0 makes it easy to build login and signup experiences that not only align seamlessly with your branding but also provide a superior user experience. A poorly designed login page can lead to user frustration and higher abandonment rates, whereas a well-designed one establishes trust and encourages engagement. Because every aspect of your application, even the seemingly mundane, should be nothing short of beautiful.

Let's dive into how Auth0 can elevate your login experience, covering the importance of UI and UX, and offering practical tips to create extraordinary login flows.

## The Importance of the Login Page Design

The login page is often the first impression a user has of your application. It sets the tone for the entire user experience and can make or break a user's decision to continue using your app.

The design of a login page encompasses both UI and UX. It should not only be pretty but also easy to use while conveying a sense of security and trustworthiness to the user.

If you need inspiration or to learn some tips on what makes good login pages extraordinary, check out these [ten tips](https://www.invisionapp.com/inside-design/login-page-design/).

## Getting Started

Auth0 offers a variety of [customization options to match your application's branding and design](https://auth0.com/blog/customize-auth0-universal-login-with-auth0-cli/). With Auth0, you can rest assured that your login and signup pages will be not only beautiful and match your brand but also secure and reliable.

In many scenarios, those out-of-the-box settings are all you need to make your login and signup pages match your brand and style. But in case you want a completely customized page, Auth0 offers the possibility to create your own styles and designs using [HTML, CSS, and JavaScript templates](https://auth0.com/docs/customize/universal-login-pages/universal-login-page-templates). 

> Custom templates require enabling [custom domains](https://auth0.com/docs/customize/custom-domains), which is a paid feature.

In this article, we’ll focus on creating our own template to have full control over the login experience. However, if you would like to know how to set up your branding settings instead, you can refer to this article on [Customize Auth0 Universal Login with Auth0 CLI](https://auth0.com/blog/customize-auth0-universal-login-with-auth0-cli/).

You can work with templates either through the [Auth0 Dashboard](https://manage.auth0.com/#/login_page) with an integrated code editor and preview mode, or you can use the [Auth0 CLI](https://github.com/auth0/auth0-cli) with your editor of choice and [Storybook](https://storybook.js.org/) to preview your designs.

Throughout the article, we'll use the Auth0 CLI to customize the templates as it provides a rich developer experience.

## Setting up the Auth0 CLI

The Auth0 CLI is a powerful tool that allows you to manage your entire Auth0 tenant from the command line. The Auth0 CLI helps you simplify your workflows and set up automation on your Auth0 account.

### Install the Auth0 CLI

The Auth0 CLI is available for macOS, Linux, and Windows. To install it on your preferred OS, please follow [these installation instructions](https://github.com/auth0/auth0-cli#installation).

After your installation completes, you can verify the installation by running the following command:

```bash
auth0 -v
```

### Connect the CLI to your Auth0 Account

To connect the CLI to your Auth0 account, you'll need to log in. Run the following command in your terminal and follow the instructions to authenticate:

```bash
auth0 login
```

First, the CLI will prompt for one of two authentication methods, `As a user` or `As a machine`. For now, we’ll select `As a user` since it is the recommended option for a personal computer. However, for automation scenarios, it is recommended to select the latter.

Next, we need to authenticate in the browser using [device authorization flow](https://auth0.com/docs/get-started/authentication-and-authorization-flow/device-authorization-flow). The Auth0 CLI will show a code on the screen and will open a browser session, where the code should match, and after verification, you’ll have to authorize the CLI on all the requested scopes.

## Activate a Custom Domain

As mentioned before, a requirement for editing custom templates is to activate custom domains, which is a good practice for production. Since custom domains come in different configurations and multiple steps, I won’t be covering them in this article. Instead, I can refer you to the [custom domains documentation](https://auth0.com/docs/customize/custom-domains), where you can find all the information you’ll need with step-by-step instructions.

Once you have a custom domain set up on your account, you can continue with the rest of the article.

## Customizing the Universal Login UI

To start customizing the Universal Login UI, run the following command on your terminal:

```bash
auth0 universal-login customize
```

This will open the Auth0 customization editor on your browser which will allow you to change any visual settings in Universal Login, from colors, logo, texts, and you can design your own templates with live preview in this app.

![Auth0 Universal Login Editor Preview](https://images.ctfassets.net/23aumh6u8s0i/5YNs9FYoGfPXrMon6OMpkY/88008ca9b492268c60724883011271f0/Screenshot_2024-04-18_at_09.41.25.png)

Any changes that you make locally can then be deployed to your Auth0 tenant from the same UI.

### Exploring the UI

The UI customization tool is divided into three sections:

- **Navigation bar**: It allows you to work on different areas of customization, from settings, theme, page template and custom texts. It also allows you to navigate through the different prompts like login, signup, etc.
- **Editor**: On the left side, it's the editor. It will display information about the current state of your page in either JSON for settings or HTML code for the page template editor.
- **Preview window**: The preview window gives you a live preview of your changes and how your UL page will look like when deployed to your tenant.

## Building a Beautiful Template

If you jump into the **Page Template** section, the editor will load the current template available for your tenant. If you have never customized your template, it will display the default template which looks like this:

```html
<!DOCTYPE html>
<html>
  <head>
    {%- auth0:head -%}
  </head>
  <body>
    {%- auth0:widget -%}
  </body>
</html>
```

There's some custom code in that template, let's explore what each of those sections do:

- `{%- auth0:head -%}`: This will set all the head elements that are required for universal login to work, like importing scripts, basic styles, etc.
- `{%- auth0:widget -%}`: This will place the login widget on the screen.

Templates use [Liquid syntax](https://shopify.github.io/liquid/basics/introduction/), with variables you can use to further customize your experience. You can read about all variables available [here](https://auth0.com/docs/customize/universal-login-pages/universal-login-page-templates).

One of the benefits of using Auth0's rich templating system is the ability to customize logic depending on the current prompt. For example, you could have some parts of the UI shown on the signup screen but not on the login or other prompts. The term prompt is used to refer to a specific step in the login flow. Each prompt can have one or more screens. For example, the `reset-password` prompt would have multiple screens for resetting password requests, checking your email, entering a new password, and confirming your change. You can find the complete list of prompts and screens on the [official template variables documentation](https://auth0.com/docs/customize/universal-login-pages/universal-login-page-templates#:~:text=screen%20being%20rendered.-,The%20term%C2%A0prompt,-is%20used%20to).

You can do that by implementing conditionals over the variable `prompt.name`. Here's an example that renders additional content when the user is signing up.

```text
{% if prompt.name == "signup" %}
Show this only if the user is signing up
{% end %}
```

As part of templating, you can also set custom brand parameters, such as the brand's primary color, background, and logo, which you can use throughout the template by accessing the `branding` variable.

For example, if you need a button that aligns with the branding's primary color, you could implement it as follows:

```html
<button style="background-color: {{branding.colors.primary}}" ...>My Button</button>
```

Now that we know what we can do with the templating system, it's time to build your own.

Here's what I'll build. Feel free to copy and paste this template and customize it to your application or use it as a baseline for your own.

- Signup screen:
	![Custom Signup Screen](https://images.ctfassets.net/23aumh6u8s0i/5u5pK7O3FLMInWmakSjRAr/99dce5b115abc63d90ea271440f1afa6/custom-template-signup.png)
- Login screen:
	![Custom Login Screen](https://images.ctfassets.net/23aumh6u8s0i/3dzWx5rQ3xiIgqUTyBTqXT/0fee59fa6b4f593f5771ed4e25d8100d/custom-template-login.png)

What’s interesting about this design is that the signup page looks different from the rest as it provides additional information about the product, so users know what they are signing up for. I also make use of variables to set the branding color on custom elements and I added some responsive elements for tablets and mobile devices.

Here is my template for your reference:

```html
<!DOCTYPE html>
<html>
  <head>
    {%- auth0:head -%}

    <style>
        body {
            background-color: #fff;
        }

        .wrapper {
            max-width: 80rem;
            margin: 0 auto;
        }

        {% if prompt.name == "signup" %} 
        .container {
            width: 100%;
            height: 100vh;
            display: grid;
            grid-template-columns: 1fr 1fr;
            align-items: center;
        }

        @media screen and (max-width: 720px) {
            .container {
                display: flex;
                flex-direction: column;
            }
        }

        .container > .info {
            max-width: 28rem;
            padding: 1rem;
        }
        {% else %}
        .container {
            width: 100%;
            height: 100vh;
            display: flex;
            align-items: center;
            justify-content: center;
        }

        .container > .info {
            display: none;
        }
        {% endif %}

        .container > .info h2.title {
            font-size: 3rem;
            line-height: 1.2;
            margin-bottom: 1.5rem;
            font-weight: bold;
        }

        .container > .info p.subtitle {
            color: #718096;
        }

        .container > .info ul {
            list-style-type: none;
            margin: 0;
            padding: 0;
        }
        
        .container > .info li {
            color: #1A202C;
        }

        .container > .info li svg {
            color: #5CC98D;
            vertical-align: text-bottom;
            margin-top: 1.5rem;
        }

        .container > .login-box {
            position: relative;
            display: flex;
            align-items: center;
            justify-content: center;
            padding: 0 4rem;
        }

        .container > .login-box svg {
            position: absolute;
            width: 100%;
        }
    </style>
  </head>
  <body>
    <div class="wrapper">
        <div class="container">
            <div class="info">
                <h2 class="title">My Product</h2>
                <p class="subtitle">My product is awesome and it offers the following features:</p>
                <ul role="list">
                    <li>
                        <svg stroke="currentColor" fill="currentColor" stroke-width="0" viewBox="0 0 24 24" focusable="false" role="presentation" height="1em" width="1em" xmlns="http://www.w3.org/2000/svg"><path d="m10 15.586-3.293-3.293-1.414 1.414L10 18.414l9.707-9.707-1.414-1.414z"></path></svg>
                        Feature 1
                    </li>
                    <li>
                        <svg stroke="currentColor" fill="currentColor" stroke-width="0" viewBox="0 0 24 24" focusable="false" role="presentation" height="1em" width="1em" xmlns="http://www.w3.org/2000/svg"><path d="m10 15.586-3.293-3.293-1.414 1.414L10 18.414l9.707-9.707-1.414-1.414z"></path></svg>
                        Feature 2
                    </li>
                    <li>
                        <svg stroke="currentColor" fill="currentColor" stroke-width="0" viewBox="0 0 24 24" focusable="false" role="presentation" height="1em" width="1em" xmlns="http://www.w3.org/2000/svg"><path d="m10 15.586-3.293-3.293-1.414 1.414L10 18.414l9.707-9.707-1.414-1.414z"></path></svg>
                        Feature 3
                    </li>
                    <li>
                        <svg stroke="currentColor" fill="currentColor" stroke-width="0" viewBox="0 0 24 24" focusable="false" role="presentation" height="1em" width="1em" xmlns="http://www.w3.org/2000/svg"><path d="m10 15.586-3.293-3.293-1.414 1.414L10 18.414l9.707-9.707-1.414-1.414z"></path></svg>
                        Feature 4
                    </li>
                    <li>
                        <svg stroke="currentColor" fill="currentColor" stroke-width="0" viewBox="0 0 24 24" focusable="false" role="presentation" height="1em" width="1em" xmlns="http://www.w3.org/2000/svg"><path d="m10 15.586-3.293-3.293-1.414 1.414L10 18.414l9.707-9.707-1.414-1.414z"></path></svg>
                        Feature 5
                    </li>
                </ul>
            </div>
            <div class="login-box">
                <svg width="1013" height="890" viewBox="0 0 1013 890" fill="none" xmlns="http://www.w3.org/2000/svg">
                    <path d="M180.462 795.681L40.8315 567.776C19.5801 533.09 8.95466 515.747 4.64446 497.091C0.831363 480.586 0.608543 463.413 3.99145 446.712C7.81567 427.835 17.9843 409.924 38.3214 374.102L184.235 117.101C203.682 82.8483 213.405 65.722 227.028 52.9648C239.084 41.6743 253.303 32.9153 268.81 27.225C286.332 20.7958 306.003 19.8141 345.345 17.8502L644.507 2.91668C685.874 0.851143 706.557 -0.18069 725.22 4.94606C741.731 9.48141 757.023 17.479 770.074 28.4042C784.827 40.7544 795.51 58.1913 816.877 93.066L955.838 319.878C977.009 354.434 987.595 371.712 991.91 390.3C995.728 406.747 995.98 423.86 992.649 440.515C988.883 459.337 978.815 477.215 958.678 512.969L811.011 775.156C791.315 810.127 781.466 827.612 767.593 840.563C755.316 852.023 740.811 860.86 724.997 866.515C707.127 872.905 687.074 873.638 646.968 875.103L350.229 885.943L350.228 885.944C309.449 887.433 289.06 888.178 270.689 882.944C254.434 878.313 239.396 870.318 226.557 859.48C212.045 847.23 201.517 830.047 180.462 795.681Z" fill="{{branding.colors.primary}}"/>
                    <path d="M179.711 769.196L58.7659 539.848C40.3585 504.942 31.155 487.489 28.2839 469.088C25.744 452.808 26.7984 436.065 31.3778 419.97C36.5543 401.778 47.9229 384.859 70.66 351.022L233.792 108.259C255.534 75.9041 266.405 59.7266 280.801 48.0099C293.543 37.6402 308.23 29.8499 323.963 25.1169C341.74 19.7693 361.233 19.8416 400.221 19.9857L696.692 21.0815C737.687 21.2325 758.184 21.3089 776.23 27.2798C792.194 32.562 806.699 41.1538 818.774 52.4806C832.423 65.2849 841.676 82.8321 860.183 117.928L980.548 346.176C998.887 380.95 1008.06 398.337 1010.94 416.674C1013.49 432.897 1012.46 449.584 1007.94 465.636C1002.82 483.778 991.558 500.669 969.023 534.451L803.775 782.175C781.734 815.216 770.713 831.737 756.054 843.629C743.084 854.153 728.106 862.004 712.074 866.687C693.957 871.978 674.104 871.643 634.398 870.973L340.624 866.016L340.623 866.016C300.251 865.335 280.065 864.994 262.316 858.934C246.611 853.572 232.358 844.996 220.486 833.765C207.067 821.072 197.948 803.779 179.711 769.196Z" fill="{{branding.colors.primary}}"/>
                </svg>
                {%- auth0:widget -%}
            </div>
        </div>
    </div>
  </body>
</html>
```

## Explore Your Own Designs

By the end of this article, you can now design and customize signup and login experiences with Auth0 that are as beautiful and user-friendly as the rest of your application. With the power of custom templates, you can integrate your brand's color palette, unique fonts, and more. I'd love to see the unique and effective login experiences you create! Please share screenshots or links in the comments below.

Thanks for reading!

Building Beautiful Login Pages with Auth0

Calah Vargas

Calah Vargas is the Associate Manager of Product Led Growth, focusing on nonprofits, startups, and partnerships. She works on product marketing and customer marketing initiatives. Outside work, you can find her cooking, trying new restaurants, and traveling with friends and family.

Associate Manager, PLG

Upgrading made easy: from in-house authentication to modern login flows, flexible user profiles, and the convenience and security of passkey

Imagine you’re working on a monolithic application that includes a home-grown authentication system. Over the years, the authentication function has received upgrades here and there to improve security and to stay reasonably up-to-date in a changing world.

Sooner or later — perhaps triggered by considering different growth paths and how best to make use of developer time — you start to recognize that your in-house Identity stack is a limiting factor:

* Integrating with partners and other technology components requires custom work
* Maintenance obligations are distracting from work on your core app
* Meeting regulatory requirements for privacy is an ongoing challenge 
* Providing different access privileges to different types of end users is becoming more complicated than ever anticipated
* With every breach headline, you’re reminded of the constant need to strengthen security

Shopper Approved found themselves in a similar situation — in 2017, the company’s ambitions were outgrowing the home-grown Customer Identity capabilities of their monolithic PHP app.

With that realization, the search was for a third-party authentication solution.

# Why Shopper Approved chose Auth0 by Okta 

Since its launch in 2010, [Shopper Approved](https://www.shopperapproved.com/) has helped over 20,000 eCommerce brands — from mom-and-pop shops to global enterprises — generate more online trust, visibility, and conversions.

> “We knew we wanted to replace our login and authentication mechanism, and we needed a solution that would ‘tango’ with our [Laravel](https://laravel.com/) front-end templating engine,” Christopher Budge, Shopper Approved’s CTO recalled, “but we didn't know which direction we wanted to go in.”

<include src="QuoteCard" body="The Self-Service pricing was really attractive to us. The other providers that we found were prohibitively expensive for what was initially an experimental project, and not a lot of them had the adaptability that we needed to integrate into our existing application." name="Christopher Budge" title="CTO" team="" company="Shopper Approved" />

While searching online for ideas and options, Budge came across Auth0 — and, in particular, the Self-Service plans.

> “The other providers that we found were prohibitively expensive for what was initially an experimental project, and not a lot of them had the adaptability that we needed to integrate into our existing application.”

The Self-Service option gave Budge and the wider team plenty of time to perform due diligence. “_We looked for a long time before ultimately deciding upon Auth0,_” he shared. “_The more I dug into it, the better it looked._”

The ability to explore the solution in a hands-on manner, without a commitment, helped the team to make an informed choice. Budge explained that:

<include src="QuoteCard" body="I got together with our technical lead and programming contractor, and they started playing with it — and then they said, 'Yeah, we think this is going to work." name="Christopher Budge" title="CTO" team="" company="Shopper Approved" />

While every organization’s Identity journey is unique, here’s how Shopper Approved implemented Auth0.

## Migrating Users from the Legacy System to Auth0	

No matter how much preparation is done, a migration is always a nervy thing. As it turns out, those nerves were unnecessary — Shopper Approved’s migration from their legacy, home-grown authentication system to Auth0 went off without a hitch.

Budge recalled, “_We weren't sure how well our system would adapt to having its old authentication system ripped out and something new put in its place, but the migration actually exceeded expectations. Within 24 hours, we were able to ingest our entire user database into Auth0 and have them set up as users able to log in._”

However, migrating users was simply the foundation for modernizing the experience for Shopper Approved’s customers, with Budge adding, “_The universal login allows for such a smooth application login and flow. And our marketing team has really appreciated the customization and branding options that allow us to deliver a better customer experience._”

### Letting quickstarts guide the way

One of the first things Budge’s team did was explore Auth0’s step-by-step [quickstart guides](https://auth0.com/docs/quickstarts) to get a feel for the overall migration process.

“The quickstart guides were dead easy. Plus, between your host documentation and the notes in GitHub, it’s really, really easy as a developer to figure out ‘where am I and where do I need to go?’” and ‘What’s next?’”

![quickstarts](https://images.ctfassets.net/23aumh6u8s0i/58lZcrqemW0dCDEIrlLxef/fd17a831afcbbe647abd73d3420e9d95/01-migration.png)

### Leveraging SDKs

SDKs reduce the developer effort required to implement specific use cases, and Budge’s team found exactly what they needed among Auth0’s 40+ SDK libraries.

“Your SDKs are written really well, and your APIs are documented really well. So, code-wise, it’s extremely easy to interact with the platform — you can get going and don’t really have to think hard about it.”

![SDKs](https://images.ctfassets.net/23aumh6u8s0i/1cSZQDXlQ1VDHD7RFG71vu/6922a4a4409f3bab6453b7b48f12541e/02-migration.png)

## Building User Profiles

User data can come from many sources, including your own databases as well as social, legal, and enterprise identity providers. Some examples include Google, Facebook, Active Directory, and SAML.

In Shopper Approved’s case, there was an added complication — practically every user profile that had ever been created in their system still existed, and collectively, many of these profiles had inconsistent and incomplete data. But, perhaps counterintuitively, the upgrade actually presented an opportunity to clean up the user database. Budge’s migration script identified existing user records that were poorly formatted, allowing the team to quickly correct any issues — ultimately improving the overall structure of the company’s user data and laying a strong foundation for efficient scalability.

“The way your user profiles are set up — they’re just really easy to understand, manipulate, and customize. The data structure was easy to map to what we had and what we needed.” Maybe even more importantly, Budge recalled that “It just worked. When we were playing around with it, we saw that it does exactly what [your documentation](https://auth0.com/docs/manage-users/user-accounts/user-profiles) says it does.”

![User Profiles](https://images.ctfassets.net/23aumh6u8s0i/3EfvAVkkj9Ornz9JcTH5CJ/1783bd310eb0cd0722dbbe754aa606c4/03-migration.png)

## Innovating With Identity: Exploring Passkeys

The Identity domain is always evolving, with new specifications, standards, and [regulatory requirements](https://auth0.com/security) frequently appearing.

Unsurprisingly, one of the reasons why Budge was so eager to introduce a leading off-the-shelf solution was that it would allow the company to keep pace with these changes — while at the same time allowing the team to apply their finite resources on their core value proposition. In short, he knew that choosing Auth0 meant that Shopper Approved’s CIAM needs would be met today, tomorrow, and as far into the future as he could imagine.

Like many CTOs, Budge had closely been following [passkeys](https://learnpasskeys.io/) — FIDO credentials that are discoverable by browsers or housed within native applications to enable — and was excited by their potential to provide [a highly secure and very convenient user authentication experience](https://auth0.com/blog/webauthn-and-passkeys-for-developers/).

> “I’ve been watching passkeys for a long time, and — literally the day I got [the announcement that they were available](https://auth0.com/blog/activate-passkeys-let-users-log-in-without-password/) — I jumped right in. We really enjoyed rolling them out early to our organization, and we’ve had zero issues. And it’s great that we didn’t have to build passkey support ourselves!”
> _Christopher Budge_

![Passkeys](https://images.ctfassets.net/23aumh6u8s0i/3qOGVNCBexcnp5LqxkAcNB/7a0c5eaa7bdb2cd37987795f7a504712/passkeys.png)

## Enjoying Ongoing Value

Budge’s hopes for lower support and maintenance obligations have come to fruition. “We have not had to spend a single development hour at all on user authentication and login — it's never failed, and it's never broken.”

Similarly, the upgraded security is evident. 

> “We've had many security researchers and penetration testers try to break in. Every time they run smack-dab into Auth0.”

<include src="QuoteCard" body="We have not had to spend a single development hour at all on user authentication and login — it's never failed, and it's never broken." name="Christopher Budge" title="CTO" team="" company="Shopper Approved" />

### Get started in minutes — for free — with no humans (other than yourself) required!

We’ve always tried to make things less complex for developers, which is why [our Self-Service plans](https://auth0.com/pricing) allow you to create a trial account with nothing more than an email address. During your 22-day trial period, you can create a simple app, configure its look and behavior, and explore the Auth0 solution in detail — giving you plenty of time to really get your hands dirty.

![Get started](https://images.ctfassets.net/23aumh6u8s0i/3s3e2u6XsF3BitzYgE3TpY/1097a71343e41a488444684c12c2c248/identity_journey.png)

Plus, anyone using our products can take advantage of resources including [quickstarts](https://auth0.com/docs/quickstarts), [40+ SDKs](https://auth0.com/docs/libraries), [detailed guides](https://developer.auth0.com/resources/guides/web-app/nextjs/saas-basic-authentication), and [extensive (but easy-to-follow) documentation](https://auth0.com/docs/articles) to help get started and implement a strong Customer Identity function.

In fact, with only a few lines of code, you can have Auth0 integrated into any app, written in any language, and in any framework.

[Try for free](https://auth0.com/signup?utm_source=whitepaper&utm_medium=auth0&utm_campaign=whyauth0) and see for yourself.


A Customer Identity Migration Journey

Shreya Gupta

Shreya is the Developer Advocate for Auth0 for Startups. She previously founded a non-profit called Bit Project, worked at a YC-backed Startup as a Developer Advocate, and currently hosts The Developer Diaries podcast. Through each experience, she has found her love for building resources and tools that help move the needle for developers. Outside of work, she enjoys traveling, watching K-Dramas, and drinking boba.

Developer Advocate, Startups

Before you start working with AI developer tools, understand what it could mean for you, your product, and your customers.

<div class="alert alert-info alert-icon">
  <i class="icon-budicon-487"></i>
  <strong>Note:</strong><br> 
  This blog post is based on interviews conducted with startup founders, engineering managers, data scientists, and risk analysts in the Artificial Intelligence and Machine Learning space.<br> 
</div>

Evaluating tools that can help optimize your development processes? Maybe you’re entirely building alongside [Devin, the first AI software engineer](https://www.cognition-labs.com/introducing-devin) to get your app to market faster, generating code snippets for your React app with [V0.dev](https://vercel.com/blog/announcing-v0-generative-ui), or using [GitHub CoPilot](https://thehackernews.com/2024/03/github-launches-ai-powered-autofix-tool.html) to help patch your website’s security flaws.

While productivity and efficiency are hallmarks of development success, security and privacy are just as paramount to protect your product and maintain customer trust. According to [Snyk’s 2023 AI Code Security report](https://snyk.io/reports/ai-code-security/), **80% of developers are bypassing security policies to use AI**.

But modern-day [Generative AI](https://news.mit.edu/2023/explained-generative-ai-1109) tools don’t typically have the built-in capability to determine whether the data it is exposed to is sensitive. It’s completely up to the user to take precautions and set up the proper protocols when choosing to use one of these tools. Let’s explore the potential risks of using AI tools in the dev process and what questions you could ask yourself to help make more informed decisions – for you, your product, and your customers.

## Productivity vs. Risk

According to Snyk’s blog, [How to Embed Security in AI-assisted software development](https://snyk.io/blog/snyk-and-atlassian-embed-security-ai-assisted-software-development/), “Code generation, using generative AI… is the area that stands to offer the greatest productivity benefits — **and the highest potential for introducing risk**.“

AI tools can help accelerate the process of taking an idea and building an MVP with limited resources. Although engineering productivity cannot be tracked by a single metric for all, it’s easy to see how these tools are already helping developers reduce time spent in generating code and improving the quality of code.

Like with all third-party tools, to strike the perfect balance between productivity and risk, it’s important to recognize ways in which these tools can hurt your product and customer security, now and in the future. In many situations, risk cannot be quantified, but companies can have an increased or decreased risk factor (risk tolerance) depending on:

* Industry
* Product type and use case
* Company stage

For example, risk tolerance can be higher for startups in growth mode, especially in industries outside of security.

## Risk Prevention Strategies

Let’s explore the most common risks associated with AI tools and mitigation strategies outlined by some engineers. 

Nonprofit OWASP (The Open Worldwide Application Security Project) documented a [list of potential security risks](https://owasp.org/www-project-top-10-for-large-language-model-applications/) when deploying and managing Large Language Models (LLMs) – some examples include:

* Sensitive Information Disclosure (LLM06) - LLMs can inadvertently disclose sensitive, proprietary, or confidential information leading to privacy breaches, intellectual property theft, and unauthorized access
* Prompt Injection (LLM01) - Attackers can manipulate LLMs through crafted inputs, causing the LLMs to execute the attacker’s intentions
* Overreliance (LLM09) - Systems or people overly dependent on LLMs without oversight may face misinformation, miscommunication, legal issues, and security vulnerabilities due to incorrect or inappropriate content generated by LLMs

When adding these tools to your tech stack, do these questions come to mind?

* How are you deciding which tools to use to increase your efficiency and productivity? 
* Do you have an internal vetting process for third-party vendors? How are you updating this for AI tools?
* Will you be prompting the AI tools with customer data and PII or proprietary restricted information? Are you in line with your applicable regulatory compliance frameworks? (GDPR, etc.)
* Does this tool abide by your corporate guidance?
* Do you have customer permission to use their data in this way?
* How could these tools impact you?
* What risks will you, your product, and your customers face?
* What guidance or guardrails does the tool have to protect your data as a user? Two popular types of AI developer tools are those for engineering productivity and those for general use, and the available configurations may vary.

We interviewed a few engineers (anonymously) about what they’re doing to minimize the risks associated with AI developer tools. Here’s a breakdown of some of the most common concerns and questions engineers are asking to reduce any harmful and inadvertent impact while coding with Gen AI tools.

* PI and copyright concerns
    * Once one of these tools generates code, who is the owner?
    * What happens if the tool is suggesting the same code to another customer, maybe even a competitor?
    * If you use AI tools in order to create a customer-facing chatbot, and a customer includes PII in their prompt – who is in charge of monitoring and removing this data and ensuring it isn’t being used to re-train models?
* Overreliance
    * Generating a few lines of code vs a few files of code – how familiar are you with the code in your product, and how much do you trust it?
    * Are you aware of the potential risk of [AI hallucinations](https://www.ibm.com/topics/ai-hallucinations) and how are you reducing it?
        * AI hallucinations are outputs from models that are nonsensical or inaccurate. For example:
            Question: where can I find the help center?
            Context: you’re looking for a website like [domain].com/help or support.[domain].com
            AI answer: the help center is located on the ground floor of this building.
* How are you updating your code and content review processes to deal with Gen AI?
* Data Exposure
    * Can you make sure your own data won't be used to answer prompts for competitors or malicious actors?
    * What are practical and technical strategies you can take to prevent data exposure?
    * Do you have strict policies and training for engineers when they are using these tools, or are you exploring third-party tools that tackle data leak prevention?

There’s no specific path to being completely secure from the risk of AI tools today, but there are many different strategies you can take to build strong guardrails to protect code and mitigate risk. Ensuring restrictions are very specific when engineers are using AI tools like Devin and code review is a must.

## AI Developer Tools Now and Tomorrow

AI tools for developer productivity are becoming increasingly popular. Further down the line, a startup founder might be able to ideate, possibly write [pseudocode](https://builtin.com/data-science/pseudocode), and use these tools to bring their idea to life. They might be able to start testing in a matter of minutes, not months.

If you’re an early-stage company, you might be eager to get started and may not have as much internal guidance as a large corporation. We hope this blog helps you start to outline the potential risks and considerations when evaluating AI tools for developer productivity. 

[Auth0 for Startups](https://auth0.com/startups) is empowering early-stage startups – tell us what we can do to best support you and your team!

_These materials and any recommendations within are not legal, privacy, security, compliance, or business advice. These materials are intended for general informational purposes only and may not reflect the most current security, privacy, and legal developments or all relevant issues. You are responsible for obtaining legal, security, privacy, compliance, or business advice from your own lawyer or other professional advisor and should not rely on the recommendations herein. Okta is not liable to you for any loss or damages that may result from your implementation of any recommendations in these materials. Okta makes no representations, warranties, or other assurances regarding the content of these materials. Information regarding Okta's contractual assurances to its customers can be found at [okta.com/agreements](http://okta.com/agreements)._

Security Considerations in the Time of AI Engineering

How to Evaluate a Customer Identity and Auth Solution


<div class="alert alert-info alert-icon">
  <i class="icon-budicon-487"></i>
  <b>This blog post references information found in our ebook: <a href="https://auth0.com/resources/ebooks/why-auth0-by-okta/">Why Auth0</a>.</b><br> 
</div>

**TL;DR:** Your login box must find the right balance between user convenience, privacy, and security. There are other solutions on the market that can help with that, but at Auth0, we know Identity is so much more than just the login box.

<AmpContent>
<amp-youtube
    data-videoid="ftnhO8EKkvo"
    layout="responsive"
    width="480" height="270">
</amp-youtube>
</AmpContent>
<NonAmpContent>
<div class='embed-container' style="position: relative; padding-bottom: 56.25%; height: 0; overflow: hidden; max-width: 100%;margin-bottom:40px;"><iframe style="position: absolute; top: 0; left: 0; width: 100%; height: 100%;" src='https://www.youtube.com/embed/ftnhO8EKkvo' frameborder='0' allowfullscreen></iframe></div>
</NonAmpContent>


When you’re deciding how your customers will log in to your website or application, your first step is probably figuring out if you’ll [build auth in-house or buy an out of the box solution](https://www.okta.com/resources/whitepaper-build-vs-buy/thankyou/). If you’re trying to get your app to market faster, want to reduce engineering costs, and want to mitigate security and compliance risks, a pre-built solution is the best option. It’ll help you achieve these goals and ultimately allow you to focus on what matters most - your core product. 

Once you're ready to take the next step and purchase, it's time to evaluate your best option. Here’s a list of what to consider when choosing a solution:

**Ease of Implementation**: Will the solution help you build your product and achieve product-market fit quicker than your competitors? There’s a big difference between getting some basic login functionality working and having a stable, scalable, and prime-time-ready Identity infrastructure in place. Depending on your industry and customer requirements, you’ll need to optimize your Identity flow for security and privacy, user experience, and, in most cases, convenience – while also building an experience that can easily be updated and maintained. 

**Scalability and Reliability**: Will the solution support you today, tomorrow, and in the future? Can the solution quickly adapt and scale to meet your website’s or app’s needs? Identity might be too large of a domain for your team to tackle all at once. Most companies start with the basics and then gradually add features over time. By understanding where you are today and where you could be in the future, the solution should support your team in delivering an Identity roadmap that enables growth, addresses security, and meets ever-growing customer expectations.

![A Comprehensive Guide for Your Customer Identity Maturity Journey](https://images.ctfassets.net/23aumh6u8s0i/1PbSZDO561aYL0h4xJvND5/6d4f881c91e7db71b93a12bc73c07f03/why01.jpg)
Source: [_A Comprehensive Guide for Your Customer Identity Maturity Journey_](https://www.okta.com/resources/whitepaper-a-comprehensive-guide-for-your-customer-identity-maturity-journey)

<p align="right"></p>

**Security and Compliance:** Last but definitely not least, does the solution comply with new and evolving regulations? Does it meet the requirements for multiple compliance frameworks and certifications? Identity as a domain is governed by an increasing — and increasingly complex — array of data regulations that require you to implement effective safeguards and put users in control of their own data. 

![Security and Compliance](https://images.ctfassets.net/23aumh6u8s0i/3D6mlCWBdASCBOzIXrpDEv/f4818a5d14aa504d334fdd648bc1181f/2176574_Why_Auth0_Feature_Table_Copy_013125_1080x1080_2_021924.jpg)

Whether you’re building a B2C, B2B, or Hybrid application, Auth0 provides the foundational requirements out of the box with broad support for [open standards](https://auth0.com/learn/how-auth0-uses-identity-industry-standards), allowing you to customize your solution with [APIs](https://auth0.com/docs/api), [30+ SDKs](https://auth0.com/docs/libraries), and [Quickstarts](https://auth0.com/docs/quickstarts). With a few lines of code, you can have Auth0 integrated in any app written in any language and any framework. 

At Auth0, security is not an afterthought. We have you covered with features to protect your organization and customers. Our product is an extension of yours – as customers, your requirements and feedback guide our product development. We also do the hard work of complying with [new and evolving regulations](https://auth0.com/security), so you have one less thing to worry about. These include:

* Researching threat actor tactics, techniques, and procedures (TTPs) and introducing the advanced security features needed to combat these threats
* Host, platform, and application-layer defenses to filter malicious entities before they can even access the login box or API
* [Adaptive MFA](https://auth0.com/docs/secure/multi-factor-authentication/adaptive-mfa), an extensible MFA policy that can help you protect your tenant from bad actors without increasing friction for real users
* Login-layer defenses that prevent fraudulent signups and account takeovers, including [Attack Protection features](https://auth0.com/docs/secure/attack-protection) that can be turned on with a simple toggle
* [Observability tools](https://auth0.com/docs/secure/security-center) that allow you to see potential attack trends and quickly respond to them in real-time
<br><br>

Extensibility is at our core. With [Actions](https://auth0.com/docs/customize/actions), you can write custom Node.js functions that fire during specific events in your Identity flow – develop complex Identity flows on our platform instead of piling on your own infrastructure. [Actions Integrations](https://auth0.com/blog/actions-integrations-are-now-ga/) make extending Auth0 with partner-built innovations even easier, often with no-code, drag-and-drop ease. Instead of building and maintaining custom code, Actions Integrations are easily integrated third-party solutions that can be quickly added to extend your Identity flow. Since launching in late 2020, the [Auth0 Marketplace](https://marketplace.auth0.com/) has helped developers quickly find and install third-party Identity solutions for their applications and APIs. Today, the Marketplace includes more than 300 third-party solutions.

Identity is important to your organization, but it’s not the reason you exist — and whatever that reason is should be the main focus of your engineering resources. Identity also requires significant effort and deep expertise. Choose an Identity provider that doesn’t just provide a login box but a service based on learnings from helping 18,000+ customers. See why customers are choosing Auth0, the comprehensive Identity solution, and solving Identity with [Passkeys](https://learnpasskeys.io/), [Organizations](https://auth0.com/blog/digital-identity-management/#B2B-Ready-with-Auth0-Organizations), and more: [okta.com/customers](https://www.okta.com/customers/). 

[Try Auth0 free today](https://auth0.com/signup?utm_source=blog&utm_medium=auth0&utm_campaign=whyauth0) with up to 7,500 active users and unlimited logins; no credit card is required. If you’re an early-stage company, check if you’re eligible for our Auth0 for Startups program [here](https://auth0.com/startups). We are also proud to offer [preferential pricing for nonprofits](https://auth0.com/nonprofits/get-started)—making the leading Identity service even more accessible. 

<div class="alert alert-info alert-icon">
  <i class="icon-budicon-487"></i>
  <b>If you’re interested in learning more about build versus buy, Auth0’s features, or anything else included above, check out our ebook: <a href="https://auth0.com/resources/ebooks/why-auth0-by-okta/">Why Auth0</a>.</b><br> 
</div>

_These materials and any recommendations within are not legal, privacy, security, compliance, or business advice. These materials are intended for general informational purposes only and may not reflect the most current security, privacy, and legal developments or all relevant issues. You are responsible for obtaining legal, security, privacy, compliance, or business advice from your own lawyer or other professional advisor and should not rely on the recommendations herein. Okta is not liable to you for any loss or damages that may result from your implementation of any recommendations in these materials. Okta makes no representations, warranties, or other assurances regarding the content of these materials.  Information regarding Okta's contractual assurances to its customers can be found at[ okta.com/agreements](http://okta.com/agreements)._


Why Auth0?

michael-swanson

I live in Austin, TX with my wife, Anneke, and our two kiddos, Ilya (5) and Everett (2). I am a native Texan but lived in multiple places across the southern US as a kid. I have family in Houston TX and Midland TX that we visit on a regular basis. Prior to joining Okta, I worked with early stage startups as a hands-on Product Manager, team lead, and product designer, while also writing (mostly frontend) code. 
<br>

When I am not working you can usually find me chasing my kids around, reading sci-fi or fantasy novels, or playing needlessly complex strategy board games with friends. I am also a huge Star Wars fan and am always down to talk about the latest Star Wars movies, TV, and/or books. Additionally, Anneke and I love to travel and have been all over the world together. Much of our travel focuses on getting out of the Texas heat, tasting and learning about wine, and sampling the amazing food we find along the way!


Michael Swanson

Businesses using Auth0 by Okta’s Universal Login, can leverage a pro-code option to customize signup and login flows to address unique needs.

Every company has unique user registration and login requirements. For example, needing to capture a first and a last name during signup or requiring users to agree to terms and conditions before they can create an account. 

To meet those specific business needs and use cases, we have introduced pro-code customizations for signup and login to the Universal Login experience. This capability is available to customers on our Enterprise and Professional plans.

Using this capability, customers can insert additional form fields and custom content into the signup and login screens and include client and server-side validations to ensure that required data, such as TOS acceptance, are completed and validated before completing the authentication process. 

Use cases include:

* Adding new fields to collect necessary customer data (name, phone number, email, preferences, consent, etc.)
* Adding new form elements for presenting and capturing TOS/privacy policy and opt-in before signup
* Adding custom content such as URLs, images, or marketing information
* Localizing custom elements in different languages

### Getting started

The new [Partials API](https://auth0.com/docs/api/management/v2/prompts/get-partials) allow developers to insert custom HTML, CSS, and Javascript into the Signup and Login screens. Developers can insert new form elements and custom content, perform asynchronous client-side validation via Javascript, and leverage [Liquid syntax](https://github.com/Shopify/liquid/wiki/Liquid-for-Designers) to perform conditional logic and insert dynamic variables. Here is an example of inserting custom code into the Signup screen:

```js
# eg: PUT /api/v2/prompts/signup/partials

# Request Body
{
  "signup": {
    "form-content-start": "<div class='ulp-field'><label for='first-name'>Full Name</label><input type='text' name='ulp-full-name' id='full-name'></div>",
    "form-content-end": "<div class='ulp-field'><input type='checkbox' name='ulp-terms-of-service' id='terms-of-service'><label for='terms-of-service'>I agree to the <a href='https://my.app/terms' target='_blank'>Terms of service</a></label></div>",
  }
}

```

Once the user submits the Signup form customers will have access to the data via Actions. Here is an example of saving user provided custom data to the user_metada for the end user

```js
/**
* Given this code in the signup form:
* <div class="ulp-field">
*   <label for="full-name">Full Name</label>
*   <input type="text" name="ulp-full-name" id="full-name">
* </div>
* <div class="ulp-field">
*   <label for="terms-of-service">
*     I agree to the <a href='https://my.app/terms' target='_blank'>Terms of service</a>
*   </label>
*   <input type='checkbox' name='ulp-terms-of-service' id='terms-of-service'>
* </div>
**/

exports.onExecutePreUserRegistration = async (event, api) => {
  const fullName = event.request.body['ulp-full-name'];
  const terms = event.request.body['ulp-terms-of-service'];
  
  if(!fullName) {
    api.validation.error("invalid_payload", "Missing Name");
    return;
  }
  
  if(!terms) {
    api.validation.error("invalid_payload", "Acceptance is Required");
    return; 
  }

  api.user.setUserMetadata("fullName", fullName);
  api.user.setUserMetadata("termsAcceptance", terms);
};

```

To learn more about how Signup and Login Prompt Customizations works and to view tutorials and examples, refer to the public documentation.

* Custom-facing Documentation: [Customize Signup and Login Prompts](https://auth0.com/docs/customize/universal-login-pages/customize-signup-and-login-prompts)
* Management API Documentation: [Auth0 Management API v2: Manage Partials](https://auth0.com/docs/api/management/v2/prompts/get-partials)

Customizations for Signup and Login are Generally Available

Customers and trial customers on Enterprise and Professional plans can now customize signup and login flows to address unique needs.

Each company has unique user registration and login requirements, for example, needing to capture a first and last name during signup or requiring users to agree to terms and conditions before they can create an account. 

In order to meet specific business needs and use cases, companies often have to build and maintain different experiences – hosted pages and sites – within their account registration and login flow(s). Unfortunately, this approach slows down the time to market by introducing separate code bases that require localization and maintenance while also creating an inconsistent customer experience.

To solve this problem, we have introduced custom prompts for signing up and logging in to Universal Login. This capability is now open for early access (EA) and available to our customers and trial customers on Enterprise and Professional plans. 

## Addressing Unique Use Cases

With custom prompts for signup and login, our customers can customize and add new fields to existing signup and login prompts; this includes client and server-side validation to ensure that required data and requirements, such as Terms of Service (TOS) acceptance, are completed and validated before completing the signup or login process. 

Leveraging Universal Login and our extensibility framework, our customers can tailor these two experiences to address data capture, security, regulatory, and customer experience requirements. Use cases included:

- Add new fields in order to collect necessary customer data (name, phone number, email, preferences, consent, etc.) 
- Add new form elements for presenting and capturing TOS/privacy policy and opt-in before sign up
- Add custom content such as URLs, images, marketing information
- Localize custom text in different languages

## Getting Started

During open early access, this feature will be automatically available to all of our Professional and Enterprise customers and trial accounts. To get started, please check out our documentation [here](https://auth0.com/docs/customize/universal-login-pages/customize-signup-and-login-prompts). If you have any questions, please reach out to your Account Executive.  

Before closing, I want to give a shout-out to our customers who provided feedback during the limited EA. We had over 75 customers join and received invaluable feedback. This underscores the importance of this capability, which we’ll continue to evolve and shape based on customer feedback, so please let us know how it goes.  


_Any products, features, or functionality referenced in this material that are not currently generally available may not be delivered on time or at all. Product roadmaps do not represent a commitment, obligation, or promise to deliver any product, feature, or functionality, and you should not rely on them to make your purchase decisions._


Customizations for Sign up and Login Now in Open Early Access

sam-yapkowitz

I began my career in enterprise software development and got exposure to lots of different frameworks and methodologies. I quickly realized my passion was in the architecture and design of solutions to unique problems. I now get to use these skills to help my customers build high-quality experiences using Okta. When not at work you can find me on the golf course, playing Rocket League or watching football with my friends.

Specialist Solutions Engineer

Sam Yapkowitz

Learn how to perform A/B testing on the Universal Login page using Liquid templates and custom parameters.

There is no way to natively A/B test the Universal Login as of today. But, it can be achieved with the use of the [Liquid](https://shopify.github.io/liquid/basics/introduction/) templates that power the Universal Login, custom parameters passed from the client side, and an A/B testing platform such as [Split.io](http://split.io/), [Google Optimize](https://marketingplatform.google.com/about/optimize/), or [LaunchDarkly](https://launchdarkly.com/).  A/B testing, also known as split testing, refers to a randomized experimentation process wherein two or more versions of a variable (web page, page element, etc.) are shown to different segments of website visitors at the same time to determine which version leaves the maximum impact and drives business metrics.

## What Is the Universal Login?

Auth0 Universal Login (UL) defines your login flow, which is the key feature of an authorization server. Whenever a user needs to prove their identity, your applications redirect to Universal Login, and then Auth0 will do what is needed to guarantee the user's identity.

When using Universal Login, you don't have to do any integration work to handle different methods of authentication. You can start off using a simple username and password, and then add other features, such as social login and multi-factor authentication (MFA).

Configuring Universal Login is dynamic (and does not require application-level changes) because all functionality is driven by the web pages served by the centralized Authentication Server. Your applications benefit from any improvements Auth0 makes in the login flow without the need for you to change your code.

You can create a consistent, branded login experience by customizing the login page appearance and behavior from the Auth0 Dashboard. For advanced use cases, you can even change the code of each page.

To learn more about the differences between Universal Login and embedded login, read [Centralized Universal Login vs. Embedded Login](https://auth0.com/docs/authenticate/login/universal-vs-embedded-login).

## Universal Login Liquid Templates

The UL can be modified through the use of Liquid [templates](https://auth0.com/docs/customize/universal-login-pages/universal-login-page-templates).  To work with these Liquid templates, you will need to configure a [Custom Domain](https://auth0.com/docs/customize/custom-domains). These templates allow you to define the HTML, CSS, and JS that are shipped to the client when making an `authorize` request. These Liquid templates allow you to run conditional logic based on the Liquid syntax. This functionality allows you to provide a unique UX based on things such as application, organization, tenant, locale, and specific screen. There is the ability to pass specific query parameters during an `authorize` request that can be accessed inside the Liquid template syntax for even further customization options. These parameters must be prefixed with `ext-` to be honored by the UL. These can be accessed through `transaction.params.ext-{param}`. With these parameters, we can now specify different versions of the UL to render for a user. Here is a Liquid template example of conditionally branding the UL based on one of the custom query parameters. This example leverages the param `ext-alt-brand`:

```html
<!DOCTYPE html>
<html lang="{{locale}}">

  <head>
    <title>Welcome to {{ application.name }} </title>
    {%- auth0:head -%}
    <style>
      {% if transaction.params.ext-alt-brand == "portal_0" %}
      body {
        background-image: radial-gradient(blue, rgb(200, 200, 200));
      }
      #custom-prompt-logo {
        background-image: url('https://banner2.cleanpng.com/20180328/roq/kisspng-circle-logo-symbol-font-templates-5abbf957bfda53.1977074015222685037859.jpg');
      }
      {% elsif transaction.params.ext-alt-brand == "portal_1" %}
      body {
        background-image: url("https://images.unsplash.com/photo-1592450865877-e3a318ec3522?ixlib=rb-1.2.1&auto=format&fit=crop&w=2255&q=80");
        background-size: cover;
        background-position: center;
        background-repeat: no-repeat;
      }
      #custom-prompt-logo {
      background-image: url('https://bootstraplogos.com/wp-content/uploads/edd/2017/11/logo-51.png');
      }
      .prompt-wrapper {
        position: relative;
        display: flex;
        align-items: center;
        width: 480px;
        height: 100%;
        justify-content: center;
        background-color: rgb(247, 198, 233);
      }
      {% else %}
      body {
        background: linear-gradient(-45deg, #ff44dd, #3885ff, #3ec6eb, #1bc99f);
        background-size: 100% 100%;
      }
      #custom-prompt-logo {
        background-image: url('https://cdn.auth0.com/blog/auth0rta/theme/logos/auth0-logo-black.png');
      }
      {% endif %}
      {% if organization != null && organization != undefined %}
        #custom-prompt-logo {
            background-image: url({{ organization.metadata.logo_url }});
        }
        body {
            background: linear-gradient({{ organization.metadata.linear_gradient }})
        }
      {% endif %}

  </style>
  </head>
  <body class="_widget-auto-layout _use-custom-prompt-logo">
      <div class="prompt-wrapper">
        {%- auth0:widget -%}
      </div>
  </body>
</html>
```

When the value of the param `ext-alt-brand` is `portal_0`, the following version of the login page (say, version A) will be shown:

![Universal Login test page version A](https://images.ctfassets.net/23aumh6u8s0i/HaEPIJiEdF8m9l9XI96i2/a2b427c463052ef25e8e1395d83497ab/universal-login-test-a.png)

When the value of the param `ext-alt-brand` is `portal_1`, version B of the login page is shown:

![Universal Login test page version B](https://images.ctfassets.net/23aumh6u8s0i/5hWtq9COZWNfSAXgvzwB4r/ad29b45a10bd7d3f3843f87c8c93eeba/universal-login-test-b.png)

> Note: You can see the domain and application are the same, yet we have a unique UX for an A/B test.

## Client-Side Implementation

There are many ways to accomplish an A/B test with the Universal Login now that we understand how to render separate versions of the UX. A traditional A/B test will have equal weights between all of the options, and upon a user entering one of these flows, the first step would be to check the browser for a cookie indicating whether a particular user has entered into the experiment already.

If the user is new, they will be assigned one of the pathways for the experiment and then be delivered the content for the item. If a user has previously entered the experiment, we can examine their cookie to determine which pathway they belong to and continue delivering them that same content to provide a consistent UX for the lifetime of the experiment.

This can be implemented manually, but many providers offer this service OOTB, such as Split and LaunchDarkly, to help you make this piece more flexible as you run more experiments or implement feature flagging from a deployment perspective. For this writeup, I have built out examples leveraging both Split and Google Optimize.

To put the final piece in place, my application is built with Next.JS and deployed on Vercel to take advantage of their [Edge Middleware](https://vercel.com/docs/concepts/functions/edge-middleware) capability. This piece is purely preference, and is very dependent on your current implementation of CIC. The Edge Middleware functionality on Vercel allows you to intercept requests on the edge and rewrite URLs extremely quickly. This allows you to decouple the A/B test from your client-side authentication logic. For instance, any place in my application can continue to leverage the same login route without needing more logic to be added. The Edge Middleware then interfaces with my A/B provider to read/write cookies as well as modify the login route to supply the proper parameter during the `authorize` request. You can view the source code for the [Google Optimize](https://github.com/samyap4/auth0-ab-testing-optimize) example and the [Split](https://github.com/samyap4/auth0-ab-testing-split) example on my GitHub.

## Live Examples

Here are snippets of the live examples in action on [Split](https://auth0-ab-testing-split.vercel.app/). The cookie being set here is called `flag-universal_login`. This is version A in action:

<AmpContent>
<amp-youtube
    data-videoid="dnjnnIVDp-Q"
    layout="responsive"
    width="480" height="270">
</amp-youtube>
</AmpContent>

<NonAmpContent>
<div
  class='embed-container'
  style="position: relative; padding-bottom: 56.25%; height: 0; overflow: hidden; max-width: 100%;margin-bottom:40px;">
    <iframe
      style="position: absolute; top: 0; left: 0; width: 100%; height: 100%;"
      src='https://www.youtube.com/embed/dnjnnIVDp-Q'
      frameborder='0' allowfullscreen>
    </iframe>
</div>
</NonAmpContent>

Here is version B in action:

<AmpContent>
<amp-youtube
    data-videoid="zgj5SpiRuVo"
    layout="responsive"
    width="480" height="270">
</amp-youtube>
</AmpContent>

<NonAmpContent>
<div
  class='embed-container'
  style="position: relative; padding-bottom: 56.25%; height: 0; overflow: hidden; max-width: 100%;margin-bottom:40px;">
    <iframe
      style="position: absolute; top: 0; left: 0; width: 100%; height: 100%;"
      src='https://www.youtube.com/embed/zgj5SpiRuVo'
      frameborder='0' allowfullscreen>
    </iframe>
</div>
</NonAmpContent>

You can see the application is the same, and I can generate a different UX based on the cookie being set by my [Split.io](http://split.io/) configuration.

## Implementing Analytics

Now that we have demonstrated how to deliver different experiences to different users, the final step of the A/B testing journey will be to start gathering metrics about how users are interacting with your content. We already discussed that we can leverage the templates to bring in custom scripts to your Universal Login screens. You can use whatever service you like for tag management, such as [Google Tag Manager](https://marketingplatform.google.com/about/tag-manager/).

## Conclusion

At Auth0, we aim to provide a high-quality service and developer experience for our customers. The first interaction with your customers is often times a login screen, so we understand how important it is for the user experience to be top-notch. With our hosted Universal Login, we take away the burden of deploying and maintaining these highly secure workflows. With the capabilities of our templates outlined in this post, we are able to help your teams iterate more quickly and customize the experience to be sticky for your brand and ultimately help your business grow.


Universal Login A/B Testing

carla_urrea

I've been working as a software engineer since 2014, particularly as a backend engineer and doing system design. I consider myself a language-agnostic developer but if I had to choose, I like to work with Ruby, Python, and Elixir.  

After realizing how fun it was to create content and share experiences with the developer community I made the switch to Developer Advocacy. I like to learn and work with new technologies. 

When I'm not coding or creating content you could probably find me going on a bike ride, hiking, or just hanging out with my dog, Dasha. 

Senior Developer Advocate

Carla Urrea Stabile

Auth0 Actions allow you to customize your registration flows to fit your needs. Let's learn how to add a default role to a user when they sign up to your application.

When building an application requiring access control, you might have the need to use roles and permissions. In this blog post, you'll learn roles and permissions, the difference between the two, and how to assign a default role for your users using Auth0 Actions. 

<AmpContent>
<amp-youtube
    data-videoid="rWiviV1ziJw"
    layout="responsive"
    width="480" height="270">
</amp-youtube>
</AmpContent>
<NonAmpContent>
<div class='embed-container' style="position: relative; padding-bottom: 56.25%; height: 0; overflow: hidden; max-width: 100%;margin-bottom:40px;"><iframe style="position: absolute; top: 0; left: 0; width: 100%; height: 100%;" src='https://www.youtube.com/embed/rWiviV1ziJw' frameborder='0' allowfullscreen></iframe></div>
</NonAmpContent>

## Roles and Permissions

The first step to add authorization to your application is to add authentication. Once you guarantee that only authenticated users can access it, you should have more control over who can access what. 

In an organization, [a role defines what a user can or can't do](https://auth0.com/blog/what-is-rbac-and-how-to-implement-it-rails-api/#What-are-Roles). Roles are often used to reflect the organizational structure, departments, etc. In relatively small authorization systems, using roles is a fast way to manage access control of resources. 

A [permission](https://auth0.com/blog/permissions-privileges-and-scopes/#What-Are-Permissions) is a declaration of an action that can be executed on a resource.

[In Auth0, a role is a collection of permissions](https://auth0.com/docs/manage-users/access-control/rbac#roles) that you can apply to users, which can facilitate how you add, remove, and manage permissions because you handle them as a group rather than assigning them to users individually. For example, you could have a role `author`, and as permissions, you could have `create:article`, `edit:article`, and so on.  

### Creating and Assigning Roles with Auth0

For this blog post you'll need an Auth0 account and a [registered API with Auth0](https://auth0.com/docs/get-started/apis), if you don't have one, you can <a href="https://a0.to/blog_signup" data-amp-replace="CLIENT_ID" data-amp-addparams="anonId=CLIENT_ID(cid-scope-cookie-fallback-name)">sign up for free</a>.

<include src="SignupCTA" text="Get an Auth0 Account for free." linkText="Get started →" />

### Create a Role on Auth0

From the [Auth0 Dashboard](https://manage.auth0.com/), click on **User Management** on the sidebar, then **Roles**. Click the **+ Create Role** button to create a new role. Let's say we want a default role for users, so you can name it `default_role` and add a meaningful description, then click on **Create**.

![Create a new Role Auth0](https://images.ctfassets.net/23aumh6u8s0i/4GuPwI9qt9FxfM0H8w4mcR/702130453889177b12c87989c9cd4d62/Screenshot_2023-10-20_at_18.11.42.png)

## Assigning Roles with Auth0 Actions

Now that you have the role, you need to be able to send it to your application. A simple way to do this with Auth0 is by adding the user's role using the [Management API](https://auth0.com/docs/manage-users/access-control/configure-core-rbac/rbac-users/assign-roles-to-users#management-api)

Adding roles to sign-up is not a built-in feature, so adding an [Auth0 Action](https://auth0.com/docs/customize/actions) to the **Login Flow** is a way to do it. An Action is a JavaScript function that allows you to customize the standard behavior of different Auth0 flows. 

> Note: you'll use the Login Flow and not Post User Registration flow. 

The Post User Registration flow is triggered after a user is added to a Database or Passwordless Connection. The actions that you use in this flow are non-blocking; they run asynchronously, which means the Auth0 pipeline will continue to run without waiting for the Action to finish its execution. 

![Post User Registration Flow Diagram](https://images.ctfassets.net/23aumh6u8s0i/7HbRIH2EDFHblUTh9v20Fx/0c75bd64d3cff33f34f18c638847aa7e/post-user-registration-flow.png)

What about the other connections? Well, if your user's sign up using a Social Connection, the Post User Registration flow will not be triggered, but the Login Flow will, because in Auth0, whenever a user signs up, they are immediately logged in afterward. 

In the Login Flow, the post-login trigger will be executed after a user logs in and when a Refresh Token is requested, which is exactly what you need because you want your action to execute regardless of the database connection used. 

![Login Flow Diagram](https://images.ctfassets.net/23aumh6u8s0i/6Thx4RkK5XheYYUwzXrkPP/4906424ad7476516cef5615db5a6659b/Login_Flow__1_.png)

You can check out the official docs to learn more about [Actions Flows and Triggers.](https://auth0.com/docs/customize/actions/flows-and-triggers)

From the Auth0 Dashboard, click on **Actions** and then **Library**. Next, click on the **Build Custom** button. In the modal that opens up, add a name for the action, select the **Login/Post Login** trigger, and then click on **Create**.

![Create new Action](https://images.ctfassets.net/23aumh6u8s0i/4se18ePBFxTJmNaljcZlsw/e143d7bbb0897ee026500cec6865daf9/auth0-create-action.png)

[The Actions editor will open](https://auth0.com/docs/customize/actions/write-your-first-action#create-an-action), and inside the `onExecutePostLogin` function, add the following code: 

```js
/**
* Handler that will be called during the execution of a PostLogin Flow.
*
* @param {Event} event - Details about the user and the context in which they are logging in.
* @param {PostLoginAPI} api - Interface whose methods can be used to change the behavior of the login.
*/
exports.onExecutePostLogin = async (event, api) => {

  // Check if the user has a role assigned
  if (event.authorization && event.authorization.roles && event.authorization.roles.length > 0) {
    return;
  }

  // Create management API client instance
  const ManagementClient = require("auth0").ManagementClient;

  const management = new ManagementClient({
    domain: event.secrets.DOMAIN,
    clientId: event.secrets.CLIENT_ID,
    clientSecret: event.secrets.CLIENT_SECRET,
  });

  const params =  { id : event.user.user_id };
  const data = { "roles" : ["YOUR_ROLE_ID"] };

  try {
    await management.users.assignRoles(params, data);
  } catch (e) {
    console.log(e);
  }
};
```

Let's take a look at what this code does, starting with the first `if` statement: 

```js
if (event.authorization && event.authorization.roles && event.authorization.roles.length > 0) {
  return;
}
```

You are checking that the user has a role assigned, which, in the particular use case of this blog post, means the user has logged in previously. **Remember you care about the user's first login, and in Auth0, that happens right after they sign up.**

[You're using the `event` object from the Login Flow](https://auth0.com/docs/customize/actions/flows-and-triggers/login-flow/event-object). The `event.authorization` object contains information describing the authorization granted to the user who is logging in, and one of its properties is `roles`, an Array of strings that contains the names of the user's assigned roles. 

Then, by using the `auth0` NPM package, you create a new Management API client instance and initialize it with the values for `domain`, `clientId`, and `clientSecret`:

```js
const ManagementClient = require("auth0").ManagementClient;

const management = new ManagementClient({
  domain: event.secrets.domain,
  clientId: event.secrets.cliendId,
  clientSecret: event.secrets.clientSecret,
});
```

For this code to work, you must install the [`auth0` NPM package](https://www.npmjs.com/package/auth0). You can do so using the [dependency manager on the sidebar in your Actions Code Editor.](https://auth0.com/docs/customize/actions/manage-dependencies#add-a-dependency-using-the-actions-code-editor)

You also need to add the values for `domain`, `clientId`, and `clientSecret` to the [Actions' Secret Manager](https://auth0.com/docs/customize/actions/write-your-first-action#add-a-secret). You can find the values for these variables in your [Auth0 Application Settings page](https://auth0.com/docs/get-started/applications/application-settings).  

Next, you're initializing the payload to send it to the management API. To add a role to a user, you'll use the method [`assignRoles`](https://auth0.github.io/node-auth0/classes/management.UsersManager.html#assignRoles), which associates a role with a user. The first parameter is an object with the user's ID, and the second is an object with an array of `roles`. 

```js
const params =  { id : event.user.user_id };
const data = { "roles" : ["YOUR_ROLE_ID"] };
```

Note here you're passing `YOUR_ROLE_ID`; here, you'd need to pass the role ID, which you can find on the Auth0 Dashboard by navigating on the sidebar to **User Management> Roles**. Select the role you want to see details of, and you'll see the Role ID.

![Role Details Screen](https://images.ctfassets.net/23aumh6u8s0i/27FKFQMJ8MJOerHoIjtl3M/4f9c43afed9cc9eeea16fda94cb165ea/Screenshot_2023-10-20_at_17.53.37.png)

Finally, you're making the call to the Management API's method `assignRoles` and passing the parameters you initialized in the previous step:

```js
try {
  await management.users.assignRoles(params, data);
} catch (e) {
  console.log(e);
}
```

You can **test the action within the editor** using the user ID of a test user you have already created but has no role assigned yet. After logging in, the user should have the role assigned!

Once you're happy with your action, you can go ahead and click on the **Deploy** button in the top-right corner. 

The last step is to **add your action to the Login Flow**. From the Auth0 Dashboard sidebar, go to Actions > Flows > Login. 

Once in the Login Flow view, click on **Custom** on the right side to add the action you just created. Then, drag your action into the Login Flow and place it between the Start and Complete steps.  

![Login Flow - drag and drop role action](https://images.ctfassets.net/23aumh6u8s0i/590X9hg6UI8FpkOlty1hD4/1abcac0f26e411ed69e3c08db3ff1e9d/Screenshot_2023-10-20_at_18.04.36.png)

## Summary 

In this blog post, you learned about roles and permissions and that in Auth0, a role is a collection of permissions. 

Then, you implemented an Auth0 Action to assign users a default role after signing up. For that, you added the `auth0` NPM package, created secrets using the Actions Code Editor, and tested and deployed your action. 

Assigning a Default Role to Users on Sign-Up with Auth0 Actions

Tailor registration flows to maximize conversion while meeting business requirements.

Sign-up and login are two critical entity points for your business. They not only provide a means for your company to collect customer data, present and collect consent, and authenticate and verify users and their data, but they also serve as moments to establish brand image and trust. Because of that, these experiences need to be localized, branded, and consistent for your customers and would-be customers.  

For each company, this will be different. This means that companies require the flexibility to modify sign-up and login forms with additional fields and elements to address their unique use cases, business needs, evolving regulatory requirements, and customer demands for transparent, convenient, and personalized experiences.  

And with that, **we’re excited to announce that new sign-up customization capabilities are now available in early access within our Universal Login experience!** This flexibility will ensure that our customers can tailor their sign-up flows to meet their specific use cases.

## How Does It Work?

Customers can customize existing signup prompts by adding custom content and form elements to meet diverse customer preferences, business, localization, and internationalization requirements. No need to host your own pages, which introduce different URLs and separate code bases that slow time to market and create an inconsistent customer experience. 

This includes client and server-side validation, leveraging the Pre User Registration trigger, to ensure that required data, such as Terms of Service acceptance, are completed and validated before completing the signup process.

![How Does It Work](https://images.ctfassets.net/23aumh6u8s0i/1ka3a5mkTZz8NLSNjO7HPW/acb847f03bc1854ddfe55b83f40be34b/New_Sign_Up_Customizations_Now_in_Early_Access.png)

## What Use Cases Are Supported?

The initial early access release will provide support for various use cases, including: 

* Collect necessary customer data (name, phone number, email, preferences, consent, etc.) 
* Present Terms of Service/Privacy policy and opt-in before signing up
* Display marketing information and trust signals with URLs and/or images
* Add custom text, links, images, URLs, etc. 
* Localize or customize custom text in different languages (Note: EA release may not include a full scope of localization capabilities)
* Experiment with different designs, copies, and elements 

## How Can You Apply?

If you are interested in joining the early access program, please reach out to your account manager.  

_Any products, features, or functionality referenced in this material that are not currently generally available may not be delivered on time or at all. Product roadmaps do not represent a commitment, obligation, or promise to deliver any product, feature, or functionality, and you should not rely on them to make your purchase decisions._


New Sign-Up Customizations Now in Early Access

Oliver Wang

A product manager at Auth0 focuses on  Ecosystem and Extensibility.  With an engineering background, Oliver always puts developers' experience first.  He has mixed industrial experience as a Product Manager, Software Engineer and Data Analyst. This diverse profile unites different team members to deliver value to our customers. Besides work, you can catch him up on a ski hill in the Canadian Rockies.

Product Manager, Ecosystem

Three new capabilities are all now available in Auth0 Actions.

## Do More with Actions

You can now unlock deeper identity customization with Auth0 by Okta. Starting today, you can use advanced features in Auth0 Actions, which include SAML Mapping, Root-Level User Attributes, and Access Token Scope. These new capabilities enable you to seamlessly upgrade from Rules to Actions - our flagship extensibility product.


## Allow Deep Customization with Three New Capabilities in Actions

Our new functionalities bring unique benefits to developers and their customers alike. We dive deeper into these below.

### SAML mapping and configuration

The Security Assertion Markup Language (SAML) is essential for sharing authentication and authorization data between various identity and service providers. Our latest update integrates SAML mapping and configuration into Actions, streamlining the handling of user data and facilitating integration with SAML-based identity providers.

Developers can now map user attributes and claims from SAML assertions directly to user profiles using Actions. This integration simplifies the management of user attributes, ensuring a seamless flow of data between different identity providers and their applications. As a result, you can create context-aware, personalized experiences, bolstering your identity pipeline. Learn more about SAML in our [Docs](https://auth0.com/docs/customize/actions/flows-and-triggers/login-flow/api-object).

### Access Token scope

Access tokens are crucial for token-based authentication, allowing an application to access an API. With our upgrade, developers can freely add or remove claim scopes with custom APIs, enhancing their ability to meet their overall security needs. Learn more about Access Token in our [Docs](https://auth0.com/docs/customize/actions/flows-and-triggers/login-flow/api-object).

### Root-Level user attributes

The normalized Auth0 user profile includes both root attributes and profile attributes from various identity providers. Our latest update provides a comprehensive exposure to these attributes, enabling developers to better customize their identity solutions. This means you can make more use of standard properties such as `user.roles`, `user.groups`, and `user.permissions` to understand customer profiles and protect user interests better. Learn more about User Attributes in our [Docs](https://auth0.com/docs/customize/actions/flows-and-triggers/login-flow/event-object).

## Migrating to Actions: It’s All about out-of-Box Customization

In today's shifting digital landscape, off-the-shelf identity solutions are often insufficient. Given unique organizational needs and ever-changing regulations, customization and flexibility are critical. Auth0 Actions offers an opportunity for deep customization, benefiting customers, partners, and developers alike.

We encourage you to move from Rules and Hooks to Actions for improved developer experiences and ongoing feature enhancements. By using Actions, you can directly integrate third-party solutions, bypassing the need for custom code and benefiting from improved caching performance. Embrace simplicity and flexibility in identity management— transition to Auth0 Actions today.

We are here to help. Visit our [Move to Actions](https://auth0.com/extensibility/movetoactions) page for more migration information and learn more about SAML, Access Token, and User Attributes in our [Docs](https://auth0.com/docs/).


Unlock Deeper Customization in Actions with Three New Capabilities

diegopoza

System Engineer, geek, foodie, technology lover, speaker.

Sr Manager, Developer Advocacy

Diego Poza

Compromised credentials are a threat to your business and customers. Here’s how to reduce the risk.

Credential stuffing is a type of cyberattack in which a cybercriminal uses stolen usernames and passwords from one organization (obtained in a breach or purchased off of the dark web) to access user accounts at another organization.

Credential stuffing attacks are one of the most common causes of data breaches because[ 64% of all people](https://f.hubspotusercontent20.net/hubfs/3791228/2022%20SpyCloud%20Annual%20Identity%20Exposure%20Report.pdf) reuse the same password on multiple (and sometimes all) accounts. In fact, on Auth0's platform alone,[ nearly half of all login requests](https://auth0.com/resources/whitepapers/credential-stuffing-attacks) we receive each day are attempts at credential stuffing.

The opportunity for cybercriminals to use credential stuffing is only growing as more credentials are exposed through breaches; at present, literally billions of compromised credentials are circulating on the dark web. 

However, credential stuffing attacks are preventable if you implement the right cybersecurity measures. Below is what executives need to know about credential stuffing attacks and what can be done to reduce or prevent the likelihood that their organizations will be a victim of one.

> More in the following:
>
> - **[Credential stuffing whitepaper](https://auth0.com/resources/whitepapers/credential-stuffing-attacks)**
> - **[What is broken authentication](https://auth0.com/blog/what-is-broken-authentication/)**

## How Credential Stuffing Works

To execute a credential stuffing attack, cybercriminals add a list of stolen username and password pairs to a botnet that automates the process of trying those credentials on multiple sites at once. Large-scale botnet attacks can overwhelm a business' IT infrastructure, with websites experiencing as much as[ 180 times](https://auth0.com/blog/auth0-reveals-50000-credential-stuffing-attempts/) their typical traffic during an attack.

![Anatomy Credential Stuffing](https://images.ctfassets.net/23aumh6u8s0i/ohyMA4nbwQgkGF77RnSOs/b8997e017022790f156a985fb97c375d/anatomy-credential-stuffing.jpg)

Once cybercriminals find a site where a set of credentials works, they’ll have access to a user's account and personal data to do with as they please, which most commonly includes:

* **Selling access to compromised accounts:** This is particularly common for media streaming services. [Disney+](https://www.cpomagazine.com/cyber-security/new-disney-plus-streaming-service-hit-by-credential-stuffing-cyber-attack/),[ Netflix, and Spotify](https://www.engadget.com/2019/03/13/wickedgen-admin-arrested-stolen-passwords-netflix-spotif/) have all been victims of attacks in which hackers sold access to user accounts for less than the cost of a subscription.
* **E-commerce fraud:** Hackers can impersonate legitimate users at retailers' websites and order a high-value product, either for their own use or for reselling. This is a common (and for criminals, potentially lucrative) form of identity theft, which makes retail the most vulnerable vertical for credential stuffing, according to[ research from Akamai](https://www.akamai.com/newsroom/press-release/akamai-research-commerce-remains-top-target-with-over-14-billion-web-application-and-api-attacks).
* **Corporate/institutional espionage and theft:** While the above crimes have serious consequences for companies and their customers, this third form of attack has the potential to be most devastating for businesses. If an attacker successfully hijacks the account of an employee or admin, they could gain access to all sorts of sensitive personal information, like credit card numbers, social security numbers, addresses, and login credentials as well, all of which they can sell to the highest bidder.

## The Costs of Credential Stuffing Attacks

Although credential stuffing attacks often have a low success rate ([usually one to three percent](https://www.recordedfuture.com/credential-stuffing-attacks/)), their impact on organizations is often anything but small.

For example, the Ponemon Institute's ["Cost of Credential Stuffing" report](https://library.idgcommunications.net/idgcampaigns/documents/uploaded_data/d40/97b/1c-/original/the-cost-of-credential-stuffing_EN.pdf) found that businesses lose an average of $6 million per year to credential stuffing in the form of application downtime, lost customers, and increased IT costs.

Increasingly, regulators, as well as the public, are also holding companies accountable for credential stuffing attacks with stiff fines. Companies may be subject to legal action under data privacy laws such as [GDPR](https://auth0.com/docs/compliance/gdpr) if they fail to implement adequate security measures to prevent such attacks, fail to inform the public of a breach, or don't do enough to protect passwords.

For example, in 2018, the UK's [Information Commissioner's Office (ICO) fined Uber](https://www.computerweekly.com/news/252453244/ICO-fines-Uber-385000-for-data-protection-failings) £385,000 for "a series of avoidable data security flaws" that exposed the data of approximately 2.7 million UK customers. And in 2021, the French Data Protection Authority (CNIL) fined a data controller and its data processor €225,000 “for failure to implement adequate security measures to protect customers’ personal data against credential stuffing attacks on the website of the data controller.”

## Credential Stuffing Attacks vs. Brute Force Attacks

Credential stuffing is considered a type of brute force cyberattack. But in practice, the two are very different, as are the best ways to secure your systems against them.

Brute force attacks attempt to guess passwords by changing the characters and numbers (often in prescribed patterns or with commonly used base password phrases). To protect against them, you can limit the number of failed login attempts with[ brute force protection](https://auth0.com/docs/attack-protection/brute-force-protection), use a CAPTCHA, or require your users to use a stronger password.

However, a strong password won’t stop a cybercriminal from gaining access to an account via credential stuffing because the password is already known. Even CAPTCHA's or brute force protection’s ability to protect users is limited since users often[ change their passwords in predictable patterns](https://www.sans.org/security-awareness-training/blog/time-password-expiration-die) and cybercriminals have a breached password to iterate from.

## How to Prevent Credential Stuffing Attacks

Most people know password reuse is unsafe but choose to use the same password on multiple sites anyway because they have roughly[ 100 passwords to remember](https://tech.co/news/average-person-100-passwords). Password managers are an option, but [adoption rates are low](https://www.security.org/digital-safety/password-manager-annual-report/). So to prevent credential stuffing attacks, it’s up to organizations to take measures — such as removing passwords altogether — to ensure cybercriminals can’t use stolen credentials to access their users’ accounts. Based on [OWASP's Credential Stuffing Prevention Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Credential_Stuffing_Prevention_Cheat_Sheet.html), below are several methods for doing so.

### Credential hashing

Credential hashing is the first step to protecting your user's credentials from theft. [Hashing](https://auth0.com/blog/hashing-passwords-one-way-road-to-security/) scrambles a user's password before you store it in your database so that in the event that it is stolen, a hacker won’t be able to use them (in theory, at least).

In practice, not all password hashing is uncrackable. As Rick Redman, a penetration tester at KoreLogic, [explains](https://www.wired.com/2016/06/hacker-lexicon-password-hashing/), “The strength of the hash is the insurance policy. It tells you how much time users have to change their passwords after a data breach before they come to harm... If it’s just SHA1, there is no window... If it’s bcrypt, you have time to run away and change all your passwords.”

So although hashing user passwords won’t prevent a credential stuffing attack, it will limit what a cybercriminal can do with those passwords once they’ve stolen them.

### Breached password protection

Breached password protection compares the password a person uses to log in against databases of compromised credentials (like[ haveibeenpwned](https://haveibeenpwned.com/)) to prevent credential stuffing in real-time. 

For example,[ Auth0's breached password detection](https://auth0.com/docs/attack-protection/breached-password-detection) can be configured to notify a user, block them from logging in, or request an additional authentication factor (MFA) if it suspects their credentials were part of a published security breach or if a login attempt came from a suspicious IP address.

### Bot detection

As mentioned earlier, attackers use bots to execute a credential stuffing attack. [Auth0's bot detection](https://auth0.com/docs/secure/attack-protection/bot-detection) feature is able to identify a bot attempting to authenticate with [a high percentage of success](https://auth0.com/blog/auth0-bot-detection-reduces-bot-attacks-by-79/). It provides protection against credential stuffing attacks with very little friction to legitimate users. When a bot attack is detected, it displays a CAPTCHA step in the login experience to eliminate bot and scripted traffic.

### Anomaly detection

Monitoring what is happening is always a good approach to intervene earliest and stop an attack. If you have visibility of your traffic, you can understand when you are under attack, and you can take action to mitigate attacks. In Auth0, you can use [Log Streams](https://auth0.com/docs/customize/log-streams) to monitor your traffic in near real-time. After creating and configuring a Log Stream, you will start seeing Auth0 events being ingested into your chosen monitoring service. Based on your monitoring service, you can build your anomaly detection dashboard by anayzing the [Attack Protection Log Events](https://auth0.com/docs/secure/attack-protection/view-attack-protection-events).

### Multi-Factor Authentication (MFA)

[Multi-factor authentication (MFA)](https://auth0.com/multifactor-authentication) is a highly effective way to prevent credential stuffing because it requires users to log in with another form of authentication in addition to a username-password combination. For example, this could mean biometric authentication such as a fingerprint, a one-time code sent to a device associated with the user, or an email sent to a secured account — none of which a cybercriminal will have access to.

Although the adoption of MFA has been slow due to concerns about its impact on customer experience, the increase in sophistication and customizability of MFA are helping it catch on. For instance, in February 2020,[ Google announced](https://siliconangle.com/2020/02/12/google-require-nest-users-use-two-factor-authentication-enhanced-security/) it would require Nest smart home users to use two-factor authentication.

### Continuous authentication

Continuous authentication systems use factors like biometrics or behavioral patterns to verify a user’s identity in real-time (while they use an application) instead of a password. As a result, credential stuffing attacks (as well as a number of other cyberattacks) are no longer a viable method for cybercriminals to gain unauthorized access to a user’s account.

### Passwordless authentication

[Passwordless authentication](https://auth0.com/passwordless/) can prevent credential stuffing altogether because it verifies a user with something they have (a device or another account) or something they are (biometrics) instead of a password (something they know).[ Passwordless](https://auth0.com/passwordless/) also creates a better login experience for users and saves organizations time and money from dealing with password resets.

## Passwordless Authentication Is Better for Businesses and Users

Not only does passwordless authentication eliminate credential stuffing attacks, but numerous studies and reports show that it is a[ more secure](https://auth0.com/blog/is-passwordless-authentication-more-secure-than-passwords/),[ more user-friendly](https://www.lastpass.com/solutions/passwordless-access/from-passwords-to-passwordless), and[ more cost-effective](https://www.weforum.org/press/2020/01/forgotten-your-password-not-having-one-will-make-you-safer-says-world-economic-forum) solution overall than traditional username-password authentication for both businesses and their users.

“Relying on passwords as the primary means for authentication no longer provides the security or user experience that consumers demand,” Andrew Shikiar, Executive Director of the FIDO Alliance, [explains](https://www.weforum.org/press/2020/01/forgotten-your-password-not-having-one-will-make-you-safer-says-world-economic-forum) in a joint report with the World Economic Forum. Adrien Ogee, Project Lead from the World Economic Forum, adds, “Better authentication practices are not just possible; they are a necessity.”

Auth0’s platform makes it easy to implement secure, user-friendly passwordless authentication using biometrics, social logins, and more. Learn how to eliminate the risks associated with traditional username and password authentication with Auth0’s Passwordless authentication platform[ here](https://auth0.com/passwordless/).

What Is Credential Stuffing? How To Prevent Credential Stuffing Attacks

How SafeBase Uses Auth0 to Lead the Way in Customer Trust

## Leading the Way in Customer Trust

The security startup, [SafeBase](https://safebase.io/), is defining the standard for customer trust management. Through the SafeBase [Smart Trust Center](https://safebase.io/showcase), companies are able to share their security posture and eliminate security review friction, ultimately leading to more closed deals. “Implementing good security controls as you’re a growing company is very hard, and it’s always under-invested,” said SafeBase’s Co-Founder & CTO, [Adar Arnon](https://www.linkedin.com/in/adarnon). 

We sat down with Adar, and he shared that their approach was aimed at helping companies grow. Their goal is to eliminate human time spent on security communications like sharing SOC2 or Pentest reports, security questionnaires, or incident breach notifications. While these are crucial to maintaining customer trust, they can be time-consuming and a bottleneck to closing deals. Arnon explains that these processes can be “...super manual, and that’s what we decided is worth solving.” 


<include src="QuoteCard" body="As we’re growing with these customers, something that’s very clear is that big customers really care about identity management and security." name="Adar Arnon" title="CTO & Co-Founder" team="" company="SafeBase" />


The impact SafeBase has had on their [customers](https://safebase.io/customer-love) since their 2020 inception is truly exciting. They’ve taken historically frustrating and tedious security processes and created a product that allows companies to become more efficient, ensuring stakeholders have fewer security review emails in their inboxes. That’s a total win in our book. 

## Choosing Auth0, a Standard in Authentication and Authorization

Once SafeBase started adding users, they determined that it didn’t make sense to implement their own user management system. Upon asking his network, Adar shared, “...it sounded like Auth0 was the agreed-upon standard. Auth0 offered a platform that we felt could grow with us while providing good support.” Other factors that were evaluated were Auth0’s [tech stack](https://auth0.com/docs/quickstarts) and [documentation](https://auth0.com/docs). 

One of the key features the team benefits from is [Universal Login](https://auth0.com/docs/authenticate/login/auth0-universal-login), specifically because they do not have to deal with maintaining the front-end or back-end. The SafeBase team determined Auth0 was a good solution and joined our startup program to help them scale. 


![Why Auth0](https://images.ctfassets.net/23aumh6u8s0i/6fQxARcY6WWbfOE8wiClfN/6521c4ef2961cb12bf461db6ca037f9a/SafeBase_Checklist_-1.png)

## Join SafeBase and the Other 1700+ Startups That Benefit from Auth0

The [Auth0 for Startups](https://auth0.com/startups/profiles) program brings the simplicity, extensibility, and scalability of Auth0 to qualifying startups – **all free for one year**. We are passionate about helping startups get their applications up and running while we take care of identity needs. So much so that we recently [expanded our eligibility](https://auth0.com/blog/auth0-for-startups-expands-eligibility/) by increasing the funding limit to $5M, doubling our previous cap. If you have any questions, you can find us at [startups@auth0.com](mailto:startups@auth0.com) or apply [here](https://autheco.atlassian.net/servicedesk/customer/portal/4/group/9/create/101). 

A special thank you to Adar and the entire SafeBase team. If your organization is looking to build your own Smart Trust Center, [schedule a demo](https://safebase.io/schedule) today. 

_This profile is the fourth installment in our series highlighting members of the Auth0 for Startups program. The Auth0 for Startups program began in 2020 and has since worked with 1700+ startups._

Startup Stories: SafeBase

Catherine Razeto

Catherine Razeto is a Staff Data Scientist on the Machine Learning team for Okta's Customer Identity products. She focuses on developing threat detection models to secure our customers' applications. She led the development of the machine learning engine for the Bot Detection security feature. She is interested in classification problems, anomaly detection and fraud detection at-scale.

Staff Data Scientist

The aggregated score indicates the level of bot activity seen across all CIAM customer login flows

From online retail to social media — and everything in between — bots are (one of the reasons) why we can’t have nice things. As we examine in detail in our[ State of Secure Identity Report](https://auth0.com/resources/whitepapers/2022-state-of-secure-identity-report), these digital automatons plague Identity flows at all parts of the user journey:

* Fake signups defraud registration forms and pollute customer intelligence systems;
* Brute force attacks use breached passwords in account takeover (ATO) attacks; and
* Malicious bots burden app owners with scams and spam, degrading the user experience.

Consumer-facing apps, in particular, must identify and filter out bots as part of their security and growth objectives — and since day one, Auth0 has devoted considerable effort to helping our customers do just that.

## Bot or Not?

As a vital part of the[ Attack Protection](https://auth0.com/docs/secure/attack-protection) add-on in the[ Okta Customer Identity Cloud](https://www.okta.com/customer-identity/), our[ Bot Detection](https://auth0.com/docs/secure/attack-protection/bot-detection) feature mitigates scripted attacks against native applications, passwordless flows, and custom login pages.

By correlating a variety of data sources — like past events associated with an IP address, recent login history, IP reputation data, and an assortment of other factors — we can detect when an Identity request is likely to be coming from a bot. When the Bot Detection feature detects bot or scripted login requests, it triggers a CAPTCHA step in the login flow.

Over the years, we’ve continually refined our bot detection capabilities: today’s version employs a machine learning (ML) model that ingests 60+ inputs — and when we introduced this new system last year, it[ reduced bot attacks by 79%](https://auth0.com/blog/auth0-bot-detection-reduces-bot-attacks-by-79/) above and beyond its precursor.

Importantly, the improved defensive capabilities were achieved without the expense of user friction: even during attacks, fewer than 1% of challenges are shown to legitimate human users.

## Building on Bot Detection: The Identity Threat Level (ITL)

Being at the ‘front door’ of applications with a Customer Identity and Access Management (CIAM) solution that secures billions of login transactions per month, Auth0 has a unique vantage point from which to monitor Identity threats.

This powerful perspective was the genesis of the Identity Threat Level (ITL), a score from 0 to 10 that indicates the level of bot activity targeting CIAM systems: a score of 0 means there’s practically no bot activity to speak of, while a score of 10 means almost all traffic is attributable to bots.

By aggregating (anonymously, of course!) observations across our customer base, we can calculate an ITL for different industries and geographies, with the option of introducing additional slicing and dicing on other common attributes.

Tracking historical trends and daily shifts has the potential to inform of elevated risks to CIAM login and sign-up flows, enabling app providers to increase their own monitoring, proactively tighten thresholds, implement additional defenses — or respond in any other way they see fit.


<div class="alert alert-info alert-icon">
  <i class="icon-budicon-487"></i>
  <strong>Behind the scenes</strong><br> 
Here's a simplified overview of how an ITL is calculated.<br>
Each day, the ITL instrumentation analyzes traffic samples that cover all industries and geographies and includes customers of all sizes.
By cross-referencing the samples against our Bot Detection capabilities, we're able to determine with high accuracy what proportion of those Identity flows are associated with bots.
Finally, for each dimension or combination of dimensions (e.g., Financial Services in North America), we calculate the ITL.<br>
The ITL is based on traffic from Okta's Customer Identity Cloud customers; we believe it's reasonable to conclude that organizations that aren't customers will experience similar threats, but we cannot and do not assert that this is definitely the case.<br> 
</div>

## Sneak-Peak Observations

While future posts will explore the ITL in greater detail, including diving into Identity trends and perhaps even specific attack campaigns, in this post, we’ll stick to some high-level observations.

For example, consider the chart below, which shows the ITL for the Travel/Transportation industry, across all regions, from January 1st, 2023, through April 1st, 2023.

Just from a quick visual examination, we can see that so far in 2023, this ITL fluctuates up and down around an average of about 5.5, with the peaks corresponding to weekends (some industries exhibit this weekday/weekend pattern, and others don’t).

![Battling Bots](https://images.ctfassets.net/23aumh6u8s0i/4ahrXj9vXgxuQnLrwXlU6w/b5df3271d0dee7ac8a87819a8247e38f/Battling_Bots_01.png)

Next, let’s use the ITL to see how the threat of bots varies across industries. In the chart below, we’ve zoomed out to a weekly view to more clearly showcase the general trends in Financial Services, Retail/eCommerce, and Software/SaaS/Tech.

We can see that of the three industries, Retail/eCommerce has experienced the highest peak ITL (nearly 8) and has had an average score of around 6. During the same period, Financial Services peaked at an ITL of 7 but has generally trended downward, while Software/SaaS/Tech has maintained a fairly constant ITL of around 5.5


![Battling Bots](https://images.ctfassets.net/23aumh6u8s0i/29k788paxQ9AF3bksWHWuB/da9f6822e69ea5ed48364c5ab8558561/Battling_Bots_02.png)


For our third example, let’s shift our attention to Healthcare (with a global aggregation and weekly granularity). It’s clear that around the beginning of March, bot activity targeting the Healthcare industry picked up significantly — jumping from a baseline ITL of around 3.5 to repeated peaks approaching 6.0!

Do providers of Healthcare apps know that they’re under siege — and would they configure their defenses differently if they knew?

![Battling Bots](https://images.ctfassets.net/23aumh6u8s0i/Wb4zGX0ZgOOjDzlBYtD2M/1cf104b5bca618e3be5df9e2ed2aba82/Battling_Bots_03.png)

As our final example, let’s return our attention to Travel/Transportation, but this time we’ll go one level deeper and examine the ITL for three different geographies: the Americas (AMER), Asia-Pacific (APAC), and Europe, the Middle East, and Africa (EMEA).

From this breakdown, we can see that while the composite Travel/Transportation ITL tends to be in the range of 5.5 to 6.0, the threat level varies considerably by region: APAC and EMEA are largely in the 3.0 to 4.0 range, while the AMER score has remained above 7.0 for all of 2023!

![Battling Bots](https://images.ctfassets.net/23aumh6u8s0i/68RTbaQaVFgqNYO5rOsmJ0/23995c6abed960115b391617a78f184d/Battling_Bots_04.png)

## Looking Ahead

Anonymous firmographic metadata can help us not only to monitor _what_ is happening but also _why_. As a result, the ITL is about more than just observing attack trends — it’s about surfacing insights and informing actions to protect both providers and users of online services.

At the same time, ITL scores equip the broader security community with data that — until now — has only been available to a handful of organizations.

Ultimately, we’ve really only begun to scratch the surface of the insights that ITL scores can provide, and we invite you to join us on this journey of discovery.

Battling Bots: Introducing the Identity Threat Level (ITL)

Samuel Frank

Sam Frank is Auth0's Sr. Product Manager for new initiatives. He works within the Auth0 Lab to commercialize the team's new ideas so they're available for builders everywhere. As a former platform product manager and startup product lead, he knows the challenges that developers face when creating new apps and he leverages those experiences to focus our teams efforts delivering the next generation of identity tools.

The Customer Identity Cloud platform can now reference NFTs as profile data and as a means to grant access.

The [Auth0 Lab team](http://labs.auth0.com/) has released a pair of [Marketplace integrations](https://auth0.com/marketplace) bringing more [Web3 capabilities](https://marketplace.auth0.com/categories/web3) to the Okta Customer Identity Cloud ecosystem. As the Web3 ecosystem matures, we’re finding that on-chain data, like NFTs (non-fungible tokens), can be used in the identity ecosystem. 

[Our integration](https://marketplace.auth0.com/integrations/auth-0-inc-fetch-nfts) is a simple NFT fetch [Action](https://auth0.com/docs/customize/actions) that retrieves a list of NFTs the user owns. With them, you can make all sorts of IAM-based decisions. If you’re interested in the Auth0 Lab team’s continued Web3 research, come join the conversation on [Twitter](https://twitter.com/Auth0Lab) and [Discord](https://discord.gg/xkbkz9rZcD).

## NFTs in Identity and Access Management (IAM)

By now, you’ve probably heard of NFTs. If not, here [is a helpful explainer](https://www.nytimes.com/interactive/2022/03/18/technology/nft-guide.html). At their core, NFTs are digitally transferable tokens. Tokens have a long history in identity and access management. They are the keystone of authorization in many apps, primarily through the issuance of [JSON web tokens](https://jwt.io/). 

NFTs could be a big extension to token-based IAM. NFTs are flexible, secure, and easily transferable by their nature of using blockchain consensus algorithms to establish ownership and transference. Like with cryptocurrencies, only a specific private key in a wallet can prove ownership. They can help organizations manage capacity problems because you can limit the number of NFTs you mint. This scarcity helps manage supply while still allowing for a robust secondary market. This makes them ideal for ticketed events and venues, like stadiums, trains, and other physically limited spaces.

One of the biggest barriers to mainstream NFT adoption is the usability hurdle of working with blockchains. With our latest integrations, Auth0 Lab seeks to make it easy. Developers can query a user’s NFTs and incorporate them as identity data in their applications, even controlling access based on a user’s ownership of an NFT. We’re excited to see how developers use these new tools when implementing web3 functionality into their applications.

## Token Gating

[Token Gating](https://tokenizedhq.com/token-gating/) is the practice of managing access to resources based on a user’s Web3 NFTs. Notable examples include [‘members only’ communities](https://rarible.com/blog/9-membership-nfts/) of NFT collectors. This exclusivity extends to video games like [Alien Worlds](https://alienworlds.io/), the [largest web3 game](https://www.statista.com/statistics/1266486/blockchain-games-user-number/) at the end of 2022. NFTs are central to the game and unlock certain content, or game locations are only accessible with specific NFTs. [TravelX](https://travelx.io/) is working on another use case around airline tickets.

Token gating is interesting because of the openness of the attestation. Instead of IAM data being stored on a proprietary server, it’s on a public blockchain for anyone to use and see. We’re just witnessing the first experiments in how that data is used. 

## EVM Compatible, Open Source Coming Soon

The current integration works on all [Ethereum virtual machine (EVM) compatible](https://gocrypto.com/en/what-are-evm-compatible-blockchains/) blockchains. This means you’ll have access to NFTs available on some of the largest NFT marketplaces like [OpenSea](https://opensea.io/). You’ll be able to pull from [Ethereum](https://ethereum.org/en/), [Polygon](https://polygon.technology/), [Avalanche](https://www.avax.network/), [Binance Smart Chain](https://www.bnbchain.org/en), and others. EVM blockchains are the oldest programmable blockchains, and the ecosystem is well supported.

The Auth0 Lab team is working on open-source the code so it can be modified and moved to other blockchain platforms. That process takes some time, so keep an eye out by following us on [Twitter](https://twitter.com/Auth0Lab) or heading to our [GitHub organization](https://github.com/auth0-lab) and give it a follow.

## Unlocking NFTs for Your Application

### How it Works

The Auth0 Lab [fetch-nfts integration](https://marketplace.auth0.com/integrations/auth-0-inc-fetch-nfts) works by relying on a few other pieces of infrastructure.

1. It utilizes the [Sign in with Ethereum integration](https://auth0.com/blog/sign-in-with-ethereum-siwe-now-available-on-auth0/) that SpruceID released in the Auth0 Marketplace in 2022. This allows the integration to grab a public blockchain address for the user, which is critical to querying an NFT smart contract to know if they own an NFT. If a user logs in with a method other than Sign in with Ethereum, NFTs won’t be fetched.
2. During [setup and configuration](https://marketplace.auth0.com/integrations/auth-0-inc-fetch-nfts?tab=install), specify a list of NFT contracts that you’d like the [Auth0 Actions](https://auth0.com/actions) code to query. You’ll also need to specify an API key for [The Graph](https://thegraph.com/en/), a service that queries blockchain data.
3. With a public key in hand, and a list of NFT contracts to search, the Actions code calls out to The Graph’s APIs to query the necessary NFT contracts. It returns a list of caip-22 asset references that your Action adds to the [ID token](https://auth0.com/docs/secure/tokens/id-tokens) as claims.
4. From there, you can utilize the data in your application to make any decision, like token gating access, that you feel necessary!

### Installation

Check out our [installation](https://marketplace.auth0.com/integrations/auth-0-inc-fetch-nfts?tab=install) guide to get started!

## What’s Next?

The Auth0 Lab team is actively exploring the best ways to enable developers to build applications that rely on Web3 identity constructs and help bridge the Web2 and Web3 worlds. You can follow our progress on [Twitter](https://twitter.com/auth0lab). If you’re interested in speaking with the team, join our [Discord](https://discord.gg/xkbkz9rZcD) and start a thread.

The [Auth0 Marketplace](https://marketplace.auth0.com/) is looking for Web3 partners to build new extensions onto Auth0. Visit [https://auth0.com/integrate](https://auth0.com/integrate) to learn more.

Web3 NFTs for Identity and Access Control, Now Available on Marketplace

Tyler Keesling

With a background in engineering and sales, I’ve found the perfect combination in solutions. When not at my work desk, you might find me rock climbing, skiing, or taking moonlit walks on the beach.

Solutions Engineer

Auth0 allows you to create custom social connections. In this post you'll learn how to create and set up Auth0 with TikTok

<div class="alert alert-danger alert-icon">
   <i class="icon-budicon-487"></i>
 <strong>To follow this tutorial, you need a production application with a Terms of Service, Privacy Policy, etc. TikTok currently doesn’t support non-production apps.</strong>
 </div>


With nearly one billion users across 154 different countries, TikTok has become one of the most popular social media platforms worldwide. As a developer, you will want to create an app that delights users by letting them choose their favorite social media login, including TikTok.

In this tutorial, you'll learn how to add social login with TikTok to your application using Auth0. Marketplace [supports over 50 out-of-the-box social connections](https://marketplace.auth0.com/features/social-connections), with social identity providers like Google, LinkedIn, and Twitter. If your social provider of choice isn't there yet (in this case, TikTok), it is possible to [create a custom social connection.](https://auth0.com/docs/authenticate/identity-providers/social-identity-providers/oauth2)

## How Does Auth0 Connect to TikTok?

Most social identity providers enable third-party applications to allow end-users to log in with their social credentials by acting as an OAuth 2.0 provider. TikTok is no different in that regard.

In the [OAuth 2.0 authorization code flow](https://auth0.com/docs/get-started/authentication-and-authorization-flow/authorization-code-flow#how-it-works), the identity provider (TikTok) must publish an authorization endpoint and a token endpoint that are using a standard set of parameters. Auth0 will use the authorization endpoint to redirect users to TikTok and the token endpoint to exchange the authorization code for an access token to fetch the user profile. 

TikTok deviates from the standard OAuth naming conventions by using `client_key` as the parameter name instead of `client_id` for both the authorization and the token endpoint. The `client_id` is the application's identifier asking for authorization. In other words, the Client ID identifies your application to TikTok. By default, Auth0 uses the `client_id` nomenclature, so you will need to transform the `client_id` request parameter to use `client_key` for both requests.

## Getting Started 

To get started with this tutorial, you will need the following prerequisites:

1. A [developer account with TikTok](https://developer.tiktok.com/)
2. An <a href="https://a0.to/blog_signup" 
  data-amp-replace="CLIENT_ID" 
  data-amp-addparams="anonId=CLIENT_ID(cid-scope-cookie-fallback-name)">
  Auth0 account
</a> with a deployed app using Auth0 as the means to authenticate your users
3. A proper Terms of Service and Privacy Policy for your app [for the TikTok app review process](https://developers.tiktok.com/doc/getting-started-app-review-process)
4. [Node.js](https://nodejs.org/en/) and [ngrok](https://ngrok.com/) installed on your local environment.

You can <a href="https://a0.to/blog_signup" 
  data-amp-replace="CLIENT_ID" 
  data-amp-addparams="anonId=CLIENT_ID(cid-scope-cookie-fallback-name)">
  sign-up for a free account
</a>. With a free account, you can add authentication to up to 10 apps with support for up to 10,000 users and unlimited logins- plenty for your prototyping, development, and testing needs.

## Configuring TikTok's Integration 

Once your developer account has been created:

* Go to **Manage apps** and create a new app connection
  This will generate a `Client Key` and `Client Secret` under app details

Complete the fields for **App icon, App name, Category, Description, and Website URL**

![TikTok Configuration](https://images.ctfassets.net/23aumh6u8s0i/33JI3cEnL3sQZmkbPktL78/e4857fc0081c4656f84ff6b9e93e4f7d/image-20230121-195231.png)

* On the left under **Products**, click **Add products** and add the **Login Kit** and the **TikTok API**

![TikTok Add Product](https://images.ctfassets.net/23aumh6u8s0i/48YgCtfcTQb6H59gPuBcmT/bcb3af089a56f34f2f58240dcdd8e447/image-20221205-161528.png)

* Configure the **Login Kit** with your** Terms of Service URL, Privacy Policy URL, and Redirect domain**
The redirect domain is your base [Auth0 tenant](https://auth0.com/docs/get-started/auth0-overview/create-tenants) URL found in [Application Settings](https://auth0.com/docs/get-started/applications/application-settings)

![TikTok ToS](https://images.ctfassets.net/23aumh6u8s0i/4VVh2eNRVogHdBNCJ3GU0i/4888f62bed2ab2b4e0fad1293f446bdd/image-20221205-162520.png)

* Save your changes and [submit your app for review](https://developers.tiktok.com/doc/getting-started-app-review-process)

> Your app connection is in _Staging_ status. It may take a few hours for TikTok to review your submission before it’s moved to _Production_ status, which is required for the integration to work.

## Integrate TikTok with Auth0

Once you integrate Auth0 into your application, you will want to implement TikTok as a custom social connection. 

To create a custom social connection, head to Authentication → Social → and click “Create Connection”. Find the **Create Custom** option. Populate the form with the values as follows:

![Auth0 New Social Connection](https://images.ctfassets.net/23aumh6u8s0i/1F4rm5ziebAFfkvMH4wPu8/835cf63fbe3e418497096084ebf197e1/image-20230121-175804.png)

* **Name**: TikTok
* **Authorization URL**: TikTok’s Authorization URL `https://www.tiktok.com/v2/auth/authorize/`
* **Token URL**: This will eventually be your proxy. You’ll learn about this in a minute. For now, use a dummy URL like `https://example.com`
* **Scope**: `user.info.basic`
* **Client ID:** `Client Key` assigned to you by TikTok
* **Client Secret**: `Client Secret` assigned to you by TikTok
* **Fetch User Profile Script**: [Script](https://auth0.com/docs/authenticate/identity-providers/social-identity-providers/oauth2#fetch-user-profile-script) to fetch profile information from [TikTok’s user info endpoint](https://developers.tiktok.com/doc/tiktok-api-v2-get-user-info/) and map to [Auth0’s normalized user profile](https://auth0.com/docs/manage-users/user-accounts/user-profiles/normalized-user-profiles). Auth0 only requires the `user_id` attribute, which corresponds to TikTok’s `union_id`

```javascript
function fetchUserProfile(accessToken, context, cb) {
  const axios = require('axios@0.22.0');
  const userInfoEndpoint = 'https://open.tiktokapis.com/v2/user/info?fields=union_id';
  const headers = { 'Authorization': 'Bearer ' + accessToken };
  
  axios
    .get(userInfoEndpoint, { headers })
    .then(res => {
      if (res.status !== 200) {
        return cb(new Error(res.data))
      }

      const profile = {
        user_id: res.data.user.union_id,
      };
      
      cb(null, profile);
    })
    .catch(err => cb(err));
}
```

Click **Save** and then enable this connection to the applications that require sign-in with TikTok:

![Auth0 TikTok Demo app](https://images.ctfassets.net/23aumh6u8s0i/3y4p63NLcAwrJoXcFwozqQ/b9986a73b6e5152135aad8cc3c4d7c75/image-20230121-192650.png)

## Using the Management API Explorer to Pass Custom Parameters to TikTok

[TikTok’s authorization endpoint](https://developers.tiktok.com/doc/login-kit-web/) specifies `client_key` instead of `client_id`. Auth0 allows us to [pass provider-specific parameters to an identity provider](https://auth0.com/docs/authenticate/identity-providers/pass-parameters-to-idps) during authentication.

To add client_key as a parameter, you will first need to generate an [access token](https://auth0.com/docs/secure/tokens/access-tokens) for the [Management API Explorer](https://auth0.com/docs/api/management/v2). In the Auth0 dashboard, go to **Applications → APIs →** and select **Auth0 Management API**. Next, head to the **API Explorer** tab and click **Create & Authorize Test Application.**

![Auth0 TikTok Demo app settings](https://images.ctfassets.net/23aumh6u8s0i/7EagaLc1sxI5e2G8DwXMgO/954a49c7d530ecd4e3031321488c4b64/image-20230111-170426.png)

To use Management API Explorer, follow these steps:

1. Copy the access token and go to the [Management API Explorer.](https://auth0.com/docs/api/management/v2)
2. Click the **Set API Token** button at the top left.
3. Set the **API Token** by pasting the API Token that you copied in the first step.
4. Click the **Set Token** button.

You should now be able to use the Management API Explorer to modify the configuration of your Auth0 tenant. 

First, use the [Get a connection endpoint](https://auth0.com/docs/api/management/v2#!/Connections/get_connections_by_id) to retrieve the existing values of the `options` object. It will look something like this:

```json
{
  "options": {
    "client_id": "",
    "client_secret": "",
    "scope": "user.info.basic"
  }
}
```

Add the `upstream_params` object with the `client_key` field.

```json
{
  "options": {
    "client_id": "",
    "client_secret": "",
    "scope": "user.info.basic",
    "upstream_params": { 
      "client_key": { "value": "<Client Key from TikTok>" } 
    }
  }
}
```

Next, use the [Update a connection](https://auth0.com/docs/api/management/v2#!/Connections/patch_connections_by_id) endpoint with the new `options` object as the body. Auth0 will send the `client_key=<value>` parameter to [TikTok’s authorization endpoint. ](https://developers.tiktok.com/doc/login-kit-web/)

The [access token endpoint](https://developers.tiktok.com/doc/login-kit-manage-user-access-tokens/) requires a different solution which you’ll learn about next.

## Proxying the Request for the Access Token

Auth0 does not allow you to pass custom query parameters for a request to an OAuth provider’s token endpoint. One solution for this problem is to proxy the request to the token endpoint and append the `client_key` parameter programmatically.

### Technical details

The diagram below illustrates a modified [Authorization Code flow. ](https://auth0.com/docs/get-started/authentication-and-authorization-flow/authorization-code-flow)

![Auth0 Tiktok connection diagram](https://images.ctfassets.net/23aumh6u8s0i/35Dt2Cp6Rhv459jkL3IcJi/c507f054660eb0c157291ff479129b1c/Screenshot_2023-01-26_at_2.28.21_PM.png)

1. User visits an application that requires authentication against Auth0
2. Auth0 detects no session and redirects to the Universal Login page
3. User selects login with TikTok from available login options
4. Auth0 initiates login with TikTok and redirects to TikTok login
5. User authenticates with TikTok and consents to share their user profile
6. TikTok redirects a callback to Auth0’s `/login/callback` endpoint with authorization code
7. Auth0 connects to the proxy `/token` endpoint to exchange authorization code and modifies the `client_id` parameter to `client_key`
8. Proxy endpoint requests an access token from TikTok’s `/oauth/access_token` endpoint and returns it to Auth0
9. Auth0 uses the access token to fetch the user’s profile from TikTok’s `/user/info` endpoint
10. Auth0 issues its own `id_token` and redirects back to the application, completing the sign-in flow

For this tutorial, the proxy endpoint will be created with vanilla [Express.js](https://expressjs.com/) and hosted with [ngrok](https://ngrok.com/), an open-source tool, to expose a local development server to the internet with minimal effort. For production, it's best to host proxy endpoints in your environment.

## Deploying TikTok Integration Proxy

First, download the example code from [this GitHub repository](https://github.com/tylerkeesling/tiktok-access-token-proxy). Follow the `README` instructions to install the dependencies and start the development server. The example server has one POST route, `/token/proxy`. The server should be running on `http://localhost:3333:`

![Project running in localhost](https://images.ctfassets.net/23aumh6u8s0i/4mHJ8Uev0prP1gphpnQ7Y4/39906699faa0a5e1e6eb8bb606a33bad/image-20230121-220221.png)

The proxy endpoint should be something similar to `https://405a-104-129-13B-250.ngrok.io/proxy/token`.

Then head back to your TikTok social connection configuration and update the **Token URL** that you set to `https://example.com` to your live URL address:

![Auth0 Tiktok Token URL](https://images.ctfassets.net/23aumh6u8s0i/3N0boeKcdz3nKJABPNBrU4/4a7caf39e5f67a8234de5a8b8db2dc86/Screen_Shot_2023-01-21_at_5.14.33_PM.png)

Once the configuration is saved, you should now be able to log in with TikTok. 

## Conclusion 

In summary, if your goal is to reduce sign-up friction, increase registrations, and improve the user-login experience, then [adding social login to your website is a must-have](https://auth0.com/resources/whitepapers/why-choose-social-login/). Auth0 makes it easy with our many out-of-the-box integrations. If an integration doesn't exist within our marketplace, you can make it possible with custom social connections.

Using TikTok as a Custom Social Connection in Auth0

alexa-bio

Alexa is a Product Marketing Manager on the Auth0 platform team. With a partner and product marketing background, she is focused on growing our marketplace ecosystem working closely with new and existing partners.

Product Marketing Manager

Alexa Jacky

Customizing identity flows by stacking no-code integrations allows dev teams to innovate efficiently

As healthcare delivery models evolve and digital information unlocks new possibilities, a vast array of ecosystem participants face pressure to:

* **Build and manage consolidated patient portals** that link patients, patient advocates, and extended healthcare teams and that extend across multiple service providers.
* **Empower patients** with convenient self-service options and quicker access to appointment information, test results, diagnoses, forms, documentation, and their healthcare providers.
* **Provide rapid virtual care and assistance,** overcoming distance and time constraints and increasing accessibility of healthcare (and related) services.


<br>
From established healthcare providers to newcomers aspiring to dominate entirely new markets, the organizations best positioned to succeed will be those that are best able to implement fundamental identity capabilities and extend beyond the identity basics.

All the while — and in everything they do — healthcare organizations have to comply with complex regulatory requirements (e.g., HIPAA, GDPR), which vary by jurisdiction and are often layered (i.e., state laws versus federal laws).

But with developer resources already in short supply and with a healthcare organization's primary applications rightfully commanding the lion's share of attention, engineering organizations need to satisfy identity requirements as quickly — and with as little custom code to write or maintain — as possible.

For example, Jay Anslow, Senior Software Engineer at [Babylon Health, shared with us that](https://auth0.com/case-studies/babylon-health), "We estimated that it would take a team of eight staff at least a year to meet our new requirements with a home-built solution. As well as the cost of having that team, it would have delayed our timeline, so we wouldn't have been able to get our functionality out the door as quickly."

## Identity Enables the Healthcare Ecosystem

Identity, particularly as it relates to securing sensitive data and complying with privacy regulations, has been a foundation of healthcare since long before the digital revolution — but as healthcare delivery organizations (HDOs) embraced new information formats and leveraged the Internet for collaboration, communications, service delivery, and other functions, customer identity and access management (CIAM) systems became essential elements of healthcare organizations' technology stacks.

On top of the transition that was already happening, the COVID-19 pandemic "caused a seven to ten-year acceleration in consumer and digital trends," [according to Richard Schwabacher, Senior VP of Digital Health and Chief Digital Officer at BioReference](https://auth0.com/case-studies/bioreference). The result is that "Securing, transmitting, and authorizing patient access to health information digitally is now critical to the practice of medicine and core to what is needed from a modern digital health solution."

And CIAM is vital to this functionality. Out of the box, leading CIAM solutions include many features that can help healthcare organizations meet new needs, allowing even small engineering teams to:

* [Create patient-centric experiences](https://auth0.com/case-studies/bioreference), built around each individual’s needs and preferences;
* [Enable a vast, interconnected, and growing healthcare ecosystem](https://auth0.com/case-studies/providence); and
* [Simultaneously meet security, privacy, and convenience](https://auth0.com/security) needs, rather than trading off between these necessary elements.

But while out-of-the-box functionality is important, the real world is a complex and dynamic beast (as anyone who's ever done a year-over-year roadmap comparison understands). Being able to accommodate change and tailor identity to your unique needs — and doing both without drawing too heavily upon developers — is the difference between CIAM as a necessary component of your application stack and CIAM as an operational and competitive advantage.

## Actions Integrations and the Auth0 Marketplace

A modern CIAM solution can tackle [the healthcare identity basics](https://auth0.com/healthcare) (e.g., signups, logins, account updates, password retrievals, etc.), but satisfying advanced use cases often requires transacting with other business systems and third-parties to execute complex conditional flows.

However, identity is a very difficult and specialized domain. Here's a quick exercise: think of a subject that you know a lot about, something where you're truly an expert. And now, think about how non-experts oversimplify the problems in that area and are overconfident in their ability to solve them. Sure, it's not _impossible_ for them to do so, but it will likely take much more time and effort than they imagined, and the implementation would potentially fail to address corner cases and other complexities.

Identity is like that! An in-house developer team could drop everything else and focus considerable effort on extending an identity implementation by building (and maintaining) a custom solution to every new use case — or they could leverage a straightforward way to make identity work with other business systems quickly and effectively.

And that's where [extensibility](https://auth0.com/extensibility) comes into play.

Since launching in late 2020, [the Auth0 Marketplace](https://marketplace.auth0.com/) has helped developers quickly find and install third-party identity solutions for their applications and APIs.

[Actions Integrations](https://auth0.com/blog/auth0-no-code-actions-integrations-now-available-in-beta/) make it even easier to extend Auth0 with partner-built innovations, often with no-code, drag-and-drop ease; in fact, you can even 'stack' these integrations like building blocks to keep up with new needs and address advanced use cases.

To illustrate, let's look at some examples of how [identity proofing](https://marketplace.auth0.com/categories/identity-proofing), [mobile device verification](https://marketplace.auth0.com/integrations/incognia-authentication), [customer data platforms](https://marketplace.auth0.com/integrations/tealium), and [consent management](https://marketplace.auth0.com/categories/consent-management) integrations can be combined and conditionally employed to contribute to a strong security posture and create positive experiences for customers.

### Registering, logging in, and scheduling appointments

To meet growing expectations for convenience, healthcare organizations must make it easy for patients to register and schedule appointments — but at the same time, the signup process must be secure and must address compliance requirements.

Here's how third-party integrations can help satisfy these simultaneous needs:

* The patient initiates the registration process/account creation
* The sign-up flow within the identity engine calls upon an identity-proofing solution to verify the patient's identity
* Next, the flow calls upon a consent management solution to ensure the patient understands and agrees with how their information will be handled with respect to regulations
* Finally, the identity engine encourages the patient to enroll in [multi-factor authentication (MFA)](https://auth0.com/docs/secure/multi-factor-authentication/enable-mfa) as an added security measure; if the patient agrees, then the flow walks them through the process

To simplify future logins, the identity engine can employ mobile device verification when the patient attempts to access healthcare services via the organization's mobile app.

Once logged in, a patient can schedule an appointment:

* The patient selects "schedule appointment."
* The identity engine uses MFA to verify it is indeed the patient attempting to make the appointment
* If the patient passes the MFA challenge, the appointment is confirmed

Note that this process can be augmented by employing [Adaptive MFA](https://auth0.com/docs/secure/multi-factor-authentication/adaptive-mfa) and limiting MFA's use to when a risk threshold is exceeded.

### Changing/updating personal information

Healthcare organizations handle an enormous volume of sensitive data, including personally identifiable information (PII) and protected health information (PHI). Consequently, it's vital that only authorized users can access and modify information.

Here's a potential identity flow for patient self-service:

* The logged-in patient clicks on "update my profile."
* If the patient is using the mobile app, then the identity engine can call upon a mobile verification solution; otherwise, the identity engine can employ an identity-proofing solution
* With the patient's device or identity verified, they are now authorized to change their information
* If the information being changed is of sufficient sensitivity (e.g., relating to financial or insurance records), then the identity engine can engage MFA as an added layer of security/confirmation
* The patient's information is saved
* The identity engine passes the updated information to the CDP

### Securely accessing healthcare documents and services

Delivering healthcare services requires holding and managing access to huge numbers of documents, from information forms to lab results. Enabling patients to access their healthcare documents eases the workload for staff and can accelerate care.

In addition, telehealth reached new levels of adoption during the pandemic to help protect vulnerable people and reduce the spread of COVID-19 — but with healthcare fraud a real risk, it's important to verify that a patient is who they say they are.

Here's how identity can help. Suppose a logged-in patient clicks to access a particular health document or service. Depending upon the situation, the identity engine can conditionally branch into a number of paths:

* If the patient is using the mobile app, then the flow can call upon a mobile verification solution.
* If the patient is using a new or different device, then the identity engine can initiate an MFA challenge.
* And for especially sensitive information, then the identity engine can call upon an identity-proofing solution.

With verification complete, the patient is now able to access the document or service.

Note that these flows can also incorporate risk scoring and behavioral validation. For example:

* The identity engine can check the patient's device posture against a third-party risk service: if a risk threshold is exceeded, then a higher level of verification can be employed.
* The identity engine can check behavioral data against the patient's CDP profile: for instance, if the patient usually accesses their healthcare portal from a particular geography but in this attempt is somewhere new, then additional verification may be warranted.

### Paying bills

Healthcare organizations also hold vast amounts of financial records — including bills, bank account details, and insurance information — that must be safeguarded. But at the same time, making it easy for patients to view and pay their bills is important.

Fortunately, identity flows can allow patients to view, download, and pay invoices remotely through a third party or an in-house app:

* The logged-in patient navigates to a bill and attempts to open/view it
* The identity engine calls upon mobile verification to confirm the patient's device; alternatively, the identity engine can upon a CDP to confirm the patient's location
* If the device is not recognized or the patient is logging in from a new location, then the identity stack can initiate an MFA challenge
* With the patient's identity verified, they are able to open the bill and access the billing/payment system

## A World of Extensions and Opportunities

Extensibility is a core Auth0 principle. [Our identity platform](https://auth0.com/resources/videos/platform-introduction-video-2020) is designed to be easy to deploy and even easier to tailor to your unique business needs, so you never have to choose between customizability and ease of deployment.

Plus, with [a long list of security and privacy certifications](https://auth0.com/docs/secure/data-privacy-and-compliance) and[ the option to deploy the Auth0 Identity Platform in a private cloud](https://auth0.com/resources/whitepapers/private-cloud-deployment), healthcare organizations can be confident that their identity implementations help meet their regulatory requirements.

We're excited about the potential unlocked by the rich ecosystem of third-party integrations, as they allow our customers to continually add new capabilities as needed.

Whether you prefer the pro-code approach of [Actions](https://auth0.com/docs/customize/actions) or the no-code convenience of Actions Integrations found within [the Auth0 Marketplace](https://marketplace.auth0.com/), we encourage you to explore the options to see which of your identity and identity-related use cases already have a ready-built solution just waiting to be integrated!

Extending CIAM to Enable Modern Healthcare Applications

shiven_ramji

Shiv is an experienced product executive and builder obsessed with creating beautiful products. He is the President of Customer Identity at Okta, managing a $1B ARR business and overseeing the company’s product, data, security, and technology strategy and execution. Before Auth0 and Okta, Shiv was the SVP of Product at DigitalOcean, leading DigitalOcean’s products, pricing, and partnerships. Additionally, Shiv has held product leadership positions at global brands, including Amazon, NBCUniversal, LiveIntent, and The Nielsen Company. Shiv was the recipient of the 2023 Top Global CPO Award by the Products That Count community. 

Beyond his current corporate focus, Shiv is deeply committed to fostering entrepreneurship and innovation, particularly in Africa. He is an active angel investor and startup advisor and also serves on the boards of [Products That Count](https://productsthatcount.com/) and [Aiven.io](http://Aiven.io).

President, Auth0

Shiven Ramji

New partnerships aim to bring secure customer identity to the platforms developers use every day in one click, or less

Almost a decade ago, _The New Kingmakers_ made reference to the rise of a developer class that would fundamentally reshape technology decision-making. Today, two-thirds of professional developers have a voice when their organizations are purchasing new technologies, according to [Stack Overflow](https://survey.stackoverflow.co/2022/#technology-most-loved-dreaded-and-wanted). Product-led growth is official “a thing,” and companies that make life easier for developers have been crowned with success again and again.

The acquisition of Auth0 accelerated Okta’s own journey with developers. Over 2.8 million unique developers look to [Auth0, now the Okta Customer Identity Cloud](https://www.okta.com/press-room/press-releases/okta-introduces-okta-customer-identity-cloud-to-help-businesses-grow-user/) each month for expertise on how to implement customer identity, across in-person events, the Auth0 Ambassador program, and digital channels like docs, technical blogs, and JWT.io.

Today, at [Oktane22](https://www.okta.com/oktane22/), we announced the next giant leap in our journey toward making identity easier for developers: New partnerships with three of the leading developer platforms: DigitalOcean, Netlify, and Vercel. These are like-minded platforms that put developers at the heart of their missions. Together, we intend to bring expert advice and easy integrations to where developers already spend their time–with the ultimate vision of providing secure customer identity in one click or less within each platform environment.

“Creating compelling experiences is hard enough without having to be an identity expert, too. And the stakes are too high to get it wrong,” said Shiven Ramji, Chief Product Officer, Customer Identity at Okta. “Okta Customer Identity Cloud powered by Auth0 can be called by your app and hosted in your cloud of choice, but we don’t want to stop there. This is the first step in a multi-year journey to fully integrate secure identity capabilities where developers are building the future. We are honored to have DigitalOcean, Netlify, and Vercel join us on this quest.”

## Abstracting Away Complexity

Developers are facing all kinds of application complexity and maintenance work that takes them away from innovation. The Covid-19 pandemic only amplified the need to be hyper-focused on shipping differentiated, user-centric products. Security has become a cat-and-mouse game as attackers shift their tactics and new privacy laws are established. Developers need to balance all of these priorities while dealing with resourcing and talent pressures.

Customer identity stands at the intersection of these forces: security, privacy, and user experience. Getting it right enables everyone to safely access any technology and developers to integrate customer identities across the stack. But according to a [Gartner](https://www.gartner.com/en/documents/4009255)® report, “The cost of maintaining a homegrown CIAM toolset has grown, compared with commercial offerings. There is a growing preference for buying versus building, which is enabling the business to refocus development resources.”

## Empowering Developers for a Safer Internet

Together, we believe Okta, DigitalOcean, Netlify, and Vercel can streamline the education, implementation, and activation of customer identity for developers across the globe. Today, we’re starting with improving education and awareness around the complexity of identity, followed by improving discoverability for our integrations along the developer journey, with the ultimate vision of one-click integrations.

Democratizing access to enterprise-grade customer identity for developers will have a massive impact on the security of end-consumers and empower developers to focus on innovation. As part of Okta Customer Identity Cloud, we can put adaptive multi-factor authentication (MFA), bot detection, passkeys, and more in the hands of developers with the literal flip of a switch. Meeting developers where they are is a key part of our strategy, and we couldn’t be more excited to welcome DigitalOcean, Netlify, and Vercel to our network.

“We’re very excited to be working with Okta to better equip developers and small businesses to add customer identity into their Apps built on DigitalOcean,” said Tyler Healy, Vice President of Security at [DigitalOcean](https://www.digitalocean.com/). “When it comes to developers and digital entrepreneurs, simplicity is vital. This partnership will only further DigitalOcean’s ability to simplify innovation on our platform and enable builders to spend more time creating software that changes the world.”

“Developers are moving to a decoupled, composable web architecture because they want more flexibility to use any tool or framework to build faster, better-performing web experiences. At the same time, they need a great developer experience in a simple workflow. That’s where Netlify plays a key role as the platform connecting all developer’s tools, including Auth0 by Okta, and APIs in one place to build and run web apps. Working with Okta, we look forward to making identity and authentication as easy and simple as possible for millions of developers,” said Matt Biilmann, CEO and co-founder [Netlify](https://www.netlify.com/)

“As a leading cloud platform for frontend developers, Vercel provides innovators with the speed and reliability they need to create at the moment of inspiration. Security and identity are at the core of building delightful digital experiences,” said Malte Ubl, CTO at [Vercel](https://vercel.com/). “By joining forces with Okta, we’re not only simplifying the role that identity plays on the web but also making a commitment to enhancing the speed and breadth of developer-friendly cybersecurity in an increasingly digital world.” 

## Neutrality to Build Your App, Your Way

Developers want the freedom and power to choose the best solutions for their digital ecosystem. Okta’s commitment to neutrality means not being restricted to a specific technology stack and having the ability to control and customize identity now and in the future. We are designing easy-to-integrate solutions that free developers to use any technology, regardless of platform, device, or infrastructure. We are 100% focused on identity, so developers can focus on innovation.

## Availability and Signup

Developers can learn more about Okta’s new developer platform partnerships and get started with Okta Customer Identity Cloud [on our Developer Center](https://developer.auth0.com/resources/get-started/cloud?utm_source=blog&utm_medium=website&utm_campaign=partnerships). We will release more information about the DigitalOcean, Netlify, and Vercel integrations as they become available.

If you’re a developer platform interested in joining our quest to make identity easier for developers, [please reach out to our tech partnerships team](https://docs.google.com/forms/d/e/1FAIpQLSfGzaE5a6-OSy1D1N8PMeSE8pXCfsr4UkzDqUpW-vUGq2rYHg/viewform).

## About Okta

Okta is the World’s Identity Company. As the leading independent Identity partner, we free everyone to safely use any technology—anywhere, on any device or app. The most trusted brands trust Okta to enable secure access, authentication, and automation. With flexibility and neutrality at the core of our Okta Workforce Identity and Customer Identity Clouds, business leaders and developers can focus on innovation and accelerate digital transformation thanks to customizable solutions and more than 7,000 pre-built integrations. We’re building a world where Identity belongs to you. Learn more at [okta.com](http://okta.com/).

Okta Partners with DigitalOcean, Netlify, and Vercel to Simplify Identity for Developer

Convert and protect customers at the login box and beyond

**TL;DR:** Okta has launched the [Auth0](https://www.okta.com/press-room/press-releases/okta-introduces-okta-customer-identity-cloud-to-help-businesses-grow-user/), powered by Auth0, with support for two use cases: Consumer Apps and SaaS Apps. This article explores the Consumer App use case and capabilities, as well as how app builders, digital leaders, and security teams can set their applications up for success with end-users, starting at the login box.

It doesn’t matter if you’re in the public sector or selling pizzas–for every organization, in every industry, digital business is just business now.

As consumers ourselves, we know the best apps are the ones that improve our daily lives, keep us safe online, and are delightful to use. We also know what a terrible login experience feels like: 83% of consumers have [abandoned a cart or signup due to an arduous login process](https://info.auth0.com/expectation-vs-reality), and 48% are frustrated by filling in long login or sign-up forms.

In the identity and access management world, this is called customer identity: Learning about your customers and securely building consent-based trust by understanding who they are and how they want to engage with you.

While managing customer identity is a relatively new concept for marketers, app builders and security teams have been wrestling with the complexity around identity and access for years.

What would happen if we treated identity as the “digital front door”? Could we make end-users more secure, help developers launch the next big app, or put an end to passwords?


## Consumer Identity Without Compromise

Auth0 for Consumer Apps enables app builders, digital marketers, and security teams to give end-users access to everything they need online in a convenient and secure way. Consumer-friendly capabilities like Passwordless, Progressive Profiling, and Adaptive Multi-factor Authentication (MFA) ready to go out of the box help maximize conversion, retention, and loyalty without adding friction or security risk. And our 100% focus on identity means we’re keeping an eye on the latest attacks and technologies for you, too.

“Flo is committed to building a better future for female health with the number one OB-GYN recommended app, a thriving community, and science-backed resources,” said Roman Bugaev, Chief Technology Officer at [Flo Health](https://auth0.com/case-studies/flo-health). “Auth0 allows us to provide personalized insights to our users in a thoughtful and secure way, so they can take control of their health. Improving the authentication experience has also helped us reduce churn during the login process, driving our signups 12 times higher since we made the change.”

Here are a few of the ways our customers are using Consumer Apps today.

### Acquire Customers With Just One Click

Asking consumers to create (yet another) password that meets certain complexity requirements results in lower customer acquisition rates, especially on input-constrained devices. Streamline registration with fewer passwords for users and fewer password resets for your support team with **Single Sign-On (SSO) and social logins**, MFA, and more out of the box. Want to do away with passwords entirely? You can start with multiple passwordless options without adding security risk.


### Personalize Experiences for Long-Term Loyalty

Today, digital marketing teams are effective at personalization and testing around the login box, but very few are doing this within identity. Considering that the login box is the gateway to digital experiences, this is a huge missed opportunity. Features like **Universal Login** make it possible to customize the login experience to your exact audience with any number of authenticators–even without your own dedicated identity team. This is a huge selling point for marketers and the developers they work with, who have a lot on their plates already.


### Collect First-Party Data Without Friction

Have you ever had someone ask for too much information on a first date? Long sign-up forms are the digital equivalent. With web cookies going away, digital teams are turning to features like **Progressive Profiling** to collect first-party data over time as consumers sign up and engage with their website or app. Less creepy? Yes. Even more effective for building trust and personalizing experiences? Definitely.


### Protect Revenue From Bots and Brute Force

[Credential stuffing](https://auth0.com/resources/whitepapers/2022-state-of-secure-identity-report) accounts for 34% of overall login traffic and outpaces normal traffic in some countries (61%) in the U.S. and verticals (more than 80% in retail), according to Okta’s 2022 State of Secure Identity Report. Distinguishing between legitimate users and would-be attackers requires finesse and can quickly become a full-time job. Our **Attack Protection** capabilities like Bot Detection, Breached Password Detection, Suspicious IP Throttling, and Adaptive MFA give security teams the tools they need to fight fraud without damaging the user experience.


## What’s New for Consumer Apps?

New product innovations for Consumer Apps were announced at Oktane22. Okta expects these features to be available by the end of Q2 2023, with support for Highly Regulated Identity as an Enterprise Add-on.

* **Passkeys support:** Passkeys are a replacement for passwords that make it faster and safer to sign into apps and websites on any device. The technology is phishing-resistant and uses a device — usually a fingerprint or facial recognition, or a PIN — to prove a user is who they say they are. We are making it easy for app builders to turn on passkeys with the literal flip of a switch.
* **Highly Regulated Identity:** While we’re enabling app builders to offer the most exciting experiences, we also recognize some of our customers operate in highly-regulated industries like banking or utilities. Highly Regulated Identity is a new toolset that allows customers to safeguard riskier transactions with extra security and policy control. We are taking steps toward enabling customers to reach Financial Grade API (FAPI) compliance with several new product innovations, including:
    * **Pushed Authorization Request (PAR):** A new OAuth endpoint that avoids passing any sensitive information on the front channel (e.g., all authorization details won’t appear in the browsing bar or search history).
    * **Rich Authorization Request (RAR):** A framework that enables fine-grained control over authorization for any use case, including communicating fine-grained details on a transaction (e.g., payment amount) and customized consent gathering (e.g., selecting a bank account as part of the consent step).
    * **Private Key JWT:** An authentication method that improves security posture by signing with a private key rather than a password or secret that can be intercepted and used by someone other than the intended recipient.
    * **Strong Customer Authentication (SCA):** A component of the European Union’s second Payment Services Directive (PSD2) that requires at least authenticating users with at least two factors: something they have (e.g., device or hardware key), something they know (e.g., password or PIN), and something they are (e.g., biometrics).
    * **Mutual Transport Layer Security (mTLS):** A type of authentication where access tokens can only be used by the application they were specifically issued for; thus, if a token is leaked, it can’t be used by the attacker. 
* **Security Center:** At Okta, we have insights from billions of authentications about the threats facing consumer apps. We want to make sure your entire cross-functional team has this same visibility. Security Center is a single pane of glass that enables security professionals to monitor in real-time, detect, and respond to potential identity security events–either directly through your dashboard or by integrating with the security stack of your choice. With comprehensive dashboards, visualizations, and controls tailored to customer identity scenarios, this is a powerful tool for keeping your customers secure and your app operating at the highest level.

Learn more about the Auth0 and how to turn your login box into an engine for growth at [https://www.okta.com/customer-identity](https://www.okta.com/customer-identity/).

**Footnote:** _Any unreleased products, features, or functionality referenced in this blog post that is not currently available, may not be delivered on time or at all. Product roadmaps do not represent a commitment, obligation, or promise to deliver any product, feature, or functionality, and customers should not rely on them to make purchase decisions._

Inside Auth0 for Consumer Apps

Win business customers with enterprise-ready Identity

**TL;DR:** Okta has launched the [Auth0](https://www.okta.com/press-room/press-releases/okta-introduces-okta-customer-identity-cloud-to-help-businesses-grow-user/), powered by Auth0, with support for two use cases: Consumer Apps and SaaS Apps. This article explores the SaaS Apps use case and capabilities, as well as how product and engineering leaders can accelerate growth with an identity solution built for business customers.

The Software as a Service (SaaS) market is booming, with new products coming online every day. The average number of apps companies use increased to 89 this year, with as many as 187 for larger companies, according to [Okta’s Businesses at Work 2022 report](https://www.okta.com/businesses-at-work/).

All of this growth has created intense competition in the SaaS space. The companies that will win are the ones who can successfully onboard business customers quickly and move upmarket while remaining hyper-focused on their core product. 

In identity and access management terms, this is called customer identity: Learning about your customers and securely building consent-based trust by understanding who they are and how they want to engage with you.

Historically, there have been very limited customer identity options on the market for the SaaS use case, and product and engineering leaders end up using some combination of consumer and workforce identity solutions.

What if you didn’t have to use baling wire and duct tape? Could identity help you capture your market opportunity–instead of slowing you down?

## Customer Identity for SaaS Apps, Simplified 

Auth0 for SaaS Apps enables every app builder to become enterprise-ready and accelerate growth without having to become an identity expert. SaaS-specific capabilities like Enterprise Federation, Delegated Administration, Multi-factor Authentication (MFA), custom branding, and security features are available out of the box. And our robust identity product roadmap means we’re constantly innovating for you, too.

“Kandji is committed to being a pioneer in the future of work by helping companies manage their Apple devices at scale,” said Weldon Dodd, senior vice president of Product Strategy at [Kandji](https://auth0.com/case-studies/kandji). “Delivering the best experience for our customers means making onboarding as slick as possible, managing and customizing workflows, and providing the most secure experience from both an administrator and end-user perspective. We did all of this with Auth0 four times as fast as our DIY solution. And it’s working–we’re already seeing customer revenue trending up.” 

Here are a few of the ways our customers, like Kandji, Blackboard, and TripActions, are using SaaS Apps today.

### Acquire and Onboard New Customers

As your business scales, you want to streamline the onboarding process to your applications, so business customers can start using your product quickly and collaborating with their coworkers. This increases your “stickiness.” With our APIs and SDKs, you can build **Self-Service Onboarding** directly into your application so that your customers can provision access control, set up Single Sign-On (SSO), and invite other members of their organization without burdening your engineering team.

### Personalize Experiences For Your Customers

Technical teams can spend weeks configuring identity manually for each new customer, with lots of back-and-forths to implement changes. **Organizations** is our toolset that helps SaaS companies manage and model identity for business customers as organizations (under a single tenant). It allows you to provide last-mile customization on a per-organization basis to ensure the authentication experience meets their needs, including enterprise federation with any source, account provisioning, onboarding and migration flows, customized branding, and security policies that meet the most stringent requirements.

### Achieve On-Demand Security

[Credential stuffing](https://auth0.com/resources/whitepapers/2022-state-of-secure-identity-report) accounts for 34% of overall login traffic and outpaces normal traffic in some countries (61%) in the U.S. and verticals (more than 80% in retail), according to Okta’s 2022 State of Secure Identity Report. **Attack protection with [Credential Guard](https://auth0.com/blog/auth0-credential-guard-detects-breached-passwords-faster-to-prevent-account-takeover/)** and **[Bot Detection](https://auth0.com/blog/auth0-bot-detection-reduces-bot-attacks-by-79/)** enables you to secure the data of your business customers, and help prevent the most common identity-based attacks. We take the burden of managing identity security off your internal teams, so they can focus on shipping new features for your product.

### Customize Authentication For Complex Use Cases

No two business customers are the same, and there will be frequent requests to customize your platform for complex use cases. **Extensibility**–custom code blocks and extensibility points that allow for secure customization at any point in the authentication pipeline–has long been an Auth0 differentiator and is now available through Auth0. And because we maintain the extensibility framework, you can meet unique authentication needs and confidently check off RFP requirements today, with adaptability for tomorrow.

### Become Enterprise Ready and Scale

Your customer identity platform should help you grow and land larger customers more often. With SaaS Apps, customer requirements around **SSO and MFA** are available out of the box. Coupled with cloud choice across AWS and Azure, regional infrastructure for data residency, and our 99.99% SLA, you can grow your business anywhere in the world, one login at a time–without needing to host, manage, or scale an identity solution yourself.

## What’s New for SaaS Apps?

New product innovations for SaaS Apps, announced at Oktane22, are now available for all Okta customers:

* **Okta Workforce Enterprise Connection:** Okta Workforce Enterprise Connection makes it easy for SaaS app builders to offer out-of-the-box integrations to Okta Workforce Identity Cloud, providing end-users with a seamless and trustworthy login experience. This enterprise connection is included on all Enterprise and B2B self-service plans for no additional charge and is now easier to discover and configure for SaaS Apps use cases.
* **Organizations Enhancements:** To support our customer's business growth, Organizations now support greater scalability with up to two million organizations per user (tenant) and two million members per organization. We have also made it easier to search for organizations within the Manage Dashboard, making it even easier to find and administer those millions of business customers in your multi-tenant application.

Ready to accelerate your business with identity? Learn more about Auth0 for SaaS Apps at [https://www.okta.com/customer-identity](https://www.okta.com/customer-identity/).

Auth0 for SaaS Apps Explained

Stacking integrations from the Auth0 Marketplace enables custom identity use cases with no-code ease

As they compete for attention and conversions in a crowded global marketplace, online retailers and eCommerce companies face a number of challenges. For example:

* **Customers expect personalized omnichannel experiences** at every stage of the buying journey
* **Users want to engage with their apps or services at any time, from any device, in a secure and safe manner** — and they don’t want to spend time with cumbersome account creation
* **The loss of the third-party cookie and tighter app restrictions are threatening marketing strategies** that rely upon cookies and app-based tracking and are forcing a larger dependence on first-party data

The brands that will not only survive but thrive in this dynamic environment will be those that are best able to implement fundamental identity capabilities and extend beyond the identity basics.

But with a developer team that’s busy enough already, it’s important for the business (and for developer sanity) to satisfy identity requirements as quickly — and with as little custom code to write or maintain — as possible.

## Identity Enables Online Retail and eCommerce

Identity may not be top of mind for retailers, but the identity function is essential to helping eCommerce companies:

* **Maximize conversions and revenue** by[ minimizing friction in any and every customer interaction](https://auth0.com/resources/whitepapers/identity-insights-101)
* **Meet user expectations** by[ powering personalized experiences](https://auth0.com/case-studies/coles-group)
* **Manage risk** by addressing regulatory requirements and privacy laws and by addressing[ identity-specific security threats](https://auth0.com/resources/whitepapers/state-of-security-identity-report)

A customer identity and access management (CIAM) solution with the right set of out-of-the-box features can help engineering teams to avoid a whole lot of pain and expense.

For example,[ CIAM has been a core enabler of cosmetic giant Lush’s consumer-oriented initiatives](https://auth0.com/case-studies/lush-cs), powering a range of features including single sign-on (SSO) and guest checkout, as well as the centralization of the point-of-sale (POS) system for the entire business. In particular, extensive out-of-the-box functionality allowed Lush to implement these features with a limited developer team while ensuring the pace of transformation didn’t compromise customer privacy or system security.

While out-of-the-box functionality is important, the real world is a complex and dynamic beast (as anyone who’s ever done a year-over-year roadmap comparison understands). Being able to accommodate change and tailor identity to your unique needs — and doing both without drawing too heavily upon developers — is the difference between CIAM as a necessary component of your application stack and CIAM as an operational and competitive advantage.

![Auth0 Marketplace](https://images.ctfassets.net/23aumh6u8s0i/16QlWAA6ZN2lnMATb3RbMu/3e305e33068ab6a5afb1419500972b4c/Marketplace_Partner_Spotlight_Separator_V01B_3x.png)

## Actions Integrations and the Auth0 Marketplace

A modern CIAM solution can tackle the identity basics (e.g., signups, logins, account updates, password retrievals, etc.), but satisfying advanced use cases often requires transacting with other business systems and third parties to execute complex conditional flows.

Building such advanced logic from scratch is a major undertaking requiring specific skill sets, tools, and knowledge; worse still, it’s inefficient because each use case is a custom coding exercise with little that can be reused.

Alternatively, having a simple but effective (read: powerful, flexible, efficient, etc.) way to make identity work with your other business systems allows developers to quickly implement customized identity solutions without the time, expense, and headaches associated with custom coding projects… and that’s where[ extensibility](https://auth0.com/extensibility) comes into play.

Since launching in late 2020,[ the Auth0 Marketplace](https://marketplace.auth0.com/) has helped developers quickly find and install third-party identity solutions for their applications and APIs.

[Actions Integrations](https://auth0.com/blog/auth0-no-code-actions-integrations-now-available-in-beta/) makes it even easier to extend Auth0 with partner-built innovations, often with no-code, drag-and-drop ease; in fact, you can even ‘stack’ these integrations like building blocks to keep up with new needs and address advanced use cases.

To illustrate, let’s look at some examples…

## Prevent Fraudulent Registrations

One of the major objectives for consumer-facing companies is to convert prospects into first-time customers, and this makes fraudulent registrations (or signup fraud) especially problematic because:

* [Leveraging a customer data platform (CDP)](https://auth0.com/blog/why-you-should-integrate-customer-identity-and-your-customer-data-platform/), customer flows are often optimized based upon data that shows how users interact with a user interface and ultimately ‘convert’ — but fraudulent registrations pollute this data, significantly complicating business analytics activities.
* To maximize conversions, consumer businesses especially must minimize friction during the registration process — but lowering barriers for legitimate users also lowers the barriers for abusers.

While authentication (e.g., logging in with a username and password) shows that a user has the credentials that correspond to a particular account, it doesn’t prove that the user is who they say they are — that’s where[ identity proofing](https://auth0.com/blog/what-is-identity-proofing-and-why-does-it-matter/) comes in, by using additional verifications to create a high degree of confidence that your users are who they claim to be.

Here’s how a sign-up flow works when identity proofing is integrated:

* A new user clicks “sign up” on your website
* The sign-up flow calls upon[ the identity-proofing solution](https://marketplace.auth0.com/categories/identity-proofing)
* The identity proofing solution verifies the user’s identity using phone carrier verification
* Customer identity data is captured and collected by the[ CDP](https://marketplace.auth0.com/integrations/tealium)

By making signup fraud much more challenging to commit, identity proofing meaningfully alters the economics for bad actors and, in doing so, protects your customers, your reputation, and the integrity of the data stored in your CDP.

## Protect and Enrich Existing User Accounts

In addition to protecting against signup fraud, incorporating identity proofing into user workflows can also protect against account takeovers (ATO) and enrich user profiles with ‘golden data’ like age and demographic information.

For example:

* A returning user performs some action, like logging in or attempting to update account details
* Due to the perceived risk associated with the action (and perhaps incorporating other risk signals), the identity stack calls upon the identity-proofing solution as a safeguard
* The identity proofing solution validates the user’s identity, ensuring that the activity is not from a bad actor attempting to take over the account; or, if the user is accessing the service via a mobile app, a[ mobile verification integration](https://marketplace.auth0.com/integrations/incognia-authentication) validates the device ID to confirm the user’s identity
* With the user’s identity validated, the action is permitted, and the data associated with the user’s activity is sent to[ the CDP](https://marketplace.auth0.com/integrations/tealium) to build out the profile

Depending upon the risk signals or significance of the action, the identity-proofing solution may employ document scanning (e.g., passport, driver’s license) and cross-validation as the verification mechanism. When this is the case, the CDP can be enriched with information that may not yet be a part of the user’s profile.

![Auth0 Marketplace](https://images.ctfassets.net/23aumh6u8s0i/6U3nuyVYlbcg9i0C36khkU/61a068d638a5ee2753facbcf5924e55c/Marketplace_Partner_Spotlight_Separator_V01A_3x.png)

## Stop Fraudulent Checkouts

The previous examples involve sending data to the CDP, but the CDP data can also be leveraged within the identity flows. For instance, here’s how data from a CDP can combine with an identity-proofing solution to stop a fraudulent checkout:

* A threat actor masquerading as a user logs in, browses products and adds items to the cart
* The CDP collects and stores behavioral data from this session. The data can then be used to help determine that the risk threshold is exceeded — e.g., the total purchase amount exceeds the real customer’s typical habits, or the IP geo-location is outside the real customer’s region, etc.
* The threat actor fails the identity proofing verification, and the purchase is stopped, protecting the customer and the retail brand from the effects of fraudulent purchases

## Reward Your Loyal Customers

Retail brands can suffer reputational harm when resellers buy premium products (e.g., sneaker drops, limited edition collaborations, small batch cosmetics, etc.) only to mark up the price on a third-party marketplace.

By restricting who is able to purchase these products, retailers can reward loyal customers and protect their brand:

* A user logs in
* The CDP provides customer data that can then be used to indicate whether or not the user exceeds a certain ‘loyalty’ threshold (e.g., based on purchase history)
* If a user exceeds the threshold, then the site/service shows them premium offers
* The user adds a premium product to their cart and initiates the checkout
* Identity proofing validates the user’s identity to guard against an account takeover and ensure that the purchaser is a loyal customer

Additionally, the same building blocks can be used to encourage preferred channel adoption. For example, many retailers reserve limited edition products only for users of their mobile app. Web users could be presented with a message saying, “To see promotional offers, please switch to the app.” If the user’s device has already been verified in a past interaction, then the purchase can proceed; otherwise, the identity stack calls a short verification flow. 

Customer lifetime value is rooted in personalized offers, promotions, and pricing, which depend on rich customer profiles stored in CDPs. To build these profiles, brands collect customer data across various channels and systems, with the mobile app being perhaps the most valuable channel.

## A World of Extensions and Opportunities

Extensibility is a core Auth0 principle.[ Our identity platform](https://auth0.com/resources/videos/platform-introduction-video-2020) is designed to be easy to deploy and even easier to tailor to your unique business needs, so you never have to choose between customizability and ease of deployment.

We’re excited about the potential unlocked by the rich ecosystem of third-party integrations, as they allow our customers to continually add new capabilities as needed.

Whether you prefer the pro-code approach of[ Actions](https://auth0.com/docs/customize/actions) or the no-code convenience of Actions Integrations found within[ the Auth0 Marketplace](https://marketplace.auth0.com/), we encourage you to explore the options to see which of your identity and identity-related use cases already have a ready-built solution just waiting to be integrated!

Why Easy Extensibility is an Online Retail Essential

Nabeel-Saeed

Nabeel is a product marketer focused on all things security and identity. He has contributed to publications like Wirecutter, Information Age, and Professional Security. He has also been a guest speaker at the Bay Area Cybersecurity Meetup, and delivered talks on IAM across the US, Canada, Israel, and Singapore. He is passionate about helping build secure auth experiences that amaze users and delight businesses.

Product Marketing

Nabeel Saeed

Attackers are getting better at compromising customer accounts. Here's how to stop them

Customer Identity (CIAM) is a unique segment of the wider Identity and Access Management (IAM) space, as customer-facing applications face a different threat landscape and must deliver an experience that's user-friendly — as well as secure and private. It must rely on subtle techniques to achieve and maintain a strong security posture while also driving conversions and building trust with consumers.

Our [2022 State of Secure Identity Report](https://auth0.com/resources/whitepapers/2022-state-of-secure-identity-report) presents trends, examples, and observations unearthed from observing the billions of authentications on our platform in the hope that bringing light to such insights will help organizations understand the threats against customer identity and drive informed conversations around Zero Trust.

### Fraudulent registrations are an ever-present and growing threat

In the first 90 days of 2022, signup fraud accounted for approximately 23% of signup attempts on our platform, up from 15% in the same period last year (per last year's report). Financial Services and Energy/Utilities experienced the highest proportion of signup attacks, with such threats accounting for 64.8% and 72.5% of registration attempts in those two industries, respectively.

### Credential stuffing is on a record pace

2022 has already delivered the two largest such credential stuffing attacks we have ever witnessed, and across all industries, credential stuffing accounts for 34% of overall traffic/authentication events on our platform. While most industries experienced a credential stuffing rate of less than 10% of login events, in several cases — Retail/eCommerce (more than 80%), Financial Services, and Entertainment — these attacks represented the majority of login attempts.

### Threat actors are targeting MFA

Because of its proven merits, more application and service providers are recommending or requiring MFA. Consequently, the first half of 2022 has seen a higher baseline of attacks against MFA than any previous year in our dataset. As attackers become more sophisticated at targeting this important defensive measure, it's critical that MFA be implemented correctly and that strong secondary factors are chosen.

### Breached Passwords are a pervasive but poorly understood threat

Account takeover attacks with stolen credentials are one of the most common and costly cyber threats. Entire marketplaces exist to sell lists of user credentials leaked in third-party breaches. In fact, 58% of all Auth0 customer applications have experienced login attempts using breached/leaked credentials, illustrating the widespread nature of these attacks. What's more, most of the services that purport to protect against breached passwords use web scanners and scrapers that rely on breach data being made public, which can be months or even years after the initial breach. Reusing passwords across sites increases the risk of an attack and makes it more difficult for organizations to prevent fraudulent access to user accounts. In order to defend apps and users against this pervasive threat, it's imperative that breached passwords are detected as soon as they are compromised and accounts notified.

### CIAM at the vanguard of identity security

In an enterprise environment, security trumps convenience, so administrators can impose controls with comparatively little regard for the user experience — but customer identity management must maintain security and privacy while minimizing friction. Because of this restriction, CIAM exists at the vanguard of identity security and innovation, as it depends upon defenses that can withstand sophisticated threats but that are nearly invisible to users.

With this report, we aim to increase awareness of both threats to customer identity and the techniques that can be layered to build reliable defenses.

### Three ways to stop identity-based attacks

1. **Implement MFA everywhere.** It is still one of the best defenses we have against sophisticated attacks.
2. **Augment with defense-in-depth tools. **These work in combination across the user, application, and network layers, such as scanning for bot traffic and breached passwords among your user base.
3. **Invest in a customer identity solution.** Embrace flexibility by default and customize security and ease of use depending on your risk appetite, user requirements, and implementation.

> 📈 [Download the report](https://auth0.com/resources/whitepapers/2022-state-of-secure-identity-report) for a deeper dive into insights gained from a platform that authenticated billions of logins each month.

### Methodology

This report is based on data from Okta customers using the Auth0 platform around the world and so represents real-world observations of identity attacks. The data was retrieved by Auth0's security researchers by running simple and anonymous queries against our aggregate database of operational telemetry. Industry segmentations are based upon each customer's self-reported segment. Observations are from the first 90 days of 2022 unless otherwise noted.

Top Insights From Our 2022 State of Secure Identity Report

Flexible streaming directly to your tools powered by Auth0 Marketplace integrations.

No matter industry or size, data collection and analysis can play a critical role in the success of your business. Without the right data or tools in place, it can be impossible to fully analyze performance and make the right user optimizations. The inability to monitor and react to security incidents can set organizations up for risk and brand consequences - [with the average cost of a data breach rising to $4.35 million in 2022.](https://www.ibm.com/security/data-breach) But while real-time data monitoring and alerting is important, it can be difficult to scale - especially if you’re not in the business of data ingestion. 

That’s where log streaming comes in. Log streaming allows you to ingest activity data and receive real-time monitoring and alerts, enabling you to react to security events, analyze performance, and understand user behaviors. We first introduced [Auth0’s log streaming integrations](https://marketplace.auth0.com/features/log-streaming) in 2020, allowing you to easily integrate log streaming into your applications to monitor and keep track of events occurring within your Auth0 tenants. For a bit of a deeper dive into log streaming and our past log streaming integrations, be sure to check out our [log streaming overview blog](https://auth0.com/blog/log-streaming--what-it-is-and-why-it-matters/). 

## Investing in Log Streaming to Enable Rapid Customer Response

[Account takeover attacks increased by approximately 90% from 2020 to 2021](https://www.forbes.com/sites/forbescommunicationscouncil/2022/07/18/the-account-takeover-epidemic-a-wake-up-call-for-chief-digital-officers/?sh=4eb245354196), adding pressure on IT admins to present better account monitoring and protection solutions for their users. Organizations need to be able to quickly see and react to abnormal events within their applications and find areas to improve efficiencies for better user experiences. 

We’ve been offering both log streaming and log extensions as a monitoring solution, but as pressures to react and respond to real-time streaming data grows, we’ve decided to [move away from log extensions](https://community.auth0.com/t/log-extension-deprecation/83017) and fully invest in log streaming. Log extensions delivered a once-viable solution, but we’ve found them difficult to scale to meet the growing needs. By refocusing our efforts, we’re able to launch custom log streaming solutions that are not bound by global management API endpoint limits and rate limits and, ultimately, deliver scalability. For users, this allows you to better react to real-time monitoring and alerts, analyze application performance, and understand your customer behaviors with real-time activity data. 

## Log Streaming Flexibility: Connect Directly to Your Third-Party Data Tools

We’re excited about our new launches for a few reasons. We’ve created a more efficient solution to export log events to your third-party data tools. By shifting our focus to only log streaming, we can continue to enhance our log stream features to make them more customizable for unique use cases. 

A feature we recently implemented, Log Streaming Flexibility, allows users to select which log-type categories they want to stream. This means that instead of filtering the data you want to see at the end of the stream, you can now filter exactly what you want to see directly at the source. The result is better-defined log streams that only send relevant data and easier adoption of log streams with less volume to manage. This functionality also serves as one of the alternatives to the soon-to-be deprecated log extensions functionality. 

## Meet Our Log Streaming Partners

As we continue to fully invest in log streaming, we’ve partnered with Mixpanel and Segment to create custom log streaming integrations built on APIs for two-way communication between applications.

#### [Segment](https://marketplace.auth0.com/integrations/segment-log-streaming)

Built by Auth0, the Twilio Segment integration is a Customer Data Platform (CDP) log streaming solution that provides companies with the data foundation to help build complete customer profiles. Twilio Segment allows companies to collect, unify, and route customer data into any system to better understand their customers and create seamless, compelling experiences in real time. 

#### [Mixpanel](https://marketplace.auth0.com/integrations/mixpanel-log-streaming)
The Mixpanel integration gets engineering, product, and data teams the tools they need by providing fast, flexible, and easy-to-use product analytics. This custom log streaming integration allows you to create behavioral cohorts that can be routed to Mixpanel to create robust data profiles. Mixpanel’s reporting makes it easy to find root causes of user drop-off and growth in order to better serve your customers. 

In addition to the above custom log streaming integrations built in collaboration with Mixpanel and Segment, some of our other partners have launched log streaming integrations in the [Auth0 Marketplace](http://marketplace.auth0.com/). These partner-built integrations are built with custom webhooks to allow you to ingest and track event data within your Auth0 tenants. 

#### [Elastic](https://marketplace.auth0.com/integrations/elastic-security)
[Elastic Security](https://www.elastic.co/security) combines SIEM threat detection features with endpoint prevention and response capabilities in one solution. The Elastic Security log streaming integration for Auth0 uses custom webhooks to enable easy ingestion of Auth0 events to aid with threat detection and incident response. All Auth0 events are mapped to the Elastic Common Schema, allowing you to easily analyze, correlate, and visualize events right away.

#### [Logz.io](https://marketplace.auth0.com/integrations/logz-io)
The [Logz.io](https://logz.io/) Cloud SIEM integration for Auth0 allows you to centrally monitor your workflow logs to help rapidly identify, investigate, and remediate emerging threats. Combining the open-source visualization from Kibana with advanced security analytics backed by AI and Machine Learning, Logz.io enables you to inspect and investigate all of your relevant Auth0 event data. Using custom webhooks, Logz.io allows your team to quickly drill down into granular user data while inferring critical security intelligence to inform decision-making.

#### [MDR ONE](https://marketplace.auth0.com/integrations/mdr-one)
[Kudelski Security’s](https://kudelskisecurity.com/services/mdr-one/) MDR ONE integration uses an advanced set of detection rules to provide widely recognized threat hunting, detection, and response capabilities for Auth0. By offering a unique combination of consulting, technology, and managed services, the MDR ONE integration enables organizations to continuously evaluate security posture and recommends solutions that will address business risk and compliance needs and assist with overall security effectiveness.

## What’s Next for Log Streaming on Auth0?

We’re just at the beginning of our custom log streaming integrations. With the launch of our Auth0-built integrations, we’ll soon be opening up the opportunity for partners to build their own custom log streaming integrations on our Marketplace, in addition to the webhooks-based integrations our partners are already building. 

As we move away from extensions entirely, be on the lookout in the coming months for documentation and announcements on this opportunity, and be sure to check out [auth0.com/integrate](https://auth0.com/integrate) to learn more about the process of building and launching an integration on the [Marketplace](http://marketplace.auth0.com/).



Custom Log Streaming Integrations

Geoffrey Goodman

I am a curious and driven person. Until my early twenties, I was one of the top-ranked Canadian slalom skiers. While still competing, I pursued dual business majors at a Liberal Arts college in Nevada, funded by academic and athletic scholarships. I then joined EY in Montreal, where I worked with all of the four major service lines and earned my CA title. I now work with the Valuations and Business Modelling group and I am pursuing my CBV designation. 
<br>
I am also a self-taught computer programmer. I am comfortable in any number of programming languages. I built a website and steward a community of thousands of people across the world who rely on and benefit from its services every day.

Staff Engineer

Customers can now add custom prompts or factors in their post-login flow

We are excited to share that our customers that use Actions -  Auth0’s flagship extensibility product - can now add custom prompts or factors in their post-login flow. This enables developers and partners to confidently record the completion of a factor upon returning after a custom redirect. Auth0 delivers more tools, features, and options for developers to give them the support and capabilities they need to customize their customer’s experience through pro-code flexibility.

We have introduced a new method to the API of post-login Actions when continuing the flow after a successful custom redirect. This method allows a customer and/or partner to store the completion of that custom factor right in the user’s session. What is powerful about this is that they can then check whether that customer record is in a user session in each login and skip that prompt if it’s there already. Because it’s stored in the user session itself, it benefits from any current and future session management features within the Auth0 product offering.

## What Is the Problem We Are Solving?

Historically, there was no good way for customers to use Actions to securely implement custom prompts or custom factors in a user-friendly way. They could use user metadata or application metadata, but those objects exist across all user sessions. There was also no good way for customers or partners to see whether a user on a specific device had completed the necessary factors to login. This meant forcing users to re-perform the custom prompt or factor more often than necessary.

As an example, let's say you’re a developer for a banking app that has a special requirement to use a custom multi-factor authentication service, and you want that authentication to be associated with a user's session and or device for added security. That is where the ability to add a custom prompt enables you to build that customer experience and address that need.

## See It in the Real Example!

Let's take a look at a real example! Below is a sample Actions code for a Partner Integration implementing a custom authentication factor.

On the `onExecutePostLogin`, we trigger the custom authentication method by using Actions Redirect to send users to the customer method URL with session token information.

```js
const CUSTOM_METHOD_URL = "https://path.to.prompt";
const PROMPT_TTL = 1000 * 60 * 60 * 24; // 24h

exports.onExecutePostLogin = async (event, api) => {
    if (
        !event.authentication?.methods.some((record) => {
            // Timestamps are rendered as IS08601 strings
            const timestamp = new Date(record.timestamp);

            return (
                record.name === CUSTOM_METHOD_URL &&
                timestamp.value0f() >= Date.now() - PROMPT_TTL
            );
        })
    ){
        const sessionToken = api.redirect.encodeToken({
            payload: {
                user_id: event.user.user_id,
            },
            secret: event.secrets.SESSION_TOKEN_SECRET,
        });

        // Trigger our custom authentication method
        api.redirect.sendUserTo(CUSTOM_METHOD_URL, {
            query: { session token: sessionToken }
        });
    }
};
```

Continue with `onContinuePostLogin`, we validate the session token secret and record the completion of our custom authentication method.


```js
exports.onContinuePostLoqin = async (event, api) => {
    const payload = api.redirect.validateToken({
        secret: event.secrets. SESSION_TOKEN_SECRET,
        tokenParameterName: 'session_token'
    });

    if (!validateSessionToken(payload)) {
        return api.access.deny('Unauthorized');
    }

    // Record the completion of our custom authentication method.
    // THIS NEW API IS ONLY AVAILABLE IN 'onContinuePostLogin'
    api.authentication.recordMethod(CUSTOM_METHOD_URL);
};

function validateSessionToken(payload) {
    // Custom validation logic would go here
    return true;
}
```

Actions is an iterative platform we continually improve upon. [Start creating your Auth0 Actions](https://auth0.com/docs/customize/actions/write-your-first-action) today and customize your logic flow with the seamless low-code integration with Auth0!

New Actions Feature: Build Your Own Custom Factor

Dan McCorriston

Senior Product Marketing Manager

Now, all Auth0 customers - including those on our private cloud platform - have access to all the offerings on the Auth0 Marketplace.

Auth0 is excited to announce a newly expanded offering for [our new private cloud platform](https://auth0.com/blog/a-technical-primer-of-auth0-s-new-private-cloud-platform/) customers - Actions Integrations are now available from the Auth0 Marketplace. What that means is all Auth0 customers that utilize our new private cloud platform have access to all the offerings on the Auth0 Marketplace - SSO, Social Connections, Log Streaming Integrations, and now, Actions Integrations.

Actions Integrations will start to appear in the Development/Staging space now and will be ready in the Production environment in the coming weeks dependent on various release cadences.

### What are Actions Integrations and the Auth0 Marketplace, and why should I care?

At Auth0, we realize that many customers have unique needs, and as a result, they want the ability to customize their identity product. In order to serve these additional customer needs, Auth0 built a variety of tools to extend the functionality of identity. This concept is called **extensibility.**

Auth0 Actions and Actions Integrations is the next generation of **extensibility**. Actions is the low-code offering, and Actions Integrations allows customers to use pre-written no-code, drag and drop options to add other functionality such as ID proofing and consent management. Auth0 provides this additional functionality through integrations with **our Ecosystem partners** offered in the Marketplace.

The Auth0 Marketplace and Auth0 Actions are the two complementary ways we extend Auth0. Customers and their end users need the ability to resolve their unique identity requirements — which may include payments, subscription management, signing terms of services, etc. — to complete a successful user access journey into their application or service.

### What is Private Cloud?

Auth0’s [Private Cloud offering](https://auth0.com/cloud) provides the flexibility and agility offered by cloud deployments but also allows a customer to maintain the control and security they need to protect their customers and their businesses. Many customers that have high security and regulatory concerns - those in the financial services industry, for example - may require certain standards of uptimes, updates, failovers, and support for their deployments. The Auth0 Private Cloud deployment models come in both Standard and Managed levels, depending on the customer’s requirements.

Auth0 [recently invested in retooling the Private Cloud platform](https://auth0.com/blog/a-technical-primer-of-auth0-s-new-private-cloud-platform/) to support more automation, adopt current technologies and help scale the Private Cloud to thousands of environments.

### Benefit of Private Cloud and Actions Integrations

Private Cloud has a strong appeal for customers who have high volume or who are from certain verticals. For example, verticals like banking, where shared databases are a concern. Or customers who have data residency requirements or even those who prefer to deploy in a specific region close to their customers. Private Cloud customers do not have to be concerned with sharing space, public cloud request limits, and multiple customer’s data being present in the same deployment. 

Many of the same customers that have a need for Private Cloud also have extensive use cases for extensibility and the no-code integrations available in the Auth0 Marketplace. Easy-to-use integrations such as Identity Proofing and Customer Data Management. With Actions Integrations, developers no longer need to build or maintain custom code or make changes when we alter programming models or release new versions of Node. These Actions Integrations are built and maintained by our Ecosystem partners and are available right in the Auth0 Marketplace. 

A couple of examples of Actions Integrations available in the Auth0 Marketplace:

* [**Deduce Intelligent MFA**](https://marketplace.auth0.com/integrations/deduce-intelligent-mfa): Deduce prevents consumer-facing Account Takeover (ATO) and registration fraud via the constantly growing Deduce Identity Network, with over 400M profiles and in excess of 1.2B daily activities. Deduce risk signals significantly reduces false positive MFA challenges.
* [**Tealium User Login**](https://marketplace.auth0.com/integrations/tealium): Tealium connects customer data - web, mobile, offline, Internet of Things (IoT) - so brands can connect with their customers. Tealium empowers companies to create a unified, real-time customer data infrastructure and makes customer data more valuable, actionable, and secure.

### Is this an increased opportunity for Ecosystem Partners?

Now that Private Cloud customers have access to Actions Integrations in the Auth0 Marketplace, our Ecosystem Partners have a new and expanded pool of potential customers to reach through building and publishing Actions Integrations into the Marketplace. There’s never been a better time to become an Ecosystem Partner and market your Actions Integrations through the Auth0 Marketplace.

Make sure to visit the [Auth0 Marketplace](https://marketplace.auth0.com/) to see if there is an integration that optimizes your customer’s identity experience. To find out more about becoming a [Private Cloud](https://auth0.com/docs/deploy-monitor/deploy-private-cloud) customer, please [send an inquiry](https://auth0.com/get-started?place=documentation%20post&type=link&text=contact%20auth0%20sales) and someone from Auth0 will contact you about whether it’s a good fit for your business.

Actions Integrations Now Available in Private Cloud

500x500

I'm a software engineer, but I prefer to call myself Technology Bishop. Spreading knowledge through writing is my mission.

Software Engineer

Antonello Zanini

Learn why you may need custom error responses on 4xx errors, what a good custom format looks like, and how to apply it to your error responses in Express.

"custom"