Aliyah Winfrey

I'm Aliyah Winfrey, a staff design researcher who’s passionate about creating clarity and alignment in complex research spaces. I thrive on asking the right questions and uncovering insights that drive meaningful design. Outside work, I tend to my garden, experiment with new baking recipes, or get lost in a classic PS2 game.

Staff Design Researcher

Exploring the evolving tech/identifier trends, needs, and behaviors of a global audience

As an advocate for developers and a company that trusts the developer community, we are open-sourcing this survey data to foster dialogue, innovation, and shared learning. By making these insights publicly available, we invite researchers, developers, and CIAM leaders to analyze and build upon our findings. Understanding global digital identity trends requires diverse perspectives, and an open-source approach allows for an informed and equitable discussion. 

Digital technologies continue to change human interactions, shaping global attitudes toward identity, security, and new technological innovations in similar and different ways. Our latest End-User Device & Login Sentiment survey highlights key trends in digital identity preferences, authentication methods, and security concerns. This survey and high-level takeaways contribute to the broader discourse of technology, CIAM, and an evolving general population market. Please find details on the purpose, audience, and collection below:

## Purpose

Understand the general population of global users' evolving technology needs and behaviors to identify key trends and shifts. The following Key topics were covered: 

**Device/OS usage**

* Personal vs. Work device usage 
* Device registration preference
* Work application usage

**Attitude towards technology**

* Overall tech familiarity 
* Hardware update motives
* Frequency of technology updates

**Identifier preference**

* Identifier familiarity 
* Identifier registration preference
* Perceived vulnerability and convenience 

**Password management**

* Reuse & Change Password
* Compromised PII
* Fraud Check

![Key Topics](https://images.ctfassets.net/23aumh6u8s0i/34N68QuL8Q9JZBT8ql8wXB/218ff72b8716be2887562adb892c3e28/key_topics.png)

### Research Questions

1. Understand current technology devices and usage patterns 
2. Identifying emerging trends in end-user preference 
3. Discover unmet needs and pain points to capitalize on new opportunities, driving innovation and strategic growth

### Target Audience

Partnered with Qualtrics for a 33-question survey in the following regions/countries: EMEA (France & United Kingdom), NAMR (United States & Canada), LATAM (Mexico & Brazil), and India. 

### Sample

**N=1049**

* Age
 * Age 18-23: 19%
 * Age 24-30 19%
 * Age 35-54: 32%
 * Age 55+: 30%
* Region
 * NAMR 25%
 * EMEA 25%
 * LATAM 25%
 * APAC 25%
* Gender
 * Male:48%
 * Female: 52%
* Community Type
 * 1/3 Rural
 * 1/3 Suburban
 * 1/3 Urban
* Household Income
 * Less than $25,000- 5%
 * $25,001 - $50,000- 10%
 * $50,001 - $75,000- 20%
 * $75,001 - $100,000- 30%
 * $100,001 - $150,000- 20%
 * $150,001 - $200,000- 10%
 * More than $200,000- 5%

### Data Integrity 

No personally identifying information (PII) was collected. All responses shorter than 3 minutes (180 seconds) were removed. The median completion time was 6.08 minutes. Participants were compensated for completing the survey. 

Samplings across regions are representative of age and gender distributions. For example, given the larger youth population, more youth aged 18 to 30 were sampled in India. Given the country's demographics, ages ranging from 45 to 59+ were skewed towards EMEA and NAMR. 

Additionally, LATAM skewed predominantly toward the urban community type, EMEA represented much of the rural community type, and NAMR led heavily toward the Suburban community type.

### Regression analysis

![Regression analysis](https://images.ctfassets.net/23aumh6u8s0i/2cF18Iz0eEWlprYHPlHlFR/f21d36a8cb21cabedd6100f1037f7aba/Regression_analysis.png)
_Logistic Regression on survey data was completed to gauge if any response options forecast an individual's Willingness to Try New Identifiers. No substantial evidence indicates these factors are significant predictors._

 
Six low-level predictors for Willingness to Try New Identifiers were identified. These include the following:

1. Attitude towards New Tech
2. Familiarity with Identifiers other than Email and Username
3. How often do individuals update their devices
4. Age
5. Apple-Only OS Owners
6. APAC/India region 

Data was collected in October of 2024. Data is accessible via a[ CSV. file](https://cdn.auth0.com/blog/blog/End-User-Sentiments-Survey.csv).

#### Citation

1 End-User Device and Login Sentiment, Auth0, 2024. [Link](https://auth0.com/blog/digital-identity-what-users-think-about-devices-and-logins/)

## Insights

### Top 10 Learnings 

1. Android Phone and Windows OS more widely adopted across diverse groups: 
 - Adoption more prevalent in LATAM and APAC
 - Android users tend to be lower to middle-household income 
![Android, Windows OS lead in adoption](https://images.ctfassets.net/23aumh6u8s0i/1cz14tdcdDmqEZI5ZBgD9M/15021e7a00fe7d4967d9255f16f99b7d/Screenshot_2025-03-21_at_12.39.11_PM.png)
2. Younger demographics and higher income are more likely to use Apple OS 
 - Apple OS more pronounced in EMEA and NAMR
3. Younger demographics and higher income are more likely to use Apple OS 
 - Positive attitude toward new technology, higher frequency of device updates, and more open to adopting new identifiers
4. EMEA and NAMR are more cautious about approaching new technologies 
 - Preference could be influenced by cultural differences and regulations
![General comfortability with adopting tech once mainstream](https://images.ctfassets.net/23aumh6u8s0i/6LXzCLV1QzEPUbZk2rh5c9/33bea12287c85db2359d9e8990a5bda4/Screenshot_2025-03-21_at_12.29.28_PM.png)
5. Top upgrade motivators are new features, device damage, battery issues, and limited memory. 
 - India/APAC unique concern for social brand preference and security concerns
![New features and de ice damage lead us upgrade motivators](https://images.ctfassets.net/23aumh6u8s0i/7CbnGFomOPj6PfmU4IfzeD/e92edbcce72f7994c1ca55ac4575dfa8/Screenshot_2025-03-21_at_12.30.33_PM.png)
6. Respondents who are more familiar with alternative identifiers (email and username) show higher readiness to adopt new ones. 
 - Apple OS users less likely to try new identifiers 
7. The most familiar and used identifiers include Email, username, phone/SMS, and biometrics. In contrast, the least used and familiar include Blockchain and hardware security keys. 
 - Social login is slightly more prevalent in LATAM and APAC
![APAC lead in familiarity and use for most methods](https://images.ctfassets.net/23aumh6u8s0i/71S0j1xEeG6isV67O1SwkP/4a7cdda42233bd8cc16c2a6a2f5829cf/Screenshot_2025-03-21_at_12.35.26_PM.png)
8. Username, email, and fingerprint are rated as the most convenient across all regions. 
 - EMEA and NAMR seem to be more sensitive to non-conventional identifiers such as government ID, security key, and voice ID, while even social login is ranked neutral. 
![Username, email, and fingerprint rated as most convenient](https://images.ctfassets.net/23aumh6u8s0i/7JSF843aMWSNsNSTxBBF0d/c1e9723a8b0efd52cc02748b81256bf6/Screenshot_2025-03-21_at_12.36.02_PM.png)
9. In contrast, Social Login is perceived as the most vulnerable to hackers and cyber-attacks. 
 - Our recent article, Demystifying Social Login, dives deeper into the security of leveraging Auth0 social connections for end-users. 
![Social Login seen as most vulnerable to cyberattacks](https://images.ctfassets.net/23aumh6u8s0i/7zuPvErvRjmZo3uflHsRdG/49f35a40cc73261e8d7ad06cffba6f8b/Screenshot_2024-12-17_at_10.27.55_AM.png)
10. Security and Privacy priority for motivations to try new identifiers 
 - NAMR and EMEA rank innovation as one of the lowest drivers
![Security and Privacy priority for motivations to try new identifiers](https://images.ctfassets.net/23aumh6u8s0i/3LpGrqWztktMy8Nw1H2lYJ/550ad822c4f8684ef18c2cea1f751d56/Screenshot_2025-03-21_at_12.34.25_PM.png)

> Download the [.CSV data here](https://cdn.auth0.com/blog/blog/End-User-Sentiments-Survey.csv).

Join the conversation! Share your thoughts, repost, and tag us to discuss the future of digital identity.

Digital Identity: What Users Think About Devices and Logins

deepu-sasidharan

Deepu is a polyglot developer, Java Champion, and OSS aficionado. He mainly works with Java, JS, Rust, and Golang. He co-leads JHipster and created the JDL Studio and KDash. He's a Staff Developer Advocate at Okta. He is also an international speaker and a published author.

Staff Developer Advocate

Deepu K Sasidharan

Discover how AI agents are taking center stage by seamlessly integrating with multiple digital tools like Gmail, Calendar, Slack, and Google Drive to be more efficient. Learn why it is important to secure them and how to do it.

**AI agents** or **Operators** are the latest trend in AI. At their core, agents are autonomous systems that not only process natural language using Large Language Models (LLMs) but also decide when and how to act by interfacing with external tools and APIs. These smart entities blend machine learning with decision-making capabilities, enabling them to perform complex tasks, interact in real-time, use the most efficient tools to perform certain tasks, and even learn from their environment—all without constant human intervention.

<AmpContent>
<amp-youtube
 data-videoid="r7wEinUG0ns"
 layout="responsive"
 width="480" height="270">
</amp-youtube>
</AmpContent>

<NonAmpContent>
<div
 className='embed-container'
 style="position: relative; padding-bottom: 56.25%; height: 0; overflow: hidden; max-width: 100%;margin-bottom:40px;">
 <iframe
 style="position: absolute; top: 0; left: 0; width: 100%; height: 100%;"
 src='https://www.youtube.com/embed/r7wEinUG0ns'
 frameborder='0' allowfullscreen>
 </iframe>
</div>
</NonAmpContent>

## Tool Calling Agents

LLMs on their own are still susceptible to hallucinations and mistakes, but the ability to call tools opens up a whole new world of possibilities where error-prone tasks can be offloaded to a more traditional non-AI tool, like using a calculator to do math rather than relying on the LLM for it. Similarly, tool calling allows AI agents to interface with other applications and services, like Gmail, Calendar, Slack, and Google Drive, to do more for you than just answering questions.

Tool calling can be generally classified into these:

1. **Unauthenticated Tools:** These are tools that don't require authentication and are generally simpler to configure, like a calculator, a weather API, or a unit converter.
2. **Authenticated Tools:** These are tools that require authentication and are generally complex to configure, such as an API provided by another internal application or services like Gmail, Calendar, Slack, and Google Drive.

In an enterprise environment, the authenticated tools can be further classified into:

1. **First-Party Tools:** These are services that are part of the same infrastructure and require authentication, like an API provided by another internal application or a microservice.
2. **Third-Party Tools:** These are external services that require more complex authentication. They could be services that are authenticated using service accounts or API keys, like a payment API, or services that need to be authenticated by the end user, such as Gmail, Calendar, Slack, and Google Drive.

Tool calling provides many key advantages to an AI agent:

- **Autonomous Decision-Making:** AI agents analyze context and determine the next best action, reducing the need for manual oversight.
- **Optimized Task Execution:** They can connect to various services and APIs, enabling them to perform specialized tasks like data retrieval, scheduling, and communication.
- **Scalability and Adaptability:** As systems evolve, agents can easily incorporate new functionalities, adapting to changes in workflow or priorities.
- **Improved User Experience:** Their ability to tackle diverse tasks leads to more personalized and efficient interactions, making technology feel both intuitive and proactive.

## Tool Calling Agent: A Conceptual Example

Imagine an AI personal assistant that consolidates your digital life by dynamically accessing multiple tools to help you stay organized and efficient. Here’s how it could work:

1. **Gmail Integration:** The assistant regularly scans your inbox to generate concise summaries. It highlights urgent emails, categorizes conversations by importance, and even suggests drafts for quick replies.
2. **Calendar Management:** By interfacing with your calendar, it can remind you of upcoming meetings, check for scheduling conflicts, and even propose the best time slots for new appointments based on your availability.
3. **Slack Notifications:** For team communications, the assistant monitors Slack channels. It identifies key messages and creates action items, ensuring you never miss an important update from your colleagues.
4. **Google Drive Access:** Whether you need immediate access to the latest project document or a file related to a current task, the assistant retrieves pertinent documents from Google Drive on demand. It can create document summaries and even create new documents based on your instructions.

With tool-calling capabilities, the possibilities are endless. In this conceptual scenario, the AI agent embodies a digital personal secretary—one that not only processes information but also proactively collates data from connected services to provide comprehensive task management. This level of integration not only enhances efficiency but also ushers in a new era of intelligent automation, where digital assistants serve as reliable, all-in-one solutions that tailor themselves to your personal and professional needs.

## Security Challenges with Tool Calling AI Agents

Building such an assistant is not that difficult. Thanks to frameworks like [LangChain](https://www.langchain.com/), [LlamaIndex](https://www.llamaindex.ai/), and [Vercel AI](https://vercel.com/ai), you can get started quickly. The difficult part is doing it securely so that you can protect the user's data and credentials.

Many current solutions involve storing credentials and secrets in the AI agent application’s environment or letting the agent impersonate the user. Storing credentials securely in the environment might work for APIs that require API keys or service accounts. However, this is not a good idea for cases where the end users need to authenticate to the service, as it can lead to security vulnerabilities and excessive scope and access for the AI agent.

 

<div class="alert alert-info alert-icon">
 
 To learn more about other security concerns and vulnerabilities in AI check out this blog post on <a href="https://auth0.com/blog/identity-challenges-for-ai-powered-apps/">Identity Challenges for AI-Powered Applications</a>. 
</div>

When you build an AI agent, you need to consider all its other security implications as well. You don't want an LLM to have unlimited access to your personal data like email and documents, and more importantly, you don't want to provide your credentials to the LLM to access these tools. Let's face it, regardless of how secure the LLM is, there is always a possibility of it getting manipulated into divulging sensitive information or doing something you don't want it to do.

## Tool Calling with the Help of Auth0

This is where Auth0 comes to the rescue. As the leading identity provider (IdP) for modern applications, our upcoming product, [Auth for GenAI](https://auth0.com/blog/auth-for-genai/), provides standardized ways built on top of OAuth and OpenID Connect to call APIs of tools on behalf of the end user from your AI agent.

Auth0 brokers a secure and controlled handshake between the AI agents and the services you want the agent to interact with on your behalf – in the form of scoped access tokens. This way, the agent and LLM do not have access to the credentials and can only call the tools with the permissions you have defined in Auth0. This also means your AI agent only needs to talk to Auth0 for authentication and not the tools directly, making integrations easier.

### Call first-party APIs on users' behalf

When your AI agent, secured with Auth0, needs to call another application also secured with Auth0, you can use standard OAuth 2.0 flows, like the [Authorization Code Flow](https://auth0.com/docs/get-started/authentication-and-authorization-flow/device-authorization-flow), to get an API token from that application with user consent. In this case, Auth0 will manage the retrieval of new access tokens using cached refresh tokens when the API token expires.

### Call third-party APIs on users' behalf

When your AI agent, secured with Auth0, wants to call external services like Gmail, Calendar, Slack, and Google Drive, Auth0 can help the agent get access tokens for the external service on behalf of the end user. In this case, Auth0 brokers the API access token from the external service to the AI agent.

![Tool calling with Federated API token exchange](https://images.ctfassets.net/23aumh6u8s0i/1gY1jvDgZHSfRloc4qVumu/d44bb7102c1e858e5ac64dea324478fe/tool-calling-with-federated-api-token-exchange.jpg)

This is made possible by Federated API token exchange, which is a way to obtain an access token from an external identity provider without the need for the user to re-authenticate every time. The end user authenticates and connects the external service once, and Auth0 intermediates the authentication and authorization process and provides the API access token to the AI agent. Auth0 takes care of storing refresh tokens and getting new access tokens when the current access token expires.

## Security Best Practices for Tool Calling AI Agents

Here is a summary of security best practices to consider when building a tool-calling AI agent:

- **Least Privilege**: Grant the minimum permissions needed (e.g., read-only access).
- **Audit Logs**: Track API calls and credential usage.
- **Proxying**: Use an IdP like Auth0 as a broker between the AI agent and the tools to protect the user's credentials.
- **Encryption**: Encrypt credentials at rest and in transit (HTTPS/TLS).
- **Token Rotation**: Regularly rotate API keys and tokens.
- **Sandboxing**: Run tools in isolated environments when possible to limit damage from leaks.

## Learn More about AI Agents and Auth for GenAI

This post offers a glimpse into the transformative potential of AI agents and highlights how secure and intelligent tool calling can empower AI agents to deliver a more connected and personalized experience. Stay tuned for a series of posts on tool-calling Agents with [Auth for GenAI](https://a0.to/ai-content), where we will build the conceptual personal assistant from the previous section in Node.js and Python, showing how to integrate with different types of services securely using your favorite AI frameworks and Auth0.

Before you go, we have some great news to share: we are working on more content and sample apps in collaboration with amazing GenAI frameworks like [LlamaIndex](https://www.llamaindex.ai/), [LangChain](https://www.langchain.com/), [CrewAI](https://www.crewai.com/), [Vercel AI](https://vercel.com/ai), and [GenKit](https://firebase.google.com/docs/genkit). [Auth for GenAI](https://auth0.com/blog/auth-for-genai/) is our upcoming product to help you protect your user's information in GenAI-powered applications. Make sure to join the [Auth0 Lab Discord server](http://a0.to/auth0-lab-discord) to hear more and ask questions.

Tool Calling in AI Agents: Empowering Intelligent Automation Securely

Jax Painter

Director, Product Marketing

To meet innovation, experience, and security requirements, organizations must establish digital Identity strategies and implement them into every product and service.

## The Multifaceted Challenges of Managing Digital Identities

People leading development, technology, security, and product strategies collectively seek to drive innovation and improve customer and employee experiences. Aligning those teams while managing an increasingly complex technology and security threat landscape is easier said than done.

Without a unified digital Identity strategy, developers and product teams often experience problems balancing customer experience, security, and speed. These challenges create delays and slow product development cycles, from planning and coding to maintenance and scale out. Technology and security teams can also struggle to streamline access for employees in ways that don't create vulnerabilities.

The stakes to get Identity correct are so high that fear often creates additional blockers. No one wants to make a mistake that could jeopardize their career or end up being tomorrow’s headline. An organization's reputation is now deeply tied to how well it protects customer data against rapidly evolving threats. So the bottom line is: Security breaches and regulatory compliance issues can result in devastating costs. In 2024, the global average cost of a data breach was [$4.88 million](https://www.ibm.com/reports/data-breach), a 10% increase since 2023.

To meet today's (and tomorrow's) innovation, experience, and security requirements, organizations of all sizes must establish intentional digital Identity strategies and implement them into every product and service from the ground up.  

## Seamless Experiences Are Driven by Digital Identities

Business efficiency and growth depend on seamless experiences for customers and employees. All of these experiences — from customer-facing digital services and AI-driven innovations to employee onboarding and business intelligence — are driven by scalable Identity and data access controls.

Achieving business efficiency and growth is easier when teams can take advantage of automation, no-code solutions, AI, and other technologies to eliminate rote work and focus on what drives the business forward. Along with equipping developers and product teams with intelligent, integrated tools for managing authentication, a unified digital Identity solution also empowers technology and security teams with flexible, scalable tools for managing customer and employee access. By implementing an integrated strategy for digital identities, organizations can:

* Infuse consistent Identity practices into agile development processes
* Implement critical changes like single sign-on and privileged access management faster
* Scale out solutions with less effort
* Help prevent risks associated with cloud usage, shadow IT, and anywhere collaboration
* Keep up with rapidly evolving cybersecurity challenges and regulations

## A Unified Digital Identity Approach Makes It Easier to Drive Innovation with Data

Effective and easy-to-use digital Identity solutions can empower any organization to fearlessly innovate and readily adapt to changing markets and customer demands. With the right authentication and access management tools, teams can safely leverage data to develop differentiating experiences and products using technologies like AI.

Organizations that successfully implement a unified digital Identity strategy realize measurable benefits across multiple fronts through financial savings and by improving productivity throughout the organization. In a research study, IDC found that companies using CIAM solutions [saved $4.3 million](https://www.okta.com/sites/default/files/2022-06/TheBusinessValueofOktaCustomerIdentityandAccessManagement.pdf) through productivity improvements alone, and for every customer-facing application they saw >$166,000 in combined annual benefits. IDC also found team efficiency benefits throughout organizations, with a 33% time savings for IT and infrastructure teams, 23% for developer teams, and 13% for security teams. 

## Identity Is Everyone’s Business 

When leaders spearheading development, technology, security, and product roadmaps understand how important a unified digital Identity strategy is, they can work together on a comprehensive strategy that equips everyone to achieve their goals. 

Developers can quickly and easily build and maintain required authentication flows that don't break and keep customers happy. Security teams can see who has access to what, when, and under whose authorization — on demand and across silos. 

Product teams can get to market faster while helping to ensure customers that their data is safe. Technology leaders can implement unified solutions that scale, lower risk, and ultimately improve the experiences of employees and customers. 

Interested in learning how to implement a collaborative strategy for digital identities? Stay tuned for the next four blogs in the Innovation Ignited series covering Identity responsibilities that development, technology, security, and product leaders face and the outcomes they can realize with a unified digital Identity strategy.

* Create a culture of synergy with digital identities: This piece explains how development leaders can empower teams to overcome authentication complexity and focus on creating differentiating solutions that improve customer experience 
* Ignite innovation with digital Identity: This piece explores how technology leaders can optimize Identity and Access Management and authentication to create a culture of alignment that fuels collaboration and continuous improvement
* How to keep your developers focused on development: Identity management burdens often overwhelm developers and delay product launches, but leaders can streamline authentication through unified digital identity solutions, allowing teams to focus on core innovation
* Accelerate product workflows and adoption: Learn how product leaders can create ambitious and realistic roadmaps that include differentiating authentication capabilities — while accelerating the journey from ideas to market success

## Accelerate Your Organization's Growth

Improve user experience, security, and innovation with a unified digital Identity solution. 

> [Read more from Auth0 thought leaders](https://www.okta.com/blog/)

## Resources

Auth0 equips organizations with an intelligent, integrated digital Identity solution that makes it easier to meet security and business requirements — and drive growth, differentiation, and impact. To learn more about how Auth0 equips businesses of all sizes with the tools they need for unified digital Identity strategies, check out the following resources.

* [Okta Named a Leader in 2023 Gartner® Magic Quadrant™ for Access Management for Seventh Consecutive Year](https://www.okta.com/press-room/press-releases/okta-named-a-leader-in-2023-gartnerr-magic-quadranttm-for-access/)
* [Okta named a Leader in first ever Forrester Wave™️ for Workforce Identity Platforms](https://www.okta.com/resources/analyst-research-okta-named-a-leader-in-first-ever-forrester-wavetm-for-workforce/)
* [Okta Recognized as a Gartner® Peer Insights™ Customers' Choice for Access Management](https://www.okta.com/resources/analyst-research-okta-recognized-as-a-2024-gartner-peer-insights/)

Innovation Ignited: How to Start Your Digital Identity Management Journey

Empower your team with a unified digital Identity strategy that includes intelligent, integrated auth capabilities that minimize risk while improving experience.

Developers are the backbone of innovation. What they focus on can accelerate or hinder the delivery of new products. Authentication and authorization have always been a top development priority, but increases in data volumes, data usage, mobility, and other factors are creating significant complexity.

Navigating increasing auth challenges with manual, cumbersome approaches —while also trying to keep up with the latest security standards and regulations — can be overwhelming. This situation can result in frustrated developers, delayed launch dates, and an increased risk of security gaps that can cause outages, costly non-compliance fees, and damaged business reputations. AI and [GenAI](https://www.okta.com/blog/2024/10/unlocking-the-power-of-generative-ai-with-identity/) adoption only amplify developers' auth challenges because models require massive amounts of information for accuracy and all data usage must align with evolving security and compliance regulations.

How organizations manage auth also determines their effectiveness in protecting data against evolving threats, complying with regulations, and improving brand reputation. Building auth services from scratch or relying on features in legacy systems can easily lead to compliance and governance missteps caused by Identity fragmentation across applications and systems. After all, siloed Identity management is difficult to track, making it harder to safeguard customer data.

Chief technology officers, directors, and development leaders can empower their teams with a unified digital Identity strategy that includes intelligent, integrated auth capabilities that minimize complexity and risk while improving experience. By building and maintaining authentication with less effort and simplifying governance and compliance, developers can spend the bulk of their time doing what they excel at, bringing new products and services to market faster.

## Moving from Complexity to Clarity — and Ideas to Impact

Authentication and authorization are critical vehicles for creating innovative solutions and differentiating experiences for customers and employees. That’s because users expect scalable, frictionless access to apps, digital tools, and cloud services.

To make this possible while enabling teams to manage all their tasks, developers need easy-to-use auth systems that minimize the need for custom code and specialized security skills. That way, developers have what they need to build flexible solutions that can easily integrate with other technologies, support new authentication methods, and facilitate new use cases including AI and GenAI — all in a way that minimizes risk and delivers positive user experiences.

## How LaunchNotes Uses Authentication to Drive Growth

[LaunchNotes](https://www.okta.com/customers/launchnotes/) equips product and development teams with the tools they need to effectively communicate, understand, and manage the what, when, and why of product roadmaps. To drive growth, especially in the enterprise customer space, LaunchNotes replaced their authentication software with a unified solution from Auth0. It provides the enterprise-grade authentication and authorization capabilities prospective customers were looking for, like [single sign-on](https://www.okta.com/products/single-sign-on-workforce-identity/) (SSO).

Auth0 is also easy to use. With it, developers were able to set up a proof of concept in one hour and deploy their new auth solution, including SSO capabilities, within less than three weeks. Within one week of going live, LaunchNotes’ first enterprise customer signed up and more than 10 customers re-engaged.

Developers are also realizing ongoing efficiencies with their unified auth solution. Today, they spend 95% less time managing password policies for B2B customers. They implemented social logins in just minutes. And now, they onboard new customers up to 20% faster, which improves the experience of customers and employees.

## How Cribl Transforms Auth to Bring New Products to Market Faster

[Cribl](https://www.okta.com/customers/cribl/) helps organizations collect, process, route, and analyze logs, traces, and other telemetry data from their in-house and third-party systems and apps. Because this data is critical in establishing and managing seamless, protected communication between systems, Cribl provides customers with strict access controls. For years, Cribl used [role-based access controls](https://www.okta.com/identity-101/what-is-role-based-access-control-rbac/) (RBAC) to authorize users.

However, when they introduced virtual Workspaces for their customers, Cribl quickly recognized that their RBAC approach could not scale with increasing complexity and growth. Developers were spending too much time manually building and maintaining auth systems. To set up authentication for just one Workspace, they had to manually define up to 400 roles in a JSON Web Token.

After evaluating their best options, Cribl’s teams unanimously chose to adopt a unified auth solution from Auth0. It enables granular RBAC and centralized auth models that are flexible, scalable, and easy to manage. Today, developers input their new products into their authorization model and Auth0 automatically handles the mapping between data owners as directed. As a result, what used to take developers months of manual effort now takes just weeks. And because developers can set up authorization for new products 80% faster, they have more time to spend on innovation.

## How Alma Media Builds and Maintains Identity Security with Less Effort

Media and service company [Alma Media](https://www.okta.com/customers/alma-media/) was struggling with siloed auth solutions. The organization operates more than 100 websites and brands used by millions of customers, and every site had its own login method. This meant customers couldn’t navigate between corporate brand sites without having to log in again. Cumbersome user experiences cut Alma Media's conversions in half. Additionally, developers had to create, manage, and scale each site’s standalone authentication solutions, leaving them little time to work on impactful projects.

To achieve their goals, Alma Media adopted a unified auth solution from Auth0 that has dramatically simplified development. As a result, Alma Media improved their user experience, security, and innovation potential. Customers now have SSO, so they no longer have to manage multiple IDs and passwords across sites. They can also opt to log in to sites using their social media accounts.

Additionally, in-house developers and IT teams now use the same flexible solution for managing auth across sites. This straightforward approach reduces risk,  boosts efficiency, and delivers measurable savings. Alma Media has decreased their total cost of ownership by 30% and license expenses by 10%.

## Ignite Innovation at Your Organization

Maximizing the time your developers have to create differentiating solutions that improve security, experience, and innovation is easier with a unified strategy. Auth0 equips organizations with intelligent, integrated authentication and authorization tools that reduce complexity so developers can turn ideas into impactful solutions faster.

No-code, low-code, and pro-code tools accelerate the development of automated flows that teams can quickly adapt to meet current and future use cases. Built-in capabilities also simplify governance and compliance, including certification and regulatory support, data sovereignty, and centralized controls.

Free your devs and simplify auth management! Learn More about [Customer Identity and Access Management (CIAM)](https://www.okta.com/customer-identity/)

## Resources

- [Check out our Developer Center](https://developer.auth0.com/)
- [Unlock SaaS app growth: Download the Why Customer Identity White Paper](https://www.okta.com/resources/whitepaper-why-ciam/)
- [Learn about Fine-Grained Authorization (FGA)](https://auth0.com/resources/whitepapers/fine-grained-authorization-technical-primer)
- [Discover how Okta secures your Generative AI implementation](https://www.okta.com/blog/2024/10/unlocking-the-power-of-generative-ai-with-identity/) 
- [Explore the Build versus buy question for CIAM](https://www.okta.com/resources/whitepaper-build-vs-buy/)


Innovation Ignited: How Development Leaders Make Authentication an Innovation Engine

carla_urrea

I've been working as a software engineer since 2014, particularly as a backend engineer and doing system design. I consider myself a language-agnostic developer but if I had to choose, I like to work with Ruby, Python, and Elixir.  

After realizing how fun it was to create content and share experiences with the developer community I made the switch to Developer Advocacy. I like to learn and work with new technologies. 

When I'm not coding or creating content you could probably find me going on a bike ride, hiking, or just hanging out with my dog, Dasha. 

Senior Developer Advocate

Carla Urrea Stabile

Nowadays you could replace your physical driver's license with a digital, cryptographically verifiable one. Let's learn about it and how to start using them.

A driver's license is a document that gives legal authorization for people to drive certain types of vehicles, and they're often made of plastic and have the size of a credit card, so you usually store it in your wallet. Some countries, like Australia, the UK, and the US, use driver's licenses to prove their citizens' identity.

As driver's licenses continue to play a crucial role in verifying your identity, it makes sense that they evolve alongside our increasingly digital world. That's where Mobile Driver's Licenses come in. In this blog post, you'll learn more about them and how to use them.

## What is a Mobile Driver's License (mDL)?

Let's start from the beginning. **A Mobile Driver's License (mDL) is a driving license that resides on a mobile device** instead of physically in your wallet. The beauty behind an mDL is that **they are cryptographically verifiable**, meaning you can use cryptography to verify their information and authorship.

An mDL is a type of [Verifiable Credential (VC)](https://auth0.com/blog/what-are-verifiable-credentials-why-you-should-care/#What-are-Verifiable-Credentials) and they're an [ISO Standard](https://www.iso.org/standard/69084.html). As a VC, mobile driver's licenses also have an issuing authority, which is the authorized organization issuing the driver's license; for example, in the US, that'd be [the DMV](https://en.wikipedia.org/wiki/Department_of_motor_vehicles). There is an mDL holder, and it's the person to whom the mDL is issued. Finally, there is an mDL verifier, which is the entity that can verify the authorship of the mDL.

### mDL Step by Step

![mDL Roles](https://images.ctfassets.net/23aumh6u8s0i/7xGF2PSKekpejYPX11EOse/157c1415ce452ff436954197c1e90eb7/mdl-roles.png)

1. **Issuing:** A user can request an mDL from an issuing authority using their digital wallet. In mDL, this wallet is called an mDoc reader. An mDoc is a document that resides on a mobile device, so the mDoc reader can retrieve an mDoc for verification purposes. The issuer will verify the user's details and use their private key to sign and issue the mDL.

2. **Presenting:** A user can show their mDL using an application called an mDL reader to prove their identity, for example. This application would request the mDL data, which must be verified later.

3. **Verifying:** The mDL reader is in charge of cryptographically verifying the mDL data.

<include src="SmallBannerCTA"
 imgLink="https://images.ctfassets.net/23aumh6u8s0i/12gXwIIea5F2nkS1hNQFWy/70e57fab64095553831e4f4a0ee497d9/mdl-logo.png"
 text="Want to learn more about mDL?"
 linkText="Visit → mdl.me"
 link="https://mdl.me"/>

## Where Are We Today?

Today, many countries have started implementing and deploying pilots for Mobile Driver's Licenses. In the US, for example, there are already [multiple states that have mDL implementations](https://www.aamva.org/jurisdiction-data-maps#anchorformdlmap) in place. [The TSA (Transport Security Administration) has been accepting digital credentials as proof of identity since early 2022](https://www.tsa.gov/travel/frequently-asked-questions/when-will-phased-digital-id-rollout-start-which-airportsstates).

In November 2023, the [European Union also submitted a proposal to introduce mobile driver's licenses](https://data.consilium.europa.eu/doc/document/ST-15808-2023-INIT/en/pdf) and make them fully equivalent to their physical counterpart.

These are just a few examples to tell you that Mobile Driver's Licenses are coming to stay, and many other countries will start piloting and adopting them. Many companies are also beginning to build their own mDL readers and implementations; in fact, [the mDL ISO Standard was tested at the Interoperability Event](https://blog.spruceid.com/iso-iec-18013-7-interoperability-event-results/) where companies joined forces to test their implementations. Some mDL readers and mDL implementers included **Google, the National Institute of Standards and Technology (NIST), Okta, Samsung**, and more. You can read more about it in the [event results publication](https://docs.google.com/document/d/1M4ufcKqmj8gycNovslOSWzFB2nB1o1eu/edit?ref=blog.spruceid.com#heading=h.gjdgxs).


## Where to Use mDL?

Mobile Driver's Licenses have many potential use cases, but some of the most relevant are:

- Prove your Identity: as mentioned above, many countries use driver's licenses as proof of identity, and mDLs should be equivalent to prove someone's identity.
- Improve business processes involving Know Your Customer (KYC) and Anti-Money Laundering (AML)

## Getting Started with mDL

There are a few ways you can get started with mDL, the first one being going to [mdl.me](https://mdl.me) to learn more about it, how it works, and use the debugger to understand what's happening under the hood.

You can also start playing with a library like the one we crafted at [Auth0 Lab, mDL](https://github.com/auth0-lab/mdl). This NodeJS library allows you to issue and verify mDL [CBOR](https://cbor.io/) encoded documents. This library allows you to have a good start to understand how mDL works but **it's important to mention the library alone allows you to create, parse and validate mDL but it's not enough if you need to exchange mDLs.** So for example if you want to present mDL you need to implement a protocol such as the one in the [ISO/IEC DTS 18013-7](https://www.iso.org/standard/82772.html).

### Using the mDL library

First, you need to install the library. For that, run the following in your terminal:

```bash
npm install @auth0/mdl
```

> Note this blog post is for educational purposes and not meant to be used in production. In order to use mDL you'd need a protocol on top to exchange the data, such as the one in [ISO/IEC DTS 18013-7](https://www.iso.org/standard/82772.html) for presenting mDLs.


### Issuing a Credential

Let's take a look at what the code for issuing a new credential would look like:

```js
import { MDoc, Document } from "@auth0/mdl";
import fs from "node:fs";

// Create Document: representation of the mDL data
const document = await new Document('org.iso.18013.5.1.mDL')
 .addIssuerNameSpace('org.iso.18013.5.1', {
 family_name: 'Jones',
 given_name: 'Ava',
 birth_date: '2007-03-25',
 })
 .useDigestAlgorithm('SHA-512')
 .addValidityInfo({
 signed: new Date('2023-10-24'),
 validUntil: new Date('2050-10-24'),
 })
 .addDeviceKeyInfo({ deviceKey: devicePublicKeyJWK })
 .sign({
 issuerPrivateKey,
 issuerCertificate,
 alg: 'ES256',
 });

// Create MDoc
const mdoc = new MDoc([document]);

// CBOR encode the MDoc
const encodedMdoc = mdoc.encode();
```

This script is doing a few things. First, it adds the document type `org.iso.18013.5.1.mDL` to the `Document` instance; this refers to the mDoc document type that is used to identify the ISO driving license standard. Then, it adds the name and birth date attributes of the holder.

The digest algorithm is set to `SHA-512`, and it's used to compute the digest of each attribute. A digest algorithm is a cryptographic hash function that maps a large block of data into a fixed-size output (512 bits or 64 bytes in this case). The verifier will use the same algorithm to verify the disclosed attributes. This is related to the way that [selective disclosure](https://www.w3.org/TR/vc-data-model/#dfn-selective-disclosure) is implemented in mDL.

Then you'll see the `validityInfo`, which is the period of time the document is valid, and finally the device key information in the `addDeviceKeyInfo` method. Here, you specify the public key of the device that will hold the mDL to ensure that the mDL will only be used by the device that holds the corresponding private key. In other words, a presentation will only be accepted if it's signed with the private key that corresponds to the public key in the mDL.

Finally, you use the `sign` method to sign the document using the issuer's private key and certificate.

### Requesting a Credential

Now let's take a look at what should happen on the verifier side. The verifier is the entity that will request the mDL from the holder to later on verify its authenticity. 

Depending on the use case, the holder could have an application on their device that can serve as mDL reader (for example if they're opening a bank account online from their phone) or they could have be requested to show their mDL and the mDL reader resides in another device (for example, to enter a bar and prove that the holder is 18 years old or more, the person at the entrance could have an mDL reader where people can present their mDLs).

The mDL reader requests the mDL data that it needs and the holder uses the digital wallet to present the credential. When the holder presents the credential, the verifier needs to first generate an [ephemeral key pair](https://csrc.nist.gov/glossary/term/ephemeral_key_pair) and a nonce. An ephemeral key pair it's a short-term key pair generated when needed, and the nonce is a random value that is used to prevent replay attacks. The verifier then sends the nonce and the ephemeral public key to the holder. 

You could use [the JOSE package](https://www.npmjs.com/package/jose), for example, to generate these short-term keys. After installing `jose` with `npm install jose` you could do something like the following:

```js
const {generateKeyPair} = require('jose');
const ephemeralKey = await generateKeyPair('ES256')
```

### Generating a Device Response

Once the holder receives the nonce and the ephemeral key, their device can generate a device response. The device response is a signed message that contains the mDL and the nonce.

```js
const deviceResponseMDoc = await DeviceResponse.from(mdoc)
 .usingPresentationDefinition(PRESENTATION_DEFINITION_1)
 .usingHandover([holderNonce, clientId, responseUri, verifierGeneratedNonce])
 .authenticateWithMAC(DEVICE_JWK, ephemeralPublicKey, 'HS256')
 .addDeviceNameSpace('com.foobar-device', { test: 1234 })
 .sign();

const encodedSessionTranscript = getSessionTranscriptBytes(
 { client_id: clientId, response_uri: responseUri, nonce: verifierGeneratedNonce },
 holderNonce,
);

const deviceResponse = deviceResponseMDoc.encode();

sendToVerifier({ deviceResponse, encodedSessionTranscript });
```

With the mDL issued to the holder, the device creates a new device response using the `DeviceRespose` class. The `usingHandover` method is used to specify the date the verifier sent along with a nonce generated by the holder. Here, the `PRESENTATION_DEFINITION_1` constant refers to [which proofs the verifier is requesting from the holder](https://identity.foundation/presentation-exchange/spec/v2.0.0/#presentation-definition). An example could be:

```js
export const PRESENTATION_DEFINITION_1 = {
 id: 'mdl-test-age-over-18',
 input_descriptors: [
 {
 id: 'org.iso.18013.5.1.mDL',
 format: {
 mso_mdoc: {
 alg: ['EdDSA', 'ES256'],
 },
 },
 constraints: {
 limit_disclosure: 'required',
 fields: [
 {
 path: ["$['org.iso.18013.5.1']['age_over_18']"],
 intent_to_retain: false,
 },
 ],
 },
 },
 ],
};
```

In this case, the verifier is asking for an mDL with just one of the holder's attributes to verify that the holder is over 18 years old. You can find other examples in the [mDL repository](https://github.com/auth0-lab/mdl/blob/41724db924161c680c6fff0aa80450a8a2aa7286/__tests__/issuing/config.ts#L108). 

The `authenticateWithMAC` method is used to specify the way in which the device response is authenticated. In this case, it's authenticated [with a MAC](https://datatracker.ietf.org/doc/html/rfc9052#name-mac-objects) using the `HS256` algorithm. The secret for this MAC is computed as follows:

- On the holder's side it uses the public ephemeral key generated by the verifier plus the private key of the device.
- On the verifier's side it uses the private ephemeral key generated by the verifier plus the public key of the device.

The `addDeviceNameSpace` method adds a namespace to the device response.

Finally, the `sign` method is used to sign the device response.

### Verifying the Device Response

Finally the verifier verifies the `DeviceResponse`.

```js
const verifier = new Verifier([ISSUER_CERTIFICATE]);
await verifier.verify(encoded, {
 ephemeralReaderKey: ephemeralPrivateKey,
 encodedSessionTranscript,
});
```

First you need to construct a `Verifier` instance with a list of the issuer's certificates you trust.

Then you call the `verify` method with the encoded device response, the private key of the ephemeral key pair, and the encoded session transcript. This is a structure defined by the ISO standard. You can learn more about it in the [ISO 18013.5 (section 9.1.5.1 - Session transcript)](https://www.iso.org/standard/69084.html)

## What's Coming: Verify mDL with Auth0

You can [sign up for the waitlist](https://regionalevents.okta.com/mdlearlyaccess) to be one of the first to know when mDL with Auth0 is available in Early Access.

You can also go to [mdl.me](https://mdl.me) to learn more, and if you know about any other mDL libraries out there, let us know so we can include them in the list of resources!

What is a Mobile Driver's License (mDL) and How to Start Using Them

sofia-prosper

Sofía Prósper, a trained architect, is a passionate Developer Advocate and the current Partner Manager of Auth0 by Okta Marketplace. She has a diverse background focused on architecture, design, art, and verbal communication. Recipient of the Spanish Data Protection Agency Prize in 2018, in her spare time, she has worked since as an advocate defending Privacy, Digital Rights, and Digital Sovereignty in Spain. Outside her daily work, you can find her illustrating her travel journal, cooking for friends, collecting recipe books, and joining side projects in beautiful Galicia, Spain.

Senior Developer Advocate and Partner Manager of the Auth0 Marketplace

Sofía Prósper Díaz-Mor

Eutelo Pena

All my career I have been oriented to the creation of software products for mobile devices. Initially, as an Android & iOS developer, implementing biometric solutions in Gradiant / Alice Biometrics. Over the years, my role has been changing towards the management layer, the product and the leadership of teams, carrying it out in places like Bank Sabadell, InAuth (AMEX group), Verse (Square group) or Eccocar. Currently back home, where I am helping to make digital onboarding easier for people.

Head of Product at Alice Biometrics

Facial biometrics revolutionizes digital processes. Implemented thoughtfully, it provides businesses a competitive edge while safeguarding privacy.

## Introduction

In the era of digital transformation, businesses are constantly looking for ways to streamline their processes and enhance security. One technology that is rapidly gaining traction in this regard is facial biometrics, which includes face recognition and face liveness detection. This technology is revolutionizing processes such as the digital onboarding of new users and adding an extra layer of security to prevent AI bots and fraudsters from causing harm. Auth0 has included facial biometrics features at [Auth0 marketplace](https://marketplace.auth0.com/partners/alice-biometrics).

## The Power of Facial Biometrics

Facial biometrics technology uses unique features of a person’s face to verify their identity. It’s a powerful tool that can be used in a variety of applications, from unlocking smartphones to verifying identities at border controls.

### Face Recognition

Face recognition technology works by comparing selected facial features from a given image with the photo ID for the onboarding use case or with the facial template stored for authentication, password reset, or access control use cases. It’s a fast and accurate way to verify the identity of users, making it an excellent tool for digital onboarding and multiple account opening. 

### Face Liveness Detection

Face liveness detection is a technology that can determine whether the source of a biometric sample is a live human being or a representation of a human being. This technology is crucial in preventing fraudsters from using photos, videos, or masks to impersonate legitimate users.

![](https://images.ctfassets.net/23aumh6u8s0i/72e8GkU7K8cuSoxC8JrleF/c3d57801015e621f725020f2db951b8e/Biometric_3.jpg)

## How Facial Biometrics Enhance Businesses Processes

Facial biometrics can significantly enhance several aspects of digital security and user experience. Let’s delve into how this technology can improve authentication, bot prevention, account recovery, and password reset processes.

### Digital Onboarding

Digital onboarding is the process of integrating new users into a system. It’s a critical process for businesses, as it’s often the user’s first interaction with the company. Facial biometrics can streamline this process by quickly and accurately verifying the identity of the user.

For example, a bank can use facial biometrics to verify the identity of a new user opening an account. The user simply takes a selfie, which is then compared to a photo ID they provided. The process is quick, easy, and secure, providing a positive experience for the user while ensuring the bank is complying with KYC (Know Your Customer) regulations.

### Authentication

Facial biometrics provide a secure and user-friendly method for user authentication. Instead of remembering complex passwords, users can simply use their faces as a form of identity verification. This not only enhances security but also improves the user experience by offering a quick and convenient authentication method.

### Bot Prevention

Bots pose a significant threat to digital security. They can carry out a variety of malicious activities, from spamming to automated attacks. Facial biometrics, particularly face liveness detection, can help prevent bots by ensuring that a real, live person is behind each action.

### Account Recovery

Account recovery can be a complex process. Traditional methods often involve answering security questions or receiving a code via email or SMS. With facial biometrics, users can recover their accounts by simply verifying their identity with their face. This makes the account recovery process more secure and user-friendly.

### Password Reset

Resetting passwords can be a hassle for users. However, with facial biometrics, this process can be simplified. Users can verify their identity using their faces and then set a new password. This not only streamlines the password reset process but also adds an extra layer of security.

![](https://images.ctfassets.net/23aumh6u8s0i/1PBtpzTeahMOcqlpm1MoL3/09f0029a9c41c405493f0549b51a7397/Biometric_2.jpg)

## Adding Security to Business Processes

In addition to streamlining digital processes, facial biometrics can also add an extra layer of security. By verifying the identity of users at key points, businesses can prevent AI bots or fraudsters from gaining access to sensitive information or systems.

For instance, a business could use facial biometrics to verify the identity of users before they make a transaction. This could prevent a fraudster who has gained access to a user’s account from making unauthorized transactions.

## Conclusion

Facial biometrics offer a powerful tool for businesses undergoing digital transformation. By streamlining the digital processes and enhancing security, this technology can provide a competitive edge while protecting against AI bots and fraudsters. As with any technology, it’s important to implement it in a way that respects user privacy and security. With these considerations in mind, facial biometrics can play a key role in the digital transformation journey. If you want to try biometrics, please visit [Alice Biometrics](https://marketplace.auth0.com/partners/alice-biometrics) profile at Auth0 marketplace to learn more.

Facial Biometrics: The Key to Digital Transformation and Enhanced Security

Verifiable Credentials can be stored on digital devices, and you can use cryptography to verify their data and authorship. Let's learn more about them and why you should care about them.

We often use physical credentials such as our passports or driver's licenses as proof of identity. Until recent years, these types of credentials have usually been used in-person or offline, but nowadays, it's possible to prove your identity through digital credentials on the web in a cryptographically secure, privacy-respecting, and machine-verifiable way. In this blog post, you'll learn about these verifiable credentials, why you should use them, and when. 

## What are Verifiable Credentials?

When you think about a credential, you can often think of a physical credential like a passport, a driver's license, or an employee badge. A credential refers to a [set of one or more claims made by an issuer](https://www.w3.org/TR/vc-data-model/#dfn-credential); in the passport example, the photo, name, or identification number are the claims made by a government to identify a subject. 

When we talk about Verifiable Credentials (VCs), we are referring to a [W3C standard](https://www.w3.org/TR/vc-data-model/) for digital, cryptographically verifiable credentials. These credentials can represent the same information as a physical credential, but they add the use of digital signatures, making them more trustworthy than their physical version. You can store them on your device, which makes them more convenient and available almost everywhere. 

In the verifiable credentials context, there are a few important roles:

- **Holder**: it's the entity that possesses the verifiable credential. Holders could be, for example, students, employees, and customers. 
- **Issuer**: the entity that asserts claims about the subject, creates and transmits the verifiable credential to the holder. For example, governments, corporations, and non-profit organizations can be issuers. 
- **Subject**: the entity about which claims are made. For example, human beings, animals, and things. 
  - Often, the holder of a verifiable credential and subject can be the same, but only sometimes. For example, a parent can be the holder of the verifiable credential of their child (subject)
- **Verifier**: the entity that receives and processes verifiable credentials, such as employers, security personnel, and websites.   
- **Verifiable Data Registry**: the system that creates and verifies verifiable credentials schemas. For example, government ID databases and trusted databases. 

![VCs Roles](https://images.ctfassets.net/23aumh6u8s0i/4Gc0xRKUsczAlJ2w7JEh1/22f16ee9cfe9924b4a23f46638646649/vcs.png)

The image above shows how each entity interacts with each other. The issuer issues credentials to the holder as well as identifies and verifies the verifiable credentials. The holder acquires, stores, and presents VCs to the verifier. The verifier verifies VCs against the Verifiable Data Registry, which maintains identifiers and schemas. 

If we think of an example, let's say you are a citizen of the Asgard country. Asgard's government can issue a verifiable credential so you can prove your identity. 

![Asgard country issue VC](https://images.ctfassets.net/23aumh6u8s0i/35vmzFohdAtzKYw0drPXZ7/4a369f5669ef1133b750a9502fe3e8c5/holder-issuer.png)

In this example, the **holder** of the verifiable credential would be you because you are the owner of it and Asgard's government would be the **issuer**. This would be one of those scenarios where the **subject** would be the same as the holder because Asgard's government created claims for you, such as full name, identification number, and so on. 

Later on, let's say the Asgard police stop you and ask you for your ID. You decide to use your VC, and you have it in your wallet, so you **present** it to them. In this case they'd act as the **verifier** and check against Asgard's government database (the **Verifiable Data Registry**) that the VC is legit. 

![Present VC Asgard](https://images.ctfassets.net/23aumh6u8s0i/1SLhpBZvsGcEuJDQypUuqt/ff34ca49671651f75d9b23af70d18885/holder-presenter.png)

## Verifiable Credentials Are Necessary 

Verifiable Credentials have many use cases in our day-to-day life, and as we move more into an online world, [we need to be able to disclose our identity without issuers knowing](https://auth0.com/blog/our-take-on-verifiable-credentials/#The-Reason-We-Believe-VCs-Will-Happen). Because VCs are available in your wallet, you can use them "offline", meaning the issuer doesn't know when and how often you use them. This is what makes VCs so powerful: they are convenient, and having them available in your wallet removes a lot of friction from a user's life. So, let's go ahead and explore some use cases. 

### Legal Identity 

It's essential that you're able to prove your identity in a way that can be quickly verified, and governments are in the position to provide such identification in a verifiable digital form. Some examples are:

- Digital Driver's License
  - You get stopped over a traffic violation; with a digital driver's license, you always have access to it, and you can use it to prove to the officers both your identity and that you can drive. 
- Digital passports 
  - The electronic passport can contain a list of all the places you've visited and visas, so immigration officers can quickly and easily evaluate your suitability when visiting a new country. 
- Proof of Birth
  - Imagine asking for refuge in a country in such desperate conditions that you don't have your physical credentials. Still, you were issued a [self-sovereign](https://en.wikipedia.org/wiki/Self-sovereign_identity) proof of birth, and attached to this is the proof of birth and marriage of your parents; since it's verifiable, you can show this at the border controls of the country you're seeking refuge.

### Finance 

In finance, we can think of banking, brokerage, insurance, etc. Some example use cases are: 

- Money transfers
  - Let's say you want to send money to your family abroad; you can share your identity profile as well as your family member's with the money transfer service. This allows them to verify the source and destination of funds automatically.
- Opening or closing bank accounts 
  - If you want to open an account, you can use your government-issued certificate to prove your identity. Later on, when you want to close the account, the bank needs to revoke the "account owner" claim as part of the closing account process. 

### Healthcare

In the healthcare industry, privacy is extremely important, and with VCs, we can guarantee that the holder of the credential can disclose only the information they need. Let's understand some use cases in this area: 

- Prescribed medicine
  - A pharmacy can receive a prescription for medication for a patient. The pharmacy can automatically verify the doctor's ability to write prescriptions and the patient's insurance coverage. 
- Proving Legal Disability Status 
  - You can have government-issued disability credentials without having to disclose your specific disability to the service or entity you're providing. Issuers can issue verifiable credentials that support [selective disclosure](https://www.w3.org/TR/vc-data-model/#dfn-selective-disclosure) so holders can present proof of claims without revealing the entire verifiable credential. 

### Professional Credentials 

You may need a prove that an entity is who they say they are, and they can do what they say. This allows you to trust universities, doctors, companies, etc. 

- Doctors 
  - Health providers could provide information about the doctors they have on staff, including verifiable credentials about their education, board certification, etc. 
- University Degrees 
  - You could verify someone's obtained degree from a university that has a digital certificate to issue verifiable credentials. 
- Companies 
  - You can have an electronic badge that proves your identity to your company. 


## How Does a VC Look Like?

Let's take a look at what a verifiable credential looks like. Let's think of someone's ID card: 

```json
{
  "@context": [
    "https://www.w3.org/2018/credentials/v1"
  ],
  "type": ["VerifiableCredential", "IDCard"],
  "id": "urn:credential:34502108-4540",
  "issuer": "did:web:asgard-state.auth0lab.com",
  "issuanceDate": "2020-07-20T13:58:53Z",
  "credentialSubject": {
    "id": "urn:id-card:personal:1",
    "personalIdentifier": "34502108",
    "name": "Hanna Herwitz",
    "dateOfBirth": "1984-09-17",
    "placeOfBirth": "Asgard City",
    "currentAddress": "24th Street 210, Asgard City, 1023",
    "gender": "Female"
  },
  "credentialStatus": {
    "id": "https://asgard-state.auth0lab.com/vcs/credential/status/14",
    "type": "CredentialStatusList2017"
  }
  "proof": {
    "type": "Ed25519Signature2020",
    "created": "2020-07-20T13:58:53Z",
    "proofPurpose": "assertionMethod",
    "verificationMethod": "https://asgard-state.auth0lab.com/keys/1",
    "proofValue": "z2ty8BNvrKCvAXGqJVXF8aZ1jK5o5uXFvhXJksUXhn61uSwJJmWdcntfqvZTLbWmQHpieyhdcrG43em37Jo8bswvR"
  }
}
```

This JSON represents the digital version of Hanna Herwitz's ID card. Let's take a look at some of the most relevant parts of the VC: 

### Type 
The credential type can be used to determine if a specific credential is appropriate for a particular use case. In the example above, the type value is ` ["VerifiableCredential", "IDCard"]`.

### Issuer 
Represents the issuer of the credential and has to be a URI or an object containing an ID property. The example above is the Asgard government with the value `did:web:asgard-state.auth0lab.com`. Note that the value starts with `did`; this is a [Decentralized Identifier](https://www.w3.org/TR/did-core/), a new identifier enabling verifiable, decentralized digital identity. However, it's not mandatory to use DIDs. 

### Credential Subject 

Refers to the subject of the verifiable credential; it can be a DID or an object containing an id property. In the example above, the subject data is: 

```json
"credentialSubject": {
  "id": "urn:id-card:personal:1",
  "personalIdentifier": "34502108",
  "name": "Hanna Herwitz",
  "dateOfBirth": "1984-09-17",
  "placeOfBirth": "Asgard City",
  "currentAddress": "24th Street 210, Asgard City, 1023",
  "gender": "Female"
}
```

### Cryptographic Proof

It is one of the most essential parts and **what makes this credential verifiable**. Refers to cryptographic proofs (can be an object or an array) that can be used to detect tampering and verify the authorship of a credential or the data derived from the VC. In the example above: 

```json
"proof": {
  "type": "Ed25519Signature2020",
  "created": "2020-07-20T13:58:53Z",
  "proofPurpose": "assertionMethod",
  "verificationMethod": "https://asgard-state.auth0lab.com/keys/1",
  "proofValue": "z2ty8BNvrKCvAXGqJVXF8aZ1jK5o5uXFvhXJksUXhn61uSwJJmWdcntfqvZTLbWmQHpieyhdcrG43em37Jo8bswvR"
}
```

## Verifiable Credentials in Action 

Now that you know what a VC looks like, let's look at them in action. 

We've developed a site, [verifiablecredentials.dev](https://verifiablecredentials.dev), where you can play around and debug verifiable credentials. 


### Issue a VC 

To obtain a new verifiable credential, navigate to [wallet.verifiablecredentials.dev](https://wallet.verifiablecredentials.dev/), where you'll see a demo wallet where you can start by adding your first VC. 

![ID Wallet Add VC](https://images.ctfassets.net/23aumh6u8s0i/5cQaJh6drruR9bx86ZnSAR/3978c6e7e745ac70152a91d00da61f06/Screenshot_2024-01-16_at_13.37.27.png)

Follow the steps, and you'll create your verifiable credential! 🎉

![ID Wallet VC created](https://images.ctfassets.net/23aumh6u8s0i/6S3VrXJpueAeXvqaE3vl05/7042036ccc4d40524cf352a55f224c50/Screenshot_2024-01-17_at_17.30.14.png)

### Present a VC 

You can use the [Presentation Debugger tool](https://verifiablecredentials.dev/presentation) to create a request that defines the characteristics you want a Verifiable Presentation to meet.

You can use ID Wallet to see your verifiable credential data in the Presentation Debugger tool.

![Presentation tool](https://images.ctfassets.net/23aumh6u8s0i/10ykc9VwNiJs2hLDeV6PEI/dfcaac31665344445c3087ff92f7d99b/Screenshot_2024-01-17_at_17.29.27.png) 

## Conclusion 

Verifiable Credentials are digital, cryptographically signed credentials that you can use in many aspects of your life. There are many use cases in healthcare, education, and legal contexts where VCs are extremely useful. 

Users need the means to exercise their identity and disclose their claims without issuers knowing, the same way they do offline. 

If you want to learn more about VCs, go to [verifiablecredentials.dev](https://verifiablecredentials.dev), where you can play around and create and present verifiable credentials.

What are Verifiable Credentials and Why You Should Care About Them

I stream, blog, and make youtube videos about tech stuff. I love coding, I love AI, and I love building stuff!

Juan Cruz Martinez

Your identity platform is critical to growing and scaling your SaaS application. Accelerate business growth and keep your users secured with Auth0 by Okta

For today’s SaaS builders, the pressure to rapidly innovate and seamlessly scale can be intense.

Evolving macroeconomic pressures mean companies building SaaS applications need to do more with less. And every B2C innovation amps SaaS customer expectations. AI has further transformed the competitive landscape, presenting both an opportunity for product differentiation and a threat. [There’s just more that attackers can do now](https://www.securitymagazine.com/articles/99832-study-finds-increase-in-cybersecurity-attacks-fueled-by-generative-ai) — and they can do it faster. 

SaaS companies also need to do more — and they need to see speed and security gains just so customers can keep up with the rate of change. And honestly, they need to deliver more than what’s expected in order to stay relevant in this fast-paced society. 

Since SaaS is in this ever-evolving space, companies must keep up at the business level to stay ahead of their competition. In turn, developers must continuously learn new back-end methods to keep up with the new SaaS technologies.

Let us show you how Auth0 by Okta keeps up and makes your life easier.

## How Auth0 by Okta can help your SaaS

Robust identity management is crucial for ensuring seamless user experiences, maintaining data security, and complying with regulatory requirements. Auth0, the leading identity and access management (IDaaS) platform, stands out as the ideal solution for SaaS applications due to its comprehensive features, ease of use, and robust security measures.

Auth0 simplifies the authentication and authorization process for SaaS applications, enabling developers to focus on building core functionalities rather than building their own identity solutions and managing identity infrastructure.

[Universal Login](https://auth0.com/features/universal-login) provides a centralized and unified login experience for users across all your applications, supporting a wide range of authentication flows, devices, and screen sizes. Universal Login enhances user experience and simplifies the integration process for developers. With Universal Login, users can sign in using [passkeys](https://auth0.com/docs/authenticate/database-connections/passkeys) or use their existing credentials from social media platforms, enterprise directories, or email addresses, eliminating the need to create separate accounts for each application.

In addition to Universal Login, Auth0 provides a comprehensive set of SDKs for various programming languages and frameworks, making it easy for developers to integrate Auth0 into their applications. These SDKs handle everyday authentication tasks, such as login forms and password resets, ensuring consistent and secure user experiences across applications. For more customized scenarios, Auth0's powerful APIs provide granular control over authentication and authorization flows, allowing developers to tailor them to specific requirements and integrate seamlessly with third-party services.

**Here are some specific benefits of using Auth0 for SaaS applications:**

* **Streamlined user onboarding**: Universal Login eliminates the need for users to create separate accounts for each application, making it easier for them to get started.
* **Improved user experience**: A seamless and consistent login experience across all applications enhances user satisfaction and reduces friction.
* **Customizability**: The Universal Login page can be customized to match your brand and needs. At the same time, [Auth0 Actions](https://auth0.com/features/actions) enable developers to extend Auth0 beyond its core functionality and incorporate custom logic such as integrations with APIs (CRMs, billing, email automation, marketing tools, etc) or write custom policies into the authentication and authorization flows.
* **Reduced development time**: Developers can save time and effort using pre-built Universal Login components and SDKs, simplifying the integration process.
* **Global or regional scalability**: Auth0's public and private cloud-based infrastructure scale seamlessly to accommodate user demand internationally and fluctuating traffic spikes.
* **Security Center and Log Streaming**: Auth0 provides robust security features to protect your SaaS application users and your business. With Attack protection features such as bot detection and breached password detection, you can offer comprehensive protection against credential-stuffing attacks. You can also offer streamlined security and follow compliance with MFA and RBAC. In addition, you can monitor your applications and detect identity-driven attacks with Security Center and integrate activity logs with your security toolkit with Log Streaming.
* **Expanded support for various platforms**: Universal Login and SDKs are available for various programming languages and frameworks, enabling developers to build secure and scalable SaaS applications across various platforms.
* **Future-Proof Features**: Auth0 continuously invests in innovation, incorporating the latest security and authentication technologies. By integrating with Auth0, SaaS applications can leverage these future-proof features, ensuring they remain secure and compliant with evolving industry standards.

## B2B Ready with Auth0 Organizations

For some SaaS applications, the B2B aspect is baked into the core design, with a clear understanding of the requirements for managing users from different organizations. However, for many SaaS applications, the need to support B2B scenarios may arise as a requirement that needs quick implementation. This can add complexity to development and require significant effort to integrate and maintain separate identity management systems for each organization.

Auth0 addresses this challenge with [Auth0 Organizations](https://auth0.com/organizations) by providing a unified platform for managing B2B relationships, enabling SaaS applications to efficiently onboard, manage, and secure user identities across multiple organizations.

Auth0 customers can use Organizations to:

* Represent their business customers and partners in Auth0 and manage their membership.
* Allow your business customers to securely manage and customize how their end-users access apps, with the ability to add as many organizations as they need to their Customer Identity Cloud (Private Cloud) tenant.
* Configure branded, federated login flows for each business.
* Build administration capabilities into their products, using Organizations APIs, so that those businesses can manage their own organizations.
* Supports your multi-tenant product out-of-the-box, conveniently serving from a single Customer Identity Cloud tenant.

![Organizations](https://images.ctfassets.net/23aumh6u8s0i/kZUAmaE3qFsxXaeTwxeOb/3dbe661afe612b1596fe4e990803d248/saas01.png)

## Enterprise Ready

In the realm of enterprise-grade SaaS applications, the need for comprehensive identity management extends far beyond traditional user authentication. Enterprises demand a robust solution that seamlessly integrates with existing IT infrastructure, manages complex access policies, and complies with stringent security standards.

Auth0 enables SaaS applications to connect seamlessly with enterprise systems without building custom integrations, eliminating the need for developers to maintain multiple integrations and reducing development time and effort by providing:

* **Seamless Integration with Enterprise Identity Systems**: Auth0 Organizations seamlessly integrate with existing [enterprise identity providers](https://auth0.com/docs/authenticate/identity-providers/enterprise-identity-providers), such as Active Directory, LDAP, and SAML IdPs.
* **Single Sign-On (SSO) for Enterprise Applications**: Auth0 Organizations supports SSO for enterprise applications, enabling employees to sign in to multiple applications using a single set of credentials. This streamlines the user experience and improves productivity.
* **Activity Auditing for Enterprise Compliance**: Auth0 provides detailed activity auditing for enterprise compliance, allowing organizations to track user activity and access patterns. This auditing functionality helps to identify suspicious activity, investigate potential security breaches, and ensure compliance with regulatory requirements.

## Built-in Security

With built-in security features and continuous innovation, Auth0 provides developers with the tools and expertise to build secure SaaS applications that safeguard user identities, sensitive data, and applications from a wide range of threats. Auth0's security features are not only beneficial to developers; they are also a key selling point for SaaS providers who want to ensure their customer’s data and applications are safe and secure.

Here are some of the built-in security features of the Auth0 platform:

### Attack Protection

Auth0's attack protection features can detect and stop malicious attempts to access your application by blocking traffic from specific IPs, displaying CAPTCHAs, and more.

Auth0 offers the following attack protection options:

* **[Bot Detection](https://auth0.com/docs/secure/attack-protection/bot-detection)**: Bots, automated programs often employed by malicious actors performing credential-stuffing attacks, pose a significant threat to online applications and services. Auth0's bot detection capabilities utilize sophisticated techniques to identify and block these bots, preventing them from accessing your applications and disrupting user experiences.
* **[Suspicious IP Throttling](https://auth0.com/docs/secure/attack-protection/suspicious-ip-throttling)**: Blocks traffic from any IP address that rapidly attempts too many logins or signups. This helps protect your applications from high-velocity attacks that target multiple accounts.
* **[Brute Force Protection](https://auth0.com/docs/secure/attack-protection/brute-force-protection)**: Brute force attacks involve repeatedly attempting to guess user login credentials, often automated through scripts or botnets. To combat these attacks, Auth0's brute force protection feature limits the number of failed login attempts from a single IP address. Once a threshold of failed attempts is reached, the IP address is temporarily blocked, preventing further attempts and mitigating the risk of successful brute-force attacks.
* **[Breached Password Detection](https://auth0.com/docs/secure/attack-protection/breached-password-detection)**: Auth0 tracks large security breaches that occur on major third-party sites. If Auth0 identifies that any of your users’ credentials were part of a breach, the breached password detection security feature triggers keeping your accounts safe.

![attack protection](https://images.ctfassets.net/23aumh6u8s0i/6T8KTzpEpJ0YrNMX7qDIMM/a93051c4295c9fd66acbb752fcbdaa08/saas02.png)

Auth0's attack protection features are based on industry-standard security protocols, and they can help you protect your applications from a wide range of attack vectors. To implement Auth0's attack protection features, you can integrate Auth0 into your application. Once integrated, Auth0 will automatically protect your application from attacks.

## Extensibility

Auth0 goes beyond providing a robust authentication and authorization platform; it also offers a wide range of extensibility capabilities, enabling developers to tailor the platform to their specific application requirements and integrate it with their existing infrastructure.

### Auth0 Actions

[Auth0 Actions](https://auth0.com/features/actions) is a powerful extension mechanism that empowers developers to modify Auth0's authentication and authorization flows. These JavaScript functions can be executed at various points in the authentication process, allowing developers to:

* **Modify access tokens with custom claims**: Add, update, or remove custom claims to access tokens, enabling granular control over user permissions and data sharing.
* **Integrate with external services**: Connect to external services like CRM systems, customer data platforms, and payment gateways to enrich user profiles and facilitate seamless user journeys.
* **Enhance user experiences**: Personalize the login and registration experience, customize error messages, and provide user context-aware support.
* **Implement custom logic**: Add custom logic to handle specific scenarios, such as verifying two-factor authentication codes or managing user roles.

You can write your own custom Auth0 Actions writing JavaScript code or browse and install any Action from a curated collection at the [Auth0 Marketplace](https://marketplace.auth0.com/). In the marketplace, you can find Actions providing a wide range of functionalities, such as:

* **Social login integrations**: Connect with popular social networks like Facebook, Google, and LinkedIn to facilitate user authentication and signup.
* **Identity Proofing**: Identity proofing allows you to verify a user's real-world identity based on life history (a credit report), biometrics (a facial scan), and other factors before granting access.
* **Compliance and security solutions**: Implement compliance solutions like fraud detection and data privacy controls.

And much more...

## Get Started with Our SaaS Starter Kit

Embarking on developing a SaaS application can be an exciting yet challenging endeavor. To simplify the process and accelerate time to market, Auth0 offers a [SaaS Starter Kit](https://developer.auth0.com/resources/guides/web-app/nextjs/saas-basic-authentication) that provides a jumpstart for building secure and scalable SaaS applications.

The SaaS Starter Kit is a guide and boilerplate you can use to build a Next.js SaaS application tailored for the following use cases:

* SaaS Multi-tenancy with Auth0 Organizations in a single Auth0 tenant.
* A tiered pricing model using Auth0 Actions and User Profile[ App Metadata](https://auth0.com/docs/manage-users/user-accounts/metadata#metadata-types).
    * Support Trial, Personal, Teams, and Enterprise plans in a SaaS application.
* Trial plan expiration and user conversion using Auth0 Actions.
    * Use Actions to update user profile data, enrich an ID or Access Token with custom claims, or call 3rd-party APIs, such as the Stripe API, to manage user subscription status.
* Self-service SSO for business users using the Auth0 Management API and Enterprise connections with support for OIDC connections.
* Self-service User Management using the Auth0 Management API.

With the [Auth0 SaaS Starter Kit](https://developer.auth0.com/resources/guides/web-app/nextjs/saas-basic-authentication) as your foundation, you can build secure, scalable, and feature-rich SaaS applications that provide a seamless user experience while adhering to industry best practices for authentication and authorization.

## The Customer Identity Platform for Startups

[Auth0 for Startups](https://auth0.com/startups) is a program that provides the convenience and security of Auth0 by Okta to eligible startup customers FREE for a year, so you can get your SaaS application up and running quickly while keeping your users’ data secure.

Some of the benefits of the program are:

* Up to 100k Monthly Active Users
* Up to 5 Enterprise Connections
* All the B2B features you need to scale your business

> Learn more and apply for the program in[ the customer identity platform for startups](https://auth0.com/startups).

Solving Digital Identity Management for Your SaaS Application

Viktor Petersson

Viktor, a seasoned entrepreneur, initiated his journey in the business world during his college years. His first venture, YippieMove, emerged as a pioneering email migration service, setting the stage for his future successes. Demonstrating a keen sense for uncharted territories, Viktor then co-created Blotter, a productivity app for macOS that not only was bootstrapped but also climbed to the top 10 in the Mac App Store before its discontinuation. 

Prior to the widespread adoption of remote work spurred by the COVID-19 pandemic, Viktor had already recognized the transformative potential of a decentralized workforce. He leveraged this insight to lead his early ventures, particularly Blotter, towards prosperity as bootstrapped operations, embracing remote-only models long before they became a global norm. 

Following these successes, Viktor co-founded Screenly, where he currently leads as a visionary. Screenly, also a bootstrapped venture, was created with the ambition of developing the world’s first developer-friendly digital signage product. Under Viktor’s stewardship, the company has introduced revolutionary products like Anthias, the top-ranked open source digital signage solution, and Screenly’s flagship offering, which now powers over 10,000 screens globally. Viktor’s innovative mindset and relentless entrepreneurial spirit continue to propel the digital signage industry into the future.

CEO / Co-founder at Screenly Inc

The beauty of standards is that they span vendors. Auth0 is a big champion of open standards, including OAuth 2.0. In this tutorial, we will leverage OAuth 2.0 Client Credentials to access sensitive dashboards securely by leveraging Screenly’s [Edge Apps](https://www.screenly.io/developers/edge-apps/).

The relevance of these open standards becomes particularly evident when we consider the omnipresence of digital signage in our daily lives.

## Screens, Screens, Screens

They’re everywhere. Advertisement, self-checkout counters, and dashboards on your office walls. The use cases are endless. In industry terms, these screens are known as Digital Signage. Screenly is a leading provider of secure digital signage, trusted by the likes of banks and Fortune 500 companies.

Screenly was recently asked to implement a Power BI dashboard in a secure fashion. They had very strict requirements about how the authentication flow could happen and how the sensitive information could be stored. Fortunately, this company embraces open standards and relies heavily on OAuth 2.0 for internal authentication. More precisely, they had adopted the OAuth 2.0 Client Credential flow as their standard to use whenever possible for services to be integrated.
Recognizing these stringent security needs and their client's preference for robust authentication protocols, Screenly used [Edge Apps](https://www.screenly.io/blog/2023/08/30/introducing-edge-apps/), a developer framework that allows developers to deploy applications in a secure fashion.
As we discussed possible solutions with the client’s security team, Screenly realized that they could solve all of their security concerns by making the OAuth 2.0 Client Credential feature a first-class citizen in the Edge App runtime environment. So they did. The result was the [Power BI Edge App](https://www.screenly.io/blog/2023/10/16/introducing-powerbi-edge-app/), which can be found on their [Playground](https://github.com/Screenly/Playground/tree/master/edge-apps/powerbi) on GitHub.
Now, PowerBI is just one of many assets that need to be protected. There are a large number of assets that customers may want to show on their screens, such as internal dashboards, that are protected by some sort of authentication.

## Connect Screenly with Auth0

In this tutorial, we will mimic what Screenly did for their customers but for your internal assets. For the sake of argument, let’s assume it is an internal dashboard that you want to display on your office walls but have been unable to do so due to security concerns.

In this guide, we'll utilize an Edge App to execute an OAuth 2.0 [Client Credential Flow](https://auth0.com/docs/get-started/authentication-and-authorization-flow/client-credentials-flow), enabling automation of the login process for apps supported by Auth0.

Big-picture, the way the Client Credential flow works is as follows:

The client initiates the authentication process by sending a POST request to the authentication end-point, with, among other things, the Client ID and Client Secret.
Assuming the request was successful, the authentication server will return a Bearer Token (that usually expires soon thereafter)
The client can now authenticate to the dashboard using the Bearer Token to access the resource.

To mimic this flow, we will be building on top of the [Auth0 Getting Started Guide](https://auth0.com/docs/get-started/auth0-overview/). 

1. Establish an Auth0 account and configure it using the [Getting Started Guide](https://auth0.com/docs/get-started/auth0-overview/set-up-apis).
2. Clone and set up a sample app using Auth0's [Flask Example](https://auth0.com/docs/quickstart/backend/python/interactive) for a comprehensive demonstration.

Once you have your Flask application running, you need to ensure your application is network-accessible (i.e., not restricted to localhost). If not, the [Screenly Player](https://www.screenly.io/digital-signage-players/) will not be able to communicate with the resource.

In order to authenticate to the Flask App, we now need to generate our credentials as per [this guide](https://auth0.com/docs/get-started/authentication-and-authorization-flow/call-your-api-using-the-client-credentials-flow). Once done, you need to take note of the following:

* Authentication URL
* Client ID
* Client Secret
* Audience

Equipped with this information, we'll craft an Edge App to facilitate automatic logins into your Auth0-protected resource.

## Crafting the Edge App

Before diving in, ensure:
* You have an active Screenly account.
* You possess a Screenly Player, preferably a Screenly Player Max.

Install the Screenly [CLI](https://github.com/Screenly/cli/). For macOS users with Homebrew:

```bash
$ brew tap screenly/screenly-cli
$ brew install screenly-cli
```

After installing the CLI, run `screenly login` to access your account.

Next, initiate the creation of your Edge App by generating the `screenly.yml` file in a new directory. This file should contain the settings you provided, which will allow you to define the various necessary configurations:

```yaml
---
app_id:
entrypoint: http://my.app.com
settings:
  oauth2_client_secret:
	type: secret
	title: Oauth 2 Client Secret
	optional: true
	help_text: Auth0 Client Secret
  oauth2_client_id:
	type: string
	title: Oauth 2 Client ID
	optional: true
	help_text: Auth0 Client ID
  oauth2_audience:
	type: string
	title: Oauth 2 Audience
	optional: true
	help_text: Auth0 Audience
  oauth2_scope:
	type: string
	title: Oauth 2 Scope
	optional: true
	help_text: Auth0 Scope
  oauth2_endpoint:
	type: string
	title: Oauth 2 Entrypoint
	optional: true
	help_text: Auth0 Entrypoint
```

Modify the `entrypoint` to correspond to the sample app you established earlier.

Following this, embed the application into the system using the specified command. Then, after updating the `app_id` in `screenly.yml`, you'll push the file and adjust the settings accordingly.

Complete the process by promoting the Edge App as an asset, which, once done, will be visible in your web interface as `Auth0 Example (stable)`. Schedule and display this asset on your Screenly device as you would with any other content.

Once you've run that final command, you should see an asset named `Auth0 Example (stable)` appearing in your web interface. Just schedule this asset as you would with any other image or video, and it should show up on your Screenly device.

## That’s a wrap!

That’s it! While the above simply used a basic Flask application, it could equally well have been a fully-fledged dashboard that supports the authentication flow adopted by the Flask application.

Integrating Auth0 with Screenly

jamie-hughes

At Fingerprint, Jamie solves EMEA customers' device intelligence challenges at each stage of the digital lifecycle (from ATO to credential stuffing to MFA friction and more) by quickly discerning their technical needs and demonstrating how Fingerprint can help them stop fraud and grow revenue. Jamie was previously a lead sales engineer at Auth0 and Beyond Identity. His years of experience in both the CIAM and device intelligence space enable him to help customers seamlessly reduce fraud and improve the user experience by combining best of breed identity and security solutions.

Solutions Engineer at Fingerprint

Jamie Hughes

Changing the conversation from “detected” to “prevented”… stop identity fraud at the source.

**TL:DR:** Digital identities have emerged as a crucial aspect of an online existence. From buying a product online, logging into a streaming service, or communicating with friends via social media, digital identity is a fundamental component in each of these activities. At the same time, companies must ensure digital identities are safe from malicious actors without adding friction for trusted users. This blog outlines how device intelligence can play a crucial role in protecting digital identities from fraud and optimizing the user experience.

## The Role of Digital Identity

A digital identity encompasses the data and information that represents an individual, organization, or device online. It plays a pivotal role in how a person interacts, transacts, and takes advantage of the digital world.

Successful validation of a digital identity enables one to perform associated actions and transactions for the service being used, such as updating account information or authorizing a banking transaction. However, malicious actors target these digital identities to commit fraudulent transactions or steal valuable data, which has left many users lacking trust and confidence in the security of their online accounts.

## Types of Digital Identity Fraud

* New Account Fraud New account fraud (or fake accounts) occurs when users sign-up more than once to receive one-time bonuses or promotional offers as a reward for becoming an account holder but with an ulterior motive. 
* Account Takeover (ATO) Account takeover occurs when malicious actors steal login credentials to access someone else's account. Once fraudsters have access, these accounts can be used to conduct various activities, such as transferring funds or accessing personal data.
* Social Engineering Social engineering is a deceptive and manipulative technique used by cybercriminals to gain unauthorized access to sensitive information; instead of relying on technical vulnerabilities, social engineering preys on people's trust, curiosity, and willingness to help. It often takes the form of phishing emails, pretexting phone calls, or impersonation tactics, tricking individuals into divulging confidential data or performing actions that compromise security. In September 2022, Uber's private network was [breached by a teenage hacker](https://fingerprint.com/blog/why-social-engineering-attacks-are-successful-with-technical-staff/) who used social engineering methods to gain secure information from an engineer.

## What about Multi-Factor Authentication (MFA)?

Product teams are conscientious about adding additional layers of friction to secure user accounts, fearful that they will abandon the transaction or sign-up process, resulting in a loss of revenue. This typically means that MFA is not mandated and is optional for the user. Even when users opt-in or MFA is enforced, companies are still relying on weak or outdated MFA methods, such as SMS/email one-time password (OTP) or cookie-based MFA, which can easily be phished or spoofed.

Strong MFA is an effective defense layer to help secure user accounts, given how easy it is to steal a user's password. However, many companies are challenged with how to make accurate and context-based MFA decisions that reduce friction for genuine users. Most forms of context-based authentication rely on IP addresses or cookies, which on their own are not stable or reliable enough to ensure the trust required to skip the MFA stage.

As a result of the above challenges, most companies fall back to challenging all authentication transactions with MFA, resulting in unnecessary user friction and rising SMS OTP costs.

## How Device Intelligence Protects Accounts

Accurate device intelligence recognizes trusted users from bad actors. Generating an accurate and stable device identifier during account creation or the next trusted login results in the user having a list of “trusted devices”. If an authentication attempt is initiated from a “new” device not within that list, the attempt can be blocked or challenged with a strong MFA factor. When the actual user returns and authenticates from a “trusted device,” you have a high degree of confidence it is actually the owner of the account and can, therefore, skip any additional friction, which leads to an enhanced, seamless user experience.

Capturing device intelligence data for each account creation request allows you to make smart decisions on whether or not to allow account creation. During the creation process, if the device identifier captured already exists for a registered user, depending on your allowed account-to-device ratio, you can block or allow the sign-up request. 

Companies who are using device intelligence are able to block malicious actors from using their services by adding them to a block list, as they can easily identify when they have attempted to create multiple fake accounts (for the purpose of promo abuse or [SMS pumping](https://fingerprint.com/blog/sms-pumping-fraud/)) or attempted account takeover attacks using their device/browser or browser automation tools (bots).

## Why Fingerprint with Auth0

Fingerprint was built to help companies solve complex identity & fraud-based challenges. Fingerprint is an API-based solution, which makes it very easy to plug into Auth0’s well-known [Extensibility](https://www.okta.com/customer-identity/extensibility/). 

Using Fingerprint in addition to [Auth0 Security](https://www.okta.com/customer-identity/login-security/) modules layers in an extra level of defense to help keep your Auth0 tenant safe from synthetic account creation and account takeovers. This is achieved by adding Fingerprint’s unique device fingerprint to the Auth0 user profile for each user at signup or a trusted login. Fingerprint’s visitor identifier is 99.5% accurate at identifying returning visitors; it can then be used to evaluate the identity of the device that is attempting to authenticate. 

See the example flow below for preventing account takeovers: 

![Auth0 Security](https://images.ctfassets.net/23aumh6u8s0i/4P8cG3n0TfGZAAiQIn9yZn/150b48b1b176d0bd24b7e19ad06663a4/use-case.png)

In addition to device identification, Fingerprint also provides [Smart Signals](https://fingerprint.com/products/smart-signals/), such as bot detection, VPN detection, and browser tampering detection, that pinpoint indicators of fraud from anonymous traffic. All of these Smart Signals can be evaluated in Auth0’s extensible [Actions](https://www.okta.com/customer-identity/actions/) within the sign-up or login flows. 

You can find additional details and technical integration documentation in the Auth0 Marketplace [Fingerprint listing](https://marketplace.auth0.com/integrations/fingerprint-pro). 

## Conclusion

One of the key use cases for implementing a device intelligence platform is to prevent fraud, and as discussed above, digital identities are prime targets for types of fraud, such as signup abuse, account takeover, and social engineering. 

Unique, stable, and accurate device identifiers from Fingerprint recognize good users from bad users and block the activity associated with bad actors as a result. Accurately identifying the devices of your good users and incorporating them with Auth0 Actions allows you to make smart decisions to keep accounts secure with no additional friction. 

To get started, sign up for your free Fingerprint trial [here](https://dashboard.fingerprint.com/signup) and check out the Auth0 Marketplace [Fingerprint listing](https://marketplace.auth0.com/integrations/fingerprint-pro) for more details on how these solutions work together to help you stop fraud without friction.

Leveraging Device Intelligence to Protect Digital Identities

Mallory Sword Glenn

Mallory Sword Glenn is a Senior Product Marketing Manager for Okta’s Customer Identity products. Her key focus is showcasing how organizations can create secure and seamless digital experiences for their end users using Okta’s identity products. Prior to joining the Product Marketing team, Mallory led the pricing strategy for Customer Identity products on Okta’s Pricing team. Mallory has a breadth of SaaS experience spanning go-to-market, pricing, deal strategy, and operations at companies like Adobe and HPE.

Senior Product Marketing Manager, CIAM

Learn how Identity and Access Management (IAM) helps level the digital playing field for everyone.

Wheelchair ramps, braille, text captions, large print books are all examples of accessibility in the real world. We use these as tools to help ensure everyone has equal access to places and resources. But what about the internet and technology? What tools exist in the digital world to ensure everyone has access to digital resources? 

One of the opportunities we have through the internet and technology is a better chance at leveling the playing field for everyone and ensuring equal access to digital resources and experiences, especially for those experiencing disabilities. 

## The Complexity of Accessibility

Developers are already familiar with many of the complexities of identity and access management (IAM), but one often overlooked complexity is around accessibility. How do you ensure that the steps you’re taking to secure your customers and their accounts aren’t introducing unnecessary friction for some groups? 

Here, we talk specifically about accessibility as it relates to Customer Identity and Access Management, but many of the same considerations also apply to Identity and Access Management as a whole.

## What Are Some of the Things We Should Think about When It Comes to Identity and Accessibility? 

When we talk about accessibility, we’re not only talking about physical disabilities like impaired hearing or vision. It’s also important to think about different social groups that could be impacted, such as aging populations or those with reduced access to the internet or technology. 

For identity specifically, we need to think about accessibility in a few different contexts: 

* **Sign-up process** - A user's journey often starts with the sign-up process. 
    * Considering populations that might be accessing with a poor internet connection, we need to ask whether the sign-up flow is lightweight enough to allow optimal functionality. Ensure the sign-up flow is accessible across different devices and that it is formatted correctly – the size of the text should be large enough to read on smaller devices. 
    * For users that might not be as familiar with password security, do you guide them through the process to ensure they have a secure password by checking for breached passwords or recommending certain password parameters? 
* **Sign-in process** - Many of the same rules apply to the sign-in process as to the sign-up process. 
    * Is it easy to know where to log in and what information is needed? Make it easy to find where to log in – don’t hide your login button on a busy webpage. Then, once users get to your login box, make it clear what information the customer needs to provide to log in – whether that’s a phone number, email, username, password, etc. 
    * Do you make it easy to recover a forgotten password or perform a self-service password reset? Use clear language and provide step-by-step instructions that help users gain access to their account when they’ve forgotten their credentials.
* **Multi-factor authentication** - Multi-factor authentication is one of the best steps we can take to help users secure their accounts and protect them from account takeover. However, we also need to consider the accessibility of the MFA solution we’re offering. 
    * Do you offer multiple factors that can meet people where they are? While SMS might be a preferred factor for some, it could serve as an impediment to others who might be better suited for voice or biometrics as a second factor. 
    * Is the MFA enrollment process simple for users that might not be technologically savvy? Does it require the user to switch between multiple devices? Does it require the user to have an internet connection? By offering your users options, you can ensure you’re providing your customers with that extra layer of protection while still maintaining a frictionless experience that’s accessible to all. 

## What Steps Can You Take to Ensure You’re Securing Users While Maintaining Accessibility? 

Accessibility is something that varies from person to person and application to application. There’s no one-size-fits-all solution when it comes to web accessibility. The full scope of accessibility generally relies on many different applications, settings, and devices working together. However, you can do your part to make your customer identity more accessible by:

* **Bringing awareness** - You’ve already taken one of the first steps toward making your customer identity more accessible by simply being aware. Going forward, you can put accessibility at the front of your development process, considering the accessibility implications of different solutions as you’re planning and building your application.
* **Reviewing the WCAG guidelines** - [WCAG 2.1](https://www.w3.org/TR/WCAG20/) outlines the best practices for digital accessibility. They also offer tests and techniques you can use to enhance accessibility for your application. Following the guidelines here, you can make your web content more accessible to more audiences. 
* **Allowing more choice in your login flow** -  While you might think it seems easy enough to verify your identity using a OTP from an authenticator, this could be a huge barrier to someone who isn’t technologically savvy, doesn’t have a mobile device, or is visually impaired. Allowing your users to choose from different MFA factors allows them to choose one that works best for them. Similarly, allowing your users to have the ability to recover a lost password or perform self-service password reset means they don’t have to call a help desk if they forget their password. By providing options to your users, they can choose what works best for them. 
* **Use social login or passwordless** - If users have already registered for an account elsewhere, why not allow them to use that account to access your application? Social login is a great place to start and can be as simple as clicking a button. It doesn’t require users to go through a sign-up process or memorize another password. Passwordless login allows users to leverage things like email magic links to log in. 

## How Does Okta Consider Accessibility When Building Features and Products? 

One of the benefits of using an identity solution like Okta is that we provide you with tools to make it easier to deploy accessible solutions to your users. Okta is continuously working to improve the functionality of its products in support of accessibility standards such as Section 508 of the US Rehabilitation Act of 1973 as well as the Web Content Accessibility Guidelines (WCAG). [This page](https://www.okta.com/accessibility/) provides information about our efforts to provide a more accessible experience to your end-users.

If you want to learn more about our journey to a more accessible login, check out our blog post [here](https://auth0.com/blog/auth0s-journey-towards-a-customizable-and-accessible-login-experience/). 

_These materials and any recommendations within are not legal, compliance, or business advice. These materials are intended for general informational purposes only and may not reflect the most current legal and compliance developments nor all relevant issues. You are responsible for obtaining legal, compliance, or business advice from your own lawyer or other professional advisor and should not rely on the recommendations herein. Okta is not liable to you for any loss or damages that may result from your implementation of any recommendations in these materials. Okta makes no representations, warranties, or other assurances regarding the content of these materials.  Information regarding Okta's contractual assurances to its customers can be found at[ okta.com/agreements](http://okta.com/agreements)._


How Can We Make Identity Accessible for Everyone?

shiven_ramji

Shiv is an experienced product executive and builder obsessed with creating beautiful products. He is the President of Customer Identity at Okta, managing a $1B ARR business and overseeing the company’s product, data, security, and technology strategy and execution. Before Auth0 and Okta, Shiv was the SVP of Product at DigitalOcean, leading DigitalOcean’s products, pricing, and partnerships. Additionally, Shiv has held product leadership positions at global brands, including Amazon, NBCUniversal, LiveIntent, and The Nielsen Company. Shiv was the recipient of the 2023 Top Global CPO Award by the Products That Count community. 

Beyond his current corporate focus, Shiv is deeply committed to fostering entrepreneurship and innovation, particularly in Africa. He is an active angel investor and startup advisor and also serves on the boards of [Products That Count](https://productsthatcount.com/) and [Aiven.io](http://Aiven.io).

President, Auth0

Shiven Ramji

New partnerships aim to bring secure customer identity to the platforms developers use every day in one click, or less

Almost a decade ago, _The New Kingmakers_ made reference to the rise of a developer class that would fundamentally reshape technology decision-making. Today, two-thirds of professional developers have a voice when their organizations are purchasing new technologies, according to [Stack Overflow](https://survey.stackoverflow.co/2022/#technology-most-loved-dreaded-and-wanted). Product-led growth is official “a thing,” and companies that make life easier for developers have been crowned with success again and again.

The acquisition of Auth0 accelerated Okta’s own journey with developers. Over 2.8 million unique developers look to [Auth0, now the Okta Customer Identity Cloud](https://www.okta.com/press-room/press-releases/okta-introduces-okta-customer-identity-cloud-to-help-businesses-grow-user/) each month for expertise on how to implement customer identity, across in-person events, the Auth0 Ambassador program, and digital channels like docs, technical blogs, and JWT.io.

Today, at [Oktane22](https://www.okta.com/oktane22/), we announced the next giant leap in our journey toward making identity easier for developers: New partnerships with three of the leading developer platforms: DigitalOcean, Netlify, and Vercel. These are like-minded platforms that put developers at the heart of their missions. Together, we intend to bring expert advice and easy integrations to where developers already spend their time–with the ultimate vision of providing secure customer identity in one click or less within each platform environment.

“Creating compelling experiences is hard enough without having to be an identity expert, too. And the stakes are too high to get it wrong,” said Shiven Ramji, Chief Product Officer, Customer Identity at Okta. “Okta Customer Identity Cloud powered by Auth0 can be called by your app and hosted in your cloud of choice, but we don’t want to stop there. This is the first step in a multi-year journey to fully integrate secure identity capabilities where developers are building the future. We are honored to have DigitalOcean, Netlify, and Vercel join us on this quest.”

## Abstracting Away Complexity

Developers are facing all kinds of application complexity and maintenance work that takes them away from innovation. The Covid-19 pandemic only amplified the need to be hyper-focused on shipping differentiated, user-centric products. Security has become a cat-and-mouse game as attackers shift their tactics and new privacy laws are established. Developers need to balance all of these priorities while dealing with resourcing and talent pressures.

Customer identity stands at the intersection of these forces: security, privacy, and user experience. Getting it right enables everyone to safely access any technology and developers to integrate customer identities across the stack. But according to a [Gartner](https://www.gartner.com/en/documents/4009255)® report, “The cost of maintaining a homegrown CIAM toolset has grown, compared with commercial offerings. There is a growing preference for buying versus building, which is enabling the business to refocus development resources.”

## Empowering Developers for a Safer Internet

Together, we believe Okta, DigitalOcean, Netlify, and Vercel can streamline the education, implementation, and activation of customer identity for developers across the globe. Today, we’re starting with improving education and awareness around the complexity of identity, followed by improving discoverability for our integrations along the developer journey, with the ultimate vision of one-click integrations.

Democratizing access to enterprise-grade customer identity for developers will have a massive impact on the security of end-consumers and empower developers to focus on innovation. As part of Okta Customer Identity Cloud, we can put adaptive multi-factor authentication (MFA), bot detection, passkeys, and more in the hands of developers with the literal flip of a switch. Meeting developers where they are is a key part of our strategy, and we couldn’t be more excited to welcome DigitalOcean, Netlify, and Vercel to our network.

“We’re very excited to be working with Okta to better equip developers and small businesses to add customer identity into their Apps built on DigitalOcean,” said Tyler Healy, Vice President of Security at [DigitalOcean](https://www.digitalocean.com/). “When it comes to developers and digital entrepreneurs, simplicity is vital. This partnership will only further DigitalOcean’s ability to simplify innovation on our platform and enable builders to spend more time creating software that changes the world.”

“Developers are moving to a decoupled, composable web architecture because they want more flexibility to use any tool or framework to build faster, better-performing web experiences. At the same time, they need a great developer experience in a simple workflow. That’s where Netlify plays a key role as the platform connecting all developer’s tools, including Auth0 by Okta, and APIs in one place to build and run web apps. Working with Okta, we look forward to making identity and authentication as easy and simple as possible for millions of developers,” said Matt Biilmann, CEO and co-founder [Netlify](https://www.netlify.com/)

“As a leading cloud platform for frontend developers, Vercel provides innovators with the speed and reliability they need to create at the moment of inspiration. Security and identity are at the core of building delightful digital experiences,” said Malte Ubl, CTO at [Vercel](https://vercel.com/). “By joining forces with Okta, we’re not only simplifying the role that identity plays on the web but also making a commitment to enhancing the speed and breadth of developer-friendly cybersecurity in an increasingly digital world.” 

## Neutrality to Build Your App, Your Way

Developers want the freedom and power to choose the best solutions for their digital ecosystem. Okta’s commitment to neutrality means not being restricted to a specific technology stack and having the ability to control and customize identity now and in the future. We are designing easy-to-integrate solutions that free developers to use any technology, regardless of platform, device, or infrastructure. We are 100% focused on identity, so developers can focus on innovation.

## Availability and Signup

Developers can learn more about Okta’s new developer platform partnerships and get started with Okta Customer Identity Cloud [on our Developer Center](https://developer.auth0.com/resources/get-started/cloud?utm_source=blog&utm_medium=website&utm_campaign=partnerships). We will release more information about the DigitalOcean, Netlify, and Vercel integrations as they become available.

If you’re a developer platform interested in joining our quest to make identity easier for developers, [please reach out to our tech partnerships team](https://docs.google.com/forms/d/e/1FAIpQLSfGzaE5a6-OSy1D1N8PMeSE8pXCfsr4UkzDqUpW-vUGq2rYHg/viewform).

## About Okta

Okta is the World’s Identity Company. As the leading independent Identity partner, we free everyone to safely use any technology—anywhere, on any device or app. The most trusted brands trust Okta to enable secure access, authentication, and automation. With flexibility and neutrality at the core of our Okta Workforce Identity and Customer Identity Clouds, business leaders and developers can focus on innovation and accelerate digital transformation thanks to customizable solutions and more than 7,000 pre-built integrations. We’re building a world where Identity belongs to you. Learn more at [okta.com](http://okta.com/).

Okta Partners with DigitalOcean, Netlify, and Vercel to Simplify Identity for Developer

dean-scontras

Dean Scontras has spent the last two decades in public sector sales roles at high-growth cybersecurity and technology companies, including Duo Security, MobileIron, and Hewlett-Packard. Currently, Dean sits on the advisory board of Advanced Technology Academic Research Center (ATARC) and DiversifyIT. Prior to joining Auth0, he served as the vice president of U.S. Public Sector at Duo Security (acquired by Cisco), leading federal, state, local, and education sales initiatives, alongside securing the company’s successful FedRAMP certification.

VP, State and Local Government and Education, Okta and Auth0

Dean Scontras

Consumers expect seamless, high-value digital experiences, including with the public sector.

What does it mean to build digital services that citizens both use and trust? From the local to the national, generating effective digital transformation and [getting citizens onboard with digital public services](https://www.sciencedirect.com/science/article/pii/S0740624X18304131) has been a challenge. The promise of digital government has often been muddled by institutional inertia and perceptions of government as slow-moving and bureaucratic. At the same time, positive initiatives, such as the [Tallinn Declaration on eGovernment](https://ec.europa.eu/newsroom/document.cfm?doc_id=47559), which embrace objectives as wide-ranging as improved service delivery, greater efficiency, increased transparency, interoperability, and citizen satisfaction, have begun to remove entrenched ambivalence about e-government. Modern GovTech is where these barriers collide, creating the opportunity to address newly accelerated consumer demand in the face of private-sector conveniences and the [consequences of the Covid-19 pandemic](https://www2.deloitte.com/us/en/insights/industry/public-sector/government-digital-transformation-strategy.html). 

GovTech, according to public sector entities such as [the World Bank](https://www.worldbank.org/en/programs/govtech), is a technology-based “government approach to public sector modernization.” The same definition emphasizes three core areas for modernization: universal accessibility, citizen-centric services, the delivery of efficient and transparent government systems, and finally, digital transformation, all of which rely on overcoming long-cited barriers to adoption and success, such as [citizens’ willingness to use and trust services](https://doi.org/10.1145/2096140.2096142).

GovTechs, an umbrella term for technology-based solutions (and the companies behind them) that power the technical aspects of digital transformation, can be a bridge between use and trust and learning to [see citizens as customers](https://www.mckinsey.com/industries/public-and-social-sector/our-insights/building-the-tech-enabled-government-of-the-future-a-day-1-list-of-common-pitfalls).


## Changing User Expectations 

In a pure consumer context, choice and convenience rule: you can easily go online and search, comparison shop, and buy a desired product in a few clicks without thinking about any of the complexity of the transaction. Consumers naturally transfer their positive consumer expectations to all of their digital experiences,[ according to McKinsey, raising the bar for government entities](https://www.mckinsey.com/industries/public-and-social-sector/our-insights/digital-public-services-how-to-achieve-fast-transformation-at-scale). 

But how many consumers have enjoyed the convenience of one-click (or similarly easy) citizen services, such as reviewing and paying utility bills, filing income taxes, or having a streamlined, one-stop car-and-driver licensing experience? Or, for example, registering for unemployment benefits digitally, making the physical queue at the unemployment office shorter and more efficient for those going through the process in person? 

Rapid change has led to the expectation that public sector services offer private-sector-rivaling availability, choice, and convenience, which overrides previous consumer doubts about public sector readiness. 

Driving GovTech strategy in complex public sector environments demands a delicate balance between overarching strategic questions and the nitty-gritty of implementation. For example, this balance could be examining the[ underpinnings of transformation](https://www.accenture.com/_acnmedia/pdf-90/accenture-govtech-pov.pdf) strategically, such as public expectations, financial considerations, accessibility, demographics, and sustainability, against the competing operational demands of introducing new technology into hierarchical, political, and often change-resistant environments. Practically, such implementations involve extensive political and stakeholder management and support, consideration of legacy investments and programs, and a well-defined plan for rolling out proposed changes and the downstream effects these may have, whether positive or negative. 

Ultimately, the strategy for selecting and implementing GovTech solutions and providers rests with public sector employees who are responsible for the strategic and tactical approaches described and for meeting consumers’ increasingly private-sector-style expectations. This is redefining how governments interact with citizens. 

Three core considerations highlight how uniquely demanding delivering on these expectations can be for government agencies:

### 1. Deliver on citizens’ demands and expectations. 
Government digital transformation is different from its private-sector counterpart. Historically,[how consumers perceive and use public and private sector services has differed](http://dx.doi.org/10.4018/IJIDE.2019010102). However, societal changes stemming from the Covid-19 pandemic and the attendant shift to living life almost 100% online have resulted in heightened citizen expectations for public services to be available digitally in the same way as online shopping and food delivery. As a result, old barriers against citizens' willingness and ability to use e-gov services have declined significantly. 

### 2. Balance privacy and user experience. 
More fundamentally, the private sector is driven by consumer demand and choice, incentivized by increasing profit and reducing cost. While the public sector shares these concerns, because citizens often do not have a choice in deciding whether to interact with the government, the government’s primary aim is to provide services to citizens efficiently while building trust, safeguarding citizens’ data privacy, and ensuring compliance with regulations, mandates, and standards to which government agencies are tied. Trust remains an important issue for consumer-citizens, who[ perceive a level of risk in exposing their private data to public entities in ways they don’t when dealing with private entities](https://www.ey.com/en_no/government-public-sector/how-can-digital-government-connect-citizens-without-leaving-the-disconnected-behind). For public sector agencies, privacy concerns have historically taken precedence over user experience, but they need to prioritize privacy and security over user experience and convenience is beginning to change as GovTechs offer secure solutions leveraging modern infrastructure and economies of scale that facilitate both outcomes at a lower overall cost.

### 3. Make public services accessible to all citizens. 
The rapid digitization of society champions convenience above all, but digital-only approaches can create [accessibility blindspots](https://www.openaccessgovernment.org/accessibility-making-government-work-better/55530/) and [exacerbate the digital divide](https://www.ey.com/en_au/government-public-sector/how-can-clever-governments-choose-to-close-the-digital-divide). Government agencies must serve _all_ citizens, which means designing for everyone or else disenfranchise citizens who do not have access to digital services, devices, or connectivity. 

## How Can GovTech Enable These Citizen Experiences? 

Government agencies want to deliver on these citizen expectations because the agency benefits by achieving its mission, improving efficiency, and reaching all of its citizens — ultimately benefiting citizens. 

“A valuable function of government is providing all constituents with equal opportunity to access different services. By enhancing government with modern technologies, citizens are presented with multiple paths to the same services. These paths can now be both digital and in-person avenues, allowing the government to be more efficient in providing the right access to the right group of people,” Auth0’s Jeet Shah, Identity Architect, and Senior Solutions Engineer explains. “GovTechs introduce options for how citizens are served, allowing governments to dedicate resources more effectively. Citizens who prefer interacting with their governments online allow in-person services to be more accessible and can ultimately improve the quality. GovTech vendors and what they provide to governments ultimately leads to better services for all constituents.” 

GovTech grows from two branches: the first is the services governments offer to their citizens, the second is the vendors that enable those services. Governments furnish services in line with citizen expectations, which brings together these two branches.

### Government services to citizens: Focus on usability and trust

At the heart of delivering efficient public services is the ability to unify disparate, siloed departments and functions under a single sign-in. Forcing citizens to keep track of and maintain access to multiple portals and sites creates friction and disincentivizes use while also introducing the greater potential for security vulnerabilities and data privacy breaches. 

At the same time, maintaining this fractured setup is less efficient, potentially open to fraud, and forfeits opportunities for fostering citizen trust and personalizing user experiences. For example, imagine being able to offer all citizen services through a centralized digital portal or app with a single sign-on experience. From license renewal to viewing existing permits to paying bills, governments can leverage GovTech that enable these features and gather user analytics simultaneously to feedback into personalization efforts and a deeper understanding of citizen needs and wants.

## Identity Jumpstarts GovTech Services

[Various barriers have slowed technology-driven public sector transformation](https://doi.org/10.1007/978-3-030-57599-1_4) over the past two decades. Many of these barriers, such as embedded organizational and cultural issues, existing processes, and legacy structures and infrastructure, persist regardless of technology. The impetus to accelerate the pace of change, however, has positioned GovTech to play a key role in helping to overcome some of these barriers. 

Identity enables all levels of government to bring their services to more citizens via the channels they prefer and already have access to. If the barrier faced is the difficulty of use, unified identity simplifies usability for both the government agency and the citizen user. If the barrier is trust, secure and transparent identity technologies can breakthrough. 

### Vendor service enablers: Auth0 for unifying identity

Auth0 is a GovTech vendor that, in this case, acts as an umbrella, freeing government agencies from service and platform fragmentation by bringing them together under a single, flexible sign-on solution. By reducing infrastructural complexity and providing options government agencies can use to offer services across multiple vectors, Auth0 helps public sector entities to expand the base of citizens who can access their services. 

By doing the heavy lifting of the platform and digital identity consolidation, Auth0 enables governments to reorganize and reprioritize resource allocation for more efficient processes – dedicating resources to digitizing what is possible and improving those that cannot be digitized.

If you’d like to learn more about how identity can accelerate digital change and invite citizens along for the journey, please get in touch with the [team at Auth0](https://auth0.com/contact-us).

What is GovTech?

1Vitor de Sousa_Auth0

As Regional Vice President, Vitor de Sousa supports Okta and Auth0's German customers in achieving their Identity and Access Management goals. With more than 20 years of experience in the consumer goods industry, as well as in technology and software sales, he develops strategically smart and creative solutions for the interplay of identity authentication, customer experience, and data protection.

Regional Vice President, Enterprise Sales - Germany

Vitor de Sousa

The pandemic accelerated digitization initiatives, a robust CIAM solution can assist in an iterative migration to the cloud

In the DACH region, trust is everything, and one of the first places you can build consumer trust is your login experience. German consumers say their main frustrations with signing up to a new app or online service are having to fill in long login or sign-up forms (42%) and entering private information (38%), followed by having to create a password that has to meet certain requirements (33%), and a new ID and password for every app or online service (31%). These statistics come from a [global research study](https://info.auth0.com/erwartungen-und-realitat.html) conducted by Auth0 and YouGov, including more than 2,000 consumers and 200 IT/marketing decision-makers in Germany.

One of the challenges organizations encounter when looking to launch new services or feature sets is the fact that many of these features are cloud-based while existing services that could benefit from integration are often legacy and hosted on-premises. Finding an [Identity as a Service (IDaaS)](https://auth0.com/blog/what-is-idaas/) provider who can link those legacy systems and modern cloud-first platforms is an important step towards creating a future-proof service. However, many organizations in the DACH region are still building their own identity solutions. Or they’re misusing tools designed for managing employee identities for customer-facing needs. Both of these scenarios can introduce additional pain points when it comes to joining legacy and modern systems.

## Digitization Projects Are Resource Intensive

IT departments have spent the better part of the last 18 months establishing work-from-home protocols, migrating critical systems to the cloud for better access, and ensuring that everyone’s data stays safe and secure throughout the transition. Despite the acceleration in these digitization projects brought on by the COVID-19 pandemic, many of these systems have to remain housed on legacy on-prem servers due to a lack of alternatives. Bridging the gap between these and the convenient cloud-based tools your customers need access to is a large undertaking, especially for IT teams that are already stretched thin supporting ongoing internal needs.

Your IT and development teams support the organization’s goals by creating and maintaining the best web applications for your customers and by keeping your infrastructure running smoothly. That way, everyone, both inside and outside of the company, has the best experience possible. Partnering with an IDaaS provider like Auth0 will free those teams to continue focusing on their primary goals by taking the task of user authentication off their hands — and putting it in the hands of identity experts. This ensures your users get the CX they’ve come to expect while you maintain control over your data and privacy.

## Legacy Workforce Identity Solutions Are Not Built To Face External Threats

The workforce [Identity and Access Management (IAM)](https://auth0.com/blog/what-is-iam/) tool you’re using today may look like an attractive option for your customer-facing needs. There are several problems with this idea, starting with the simple fact that IAM solutions are not focused on user experience (UX). Their priority is security, keeping your company’s intellectual property safe and secure from bad actors. 

The threats facing customer applications can be vastly different in type and scale. Workforce IAM verifies employee identity in order to approve access to just the tools they need to do their job effectively, from primarily company-owned devices. [Customer Identity and Access Management (CIAM)](https://auth0.com/blog/what-is-ciam/#:~:text=Auth0%20Docs&text=Customer%20Identity%20and%20Access%20Management,%2C%20customer%20experience%2C%20and%20analytics.) solutions, on the other hand, need to integrate protection against brute force attacks, password spraying attacks, along with other outside attack vectors. And they need to do that while maintaining identity verification across potentially millions of end-user devices and networks. Additional hurdles exist as well; for example, many IAM tools are on-prem only and unable to protect your new cloud-first infrastructure. 

## Growing Demand From Consumers for a Low-Friction Customer Experience

The acceleration and growth of online tools have increased consumer expectations for a safe and simple identity experience. They’re no longer willing to wait for slow pages to load or to endure lengthy and complex account creation flows. Your customers demand-responsive, intuitive design, or they’ll take their business elsewhere. In fact, 78% of German consumers say they have [abandoned an app or online service](https://info.auth0.com/erwartungen-und-realitat.html) due to an arduous login experience.

Addressing the systemic issues that need attention to keep up with this demand will put additional stress on your internal teams, pulling their attention away from those core goals we discussed above. You don’t need to sacrifice your user experience in order to create a user-friendly and trusted authentication experience. Auth0 provides a secure platform with a variety of cloud deployment options, including [private cloud deployments on Microsoft Azure](https://auth0.com/blog/auth0-on-microsoft-azure-as-a-private-cloud-deployment-option/) or AWS infrastructure, and public cloud options using AWS facilities in multiple regions, including Frankfurt. Built by and for development teams, Auth0 is easily customizable to create exactly the low-friction experience your customers demand without sacrificing security and extensibility.

## Auth0 Lets You Find the Right Mix of Security, Privacy, and CX

We’ve discussed three pain points organizations in the DACH region are likely to encounter when looking to deploy a new identity and authentication solution across both legacy and cloud-based systems. The Auth0 Identity Platform has a robust feature set designed to address these challenges and any others you may encounter as you embark on your own identity project.

### Extensibility allows you to quickly adapt your digitization project

Auth0’s founders wrote the book on identity management at Microsoft while helping development teams remove barriers to building applications in the cloud. The Auth0 Identity Platform is designed with developers in mind, with multiple [extensibility](https://auth0.com/extensibility) points that allow you to configure the exact authentication flows you want.

### Exhaustive integrations mean you can bridge the legacy/cloud gap easily and iteratively

No matter what systems you have housed on-prem or on legacy infrastructure and what you have already migrated to the cloud, our [Application Programming Interfaces (APIs)](https://auth0.com/docs/api) and [Software Development Kit (SDK) libraries](https://auth0.com/docs/libraries) mean, you can use one CIAM solution to bridge the gap. That allows you the flexibility to continue your deployment iteratively, knowing that your customer experience won’t suffer any negative impacts as you migrate more services to the cloud on your own schedule.

We’re able to integrate with most existing cloud-based SaaS services via our APIs and SDKs but can also integrate with your on-premise environments as long as they’re accessible via API or otherwise. We are also up to date with the [General Data Protection Regulation (GDPR)](https://auth0.com/docs/compliance/gdpr) enacted by the European Union in 2018, so we can help and support our customers in meeting their compliance requirements.

Additionally, [Auth0 Marketplace](https://marketplace.auth0.com/) and [Actions](https://auth0.com/actions) provide access to a wide array of out-of-the-box integrations with most line-of-business software and services. That means you can quickly connect your CMS and ERP to your new web app, and your users won’t see any change in their experience as it’s serverless, so there won’t be any interruption to your services.

### No-, low-, and pro-code options for creating a low-friction user experience

Between the pre-configured integrations in [Auth0 Marketplace](https://marketplace.auth0.com/) and our low-code [Actions](https://auth0.com/actions) capability, your development team can easily customize Auth0 to meet your customers’ expectations for a secure and low-friction authentication experience. For even more control, we still offer pro-code customization, as always, via our JavaScript editor.

The ability to have all your identity needs up and running quickly means your team can focus on serving their primary functions. Your developers can continue delivering top-quality experiences for your customers, and IT support can maintain your internal employees’ work environment, no matter where they’re working from.

## Partnering With Auth0 Ensures a Secure, Customizable CIAM Experience

You can rely on the identity professionals at Auth0 to help:

* focus your development team on innovation
* deliver the identity experience consumers have come to expect
* protect customer data with a deployment option that works for your business

That’s how you deliver an excellent user experience without compromising security or privacy along the way. Read more about our [compliance and certifications](https://auth0.com/docs/compliance), then [reach out to an identity expert](https://auth0.com/contact-us) to continue the conversation about how partnering with Auth0 can help your organization. 




Bridging Legacy Systems and Digital Transformation with CIAM

auziros:jeana-tahnk

Jeana has been in the tech industry for 15+ years, both as a communications professional and writer. As Director of Global Communications at Auth0, she works with her internal team and external agencies to amplify the company's visibility worldwide and establish its leadership in the identity industry. When she is not working, she can most likely be found on a field watching one of her three kids playing sports, or cleaning up after her one-year-old retriever who chews everything.

Senior Director, Global Communications

Jeana Tahnk

Joins exclusive group of AWS Partners with deep expertise and proven success in helping customers around the world build a secure digital workplace

**BELLEVUE, Wash. – June 3, 2021 –** The [Auth0](https://auth0.com/) Identity Platform, a product unit within Okta, today announced that it has achieved [Amazon Web Services (AWS) Digital Workplace Competency](https://aws.amazon.com/products/end-user-computing/partner-solutions/?partner-solutions-cards.sort-by=item.additionalFields.partnerNameLower&partner-solutions-cards.sort-order=asc) status. This global designation recognizes that Auth0 provides identity and access management (IAM) and deep expertise in supporting customers that need to effectively support their remote workers and business continuity with end-to-end digital workplace solutions in the cloud.

AWS Digital Workplace Competency Partner solutions free end users from the office by allowing them to work securely on any device, from anywhere, at any time. Achieving the AWS Digital Workplace Competency differentiates Auth0 as an AWS Partner Network (APN) member that provides specialized demonstrated technical proficiency and proven customer success with specific focus on helping customers deploy digital workplace services on AWS. To receive the designation, AWS Partners must possess deep AWS expertise and deliver solutions seamlessly on AWS.

“The onset of COVID-19 has accelerated the transition to digital services and remote work, and identity is an essential role in that shift,” said Eric Snyder, Senior Director of Business Development at Auth0. “As a remote-centric company since 2013 and a leader in helping organizations across all industries secure their valued assets and data more firmly, we are proud to achieve AWS Digital Workplace Competency status and are dedicated to helping companies achieve their technology goals by leveraging the agility, breadth of services, and pace of innovation that AWS provides.”

AWS is enabling scalable, flexible, and cost-effective solutions from startups to global enterprises. To support the seamless integration and deployment of these solutions, AWS established the [AWS Competency Program](https://aws.amazon.com/partners/competencies/) to help customers identify Consulting and Technology AWS Partners with deep industry experience and expertise.

Auth0 is an AWS Partner in the APN and recently joined the [AWS Public Sector Partner (PSP) program](https://auth0.com/blog/auth0-joins-the-amazon-web-services-public-sector-partner-program/). Additionally, the company achieved the [AWS Security Competency](https://auth0.com/blog/auth0-achieves-aws-security-competency/) status in 2020 and provides AWS customers with seamless access to [professional services in AWS Marketplace](https://auth0.com/blog/auth0-supports-the-launch-of-professional-services-in-aws-marketplace/). For more details, please see [Auth0’s AWS integration options](https://auth0.com/docs/integrations/aws).

[Auth0, recently acquired by Okta](https://auth0.com/blog/okta-acquisition-announcement/), provides a modern identity platform that helps organizations meet the security, privacy, and convenience needs of their users. Please visit [Auth0 Identity Platform](https://auth0.com/identity-platform) to learn more.

<include src="asides/AboutAuth0" />
### Media Contacts
Global Communications 
Auth0 
[press@auth0.com](mailto:press@auth0.com) 

Matter for Auth0 
[auth0@matternow.com](mailto:auth0@matternow.com)

Auth0 Achieves AWS Digital Workplace Competency Status

joey devilla headshot 900px

I’m a Senior Developer Advocate at Auth0, and I like to work on various technologies. I’ve developed software for all sorts of platforms, from CD-ROM and the PalmPilot to my current area of focus, mobile phones, IoT devices, and AI. When I’m not looking for strange new platforms to write software for, I’m playing a strange old instrument — the accordion!

Joey deVilla

Here’s an easy-to-understand analogy to help your non-technical friends and customers understand public keys and private keys, and how they relate to cryptography and digital signatures.

**If you work in cybersecurity or any computer-related field, sooner or later, you’ll have to explain public-key cryptography and digital signatures to non-technical people.** With the recent rise of remote work and stories about system breaches, computer security has become a topic of discussion even among laypeople.

After trying to explain public-key cryptography and digital signatures to some clients with varying degrees of success, I wanted to develop an analogy that explained them and was easy to remember. I’ve found that even techies get confused by the formal definitions, and many non-technical explanations just seem unsatisfying.

That’s when I stumbled upon [Panayotis Vryonis’](https://twitter.com/vrypan) article, [*Public-key cryptography for non-geeks*](https://blog.vrypan.net/2013/08/28/public-key-cryptography-for-non-geeks/). It became my go-to analogy until my computer science professor, [Dr. Robin Dawes](http://research.cs.queensu.ca/home/dawes/) pointed out a flaw. I refined it with his help, and a suggestion from Matthew Ernest, and the result is below. I hope you find it helpful when trying to explain these concepts to anyone!


## The Box

Imagine a box with a special lock, as pictured below:

![Photo of a box with a lock. There is a key inserted into the lock. Caption: "The box has a lock with three positions: Locked (at the 9:00 position), unlocked (at the 12:00 position), and locked (at the 3:00 position)."](https://images.ctfassets.net/23aumh6u8s0i/4nm7EvXpqVqMxfOPkjUlXe/bca6b7d8d0a00658045dd4f3fd0a5c7f/the_box_has_a_lock_with_three_positions.png)

The lock has three positions:

1. When the lock is at the “9:00” position, the box is locked, and its contents are inaccessible.
2. When the lock is at the “12:00” position, the box is unlocked, which means you can open it and view its contents.
3. When the lock is at the “3:00” position, the box is locked, and its contents are inaccessible.

In order to avoid wandering into endless “What if...?” tangents, assume that it’s prohibitively costly to pick the lock or break the box.


## The Keys

There are two kinds of keys that work with the box’s lock.

### The private key

The first kind of key belongs to you, and only you. You don’t share it with anyone else, which is why it’s called the **private key**. You might make a backup copy in case of emergencies, but you keep it in a safe place that only you know.

![Photo of a single key. Caption: "You keep the private key to yourself."](https://images.ctfassets.net/23aumh6u8s0i/2PJXCaqzggdgTpN4FSm8Qj/4a1228e2e8a6a46ad103c01ffd197e58/you_keep_the_private_key_to_yourself.png)

The private key fits the lock, but it has a particular limitation: it can only turn *clockwise*.

![Photo of the box with lock and key. An arrow indicates that the key is being turned clockwise. Caption: "The private key only turns clockwise."](https://images.ctfassets.net/23aumh6u8s0i/qqPVi6JTc2HOW4SuE4sEj/8fcd841021e55b659a3c5b92ad9b2da2/the_private_key_only_turns_clockwise.png)

### The public key

You treat the second kind of key very differently. Unlike the first key, you’ve made many, many copies of these keys. You’ve given them to everyone you know, and even people you don’t know. You’ve left them in as many public places as you could reach: restaurants, stores, busy streets, dark alleys, and any place you happened to pass through. You’ve even left them in other towns, and even other countries! Because of the way you treat this key, it’s called the **public key**.

![Photo of hundreds of keys hanging on hooks on a wall. Caption: "You hand out copies of the public key freely."](https://images.ctfassets.net/23aumh6u8s0i/2LTNf9JxfjDuB4rMZyM7K6/4a3a6264b81bf2b90efaffe469d3406c/you_hand_out_copies_of_the_public_key_freely.png)

Like the private key, public keys also fit the lock, and they also have a particular limitation — but in the opposite direction. They can only turn *counterclockwise*.

![Photo of the box with lock and key. An arrow indicates that the key is being turned counterclockwise. Caption: "The public key only turns counterclockwise."](https://images.ctfassets.net/23aumh6u8s0i/6QVsGSSoLuNdRgpfHznh6H/b5f42c68a9d5aa9e322e898cac14aeb3/the_public_key_only_turns_counterclockwise.png)


## How They Work Together

The lock, private key, and public keys work together to produce these interesting outcomes:

* If the box is locked with a public key, only the private key can unlock it.
* If the box is locked with the private key, only a public key can unlock it.

The keys are designed so that you can’t use one key to figure out how to make the other key.

We can use the box and keys to create two useful kinds of secure communication:

1. I can send you a secret message.
2. You can send me a message with proof that you (and not some impostor) sent it and that it wasn’t altered *en route*.

Let’s take a closer look at each of these kinds of secure communication.

## Sending Secret Messages

Suppose I wanted to send you a message that I wanted only you to read. We have enemies in common who’d love nothing more than to know what’s in the messages I send you.

We each have a cadre of minions to deliver our messages. We trust them... to a limited extent. It would be all too easy for our foes to intercept our messages through force or bribery. 

There must be a way to send messages to you secretly, and that’s where the box comes in. I can use the box to send the message so that no one but you can read it. 

You have the only private key. Everyone else has at least one of the public keys because you’ve been giving them away like candy. 

I put my message in the open box. Since it’s open, it’s unlocked, which means the lock is at the “12:00” position. 

I use one of the many copies of the public key that I own to lock it, turning it counterclockwise from the unlocked “12:00” position to the locked “9:00” position.

![Photo of the box with lock and key. An arrow indicates that the key is being turned counterclockwise. Caption: "I lock the message in the box with the public key..."](https://images.ctfassets.net/23aumh6u8s0i/3WnNKlXN7MC0BfDdEU8GyX/2bcc1521f829c80ff548cf7234078bba/i_lock_the_message_with_public_key.png)

The message is now ready for a minion to deliver to you.

I’m not worried that my minion or anyone other than you will be able to read the message while it’s in transit. Even though anyone can easily find the public key, they can’t use it to unlock the box. Only the private key can unlock the box if it’s been locked with the public key.

When you receive the box, you use the private key to unlock it, turning the key clockwise from the “3:00” position to the “12:00” position.

![Photo of the box with lock and key. An arrow indicates that the key is being turned clockwise. Caption: "...and you unlock it with the private key."](https://images.ctfassets.net/23aumh6u8s0i/2kwG5ogtYDYCkDtjC0MqgN/75f2cb365ea0014a0af58a7dbc90c481/you_unlock_it_with_the_private_key.png)

In summary: to send you a secret message, I use a public key to lock the message so nobody can read it, and you use a private key to unlock the message so that you can read it.

This is the general idea behind public-key encryption: **encrypt with the public key, decrypt with the private key.**

## Signing Messages

The “secret messages” use case for the box and private and public keys is intuitive: anyone with a public key can lock a message, but only the holder of the private key can unlock it.

There’s another way to use the box and keys: you can lock a message with the private key, which anyone with the public key can unlock. What could a possible use case there be for a system where anyone can unlock the box?

Suppose one of our common enemies has been trying to break up our alliance and that I’ve been receiving very hurtful messages that appear to have come from you. (I’ll leave the content of those messages to your imagination.)

That enemy has either been sending fake messages or has been intercepting and altering your real ones. There has to be a way to package a message in order to prove that it’s actually from you!

There *is* a way: the box!

In this scenario, you put your message in the open box. Since it’s open, it’s unlocked, which means the lock is at the “12:00” position. 

Using the private key, you “sign” the message by locking it, turning the key counterclockwise from the “12:00” position to the “9:00” position.

![Photo of the box with lock and key. An arrow indicates that the key is being turned clockwise. Caption: "You 'sign' the message with the private key..."](https://images.ctfassets.net/23aumh6u8s0i/1U2aOr7mKgMtGdZM8lPLWT/82ff89d7160d93b04fff8ac635fd41d7/you_sign_the_message_with_the_private_key.png)

One of your minions delivers the box to me.

Since you locked the box with the private key, anyone can unlock it with any one of the many public keys you have distributed. Our common enemy, knowing that this message is in transit, could intercept it and replace your invitation to tea with a “top ten” list of very cutting insults that would surely dissolve our alliance.

The problem with the enemy’s plan is that it won’t work. Intercepting and altering the message means that they would have to do one of two things before forwarding the box to me.

1. They could leave the box unlocked. Since the box is supposed to arrive locked, this is an obvious sign that the message may have been tampered with.
2. They could lock the box. They would have to do it with a public key, which means that only the private key can unlock it. I wouldn’t be able to unlock the box with the only key I had — the public key — which would lead me to conclude that someone had unlocked the box before I did.

If the box arrives at my doorstep and...

* It’s locked
* I can unlock it with the public key

...then, I can be assured that the message came from you and wasn’t changed *en route*.

![Photo of the box with lock and key. An arrow indicates that the key is being turned counterclockwise. Caption: "...and I verify your 'signature' with the public key."](https://images.ctfassets.net/23aumh6u8s0i/4Fax8BanX5Qts7KJzW7166/b4dc34b169f6eca961c8d8f3c7452af4/i_verify_your_signature_with_the_public_key.png)

In summary: to send me a message with proof that you are the sender, you use the private key to lock the message. You’re the only person with the private key, and only a public key can unlock messages locked with the private key. If one of the public keys can unlock that message, I know that it came from you.

This is the general idea behind digital signatures: **sign with the private key, verify with a public key.**

## How About Sending a Message That’s Both Secret *and* Signed?

You might think that sending a message that is both secret and signed is paranoid. I would answer by saying, “Paranoia is the ***mistaken*** impression that people are out to get you.”

Suppose I wanted to send you a secret signed message. I could do it with two boxes:

1. A smaller box, which I own. It will prove that I sent the message. I have the private key for this box, and you have one of its public keys.
2. A larger box, which you own. It will keep the message secret. You have the private key for this box, and I have one of its public keys.

I would lock the message in my smaller box using my private key and then lock it in your larger box using your public key.

When you receive the delivery, you will unlock your larger box first, using your private key. This would reveal my smaller box inside, which you would unlock with my public key.


## It’s Not Keys and Boxes, but Numbers and Algorithms

Of course, we’re not really dealing with boxes, keys (at least the kind that goes into locks), or minions. Here’s a list of elements in these stories and their real-world equivalents:

* **The message**: Anything that you’d want to send that can you can view or edit with a computer. It could be text, one or more pictures, an audio or video recording, a database, or even an application. As far as the computer is concerned, messages are just a long series of numbers.
* **The private and public keys**: Very large numbers that are used in a lengthy math process to encrypt, decrypt, sign, and verify messages.
* **The box**: An algorithm that takes the message and keys and performs the math process to encrypt, decrypt, sign, and verify messages.
* **Minions**: The way in which the message is sent. This could be the internet but could just as easily be an actual minion, such as an unsuspecting summer intern with a USB key.

In the alternate universe where messages are sent with boxes and keys, everyone would have their own set of boxes with their own private keys, as well as copies of other people’s public keys. In the real world, we run applications that run public-key encryption and digital signature algorithms to secure our messages. We still use public and private keys in the real world; they’re just digital.

How to Explain Public-Key Cryptography and Digital Signatures to Anyone

diegopoza

System Engineer, geek, foodie, technology lover, speaker.

Sr Manager, Developer Advocacy

Diego Poza

Why Naranja and Wabi turned to Auth0 to ensure identity expertise and scaling

The market in Latin America is growing faster than ever, with new venture capital deals nearly doubling to 488 between 2017 and 2020, according to [Bloomberg](https://www.bloomberg.com/news/articles/2021-03-16/latin-american-startups-had-record-venture-capital-deals-in-2020). Beyond VC, a [study by IDB lab](https://publications.iadb.org/publications/english/document/Tecnolatinas-2021-The-LAC-Startup-Ecosystem-Comes-of-Age.pdf) revealed that the tech-enabled startup market hit a valuation of more than $220 billion USD in 2020.

![LATAM](https://images.ctfassets.net/23aumh6u8s0i/Gz6t31FLxbPc7r8T996gE/caed742f057acf90192df17560dbf527/Latam11.jpg)

Globally, the pandemic has [accelerated digital road maps across industries](https://auth0.com/blog/how-brick-and-mortar-approaches-improve-digital-experiences/) and businesses now have to respond to changes in digital expectations and buying patterns.
<include src="QuoteCard" body="Companies cannot predict exactly what their business and customers will need tomorrow, especially in response to today’s rapidly changing digital environment." name="Gabriel Camargo" title="Product Director" team="" company="CLM" />

Partnering with [CLM](https://auth0.com/blog/auth0-expands-global-partner-network-in-latin-america-with-clm/) on distribution in Latin America (LATAM) extends Auth0’s reach into Brazil, Colombia, Ecuador, and Peru.

Over the years of working within Latin America, we’ve learned that [identity expertise](https://auth0.com/blog/building-an-identity-solution-quantity-doesnt-equal-quality) and [scalability](https://auth0.com/blog/can-your-identity-solution-grow-with-your-company) are two critical areas of concern for businesses in the region. You can check out our earlier posts in this series for details, but here, we wanted to look more closely at how we were able to help two companies within the region.

## Naranja — From Leading Credit Card Issuer in Argentina, To Complete Consumer Ecosystem

[Fintech leader Naranja](https://auth0.com/case-studies/naranja/) has been providing credit cards to the Argentinian market for over 30 years. In that time, they’ve grown to cover over 5 million customers by keeping those customers’ needs their top priority. As they grew, Naranja also began to integrate additional verticals into their business model. Pretty soon, they were offering payment services, financing, travel, media, and other services beyond their credit card programs.

As they added these verticals, Naranja’s head of engineering Javier Voos soon realized they would need to consolidate their identity solution to cover all aspects of their growing ecosystem. He knew that in order to continue putting the customer experience first, they would need to find the right IDaaS provider that would be able to scale along with their planned expansion.

[link to video](https://www.youtube.com/watch?v=kqouiuVk07Q&feature=emb_imp_woyt)

<iframe width="560" height="315" src="https://www.youtube.com/embed/kqouiuVk07Q" title="YouTube video player" frameborder="0" allow="accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture" allowfullscreen></iframe>

<include src="QuoteCard" body="The main idea behind the Naranja ecosystem is to provide the best experience to our customers, making sure that our digital platform provides all the resources that an online business needs for success, and hence support the ecosystem evolution." name="Javier Voos" title="Head of Engineerin" team="" company="Naranja" />

Voos’ priority was to find a platform that provided secure APIs for identity so they could focus their expansion efforts on B2B services alongside their expanded consumer offerings. Finding Auth0 meant that his team could implement one identity solution that would allow both B2B and B2C customers access to the platforms they needed access to while ensuring data privacy and a low-friction user experience.
<include src="QuoteCard" body="Auth0 gave our company the tools to secure the access to our API for first- and third-party consumers, in a way that can scale through time and put us in a better position to ally with new partners and work our way to a fully functional Naranja API Market." name="Danilo Asis" title="Solution Architect" team="" company="Naranja" />

## WABI — South America’s E-Commerce Portal

With a half-dozen offerings already on offer, [WABI](https://auth0.com/case-studies/wabipay/) is looking to the future. Their ambitious goal is to become Latin America’s go-to e-commerce portal. Their offerings already include WABI, a smartphone-based grocery service; Wabipay, an e-wallet app; and four additional applications. The end-goal WABI envisions is for customers to log in one time and have access to a complete, end-to-end e-commerce experience. They’ll be able to shop, pay, and track delivery all in one place.

Juan Manuel Mingo, former WABI Business Manager, sums up the hurdle they faced when it came to identity and customer authentication, “We had different platforms with different user registration processes,” he says. “Our aim was to unify all the user registration of the different platforms in order to get a better user experience and to have a more organized user database.” The disjointed customer experience was the first thing WABI knew they would have to solve before they could continue growing and expanding their e-commerce ecosystem. 

<include src="QuoteCard" body="Our endgame is that you enter the ecosystem through Wabi. You log in to Wabi, order your things, and when you want to pay, you simply go to WabiPay, and you’re already logged in." name="Frederico Galli" title="General Manager" team="" company="WABI" />

Like Naranja, WABI has always had a customer-first attitude. That meant that customer-facing features like single sign-on were top priorities. As Frederico Galli stated, their endgame is for customers to sign in once and have access to the entire ecosystem of WABI offerings. Not only that, but with further expansion plans in the works, they needed an identity solution that was with them for the long haul. Juan Manual Mingo put it like this, “WABI is scalable, and we need a partner that is, too. We believe Auth0 will support us in getting there.”

![LATAM](https://images.ctfassets.net/23aumh6u8s0i/P45m9X6Z8ag9oOTv8R4kW/cc92f6325cb89fd84f233aa6c6992218/Latam12.jpg)

## Learn how Auth0 can help your business

[Argentinian talent Eugenio Pace and Matias Wolowski](https://www.forbesargentina.com/editorial/la-increible-historia-auth0-cliente-us-27-quinto-unicornio-hoy-vale-us-1100-n1352) founded Auth0, so we know the ins and outs of the South American market. When you’re ready to bring your identity solution in line with your broader organizational expansion goals, reach out to our [market experts](https://auth0.com/contact-us) to start the discussion about how we can help.

<include src="asides/AboutAuth0" />

LATAM Response to Rapid Digital Change

Inaugural report reveals insidious trends and provides mitigation strategies for security professionals.

**BELLEVUE, Wash. – June 16, 2021 –** The [Auth0](https://auth0.com/) Identity Platform, a product unit within Okta, today announced the launch of its inaugural security report: [The State of Secure Identity](https://auth0.com/resources/whitepapers/state-of-security-identity-report). This detailed report highlights key areas of concern for security professionals responsible for managing digital identities, including the exponential rise of credential stuffing attacks (automated attempts to compromise a large number of user accounts with stolen credentials), fraudulent registrations, and the widespread use of breached credentials. 

Recent headlines and high-profile cyber attacks give today’s security professionals a wide swath of serious threats to worry about. The primary goal of cybercriminal activity is to access critical resources, systems, and personal data, yet systems that can be put into place to minimize the risk of attack — like identity management — often get deprioritized. Lack of budget, resourcing, or attention on managing digital identities give threat actors a prime opportunity to take advantage of these discrepancies and surreptitiously execute their attacks. 

Research into Auth0’s global customers over the past year found these key facts and figures: 

* In the first 90 days of 2021, credential stuffing accounted for 16.5% of attempted login traffic on its platform, with a peak of over 40% near the end of March — all of which Auth0 detected and prevented. 
* Travel & leisure and retail are the top two industries most affected by credential stuffing attacks. 
* The number of fraudulent registrations vary by industry vertical, but roughly 15% of all attempts to register a new account can be attributed to bots.
* In the first 90 days of 2021, the Auth0 platform detected breached passwords at an average of more than 26,600 per day, with a minimum of just under 7,300 and a high on Feb. 9, 2021, exceeding 182,000.

“Securing customers’ identities is made more difficult by industry-wide failures to protect data. The prevalence of breached passwords and the availability of automated attack tools makes the humble password a protective measure from the past,” said Duncan Godfrey, VP of Security Engineering, Auth0. “The State of Secure Identity Report is designed to share our unique identity security insights and recommendations with the industry so that application builders and developers at any organization can take the steps they need to improve their overall security posture and make things more secure for end users.” 

The most prevalent threats detailed in the report include Credential Stuffing (the most common threat observed by Auth0); Fraudulent Registrations; Multi-factor Authentication Bypass; Breached Password Usage; and other common identity attacks. The complete Auth0 State of Secure Identity Report, which includes additional key findings and recommendations on how organizations can improve their identity security posture, can be downloaded **[here](https://auth0.com/resources/whitepapers/state-of-security-identity-report)**. Auth0 will also be hosting an online meetup to examine these insights in greater detail on **[Thursday, June 24 at 8:00 AM PDT](https://auth0.com/resources/upcoming-webinars/state-of-security-identity-report-session-one)**. 

[Auth0, recently acquired by Okta](https://auth0.com/blog/okta-acquisition-announcement/), provides a modern identity platform that helps organizations meet the security, privacy, and convenience needs of their users. Please visit the [Auth0 Identity Platform](https://auth0.com/identity-platform) to learn more.

<include src="asides/AboutAuth0" />
### Media Contacts
Global Communications 
Auth0 
[press@auth0.com](mailto:press@auth0.com) 

Matter for Auth0 
[auth0@matternow.com](mailto:auth0@matternow.com)

Auth0 Releases State of Secure Identity Report, Highlighting the Most Pervasive Threats to Digital Identities

Matt Duench

Matt is a product marketer that loves helping people solve complex identity-related challenges through technology. As the Senior Director of Product Marketing at Auth0, he is focused on helping companies deliver a customizable balance of convenience, security, and privacy to their end-users through identity.

Senior Director, Product Marketing

Learn how a low-code approach can help organizations save time and money on software development.

As [more customer interactions move online](https://www.mckinsey.com/business-functions/marketing-and-sales/our-insights/a-global-view-of-how-consumer-behavior-is-changing-amid-covid-19) post-2020, [a recent report from McKinsey](https://www.mckinsey.com/business-functions/strategy-and-corporate-finance/our-insights/how-covid-19-has-pushed-companies-over-the-technology-tipping-point-and-transformed-business-forever) suggests that organizations must “recognize technology’s strategic importance as a critical component of the business, not just a source of cost efficiencies” if they haven’t already.

However, rapid digital transformation is easier said than done for most organizations, given most are [already struggling to find enough tech talent](https://www.daxx.com/blog/development-trends/software-developer-shortage-us). And it’s why more organizations are turning to low-code development to help them deliver the digital experiences their customers now demand.

Below is what executives need to know about low-code and how it can help them save time and money on software development.

## What Is Low-Code Development?

Low-code is an approach to software development that reduces the amount of custom coding required to build an application by incorporating drag-and-drop interfaces, process modeling, reusable code templates, and [software development kits](https://auth0.com/blog/what-is-an-sdk/) (SDKs) into the software development process.

Low-code platforms do not replace the job of a software developer but rather make app development faster by providing developers and non-developers with prebuilt sections of code they can assemble (either visually or in a traditional development environment) instead of hand-coding every line.

### Low-Code vs. No-Code

The terms “low-code” and “no-code” are often used interchangeably. But in practice, they’re two separate approaches to software development.

* **No-code development** eliminates the need for coding altogether by making the entire application design process a visual drag-and-drop experience. As a result, anyone can use a no-code platform to build an application or website. However, the accessibility of no-code development usually limits the functionality a user can build into their application based on the prebuilt capability of the editing environment.
* **Low-code development** also makes the development process more accessible to non-developers. But low-code platforms are still primarily designed for professional developers because they do not completely eliminate the need for coding skills. Low-code development platforms offer greater flexibility than no-code platforms, but they also require a higher technical aptitude to fully implement a functional application.

[Adalo](https://www.adalo.com/) is an example of a no-code platform because it allows anyone to build a mobile app by dragging and dropping elements inside its editing environment. But a platform like [Retool](https://retool.com/) is considered a low-code tool since it still requires developers to write custom code to build a functional internal business tool.

## The Benefits of Low-Code Development

Low-code development can save businesses [hundreds of development hours,](https://retool.com/blog/avo-story/) cut their development times [by 50-90%](https://www.redhat.com/cms/managed-files/mi-451-research-intelligent-process-automation-analyst-paper-f11434-201802.pdf) compared to developing an application from scratch with custom coding, and reduce their IT spends by [as much as 20%](https://www.appian.com/resources/nucleus-research-low-code-application-platforms-lcap-technology-value-matrix-2020/). As a result, it helps solve several common challenges that hinder digital transformation efforts for many organizations.

### Improved Agility

Low-code development shortens the Software Development Lifecycle (SDLC), which helps your organization respond to market or business changes faster than you’d be able to if your development team had to code everything from scratch.

Low-code also makes it easier to incorporate non-developers into the development process, which is something most highly agile businesses are good at, according to [PMI](https://www.pmi.org/-/media/pmi/documents/public/pdf/learning/thought-leadership/achieving-greater-agility-series/vital-role-culture-commitment.pdf?sc_lang_temp=en&utm_source=&utm_medium=&utm_campaign=&utm_term=&utm_content=). For example, since low-code software development is visual, a developer can [spin up a sample app](https://flows.auth0.com/) for business teams to evaluate much faster than they could with custom coding, which shortens the feedback loop and helps improve the finished product.

### Smaller Project Backlogs

Many enterprises have [project backlogs that cost them billions of dollars](https://www.techrepublic.com/article/low-code-platforms-help-with-project-backlogs-and-software-development-training/) in sales opportunities because they can’t find the right talent or software to address business opportunities fast enough. Low-code can help reduce costly backlogs because it helps your development team(s) [get more done](https://www.appian.com/resources/nucleus-research-low-code-application-platforms-lcap-technology-value-matrix-2020/) in less time.

### Increased Scalability

Low-code development turns application elements like user interfaces, integrations, and custom logic into visual building blocks that developers can reuse anywhere by dragging and dropping them into the design interface. Depending on the platform, a low-code approach often simplifies the work required to scale and maintain custom applications across an entire enterprise or for millions of customers, since a developer can build something once and implement it everywhere [in minutes](https://auth0.com/case-studies/cimpress/).

### More Developer Time For Innovation

According to [a global study by Stripe](https://stripe.com/files/reports/the-developer-coefficient.pdf), nearly 75% of the average developer’s week is spent on maintenance and dealing with technical debt. Since low-code development helps simplify the work required to scale and maintain software, it reduces the burden of updating legacy systems and the accrual of technical debt in the first place.

As a result, low-code can free up developer time for higher-value projects, like finding ways to innovate for your employees (which helps reduce their need to find their own software solutions ([shadow IT](https://en.wikipedia.org/wiki/Shadow_IT))) or customers.

## Low-Code Development Use Cases

Low-code development is a broad term that covers a lot of different use cases. Although most commonly used via standalone platforms for application development, low-code tools can also be incorporated into platform-as-a-service (PaaS) or other software-as-a-service (SaaS) solutions to reduce the time developers need to build applications or integrate services into their business apps. Below are the most common places low-code can help you save time and money on development costs.

### Websites

Many website builders are both a no-code and a low-code environment. For example, [Webflow](https://webflow.com/no-code) allows a user to design a website without any coding at all. But it also[ offers the option](https://webflow.com/blog/webflow-custom-code-tips) to inject HTML, CSS, and JavaScript into a site to customize it beyond what its no-code environment allows.

### Internal Business Applications

Not only does low-code development free up developer time to build internal apps or dashboards for business users, but it also helps developers build and scale those internal software solutions more effectively. For example, low-code automation platforms (LCAPs) help organizations turn business processes and tasks into automated software workflows [faster than coding them from scratch](https://www.appian.com/).

### Customer-Facing Applications

Low-code platforms often reduce the amount of time required to bring a web application or mobile application to market, as well as help businesses incorporate end-user feedback to improve those applications [faster](https://www.mendix.com/customer-stories/suez/).

### Replatforming

Low-code PaaS solutions make it easier to replace or upgrade critical components of your legacy systems with cloud-based solutions rather than trying to code everything from scratch.

For example, Auth0 [Marketplace](https://marketplace.auth0.com/),[ Actions](https://auth0.com/docs/rules), [Universal Login editor](https://auth0.com/docs/universal-login/universal-login-page-customization), and [SDKs](https://auth0.com/docs/libraries) with sample code for many technology platforms all save developers [hundreds of hours](https://auth0.com/case-studies/gymshark/) required to implement user-friendly authentication features while ensuring compliance with important data security standards (for example, [HIPAA](https://auth0.com/learn/why-hipaa-compliance-is-vital-your-business/) or [ISO 27001](https://auth0.com/blog/what-is-iso-27001-2013-a-guide-for-businesses/)).

## Consider Making Low-Code a Part of Your Strategy

Low-code can reduce the need for custom coding and allow developers to focus more of their time on the things that make their products unique rather than common (but necessary) tasks like identity. 

It’s why we continue to invest in low-code development tools for Auth0’s platform: to ensure developers can integrate identity quickly and get back to high-value tasks that will help your business grow.

Learn more about how Auth0 designs for developer experience using low-code, no-code, and pro-code [here](https://auth0.com/blog/designing-for-devs-at-auth0/).

<include src="asides/AboutAuth0" />

What Is Low Code? How Low Code Can Speed Digital Transformation

jenny-obrien

I'm a former business journalist who's fascinated by the intersection of tech and business strategy — in particular how the right solution can transform an idea into reality. I specialize in ROI, data privacy, and identity.

Business Content Manager

Jenny O'Brien

Digital adoption is higher than ever. Is your CX keeping up?

You successfully responded to the pandemic by speeding your digital transformation by six, maybe even 10, years ahead of your road map. After achieving overnight agility, what’s next? 

Across sectors, we’ve seen a [rise in digital adoption](https://www2.deloitte.com/content/dam/Deloitte/global/Documents/Financial-Services/gx-fsi-realizing-the-digital-promise-covid-19-catalyzes-and-accelerates-transformation.pdf), including in demographics that have previously been slow to reach for apps, like Boomers and seniors. Lockdowns drove the discovery of digital solutions to daily needs, resulting in an uptick in [online grocery sales](https://techcrunch.com/2020/07/06/u-s-online-grocery-shopping-hits-record-7-2-billion-in-june/) and an increase in curbside pickup. 

A [McKinsey survey](https://www.mckinsey.com/business-functions/mckinsey-digital/our-insights/europes-digital-migration-during-covid-19-getting-past-the-broad-trends-and-averages#) of 20,000 European consumers in the spring of 2020 found that on average, 70% of consumers across sectors said they intended to continue using digital services after COVID-19 as much as they did during the pandemic. “There’s no going back,” notes McKinsey. “Bold vision and disciplined execution on a set of key imperatives will ultimately differentiate the leaders from the laggards as this crisis abates.”

**In other words, a decent digital experience is now table stakes.** 

Fine-tuning work that might have been rushed during the pandemic and checking for security and compliance issues will be covered in a future series. Right now, let’s take a look at why your brand experience needs to be seamless, whether your consumer finds you in the digital world or the real one. 

![Retail: Craft New Buying Experiences](https://images.ctfassets.net/23aumh6u8s0i/1CnIZP0jw9xwsq99pE9JP7/d32690c1c3a8a3b3f3bce18f9df2020c/38_Three_Ways_Retailers_Can_Harmonize_1-2.jpg)

## Retail: Craft New Buying Experiences 

Customer loyalty got a shock during the pandemic, with 75% of surveyed US consumers saying they had tried a new shopping behavior by June of 2020, whether new brands, a different shopping method or even different retailers, [reports McKinsey](https://www.mckinsey.com/business-functions/marketing-and-sales/our-insights/the-great-consumer-shift-ten-charts-that-show-how-us-shopping-behavior-is-changing?cid=other-eml-alt-mip-). For those who tried a new digital method, 80% say they intend to continue.

The good news for businesses is that COVID-19 drove an increased appetite for new experiences. Implementing a new experience doesn’t have to be complicated, but the ones that showed early success were driven by the combination of real-world experience with digital.

> **✔︎ [How ecobee confidently entered home security](https://auth0.com/case-studies/ecobee/)** 
> **✔︎ [Optical retailer Grandvision on creating an omnichannel experience](https://auth0.com/case-studies/grandvision/)** 

While many restaurants suffered due to lockdown requirements in 2020, brands that offered drive-through and added curbside pickup fared better. Restaurant Brand International Inc. (RBI), the owner of brands like Burger King and Tim Hortons, says digital sales grew more than 120% YOY in [Q2 of 2020](https://www.fool.com/earnings/call-transcripts/2020/08/07/restaurant-brands-international-inc-qsr-q2-2020-ea.aspx). RBI CEO Jose Cil expects curbside pickup will see long-term growth since it expanded access without cannibalizing drive-through traffic.

That experience was mirrored at hypermarket [Walmart](https://corporate.walmart.com/newsroom/2020/11/17/walmart-releases-q3-fy21-earnings) which added a curbside pickup to grow online sales by 79% in Q3 and another [69% in Q4](https://corporate.walmart.com/media-library/document/q4-fy21-earnings-release/_proxyDocument?id=00000177-b235-d73b-a9f7-b2f591660001#:~:text=Walmart%20U.S.%20Q4%20comp%20sales1,U.S.%20eCommerce%20sales%20grew%2069%25.&text=Q4%20FY21%20GAAP%20EPS%20of,were%20%241.1%20billion%20in%20Q4.). 

Consumer electronics retailer Best Buy reported a [300% growth in domestic online sales](https://www.fool.com/investing/2020/05/27/where-will-best-buy-be-in-1-year.aspx) during a curbside pickup experiment, with an additional [90% increase](https://www.businesswire.com/news/home/20210225005118/en/Best-Buy-Reports-Fourth-Quarter-Results) in sales driven by digital access and attention to customer experience in Q4. 

### Mobile matters

But, as [Forbes](https://www.forbes.com/sites/aliciakelso/2020/09/22/restaurant-chains-rushed-to-add-curbside-pickup-during-the-pandemic-heres-why-theyll-keep-the-channel-after-it-ends/?sh=7393b4fd1622) points out, “Curbside doesn’t just happen at the flip of a switch. Most of the brands that have successfully added the channel in the past six months have a robust mobile app in place, which facilitates the ordering process.”

Best Buy has continued to experiment with customer experience, strategically opening some stores for [one-to-one shopping appointments and converting 450 stores to fulfillment centers. ](https://myfox8.com/news/coronavirus/best-buy-opens-stores-for-appointment-only-one-on-one-shopping-alongside-an-employee/)In addition to curbside pickup, Best Buy turned to Shipt to handle “last mile” delivery and Instacart for same-day orders. 

[Forbes](https://www.forbes.com/sites/christopherwalton/2020/12/15/best-buy-is-the-smartest-retailer-of-2020/?sh=7b7941eb48f9) believes Best Buy is creating an entirely new retail approach that combines supply chain optimization with retail experience: “The only long-term differentiators of a physical and digital experience are the confidence one gets from the helpful human-to-human interactions inside of a store or the social experience of shopping itself.”

**But not every shopping experience requires a human to be convenient.**

Touchless sales along the lines of the [Amazon GO model](https://csnews.com/analysts-amazon-go-stores-bring-50-more-revenue-typical-c-stores), which relies on sensors combined with the Prime app, offer another way of interacting with your consumers. Recently [LG phones](https://www.ajudaily.com/view/20210322130334840) introduced a store that takes self-checkout one step further — there are no salespeople in the store. Consumers use simple authentication and payment to interact with screens and self-select their phones and plans. Questions about comparing models or detailed payment concerns are handled by an AI chatbot with deep language learning enabled.

Your brand’s app is the constant in all of these scenarios. While the mobile app became the primary mode of interaction during the pandemic, as the world opens up, it’s proving to be a primary enabler of physical access as well.

## FinServ: Scale to Meet Digital Demand

According to FTI Consulting, [70% of financial services companies surveyed regarding COVID-19’s impact had a digital transformation plan in place or were working on one](https://www.fticonsulting.com/~/media/Files/us-files/insights/articles/2020/apr/digital-transformation-finance-during-covid-19.pdf) when the pandemic hit. 

But that doesn’t mean financial service companies were fully ready for serious traffic spikes.

The coronavirus drove a [72% increase](https://www.fintechmagazine.com/venture-capital/coronavirus-lockdown-sees-fintech-app-use-rise) in financial apps and mobile banking use in a single week due to lockdowns in Europe, according to research published by financial advisory organization deVere Group.

Lockdown shutters of brick-and-mortar offices drove people to increased digital transactions in Latin America as well, where Visa shared that [13 million customers had made their first-ever online transaction by the quarter ending in March 2020](https://www.marketwatch.com/story/visa-sees-massive-digital-acceleration-with-millions-trying-e-commerce-for-the-first-time-2020-05-13). Visa Chief Product Officer Jack Forestell also told MarketWatch that he expects face-to-face transactions to get an “electronic spin” as brick-and-mortar locations reopen because the actual transaction is already happening electronically.

> **✔︎[Credit card giant Naranja seeds digital evolution [video]](https://youtu.be/kqouiuVk07Q)** 
> **✔︎[How British wealth management company Nutmeg tightened security](https://auth0.com/case-studies/nutmeg/)** 

Responding to consumer expectations of safety, security, and convenience has required massive change. In a [Deloitte](https://www2.deloitte.com/content/dam/Deloitte/global/Documents/Financial-Services/gx-fsi-realizing-the-digital-promise-covid-19-catalyzes-and-accelerates-transformation.pdf) report, PNC Bank’s CEO William Demchak says, “The bank’s sales have jumped to nearly 75% digital during COVID-19, condensing 10 years worth of changes into two months.”

TD Bank also made digital investments it didn’t expect to make in 2020 to allow [80% of its workforce to work from home](https://www.borndigital.com/2020/04/16/td-banks-digital-preparation-for-covid-19), reports Born Digital. But the pandemic has also altered the company’s decision-making process. Noting that banks can sometimes have a reputation for slow decision-making, Michael Rhodes, Group Head of Innovation, Technology, and Shared Services at TD Bank Group, told Born Digital, “We are not being slow right now. We have cross-functional teams that go to the war room, and we empower them to make a decision.”

Insurers also had to make rapid changes in response to the pandemic. In a global survey of insurance CEOs, [KPMG International](https://home.kpmg/xx/en/home/insights/2020/11/the-covid-19-catalyst-insurers-race-to-digitize.html) found that 78% had “turbo-charged progress on the creation of a seamless digital customer experience.” 

KPMG underscored the urgency to meet customer expectations:

“_With lots of digital competition now in the market, customers have become increasingly willing to reconsider their insurance options. Having been forced to do all their other purchases online, customers have become increasingly comfortable with buying products (even complicated financial ones) virtually; new or more digitally savvy customers will naturally be drawn to those with the best digital offering,_” writes Laura J. Hay, Global Head of Insurance, KPMG.

## Healthcare: Accelerate time-to-value

Out of all of the industries, one could say that healthcare made the most dramatic changes in response to the pandemic. Nearly half of consumers replaced in-person appointments with telehealth visits, says [McKinsey](https://www.mckinsey.com/industries/healthcare-systems-and-services/our-insights/telehealth-a-quarter-trillion-dollar-post-covid-19-reality). Others simply postponed treatment. 

For healthcare systems that rely heavily on insurer payments, this brought financial challenges. US hospitals lost billions in revenue in 2020 and could lose between $53 and $122 billion in 2021 depending on how the pandemic progresses, says a recent report from the [American Health Association](https://www.aha.org/system/files/media/file/2021/02/KH-2021-COVID-Impact-Report_FINAL.pdf). 

The need to protect at-risk patients and get test results out quickly massively accelerated change in an industry that’s been traditionally slower to move due to the need to protect sensitive patient data and comply with regulations. For example, BioReference labs switched from a model of delivering lab results primarily to healthcare providers to managing a 25X increase in volume as they started working directly with patients who were seeking rapid COVID-19 results. 

“_COVID-19 has caused a seven to ten year acceleration in consumer and digital trends,_” says Richard Schwabacher, Senior VP for Digital Health and Chief Digital Officer at [BioReference Labs](https://auth0.com/case-studies/bioreference/).

> **✔︎[How BioReference Labs handled a 25x volume spike](https://auth0.com/case-studies/bioreference/)** 
> **✔︎[How Lifen implemented remote monitoring in 5 days](https://auth0.com/case-studies/lifen-cs/)** 

Digital health includes areas that may seem obvious to consumers accustomed to quantifying their lives via their Apple Watches or FitBits. In a healthcare setting, however, adoption rates for digital devices are still low. Access to devices, potential inconsistencies with patient compliance and availability, and doctors’ comfort with using the devices as points of information, to say nothing of insurers’ willingness to cover costs, are all contributing factors.

But global venture capital investment in digital health rose rapidly over the course of 2020, [increasing 66% over the previous year’s investment to $14.8 billion](https://mercomcapital.com/product/q4-and-annual-2020-digital-health-healthcare-it-funding-and-ma-report/). Telehealth alone saw a 139% increase. VCs are betting that these changes are here to stay.

“_The pandemic has mainstreamed the consumer side of digital health technologies in less than a year. Digital health products that were a novelty a year or two ago are now a necessity,_” says Raj Prabhu, CEO of Mercom Capital Group, in a release.

Historically, healthcare providers have handled consumer personalization by creating contained medical campuses or focused care centers for childbirth or cardiology that could offer a consistent look and feel, says Schwabacher. That experience sometimes faltered when moving from the physical experience to the digital one. The need to protect patient privacy and adhere to regulations often meant choosing security over convenience, resulting in a digital experience that wasn’t always able to seamlessly follow the patient from primary care physician to a specialist.

Noting that digital options have become more prevalent and personalized in the equally regulated financial services industry, Schwabacher sees a pattern for potential change.

Greater reliance on digital health opens up opportunities to tailor experiences more specifically to the individual. This will allow healthcare systems to provide the consumer experience patients are coming to expect — and it has the even more exciting potential to improve patient outcomes, says [Schwabacher in this guest post.](https://auth0.com/blog/covid-19-the-great-digital-health-accelerator/)

![Questions to Ask Your Team](https://images.ctfassets.net/23aumh6u8s0i/1ZekqT6oZGLtDmWLRsfuJY/bd3a9f824aa1f69e9f0f7dd3340782e2/38_Three_Ways_Retailers_Can_Harmonize_2-2.jpg)

## Questions to Ask Your Team

Brand response to a seven- to 10-year forced leap into the future could mean that we’re poised to see even greater innovation as we come out of the pandemic, but that change doesn’t have to be overwhelming. Here are three questions to take back to your team:

* What happens if you treat your app as the gateway to physical interaction? Does this open up new ways to structure your consumers’ experiences?
* How can you conduct short experiments that provide actionable insights within a single quarter?
* Can you apply lessons learned from other industries to overcome your current challenges?

 

Brands’ need to thrive will push them to create new consumer experiences with the support of technology. If you’d like to explore how a strong CIAM solution can help make your experiment a reality, please [reach out to the team at Auth0](https://auth0.com/contact-us?place=blog%20post&type=link&text=contact%20us).

<include src="asides/AboutAuth0" />

How Brick-And-Mortar Approaches Improve Digital Experiences

RichardSchwabacher

Richard brings an extensive track record developing digital strategies, best-in-class products, services, and personalized solutions that offer superior digital consumer and physician experiences as BioReference’s Senior Vice President, Digital Health and Chief Digital Officer. He is adept in building high-performing teams and leading colleagues through a shared purpose and vision, and creating customer empowerment through human-centered design, technology, innovation and digital solutions.

SVP for Digital Health and Chief Digital Officer

Richard Schwabacher

BioReference Laboratories SVP for Digital Health and Chief Digital Officer Richard Schwabacher on how the pandemic will make virtual health the default

_ EDITOR’S NOTE: During a recent case study interview, Senior Vice President, Digital Health and Chief Digital Officer, BioReference Laboratories, Inc., an OPKO Health company, [Richard Schwabacher](https://www.linkedin.com/in/rschwabacher/) said that responding to COVID-19 has accelerated trends in the digital health by 7-10 years. We asked Schwabacher, a veteran of Pfizer and Quest Diagnostics who had left diagnostics only to return due to COVID, to expand on his perspective in this guest author post. ([Learn](https://auth0.com/case-studies/bioreference/) how BioReference used Auth0 to quickly scale to meet pandemic requirements.)_

There has not been an event that has impacted humanity as intensely as COVID-19. It has exacted a heavy toll, and it is clear that we will be confronting the effects for years to come. 

In terms of digital health, we already see COVID-19 accelerating trends that were thought to be a decade or more away. Trends like telemedicine and remote patient monitoring, to name just a few, were just starting to take hold when the pandemic hit and are now experiencing rapid adoption. 

Responding to COVID-19 has created a moment when patients, physicians, and insurers are more open to new ways of thinking and working. What this means for the future of healthcare is not just exciting but potentially profound.

## FinTech as a Proxy for HealthTech

Today, most of us bank from our smartphones. This is, in part, because the financial services industry has done a relatively good job balancing customer experience and data protection within their digital solutions. FinTech companies that focused on micro journeys within the space, like peer-to-peer exchanges, led to consolidation in the sector as large institutions clamored for ways to attract new customers and delight their existing customers through thoughtful digital experiences. 

Take Zelle’s peer-to-peer payment technology. Zelle, now integrated into several of the traditional banking institutions, focused on simple peer-to-peer transactions. They appealed to a segment of the [population increasing in value to the banks as customers and offered a treasure trove of data on consumer behavior](https://www.paymentsjournal.com/peer-to-peer-payment-apps-are-diversifying/). Although peer-to-peer [can be prone to additional risk](https://www.wfmynews2.com/article/news/local/2-wants-to-know/what-you-dont-know-about-cash-apps-like-venmo-zelle-cash-app-consumer-reports-says-apps-dont-work-like-a-bank-there-are-no-protections/83-4157e228-c6f0-484c-b239-23119a44f3f5), the big banks incorporated Zelle into their user interface, knowing that customers would seek out this functionality and might leave their old bank behind. It’s a degree of personalization that is aligned with customers’ needs. The fear of a devaluating customer, or worse, one who's about to leave, is a powerful incentive for innovation. As consumers, there’s virtually nothing stopping a consumer from trying or switching banks entirely if not satisfied. We can do that with relative ease and without asking permission. We can just make the change frictionless. 

Not the case when it comes to healthcare. Don’t like your insurance company? Not so easy to jump ship. If you receive your health insurance from your employer, like most Americans, you’ll have to wait for annual open enrollment to make a change. And even then, you’ll have only a handful to choose from.

## Experience Will Shape Future Digital Health Solutions

We have become conditioned as consumers to expect all experiences to generally be the same, often judging an experience against those that immediately preceded it, especially a personalized experience. When it comes to healthcare, personalization is difficult. Pre-COVID, the patient experience would weave from analog (i.e., in-person experience) to digital (i.e., telehealth) and back, all the while attempting to silo data and protect privacy. The protection and safe transportation of data in healthcare is an industry in and of itself. The patient, or consumer’s, expectation is that when they show up at a healthcare institution, that experience is going to be consistent with what they get at their bank, and they are frustrated when it’s not. [Healthcare accounted for 17.7% of the gross domestic product (GDP)](https://www.cms.gov/Research-Statistics-Data-and-Systems/Statistics-Trends-and-Reports/NationalHealthExpendData/NHE-Fact-Sheet) in the U.S. in 2019, and given the amount of interaction behind that large a number, we’re seeing a high degree of general dissatisfaction within healthcare. When so many of us are interacting with a sector that’s antiquated and unable to keep pace with consumer expectations, dissatisfaction is expected.

Pre-COVID, the solution to personalizing experiences was to create healthcare institutions that are oriented horizontally so that experience would be tailored to patient circumstances. For example, if you were receiving treatment for cancer, the cancer center's physical layout would be orchestrated literally around a patient’s journey. 

As digital experience continued to grow in other sectors, patient’s expectations seemed to outpace healthcare experiences. After all, there’s only so much that a building layout can accomplish when you’re still working off a clipboard every step of the way. Patients began to expect their medical records would simply travel with them. For the patient, this might mean a combination of an analog and digital experience that might not feel seamless due to the rigor required to protect sensitive data.

## Post-COVID Norms

The shift we see from analog to primarily digital experiences is driving three main trends: the decentralization of healthcare, improving physician acceptance of telehealth, and where I think we’re headed; virtual care will become the default.

* **Decentralization of healthcare:** One of the important and immediate impacts of COVID was an attempt to keep most patients that didn’t need to be in a healthcare setting at home for care. This change started with the most at-risk patients for [COVID co-morbidities](https://www.cdc.gov/coronavirus/2019-ncov/need-extra-precautions/people-with-medical-conditions.html). 
If you have chronic kidney disease, going into a healthcare facility puts you at a higher risk, even if you’re taking all the precautions. But assuming greater risk by having the patient physically enter a facility is not just about protecting the individual patient. 
With the pressures of COVID, hospitals are trying to manage available ICU beds. For a small hospital operating at a typical capacity, two to four additional ICU patients mean they go from having an ICU, that’s at 40- to 50%-full to 90%-full pretty quickly. By keeping high-risk patients at home, they not only protect those more vulnerable to COVID they also can focus limited resources on those who need it most. 
Adoption typically follows payment structures and incentives. In November, the U.S. government released new reimbursement schedules for asthma patients, another at-risk group, to receive in-home treatment. That probably would have happened at some point. The trend line was there, but pre-COVID, it certainly wasn’t at the degree that it is now. 

* **Physician’s more receptive to telehealth:** Having a human in front of you is very different from observing them via a computer screen. In person, physicians notice things and investigate and interrogate them in a way that can lead to a diagnosis. There’s nothing that will ever replace that level of care, which is one of the reasons many physicians were reluctant to shift to a primarily virtual model. 
Most physicians tend to follow the practices learned during medical school. We have a large physician population that didn’t learn how to diagnose via an electronic tablet. For them, this may feel like a hindrance. However, doctors who came through medical school more recently were more likely to use electronic tablets during their much more receptive. Again, the trend lines for telehealth there, but COVID has forced acceleration. 

* **Virtual care will become the default:** Patients typically aren’t willing to pay for care that isn’t covered by insurance, and many virtual care services weren’t reimbursable. These virtual services are now seeing insurance coverage. Alongside payment, we are also seeing massive investment in the telehealth model. 
In the first three quarters of 2020, $1.6 billion was [invested in telemedicine](https://rockhealth.com/reports/q3-2020-digital-health-funding-already-sets-a-new-annual-record/)—more than twice what was invested in all of 2019. 
Based on this investment and the behavioral changes amongst patients, physicians, and insurers, I think we’ll see virtual care increasingly become able to perform primary care visits. Hopefully, this will increase both the access to care and the frequency in which it occurs. 
Now that people are more comfortable with a secure video conferencing experience, we may start to see connected devices like an Apple Watch or other bracelets feeding data to the physician’s computer or tablet. This allows the patient and the physician to have more of a shared experience while providing the opportunity for the data to aggregate because it’s being collected for a specific reason within the bounds of privacy regulations. 

These accelerating trends also underscore the need to address the Digital Divide, the noted difference between those that have access to and can afford Wi-Fi, computers, and smartphones, and those that don’t. Data has a tremendous opportunity to increase understanding, but only if we are able to provide access.

## Connecting the Dots Is Key

A major concern among patients and physicians is how to secure all this new information, and data is collected and aggregated for patient care. There’s never enough that you can do to protect personal health data, but there are important tools that can be put in place — like identity verification — that can help. 

The truly transformative unlock will occur when data transportability connects important behavioral and clinical dots to form a horizontal view. Think if all of the actors in any particular set of clinical settings could actively manage and engage with patient data. 

The CDC and other health organizations formally recognize that “[how we live, work and play affects a wide range of risks and outcomes](https://www.cdc.gov/socialdeterminants/index.htm).” The ability to connect disparate data is an incredibly powerful tool to understand the progression of social determinants of health. This is why there are entire healthcare verticals spending so much time trying to figure out how to connect the dots. If you can connect the dots, outcomes should become more positive. 

The global pandemic has made it easier for policymakers to see the clear connections between things like housing, food insecurity, and COVID outcomes. Many are hopeful that this will continue to drive social determinant conversations that could have substantial impacts. The key to this will be the successful protection of health data and patient identity. 

## What This Acceleration Means for Diagnostics

It doesn’t matter where you are in this world; you’ve been impacted in some way, shape, or form by COVID-19. Directly or indirectly, diagnostic testing is at the core of being able to manage what’s happening in the world and understand it. Healthcare diagnostics is like the zeros and the ones that create the binary code of healthcare.

<include src="TweetQuote" quoteText="Humanity’s collective understanding of the value of diagnostics has never been higher than it is right now." />

When you consider the number of people that have been tested for COVID-19 around the globe, it is incredible. And for every person that’s been tested in the United States, they probably created a patient portal account with whoever performed their COVID analysis. This means that not only these patients see their COVID-19 test results, but likely every other test that that institution performed for them previously is now in front of the patient. That’s millions and millions of patients interacting with their diagnostics data directly.

The conversations that are happening with healthcare providers, municipality leaders, and companies offer the possibility of lasting change because they’re not stopping at COVID-19 testing. They’re asking questions that go beyond it. I came back to this industry because I do believe in all of the trends that we’re talking about are going to lead to a significant shift. 

I’m fortunate to have the opportunity to work with a team of like-minded individuals who are approaching these problems, knowing that technology, digital in particular, is going to help us solve them. And, for my colleagues and me, this is exciting, but it also comes with responsibility because we understand the opportunity that we have, and we want to make sure to make the most of it.

COVID-19: The Great Digital Health Accelerator

Find out how business leaders are using identity to accelerate their business strategy

In response to COVID-19, 75% of CEOs have accelerated digital transformation, a recent [Zscaler study](https://www.zscaler.com/resources/white-papers/securing-remote-work.pdf) found. 

While the study specifically focused on work from anywhere (WFA) solutions, the need for digital change isn't critical just for employee access. As nearly every customer experience is driven online, your customers' digital experience is the major way they experience your brand.

[Fortune](https://fortune.com/2020/06/26/coronavirus-accenture-ceo-digital-transformation/) noted that the crisis has quickly widened the performance gap between companies investing in digital innovations and those who weren't into a "chasm," saying "digital leaders were performing better through crisis." Companies need new technologies that allow them to activate new business models fully. In this environment, digital transformation initiatives may still be scoped over multiple years, but CIOs need to demonstrate value on a much faster timeframe. 

And the need for rapid digital adaptability is surfacing as an even stronger driver amongst Auth0 customers, especially for those seeking [B2B](https://auth0.com/b2b-enterprise-identity-management) and [Customer and Identity Access Management (CIAM)](https://auth0.com/b2c-customer-identity-management) solutions.

<include src="ebook-ads/DigitalTransformationBook" />

For many business leaders, the question is not just about how to add artificial intelligence and machine learning to new products, but how to keep their companies moving forward, given unpredictable global conditions. Others are wondering if it's too late to catch up &mdash; or even run ahead.

If you're willing to treat Identity Access Management (IAM) as a reusable service as part of your digital transformation strategy, it's not.

## Reusable Services Speed Digital Transformation Success

Many digital transformation projects are executed over the course of several years, while everyone works through "rigid" monolithic I.T. infrastructures and apps created for specific moments in time. Replacing legacy technology with "[componentized](https://auth0.com/resources/whitepapers/state-app-assembly-2020)" digital technologies (think building blocks) that can be more easily reassembled and re-architected allows companies to adapt more rapidly to changing business needs.
 
Reusable services like online payments, communications capabilities, and identity management allow companies to speed their digital transformations and deliver scalable value to customers. Basically, these services give you the power to do what you need to do, when and how you need to do it.

As Pierre Alvear Foxler, Service Manager, IAM, for Northern Europe's leading farming cooperative, [Lantmännen](https://auth0.com/case-studies/lantmannen/), points out, shifting from on-premises to services-based solutions like Auth0 have financial benefits as well as usability benefits. "We went from an on-premise solution that was capable, but complex and costly, to one that saves us money on infrastructure, IAM delivery, and application management," he says.

Strongly designed services can also make it easier to manage the complexity of the fragmented healthcare system, says Chris Carruthers, Principal Technical Program Manager, [Providence](https://auth0.com/case-studies/providence/), a nonprofit healthcare organization based in the U.S. "The healthcare industry is a complex landscape. Many customers have legacy applications and require highly secure vendor systems that meet patient data privacy requirements. Auth0's adherence to top compliance frameworks makes them a valuable identity partner for us."

## Reduce Time to Implementation

The most effective business strategy in the world, expressed through well-planned business models, can easily stall (or die) due during change management. IAM can be a powerful tool for business leaders to speed implementation. Resolving IAM challenges with the help of a vendor focused on not only current, but potential business possibilities means that you can use the IAM discussion as a framework to drive consensus and momentum for their evolving digital transformation strategy.

### Lifen: Contact Tracing in 5 Days

AI-powered [Lifen](https://auth0.com/case-studies/lifen-cs/), a solution that facilitates the secure transfer of medical documents between patients, private practitioners, and hospitals, came to Auth0 early in the pandemic with the goal of replacing their existing identity infrastructure &mdash; and rapidly spinning up a contact tracing solution. We delivered in five days.

You read that right &mdash; five days.

"It was in record time," says Lifen CTO Dali Kilani. "We've put it in the hands of multiple healthcare institutions."

But speed wasn't Lifen's only goal. 

Especially in a global environment with an increasing number of [data breaches](https://auth0.com/blog/the-11-biggest-data-breaches-of-2020-so-far/), fast means nothing if your new solution isn't also more secure. Despite the rapid turnaround, Kilani is more than comfortable. "Auth0 maintains the highest level of security that is possible at this point. Every single doctor and patient that accesses our solution performs their authentication through Auth0. We've put Auth0 at the heart of our service."

### Gymshark: Headless Commerce + Credential Stuffing Protection

For Auth0 customer [Gymshark](https://auth0.com/case-studies/gymshark/), a conditioning brand dedicated to fitness apparel, digital adaptability means making major shifts away from siloed logins that were spoiling their user experience. "We're going down a headless commerce route, doing much of our ops and infrastructure through serverless technologies with cloud partners such as AWS. We're kind of rebuilding the whole back office of the company from the ground up," says Dan Lake, Gymshark Engineering Director.

The complexity of managing a digital transformation alongside a social media following of 10+ million and customers in over 170 countries could have made customer identity and access management (CIAM) changes extremely challenging. 

Instead, Auth0 saved time and effort.

"The ease of implementing Auth0 was brilliant. It saved us months of time, salaries, effort in finding the right engineers, obviously ongoing support, and also probably given us back a few years in our lives as well through stress," says Lake.

Lake also points out that Auth0 has added benefits. "Auth0 protects us against credential stuffing. You don't realize how valuable [credential stuffing](https://auth0.com/blog/what-is-credential-stuffing/) features are until it happens. Those are the kind of features that we relish at the moment, things we see that our customers don't."

### Scale Quickly Across Multiple Applications 

Global technology powerhouse [Siemens AG](https://auth0.com/case-studies/siemens/) plays a pivotal role in everything from digital enterprise to energy to financial services and operates in nearly every country in the world. Performing on a global scale can get extremely expensive when apps are measured across multiple divisions. Creating a uniform login experience for customers and partners allows Siemens to sustain a focus that benefits their business. 

"It was of the utmost importance to have a secured, stable and reliable authentication platform, [so that] our clients and partners can focus on their business instead of focusing on how to log into hundreds of Siemens' applications available in the market," says Hugo Francisco, Service Owner of Siemens ID, Siemens.

## Make Sure Your UX Keeps Pace With Your Business Innovation

With 170 superstores across the U.K., Dunelm prides itself on style and affordability &mdash; and is transforming their digital experience to keep pace with their tangible one.

Moving to a modern, flexible cloud platform is a critical part of that business strategy.

"One of the key things we wanted to do was move over to a cloud platform, AWS, where we could scale up and down and build the best in class for our online customers," says Antony Sohal, Head of Data Platforms for Dunelm.

But instead of building that digital experience in-house, Dunelm created the customer experience using a componentized approach. "One of the key decisions was to focus on what we're good at and single out what we're not good at. We built a product service, a pricing service, we bought authentication, we even bought search as a service. We bought the infrastructure we needed," explains Sohal.

Buying identity-as-a-service means that the effort that would be spent on authentication can instead be spent on core functions and, with the right identity partner, used to customize the user experience. This means there's no need to sacrifice digital innovation for time-to-market. A flexible, extensible identity platform means you can get to market faster and ensure future adaptability.

Treating identity as a reusable service can help your new products get to market faster — and strengthen your ability to adapt once you're there. As Lake explains, "The largest shift and growth at Gymshark is we've become a tech company through our aim to unite the conditioning community. We're building the foundation for where we're headed, and it's just going to get bigger and bigger."

Carruthers says [Providence](https://www.providence.org/en) turned to Auth0 for help creating a seamless, consumer-facing digital experience for patients. "We're years ahead of where we would be if we were to build identity ourselves," says Carruthers.

If you'd like to learn more about how Auth0 could help your company continue to adapt and grow, please reach out to an [Auth0 resource](https://auth0.com/contact-us).

<include src="asides/AboutAuth0" />

How Digital Transformation Enables Business Adaptability

tyler-nix

Tyler’s professional experience spans engineering, architecture, sales, and product at companies ranging from a small Series B startup to a large Fortune 5 enterprise. He now uses his diverse experiences to build better products at Okta. When he is not scaling digital products, he is pursuing hobbies that inherently don’t scale (especially those outside). He loves hearing his kids laugh while riding bikes, spotting a new bird species, and watching his garden grow.

Product Manager

Tyler Nix

WebAuthn is an exciting technology, maximizing security without sacrificing user experience

Since ancient times, we have used passwords to grant access to privileged information. Guards allow access to buildings if correctly presented with a password. Soldiers exchange passwords and counter password to correctly identify each other. Even 8-year old secret societies allow entry to magical tree forts after declaring the super-duper secret passphrase. And when computers were first invented, how did we decide how to secure them? Passwords! Because, well, that’s all we had.

But if there is anything that we have learned since Robert Morris first started storing login passwords in a hashed form in the 1970s, it is that passwords are messy. They are [hard to remember](https://www.digitalinformationworld.com/2019/12/new-password-study-finds-78-of-people-had-to-reset-a-password-they-forgot-in-past-90-days.html), [easily guessed](https://nordpass.com/most-common-passwords-list/), and [annoying if leaked](https://www.pcmag.com/how-to/what-to-do-when-youve-been-hacked). 

## We Are Getting Better

However, in recent years, we have become more clever in securing digital accounts past just passwords. The two most significant things you can do to make yourself more secure online:

1. Use a [Password Manager](https://www.nytimes.com/wirecutter/blog/why-you-need-a-password-manager-yes-you/) to create and store unique passwords for each of your accounts.
2. Turn on [Multi-factor Authentication](https://auth0.com/blog/multifactor-authentication-mfa/) for all your highly sensitive accounts (like your bank and email).

But passwords, those things you and I have to remember if we ever want to use anything on the internet a second time, are still at the heart of the login process. Your password is the single key that proves you are, in fact, you. If a hacker manages to steal it, they can fully impersonate you unless you are one of the [28% of users using two-factor authentication.](https://duo.com/blog/state-of-the-auth-experiences-and-perceptions-of-multi-factor-authentication)

Passwords are messy.

## How Can Webauthn Help

As of January 2021, all major browsers like Chrome, Edge, Firefox, and Safari now support the [Web Authentication API](https://developer.mozilla.org/en-US/docs/Web/API/Web_Authentication_API) meaning we now have the ability to use Public Key Cryptography to register and authenticate users instead of passwords! You might be saying to yourself, “Public Key - what??” Don’t worry. You don’t need to understand the underlying technology to use WebAuthn. If that is you, you can skip to the next section. Otherwise, let’s dive into the details.

Public key cryptography is a relatively old concept but relatively new to user passwords. Ironically, it was invented in the 1970s, around the same time our friend Robert Morris was starting to store hashed login passwords. Public key cryptography uses the concept of a key pair; a private key that is stored securely with the user and a public key that can be shared with the server. These “keys” are long, random numbers that have a mathematical relationship with each other. This technique essentially became the cornerstone that [secures most of the modern internet](https://robertheaton.com/2014/03/27/how-does-https-actually-work/). However, its brilliance of shared secrets was never really applied to managing user passwords... until now!

The Web Authentication API (also known as WebAuthn) is a [specification written](https://www.w3.org/TR/webauthn/) by the World Wide Web Consortium (W3C) and The Fast IDentity Online Alliance, known as FIDO, with the participation of Google, Mozilla, Microsoft, Yubico, and others. WebAuthn allows users to authenticate with public-key cryptography using one of two options:

* Roaming authenticators &mdash; These are removable and cross-platform devices, like a [Yubikey](https://www.nytimes.com/wirecutter/reviews/best-security-keys/) that can be used on multiple devices. To authenticate with a roaming authenticator, you simply connect it to the device (through USB, NFC, or Bluetooth), provide proof of presence (e.g., touching it), and optionally an additional authentication factor like a PIN or fingerprint recognition.
* Platform authenticators &mdash; This option includes the MacBook’s TouchBar, Windows Hello, iOS Touch_FaceId, and Android’s fingerprint_face recognition. Integrated into the device being used, these only work on that device.

![Authentication Flow](https://images.ctfassets.net/23aumh6u8s0i/3b9M189ZcgQtfKSXZEahwv/c4dba7f38fa463f6ffcecb2119117c86/01_auth_flow.jpeg "Authentication Flow")

In the context of this article, we are focusing on Roaming Authenticators, but just know that WebAuthn enables both, opening up a lot of possibilities for secure user authentication in the future.

<include src="WebAuthnMeCTA" group="B"/>

## How to Set up and Use a Security Key

What you will need:

* A laptop or desktop
* A modern browser installed, either Chrome, Firefox, Edge, or Safari.
* A hardware security key, the two best options are [Yubikey](https://www.yubico.com/store/#yubikey-5-series) or [Google Titan](https://cloud.google.com/titan-security-key). Mine looks like this:

![Hardware Security Key](https://images.ctfassets.net/23aumh6u8s0i/7mBoXFhZzqf2vTX3wKothh/f45aa6be66b9b3ab3bc0e862b1d8c735/02_hardware_security_key.jpeg "Hardware Security Key")

**Note:** Before getting started, be aware of what you are about to do. You are about to register a hardware security key as a second form of authentication for your various accounts. **If you do not have this key physically present with you when logging in, you will not be allowed to continue**. It would be wise to enable Two Factor Authentication initially via a Temporary One Time Passcode mobile app like [Authy](https://authy.com/) or using text messages sent to your phone number. This ensures that if you ever lose your security key, you can still use a second form to sign in. If you have not done this yet, you should do this now.

And if you haven’t downloaded and saved your recovery codes in a secure location like a password manager, you should do that as well. Recovery codes can be used to access your account in the event you lose access to your device and cannot receive two-factor authentication codes.

### How to set up a security key with Google

1. Log in to your [Google](https://myaccount.google.com/) account from your browser.
2. Choose Security from the options on the left-hand side.
![Security key with Google](https://images.ctfassets.net/23aumh6u8s0i/jQzUlqMi2cDQgxvWLKzqU/8d68e6505fa8c675d9f538c08517f6a4/03_security_key_with_google_01.jpeg "Security key with Google")

3. Under Signing into Google, select 2-Step Verification.
![Security key with Google](https://images.ctfassets.net/23aumh6u8s0i/5u7erpiTmNNVa43HfUCfWa/568482c8665c6adf3f2460239b333876/04_security_key_with_google_02.jpeg "Security key with Google")

4. Under the Add more second steps to verify it’s you section, choose Add Security Key.
![Security key with Google](https://images.ctfassets.net/23aumh6u8s0i/3BF0d9LDRrQX72RRWn5rBq/bdb3d13d7ee0ce4a083efc453ca7d207/05_security_key_with_google_03.jpeg "Security key with Google")

5. Choose USB or Bluetooth option.
![Security key with Google](https://images.ctfassets.net/23aumh6u8s0i/SfHemm8cvxs61oxZjh8Je/7a5c9edc7a65c9113d06637177512c95/06_security_key_with_google_04.jpeg "Security key with Google")

6. Follow the instructions to register your security key.
![Security key with Google](https://images.ctfassets.net/23aumh6u8s0i/4qoZAYZax8XwiX2EpMT1yv/0d9ce7c036874c7efb90c1e3aeb162a8/07_security_key_with_google_05.jpeg "Security key with Google")

7. Once completed, you should see your named security key as the default option (since it is the most secure) to finish signing in after you enter your password.
![Security key with Google](https://images.ctfassets.net/23aumh6u8s0i/37DgmLP4YkwhLh1WlvKt2t/91e76e7b8a0d68a95c8d5f6534653e3a/07_security_key_with_google_06.jpeg "Security key with Google")

### How to set up a security key with Twitter

1. Log in to your [Twitter](https://twitter.com/) account from your browser.
2. Click on More and choose Settings and Privacy.
![Security key with Twitter](https://images.ctfassets.net/23aumh6u8s0i/1oHkhxSEmtT2wNKY49WpTa/73f77589542621d3bf8e9023f8940643/08_security_key_with_twitter_01.jpeg "Security key with Twitter")

3. Select Security and account access and then Manage your account’s security.
4. Select Two-factor authentication.
5. Click the Security key check box.
![Security key with Twitter](https://images.ctfassets.net/23aumh6u8s0i/5vWoUU7mIS6ouNjBnjMkRV/38f07de9bf5392ba3154ef87828f28f0/09_security_key_with_twitter_02.jpeg "Security key with Twitter")

6. Follow the instructions to register and verify your security key by touching it.
![Security key with Twitter](https://images.ctfassets.net/23aumh6u8s0i/2tMaL6UsrLIOAATKMoCYjx/ff49c458c66f57e8b8b965dba395ec10/10_security_key_with_twitter_03.jpeg "Security key with Twitter")

7. Your key should now be registered with Twitter.
![Security key with Twitter](https://images.ctfassets.net/23aumh6u8s0i/F5eEnT4BOGVILJ6jNtWZA/5262032803c0e0da5093969ffc38d69e/11_security_key_with_twitter_04.jpeg "Security key with Twitter")

### How to set up a security key with Github

1. Log in to your [GitHub](https://github.com/) account from your browser. 
2. Click on your profile image in the top right, and choose Settings.
![Security key with Github](https://images.ctfassets.net/23aumh6u8s0i/2O9KATj48kSAzV9CpXdSXn/896653ff07a309236ceabc091facc645/12_security_key_with_github_01.jpeg "Security key with Github")

3. Select Account Security, then Add.
![Security key with Github](https://images.ctfassets.net/23aumh6u8s0i/7FlPdqNW69mIJ38Dkig2BL/f6671aca1a71a7224fbca573b39bf280/13_security_key_with_github_02.jpeg "Security key with Github")

4. Under Security keys section, register your new security key.
![Security key with Github](https://images.ctfassets.net/23aumh6u8s0i/1Zl3MYe9UiWaA0Ih0hy8hw/f6dac28da88f9a446d4a067b93014aff/14_security_key_with_github_03.jpeg "Security key with Github")

5. Enter a name for this security key.
6. Follow your browser’s steps to register your security key.
7. Insert your security key into your computer and touch it. 
8. Your key should now be registered with GitHub!
![Security key with Github](https://images.ctfassets.net/23aumh6u8s0i/4kua0N7QM8zC3y2PHTypcD/406e672efcffca3df2403f9e629210ed/15_security_key_with_github_04.jpeg "Security key with Github")

It is that easy! You have now made a giant leap in securing your digital life all thanks to WebAuthn. 

On a day-to-day basis, you may not be required to use your hardware key all that often. Services often consider different risk factors to determine whether to require it. Some sites may ask you to enter it when you’re managing what kind of authentication you’re using, while others may ask you to use your key only when you’re logging in from a new computer.

## How to Set up Security Keys for Your Company

If you manage a company’s customer identity access management, then giving users more secure ways to protect their accounts can drastically reduce your risk. One of the easiest (and most secure) ways for you to implement WebAuthn with Security Keys for your website is allowing Auth0 to manage it for you. 

A Beta release of Auth0 with WebAuthn support for Security Keys is available starting today. You can enable the second factor in the WebAuthn with Security Keys MFA configuration section of the Auth0 admin dashboard:

![Security Keys for Your Company](https://images.ctfassets.net/23aumh6u8s0i/4u8PPLPBkktBasuyA5rfJW/baf9ac172457257001902a51a850dad4/16_security_keys_for_your_company_01.jpeg "Security Keys for Your Company")

After it is enabled, users will go through the enrollment flow below. At some point, their browser will show a native dialog to ask users to engage the security key. In the example below, we show the Android dialog:

![Security Keys for Your Company](https://images.ctfassets.net/23aumh6u8s0i/67mLa4gSwO48DW3SSepofu/00cf7adc623946693f92661cb95c3b97/17_security_keys_for_your_company_02.jpeg "Security Keys for Your Company")

The next time they login, the flow will look like this:

![Security Keys for Your Company](https://images.ctfassets.net/23aumh6u8s0i/6TWq0ebOknQ41urkuqrKQU/9cfaa0365656a2a5df489f86b64ba5fc/18_security_keys_for_your_company_03.jpeg "Security Keys for Your Company")

## Passwordless Future

Now let me give a fair warning, we are still on the cutting edge of this technology. Even though browsers now support it, most companies have been slow to adopt WebAuthn, and where there is support, it is only used as a second form of authentication. In other words, we are still a few years from seeing true passwordless user authentication, but it is a start - a very promising start.

What we need is more people insisting that companies start implementing WebAuthn as a primary form of authentication. And the best way to do that is by demonstrating there is public demand for such feature requests by utilizing what is currently offered today.

WebAuthn is an exciting technology, and Auth0 is committed to providing the best possible implementation, maximizing security without sacrificing user experience. Please [try our Beta](https://auth0.com/docs/mfa/configure-webauthn-with-security-keys-for-mfa) today and let us know what you think on our [Feedback page](https://auth0.com/feedback) or in the [Auth0 Community](https://community.auth0.com/) .

<include src="asides/AboutAuth0" />

Using WebAuthn to Secure Your Digital Life

auziros:mckenzie-mayer

Customer Identity (CIAM) Product Comms lead, driving collective storytelling across Okta and Auth0. Making technology accessible for everyone.

Customer Identity Product Comms Lead at Okta

McKenzie Mayer

Cloud-based identity management enables safe and convenient digital experiences for financial customers

**LONDON – 7 December 2020 –** The [Auth0](https://auth0.com/) Identity Platform, a product unit within Okta, today announced that [Ninety One](https://ninetyone.com/en/south-africa/) has deployed its solution to authenticate retail fund investors in South Africa. Started in South Africa as Investec Asset Management, the firm spun out from parent Investec and rebranded as Ninety One this year. Ninety One replaced their on-premises identity solution with Auth0 as part to provide customers with a seamless login experience across its investment products.

Following the demerger and listing, Ninety One required its own [Customer Identity and Access Management (CIAM)](https://auth0.com/blog/what-is-ciam/) infrastructure, including Single Sign On, Multi-factor Authentication, and self-service password reset features. Ninety One’s own development team and a local transfer agency and administrative outsourcing partner, Silica, recommended Auth0 for ease of integration and the ability to host in the cloud while migrating users gradually from the previous on-premises system. 

“The move to Auth0 is indicative of our journey in other parts of the organization,” says Scott Carr, IT platforms manager at Ninety One. “We have embraced Auth0 as essential for our success as a new brand because they enable us to provide the caliber of safe and convenient digital experiences our financial services clients demand.”

IT security spending in the META region (Middle East, Turkey, and Africa) will cross $3.4B in 2023, driven by a focus on [digital identities and shifts to the cloud](https://www.biznesstransform.com/idc-predicts-major-spending-on-digital-transformation-by-the-ict-industry-in-meta/) (Source: IDC)[1]. Auth0 has been recognized as a top private cloud company in identity management on the [Forbes Cloud 100](https://auth0.com/blog/auth0-is-named-to-the-2020-forbes-cloud-100/) and by industry analysts for serving as a key enabler in customers’ [digital transformation](https://auth0.com/forrester-total-economic-impact) efforts.

“Digital transformation shouldn’t be underestimated, but it doesn’t have to be feared either,” said Steven Rees-Pullman, SVP International at Auth0. “Ninety One is looking to the cloud and replacing legacy systems with building blocks like Auth0 to be more adaptable and resilient while delivering great experiences for their clients. We’re pleased to help power their journey.”

[1] IDC Worldwide Black Book Live Edition, July 2020

## About Ninety One

Ninety One is an independent, active investment manager dedicated to delivering compelling outcomes for its clients, managing more than £119 billion/R2.6 trillion in assets (as at 30.09.20).

Established in South Africa in 1991, as Investec Asset Management, the firm started offering domestic investments in an emerging market. In 2020, almost three decades of organic growth later, the firm demerged from Investec Group and became Ninety One. Today the firm offers distinctive active strategies across equities, fixed income, multi-asset, and alternatives to institutions, advisors, and individual investors around the world.

[www.ninetyone.com](https://ninetyone.com/international) 

<include src="asides/AboutAuth0" />

### Media Contacts

Media Contacts 
McKenzie Mayer 
PR Manager, EMEA 
press@auth0.com 

Kotie Basson 
Head of Marketing, Africa Client Group 
Ninety One 
kotie.basson@ninetyone.com

Ninety One Chooses Auth0 as Foundation for Digital Transformation

Salesforce's Next Generation Identity demands the scalability, agility, and connected digital experiences that Auth0 offers

**BELLEVUE, Wash. – November 17, 2020 –** The [Auth0](https://auth0.com/) Identity Platform, a product unit within Okta, today announced it has been selected as the identity provider to power authentication for Salesforce Customer 360 Identity, its best-in-class consumer identity and access management (CIAM) technology, providing a single, trusted identity for more streamlined user management. Salesforce Customer 360 Identity will go into a pilot phase at the end of the year and will be generally available in early 2021. 

Salesforce Customer 360 Identity is one of four products that comprise [Customer 360 Truth](https://www.salesforce.com/products/platform/features/customer-360-truth/), a set of data and identity services that enable companies to build a single source of truth for relevant and lasting customer relationships. The leading CIAM, data management, customer data platform, and privacy tools available in Customer 360 Truth provides a unified customer view to maintain customer privacy, security, connect siloed data systems, and harness new digital business.

Driving the frictionless login experiences for all Customer 360 Identity users, Auth0 will provide a seamless signup to drive better conversions, the ability to scale to any size, and a single customer login across all users' digital properties, eliminating siloed data and providing a single source of truth for IT departments. 

"The need for digital transformation has reached new heights, challenging companies to deliver simple, connected, and trusted experiences online," said Patrick Stokes, EVP, Platform Shared Services at Salesforce. "Customer 360 Truth delivers just that. And, combined with Auth0, companies will be able to engage with their customers like never have before—authenticating millions of users quickly and securely."

"Customer data is the cornerstone of Customer Success and hinges on the ability to have a comprehensive view of your customers," said Nick Mehta, CEO of Gainsight. "As a customer of both Auth0 and Salesforce, I'm excited about their integration to help streamline how we access and map user data."

Auth0's deep developer roots and the ability to provide a superior pro-code developer experience offers a natural integration into Salesforce's platform. Auth0's platform provides the out-of-box experience that most customers need and also allows their developers to easily customize their login flows via code and the large library of integrations readily available from the Marketplace. 

"Persistent challenges B2C customers face&mdash;scale, needing a holistic view of the customer, and enhanced security&mdash;are consistent across the industry, especially with the urgent speed in which companies are prioritizing their transformation efforts," said Shiven Ramji, Chief Product Officer at Auth0. "We believe this need will intensify as more businesses are forced to transform and we look forward to working with Salesforce customers going through this process."

In July 2020, Salesforce Ventures was the lead investor in Auth0's $120 million Series F round, bringing Auth0's valuation to $1.92 billion and total capital raised to more than $330 million. 

<include src="asides/AboutAuth0" />

### Media Contacts
Global Communications 
Auth0 
[press@auth0.com](mailto:press@auth0.com) 

Hannah Carroll 
Matter for Auth0 
[auth0@matternow.com](mailto:auth0@matternow.com)

Auth0 Selected as Identity Vendor of Choice for Salesforce Customer 360 Identity

jessica-sealby

Jessica drives public relations and global communications efforts for Auth0 across Asia Pacific. Outside Auth0, she frequents Melbourne’s live music venues and chases after her two energetic dogs.

PR Manager - APAC

Jessica Sealby

Identity management serves as essential technology for a global car manufacturer to streamline customer experience

**BELLEVUE, Wash. – November 16, 2020 –** The [Auth0](https://auth0.com/) Identity Platform, a product unit within Okta, today announced that Subaru Corporation has chosen Auth0 to provide secure identity management for its newly launched online customer experience, “My Subaru.” Auth0’s secure and frictionless customer authentication experience serves as an essential element in Subaru’s leading approach to customer engagement and meeting the demands of shifting consumer behavior. 

“My Subaru” was designed to support the corporation’s digital transformation efforts and appeal to the industry trend of consumers researching cars online more than ever before. Auth0 will serve as the primary authentication provider for Subaru and will provide assistance in creating a foundational CRM and identity system for managing customer information in a secure manner. Driven by Japan’s Personal Information Protection Act&mdash;which requires companies to show how customer information is being received and managed&mdash;there is a widespread need for proper authentication and digital ID management solutions across the region. Auth0 will assist in compliance with this regulation. 

For Subaru, customer experience could not exist without advanced security, and keeping customers’ personal information safeguarded was paramount. Auth0 was chosen for its ease-of-use, speed of deployment, and extensibility, together with its ability to provide multi-factor authentication (MFA) for even more secure digital engagement. 

“Auth0 is a key factor in our ability to enhance our customers’ online experience, and also provides us with secure identity management. In the near future, we plan to launch a portal service compliant with the Personal Information Protection Act through Auth0’s technology,” said Atsushi Yasumuro, Chief of Business Innovation at Subaru Corporation. “Auth0 is exactly the kind of authentication solution that allows us to achieve Subaru’s vision of ‘Peace of mind & enjoyment,’ giving us the confidence that we are securing customers’ data while offering them the best experience possible.”

The automotive industry is facing a major transition in purchasing behavior, fueling Subaru’s considerable investment in its online offering. The company required an entirely new infrastructure and approach to managing customer information, focusing on integrated CRM software and an identity platform. Auth0 is a vital means for Subaru to build stronger relationships with customers, offer greater post-purchase service, and remain a leader in this highly competitive space.

“We’ve seen enormous momentum around digital transformation in the region. Combined with updated regulations around customer data management, it is more important than ever that identity management becomes a critical piece of any digital foundation,” said Eugenio Pace, co-founder, and CEO of Auth0. “We are honored to work with Subaru on its industry-leading online offering, and look forward to merging identity security with their online presence into one seamless experience.” 

With more than 550,000 users on its owner-oriented “My Subaru” application, Subaru’s goal is to improve consumer engagement and users’ before and after sales experience through universal identification and the identity work in place now with Auth0 will help the company achieve its ambitious goals into the future.

<include src="asides/AboutAuth0" />

### Media Contacts
Jessica Sealby 
Auth0 PR Manager, APAC 
[jessica.sealby@auth0.com](mailto:jessica.sealby@auth0.com)

Auth0 Supports Subaru Corporation with Digital Transformation Shift

Official UK Digital Marketplace accreditation makes it easier for public sector organizations to access Auth0’s identity and authentication management

Auth0 has once again been named as a supplier in the Cloud Services category of the G-Cloud 12 framework, part of the United Kingdom's official [Digital Marketplace for the Public Sector](https://www.digitalmarketplace.service.gov.uk/). G-Cloud accreditation prequalifies Auth0 to participate in public sector tenders for critical software and security services. It is the gateway to servicing government departments (such as HMRC) and non-governmental organizations (such as Homes England and the NHS).

This is the fourth year in a row that Auth0 has achieved G-Cloud accreditation, demonstrating Auth0's commitment to the vital public sector. This accreditation ensures continued access to Auth0's world-class security platform for public sector organizations in the UK.

## What Is G-Cloud 12?

The G-Cloud 12 framework helps ensure that public sector organizations have the ability to make informed and competitive choices in choosing cloud service providers (CSPs). The platform's internal marketplace of pre-negotiated service terms provides transparency on CSP pricing models and allows the public sector to avoid negotiating per-product contracts. This significantly streamlines the tender process, providing a base level of legal protection and pricing benchmarks for public sector entities. 

![Auth0 Search Results](https://images.ctfassets.net/23aumh6u8s0i/6njj9d9z8Ud2dgohq8Wv8l/ca3e6746ed06452932631bde00097f3f/01-auth0-search-results)

The framework clearly outlines pricing structures, security protocols, cost, platform compatibility, and more, serving as a central repository that makes it easy for public sector organizations across the UK to assess the cloud-based software tools available to them.

G-Cloud 12 encourages organizations to make the best choices for their own use cases, allowing them to use implementations that might not be feasible through a traditional government procurement system. As in the private sector, public sector software needs aren't one-size-fits-all, and pre-approved pricing structures make it easier to try software on any scale. The G-Cloud hub is a vital resource helping the public sector update their workflows faster and more cost-efficiently.

As the UK Government moves to better serve the public by making online services more available, protecting user identity is a critical security priority. Building identity solutions themselves can tie up valuable resources and expose public sector entities to risk, so they are moving toward utilizing standardized solutions such as those offered by Auth0. These offer world-class security, reduce risk, and free up internal resources for other key tasks.

For example, the West Midlands Fire Service (WMFS) is one of the few government departments in the country with its own in-house software development team. WMFS has been a leader in [creating award-winning digital applications](https://www.itproportal.com/features/how-open-data-helps-put-out-digital-fires/), including Tymly, a low-code, an open-source software platform that allows businesses to create and use flexible applications to gather, process, and distribute data.

However, rather than spend months building its own authentication system for Tymly, WMFS chose to outsource it. WMFS used the G-Cloud framework for its search, ultimately choosing Auth0's Identity-as-a-Service (IDaaS) to provide GDPR-compliant, cloud-based authentication for the Tymly platform. 

Using Auth0, WMFS can implement multi-factor authentication (MFA), biometrics, single sign-on (SSO), and social login to provide ease of access and the high level of security needed for public sector data.

## Recent Changes to G-Cloud Frameworks

The G-Cloud 12 framework is the 2020 update of the cloud services portion of the UK's Digital Marketplace, the central hub for approved services and suppliers operated by the [Crown Commercial Service (CCS)](https://www.gov.uk/government/organisations/crown-commercial-service) since 2019.

The latest iteration is largely similar to G-Cloud 11, but with a few changes. 

New this year is a requirement that suppliers who hold or work with government data need to meet "buyer requirements in respect of AI ethical statements." The Government Digital Service (GDS) has joined with the Office for Artificial Intelligence (OAI) to offer guidance on using AI in the public sector, with the goal of making sure "the public sector is leading from the front in the safe and ethical deployment of AI and other emerging technologies."

This year, G-Cloud 12 also requires in-depth service definitions for each listing explaining the service and how it works — something that Auth0 has always provided for its G-Cloud listings.

![Auth0 Digital Marketplace](https://images.ctfassets.net/23aumh6u8s0i/3ek6TCIybEXqkMBVOXpUhP/2d158a8b6285aa918bb42d73d77f0782/02-auth0-digital-marketplace)

G-Cloud 11 features about 4,200 suppliers and nearly 31,100 services, both an increase over G-Cloud 10. CCS has tracked spend data since the inception of G-Cloud in real-time via an [online dashboard](https://app.powerbi.com/view?r=eyJrIjoiNTEyMTZhZDAtZGNiNi00OWQxLWI5ODYtMjg1ZWNlMmNkODVhIiwidCI6IjlmOGMwZDc5LTNlODctNGNkMy05Nzk5LWMzNDQzMTQ2ZWE1ZSIsImMiOjh9).

## Benefits of Identity Management in the Public Sector

The UK public sector has been criticized for being reactive to new technologies, which often doesn't take into account the complexities and sheer scale of public sector requirements. The G-Cloud regime is an ambitious program designed to help streamline the procurement of best in class CSPs &mdash; which, in the world of identity, means Auth0. 

Identity and access management are clearly critical issues for almost all public sector organizations, but adhering to the constantly changing standards is difficult when an organization is locked into a rigid software stack. Having the flexibility to pursue up-to-date software helps organizations nimbly respond to changing security needs and threats.

Auth0's ability to identify and protect against ever-evolving security threats and our agile development methodology ensures that our customers have accelerated access to security updates and enhancements. With our continued presence in the G-Cloud market, public sector organizations can also benefit from our expertise in this area. 

Our continued G-Cloud accreditation underscores our commitment to democratizing access to our software and mainstream security practices, much like the platform itself aims to improve accessibility and choice for the UK public sector.

## Auth0's Mission

We believe that world-class security protections don't have to be reserved for elite companies or users but should be applied in broad contexts and accessed on platforms such as G-Cloud 12. Auth0's mission is to provide users with secure access to any application with one click or less. Whether you're a public sector organization, a small business owner, or a security-minded user, Auth0 helps ensure that you can access the most up-to-date security standards with low overhead and a seamless user experience.

![Auth0 Identity Platform](https://images.ctfassets.net/23aumh6u8s0i/469d5UiPrrjSZE0cDLMAbC/27a2b8459e326c9b052ab326ca6d34f8/03-auth0-identity-platform)

<include src="asides/AboutAuth0" />

Auth0 named to G-Cloud 12 framework for fourth year in a row

ken-oestrich

Ken Oestreich is a Product Marketing and Product Management veteran. He's a serial achiever at introducing new products and categories, growing platform adoption, building marketing teams, and maturing new markets for B2B enterprise technologies. He has consistently anticipated and marketed new industry solutions in the IT space, including cloud workspaces, data center infrastructure automation, and federated identity management, and API/Integration technologies.

VP Product Marketing, Messaging, Content, DevRel.

Ken Oestrich

Apps are becoming componentized and API-based to facilitate reuse and agility; Identity management cloud services will help.

> _"In today's online-first, intensely competitive environment, creating a monolithic, inflexible CIAM system will quickly put the firm on the path toward extinction." - Forrester's Customer-Obsessed IAM Operating Model April 2020_

There is an "old-school" view of Identity and Access Management (IAM) that sees it purely as a security requirement for apps and websites. Simply put, IAM is there to keep the bad guys out and let the good ones in. 

A more progressive view recognizes how IAM can help provide a better level of user convenience and app-level [personalization](https://auth0.com/blog/how-identity-management-helps-you-personalize-your-user-experience/), as well as [lower-friction interactions](https://builtin.com/product-management/customer-friction). Plus, it can offer the business better CRM data, a lever for managing [data privacy](https://auth0.com/blog/data-privacy-101/) and [compliance](https://auth0.com/security) controls, and (if implemented properly) a consistent [security perimeter](https://www.itproportal.com/features/why-user-identity-is-becoming-the-new-security-perimeter/) across all apps/properties.

But there's a third level of benefit of IAM that IT often overlooks: _A consistent, flexible IAM foundation can contribute to the firm's overall [digital agility](https://auth0.com/digital-transformation)._ 

Here's why: IAM systems have traditionally been embedded into apps and frameworks (think: React, Angular, JS, etc.). Using that approach, each app runs the risk of becoming an IAM silo unto itself. And when it comes time to integrate those apps with other identity-driven systems, the approach can create a massively _inflexible_ infrastructure. 

Worse, firms should expect that many of their custom apps will have to work alongside other enterprise apps &mdash; e.g., marketing, digital experience, privacy/governance, business systems, and of course, security and analytics. However, the reality is that the logical topology surrounding your IAM system _will always be dynamic and distributed_ &mdash; plan for it. The nature of enterprise systems IAM needs to interface with will always change. But when business leaders don't plan a consistent IAM foundation, digital agility is one of the big losers.

![IAM](https://images.ctfassets.net/23aumh6u8s0i/sBencPL2DaZRTy2DXX8JJ/ebc8f6a50b2b5f9eb45442c49edb43b7/iam_digital_agility)

## Identity Has Become a Foundational Component of Digital Transformation, IT Agility, and Infrastructure Modernization

[_Digital transformation_](https://auth0.com/blog/what-digital-transformation-is-and-what-it-isnt/) initiatives are when progressive software-driven companies shift from rigid, monolithic IT infrastructures and apps into more componentized [API-first architectures](https://auth0.com/blog/the-business-value-of-api-first-design/). These are more easily reassembled/rearchitected and reused (see this great blog about [API strategies](https://blogs.informatica.com/2019/09/18/how-to-win-with-apis/) by Informatica). Component software also means that app updating can be done on a piece-part basis, without requiring the _entire_ application to be retested and QA'd. 

When shifting to an API-based strategy, there is often a simultaneous [replatforming](https://auth0.com/blog/what-is-replatforming) initiative for some (or all) of the components, shifting them into the cloud and/or onto serverless cloud platforms. These initiatives also help businesses respond more rapidly to fast-moving opportunities and/or competitive issues. The growth of API-first architectures and use of serverless execution platforms has been nearly geometric during the past few years.
![Growth API](https://images.ctfassets.net/23aumh6u8s0i/4dwfCPiVqFIyeaNqR5KFAN/8f3e34515b5bdb607e7d46620555dafc/growth_api)

### Distributed and loosely coupled

In software design, a loosely coupled system is one where each component has, or makes use of, little or no knowledge of the other components. This could include the coupling of software classes, interfaces, data, and other SaaS services. Loose coupling is important because it allows you to rearchitect specific components in the future with minimal impact to other components. 

Often, one of the loosely-coupled underpinning layers of these digital transformation initiatives is security and access management &mdash; certainly found at the application level, but also even at the _component_ level. With potentially millions of such API-first distributed components being deployed, each component, app, and composite application _must be reliably and consistently secured_, embracing the capacity to be _identity-aware_.

Decoupling identity from the application and/or app component means avoiding inconsistent IAM stores/DBs, yet ensuring a consistent privacy model, reliable access, and a strong security perimeter. 

## The auth0 Point of View: Your Identity Management Functions Must Be Componentized, Programmable, and Cloud-Neutral

Many of today's IAM technologies are embedded in programming frameworks and therefore hardwired to apps. We believe these IAM functions must &mdash; and will &mdash; become decoupled from the apps they support. Decoupling IAM helps release customers from the bonds of vertical integration stacks that are inherently siloed, brittle, and fundamentally non-optimized for the complexity of today's identity needs. 

IAM functions should also be released from mega-cloud lock-in. The market requires an IAM foundation that's open and customizable &mdash; rather than a foundation that binds customers to an Amazon, Azure, or Google agenda.

This matters because an IAM approach that's API-first, application-decoupled, and componentized also allows developers and their enterprises to rearchitect and dynamically deploy new updates, features, and functionality without disrupting the underlying identity infrastructure. That results in the ability to respond to business conditions and competitive situations more quickly and reliably.

<div class="alert alert-info alert-icon">
“Using microservices in containers has also allowed us greater flexibility when deploying IAM solutions. Typically IAM solutions have featured larger, more monolithic services that are harder to scale and upgrade. Microservices allow the structuring of an application as a collection of loosely coupled services. This architecture then enables the continuous deployment of complex applications, as it is less complicated to update smaller services incrementally than larger ones. It also allows the scaling of particular components (e.g. databases, LDAP servers, etc.) to meet demand as required.” 
~ IAM DevOps in Capgemini, Terence Stamp 
</div>

### Some closing recommendations 

For executives, technology agility equates to business agility. Work with your technical colleagues to understand what IAM underpinnings you currently have and how those will need to evolve to work alongside adjacent systems for marketing, digital experience, privacy/governance, business systems, and security and analytics. Urge technical partners to: 
* **Seek to componentize applications underpinned by a consistent IAM infrastructure**. Treat IAM as a reusable component service the way you use other reusable SaaS services (e.g., payments, databases). 

* **Measure and justify the benefits of IAM across your infrastructure**. Collaborate with colleagues in security, customer experience, web, and CRM teams; assess where identity can yield quantifiable top-line revenue and competitiveness.

* **Prioritize customer outcomes within digital transformation initiatives**. Digital agility and transformation program outcomes must be driven by a focus on responsiveness to customer needs and expectations. Identity management foundations not only contribute to a consistent/reusable infrastructure but also help build a comprehensive customer 360°.

* **Neutralize cloud vendor lock-in risk with an independent, cloud-neutral IAM system**. Long-term agility and avoidance of high switching costs are further enabled by using an independent, cloud-neutral IAM service.

For technologists, it's time to apply IAM like other loosely-coupled SaaS services you commonly use. For example: 
* **Use familiar API and microservices principles when adding IAM into your platform**. Select a reusable, easily-integrated cloud IAM service that's compatible with a broad set of programming languages and frameworks. 

* **Reduce IAM time to production; simplify app reuse**. Get your team started quickly with a solution offering SDKs, quickstarts, and implementation guidance. 

* **Consolidate user IAM systems and databases**. Use an IAM solution offering a range of migration tools and customer DB connections to fit the user migration scenario best for you. 

To learn more about how IAM contributes to overall digital agility, [explore our identity resources](https://auth0.com/resources/), or [reach out to sales](https://auth0.com/contact-us).

<include src="asides/AboutAuth0" />

Digital Agility: The Auth0 Point of View

Securing customer loyalty means offering choices about how to shop.

Retailers in the COVID-19 era have been forced to integrate their digital operations with their brick-and-mortar stores as a means of survival. According to research from digital signage platform [Raydiant](https://www.raydiant.com/blog/reopening-of-retail/), 55% of retailers report that without expanding into e-commerce, they’re unsure whether they would have survived the pandemic, or they’re certain their business would have failed.

Yet the same research found that only a small fraction of retailers plan to keep these integrations of physical and digital operations in place after the pandemic (14% for delivery and 17% for curbside pickup).

This disconnect shows that marketers and data officers still don’t fully appreciate the harmonizing of digital and physical operations and making them flexible enough to respond to changing customer needs. But it is possible to express brick-and-mortar strengths in the digital world; it just means getting smart about your [omnichannel strategy](https://auth0.com/blog/why-an-omnichannel-strategy-is-critical-in-2020/). Here are three ways to start.

## Use Brick-and-Mortar Stores for Online Pickups and Returns

In recent years, retailers have discovered that using physical stores for fulfillment and returns are key to staying competitive in the age of Amazon. These options are convenient for customers and good for retailers since customers who step inside a store are more likely to make a second purchase.

Implementing a buy online, pick up in-store (BOPIS) program has been a particularly valuable strategy during the pandemic since it lets customers minimize the amount of time they have to spend in stores. As early as April, the [National Retail Federation reported](https://nrf.com/blog/how-retailers-are-adapting-curbside-pickup) that half of the consumers used BOPIS because of the pandemic.

In the long run, buy online, return in-store (BORIS) may prove to be just as valuable to retailers as BOPIS because it ensures quicker restocking of returned items and eliminates the cost and logistical challenges of accepting returns by mail.

### Let customers choose

Integrating stores into online pickups and returns is most effective when you present it to customers as a choice and let them pick the method that’s best for them. When a customer needs something urgently, they can pick it up that day, but if they don’t mind waiting, they can get the item delivered and save themselves a trip to the store. Walmart credits this strategy for its success during the pandemic. Its online sales rose 97% in the second quarter but not at a cost to store sales, which grew 9.3%.

[Walmart CEO Douglas McMillon](https://multichannelmerchant.com/ecommerce/walmart-posts-blowout-ecommerce-growth-nearly-doubling-sales-q2/) plans to keep weaving together online and in-person strategies with an omnichannel approach in which “the customer is ultimately in charge.” Walmart plans to add a membership program to further drive loyalty by giving customers flexibility. Says McMillon: “Sometimes they’ll be in the store, and sometimes they’ll do pickup, and sometimes they’ll do delivery, and many of them will buy a membership.”

### Unite all locations with a single inventory

Successfully implementing these programs requires a high degree of visibility into both customers and inventory. You need access to a customer’s geographic location, and you need to pinpoint the location of the product they’re looking for. With this information, when a customer is browsing online, you can provide them with the best options at checkout. If the item they want is in a far-off warehouse, deliver it. If it’s at their neighborhood store, let them pick it up. If it’s at a store a few miles away, give them a choice.

“Flexible inventory is the best inventory,” noted [Jonathan Jonas](https://multichannelmerchant.com/wp-content/uploads/2020/05/mcm_warehouse_software_report_v5.pdf), co-founder of eCommerce infrastructure consultancy Decent Startup. He predicts that in the coming years, “we could also see more and more same-day offerings as fulfilling eCommerce orders from store becomes a normal part of everyday operations.”

## Personalize Customer Outreach Without Being Invasive

Retailers are always looking for ways to give their brand that “personal touch,” and for marketers, that increasingly means targeted digital outreach. Properly employed, these efforts can drive customers to your stores, but it’s important to be cautious about the data you ask for and how you use it.

Some retailers, for instance, have experimented with using customers’ location data to send notifications to customers’ phones when they’re near a store. However, retailers need to use this data cautiously or risk alienating consumers.

[Mike McGuire, VP analyst for Gartner Marketing](https://www.chiefmarketer.com/gartner-analyst-qa-martech-innovations-in-the-covid-19-era/), points out that “proximity does not equal permission. Many consumers will keep location tracking off of their applications because they don’t want to be pestered.” He says that Gartner’s surveys found that consumers will enable location tracking only in cases when it delivers value to them: finding a store near them or if a product needs to be delivered to them.

### Prioritize privacy and choice in data collection

Keeping customer value and privacy in mind is critical in assessing how you should collect and employ personal data. Gartner recognizes this growing concern, and they included “[customer data ethics](https://www.chiefmarketer.com/martech-innovation-gartners-hype-cycle-for-digital-marketing-2020-report/)” on their 2020 Hype Cycle for Digital Marketing. This highlights the need for retailers to be transparent, legally compliant, and secure, even as they innovate. That means, at a baseline, that personally identifiable data should be encrypted and access to it should be rigorously controlled. At a time when customer trust is everything, you don’t want to squander it with a data breach.

There are less invasive methods for targeted digital marketing that can still drive customers to stores. For instance, optimizing your company for local SEO is still the best way to find new customers instead of losing them to online competitors.

You should also look for opportunities for targeting that require customers to directly opt-in, like emails and push notifications that tell them about sales at their local store. [_Multichannel Merchant_](https://multichannelmerchant.com/blog/digital-tools-help-retailers-adapt-post-quarantine-world/) suggests using in-store signs to promote digital marketing. “Stores can have signs for customers to text ‘Welcome Back’ to a five-digit number to receive an exclusive promotion. A quick text elevates their store visit and opts them in for future updates.”

## Guarantee Adaptability With an Omnichannel Approach

We don’t know when the pandemic will end or how it will affect consumer habits in the long-term, but the retailers that survive and thrive will be the ones that embrace [organizational change](https://academy.whatfix.com/change-management-101/) to stay aligned with their customers. The only way to do that effectively is with an omnichannel strategy that lets you allocate resources to the right channels and make adjustments as you go.

![Omnichannel Diagram](https://images.ctfassets.net/23aumh6u8s0i/4R9jiLsQ22iKfF5nFYW5qm/5e22f180c5c980130af02a358c9d7d04/omnichannel_diagram)

First and foremost, this requires retailers to know these customers on both a broad and granular level, and tailor your approach to them based on your knowledge. In an effective omnichannel approach, user identity is the connective tissue between digital and physical transactions. It’s what lets you create seamless customer experiences and maintain visibility over your customers and their habits. A customer can order a product on their laptop, get a push notification on their phone when it’s ready, and pick it up curbside; it works because the retailer’s identity management system keeps track of their journey, from computer to mobile device to physical location.

To get this bird’s-eye view of customers, use your [customer identity and access management (CIAM)](https://auth0.com/blog/what-is-ciam/) system to create a single source of truth about each customer. Each interaction with your company&mdash;whether in-store or online&mdash;feeds into a central profile, which enables better audience segmentation and marketing. The analytics from your CIAM platform will give you real-time insights into shoppers’ habits, so you can provide the right experiences based on their needs.

The important thing is to build adaptation and evolution into your strategy. Right now, an omnichannel approach may mean using your physical stores to promote digital channels, like retailers with signs out front that advertise curbside pickup. In the future, when the pandemic subsides, you can use digital marketing to encourage customers to return to stores.

And in the meantime, use those digital channels to keep customers informed and connected to physical stores. Post updates about the health precautions your company is taking. Use blogging and social media to humanize your in-store teams and keep the personal connection alive.

## Brick and Mortar Doesn’t Have to Mean Stuck in the Mud

Customers don’t want to choose between in-person and online shopping. What they want and expect are retail experiences that let them effortlessly move between channels.

When you embrace your customers’ flexibility, you can start finding more flexibility in how your digital and brick-and-mortar operations complement each other. Your stores can simultaneously be showrooms, warehouses, and community hubs. Your customers will use digital channels to tell you which option they need. You just need to have the capabilities to listen.

<include src="asides/AboutAuth0" />

Three Ways Retailers Can Harmonize Brick-and-Mortar and Digital Operations

The Israeli stock exchange integrates Auth0 for single-sign on and advanced security on its path to digital transformation and data accessibility

**TEL AVIV, Israel &mdash; August 3, 2020 &mdash;** [Auth0](https://auth0.com/), the identity platform for development teams, and its partner [MalamTeam](https://www.malamteam.com/), Israel’s largest local systems integrator, today announced they have been selected by The [Tel Aviv Stock Exchange (TASE)](https://www.tase.co.il/en) to provide secure single sign-on for all of its customer-facing applications. For the first time, users will be able to access TASE’s main website, ‘MAYA’ corporate website, mobile app, and many other digital services using a single set of credentials, with advanced security features to protect against cyber attacks.

The Tel Aviv Stock Exchange plays a major role in the growth and development of the Israeli economy. Building on the launch of an [English version of its MAYA website](https://www.prnewswire.com/news-releases/the-tel-aviv-stock-exchange-tases-maya-website-is-now-available-in-english-301084923.html) to make information more accessible to foreign investors, TASE wanted to provide a world-class login experience with a simple and secure customer identity and access management (CIAM) solution. They chose Auth0 for its security and [extensibility](https://auth0.com/blog/new-whitepaper-the-tao-of-extensibility/) &mdash; the ability to easily customize and add features like social login over time &mdash; and MalamTeam for its expertise as a local delivery partner.

Previously, each TASE application required a unique username and password. With the help of Auth0 and MalamTeam, TASE [standardized its identity management](https://auth0.com/resources/whitepapers/power-standardized-identity) and will offer SSO for customers across all of its current and future applications, including:

* TASE main website: [https://tase.co.il/](https://tase.co.il/)
* TASE info website: [https://info.tase.co.il/](https://info.tase.co.il/)
* MAYA corporate website: [https://maya.tase.co.il/](https://maya.tase.co.il/)
* TASE Open API website: [https://openapi.tase.co.il/tase/prod](https://openapi.tase.co.il/tase/prod)
* Mobile App - The Securities Exchange
* Document system for e-signatures

“The authentication solution from Auth0 represents a milestone for TASE that will allow us to better serve our customers and the Israeli business community. We no longer have to reinvent identity for every application, and that makes us more efficient and accessible as well,” said Uri Shavit, EVP, TASE CIO. “Our customers expect information at their fingertips, and this is the first time we’re enabling users to access all TASE applications with a single click. The flexibility of Auth0 means we can also customize the solution as our needs change.”

“We are grateful to Auth0 and MalamTeam for their support of our vision to make our data and information more accessible to investors and the fintech community,” added Assaf Kabakov, TASE project manager.

Auth0 also enables TASE to offer customers advanced security features like [Anomaly Detection](https://auth0.com/docs/anomaly-detection) and Multi-factor Authentication (MFA) for blocking attacks and detecting stolen credentials. Customers who already have an account with TASE will be migrated seamlessly to the Auth0 platform without needing to reset their username or password.

“The login experience is often a customer’s first interaction with a brand, and they expect it to be both convenient and secure,” said Bill Lapcevic, VP of business development at Auth0. “TASE is proving that security and customer experience are not mutually exclusive. We’re pleased to work with our partner MalamTeam to let the good users in, and keep the bad actors out of TASE applications.”

[Auth0 and MalamTeam](https://auth0.com/blog/auth0-expands-to-israel-with-malam-team-partnership/) signed a strategic partnership in Israel earlier this year. The two companies are committed to providing modern, componentized identity management solutions for Israel’s innovation ecosystem.

“With Auth0 and MalamTeam, Israeli companies have an opportunity to strengthen their user security and achieve great value for their organization,” said Amir Mesulam, CTO at Team Software, MalamTeam's software innovation division. “Auth0 provides TASE a single platform for all their authentication needs, internal and external, while enabling them to maintain robust security and advanced, yet simple control of their authentication flows.” 

## About MalamTeam
MalamTeam, the largest and the leading IT services group in Israel, provides a comprehensive range of computer services in the field of information technology. It is known for maintaining quality standards, customer service, and professionalism at an international level. The group combines innovation and decades of experience in setting up, implementing and integrating information systems. Its more than 3400 experts in a variety of information technologies are deployed throughout Israel at the facilities of the company and its customers. MalamTeam offers distinctive integrated solutions for all types of hardware, software, database and communications platforms; each of its business units specializes in a distinctive area.

<include src="asides/AboutAuth0" />

### Media Contacts
Mark Fowler 
Racepoint Global for Auth0, EMEA 
[auth0@racepointglobal.com](mailto:auth0@racepointglobal.com) 
+44 (0) 77 1124 4113

Auth0 and MalamTeam Secure Access to The Tel Aviv Stock Exchange Apps

ghazi-masood

I'm a seasoned business leader with nearly a 25 year track record in Sales running and managing teams of all sizes working in leadership positions for world class organizations.  Nowadays, you can find me at Auth0 leading all aspects of Revenue growth  for the Americas business.

Auth0 Vice President and General Manager, Americas.

Ghazi Masood

Executives might be over the term, but it still has a lot to teach

Digital transformation has been one of the defining business concepts of the past few decades, yet it’s also one of the most commonly misunderstood.

For some executives, the term evokes salespeople promising that their shiny new product is the key to digital transformation and then leaving them with technology that causes more problems than it solves. Meanwhile, others think they can afford to stop thinking about digital transformation because their business has already accomplished it.

Both reactions are understandable, but both are wrong.

In reality, digital transformation is too important a concept to be written off as a meaningless buzzword. [IDC estimates](https://www.idc.com/getdoc.jsp?containerId=prUS45612419) that worldwide spending on these technologies and services will reach $2.3 trillion in 2023. Yet, according to [McKinsey research](https://www.mckinsey.com/business-functions/organization/our-insights/unlocking-success-in-digital-transformations), fewer than a third of digital transformations actually succeed in improving company performance. Executives can reduce this waste by having a high-level understanding of digital transformation so they can rally their teams behind a shared vision and clearly defined goals.

 Digital transformation doesn’t refer to any specific digital initiative or product, but to a philosophical approach to implementing and assessing technology.

So let’s untangle the true meaning of digital transformation from all of the misunderstandings.

<include src="ebook-ads/IamWhitepaper" />

## What Is Digital Transformation?

In a nutshell, digital transformation means organizations refining their processes through continuous technological improvement, rooted in business goals and interwoven throughout an organization. [Ashutosh Bisht](https://www.idc.com/getdoc.jsp?containerId=PRF004945), senior research manager at IDC, [describes it as](https://www.idc.com/getdoc.jsp?containerId=prUS45612419) “managing the existing business and building for the future at the same time, something like changing the engine of the plane while in flight.”

### Designed to Adapt

Digital transformation isn’t just about adopting digital initiatives for today’s needs. It’s about instituting processes designed to adapt and evolve future technological advancement.

<include src="TweetQuote" quoteText="Technology that meets the definition of digital transformation is modular, is designed to be rearranged, and doesn’t fall apart with the slightest tinkering."/>

In the ’90s, digital transformation was all about setting up your company’s first website, transitioning to email for communication, and replacing rows of file cabinets with digital records. In the early 2000s, it meant switching to the cloud, harnessing useful analytics, and expanding the suite of services offered through your website and app. The next phase of digital transformation involves automating operations, using robotics, and constructing frictionless digital ecosystems for customers and employees.

All of these waves of innovation build on one another, and the companies best equipped to ride each successive wave are the companies that employ adaptable, extensible tools. Building complex applications in-house can leave your business stuck with legacy code bearing the distinctive fingerprints of its original designer, who may have left the company and taken their expertise with them. By contrast, the technology that meets the definition of digital transformation is modular, is designed to be rearranged, and doesn’t fall apart with the slightest tinkering.

![Collapse](https://images.ctfassets.net/23aumh6u8s0i/62orxkFTkFC3t9kPpJGoQQ/bdacba8b87953290dadb0da16632db27/pyramid-collapse)

Consider a [2020 report](https://www.e-shelter.de/sites/default/files/2020-05-12_-_hesitancy_gap_press_release.pdf) by UK-based technology company NTT called Mind the Hesitancy Gap. The report surveyed IT professionals in the UK and found that IT teams wasted 26% of their time “laying the groundwork for digital transformation processes,” with the result that those processes were often delayed, over- budget, or scrapped altogether. Thirty-five percent listed “the complexity of connecting the range of cloud services and other technologies together as a major barrier,” while 42% named “concerns over whether a new digital capability could introduce a security risk or leave the company non-compliant with regulation.”

### Designed for Business Goals

Fans of The Office (the American version) will recall Dunder Mifflin’s ill-fated attempt at digital transformation: an application for ordering bulk paper products that doubled as an exciting social network. This is a prime example of why digital initiatives often fail: companies chase “cutting-edge” tech, but fail to connect it to their business’ value proposition.

<table>
<tbody>
<tr>
<td>True digital transformation is rooted in business goals that are specific, and above all, measurable.</td>
<td><img src="https://images.ctfassets.net/23aumh6u8s0i/8S3tbcx2Il9uqaWRsFS2B/ca3b03aa4f5692c4a36e4ebb498ceb89/the-office" alt="the-office" width="360" height="218"/></td>
</tr>
</tbody>
</table>


You need to know exactly what problem a digital innovation is trying to solve so you can measure its success. For instance, don’t adopt a messaging platform to “speed communication” because faster communication isn’t an end unto itself.

Instead, ask who needs to be able to communicate faster. What information do they need to exchange, and are there other ways the information could be accessible? How do you measure success? If you’re adopting the platform in the factory, it might be a reduction in maintenance time for equipment. If it’s on the sales floor, it might be the sales team making more sales because they’re empowered to cut customers a better deal without having to walk away and talk to a supervisor.

## Digital Transformation Myths and Misconceptions

The meaning of digital transformation has eroded over the years. That has led to wasteful spending and an uphill battle for innovators trying to get organization-wide support for their ideas.

### Digital Transformation Isn’t Digitization

[Digitization](https://www.forbes.com/sites/jasonbloomberg/2018/04/29/digitization-digitalization-and-digital-transformation-confuse-them-at-your-peril/#46410592f2c7) means moving from pen-and-paper processes to digital ones. When a company transfers years of paper records onto a database, that’s digitization. While that’s certainly important, simply moving from analog to digital isn’t truly transformative.

### Digital Transformation Isn’t a Pretext for Laying off Your Workforce

Employees often get nervous about new technologies because they imagine the technology will put them out of a job. That may be true in some cases, such as robotic assembly lines and driverless trucks. But by and large, digital transformation should be an invitation for your workforce to evolve along with your technology. If you want a holistic adoption of digital initiatives, you need buy-in from all levels. Use this as an opportunity to train your workforce in new skills, not render them obsolete.

### Digital Transformation Isn’t Top-Down

Or at least, it can’t be only top-down. Far too many digital initiatives are undertaken by a well-meaning C-suite but fail to get the crucial input of the IT team or the workers on the ground.

True digital transformation is holistic and dedicated to removing silos. In that way, it mirrors the increasing integration of technology into every facet of our lives.

## Designing a Digital Transformation Strategy That Works

So we’ve talked about what digital transformation is and isn’t. Now let’s look at how that definition should inform your business’s strategy as you decide what initiatives to adopt.

### Ask Your Insiders

Looking for inefficient processes that could be improved by technology? Don’t go to strangers; ask your teams! [_Harvard Business Review_](https://hbr.org/2019/03/digital-transformation-is-not-about-technology) points out that companies “frequently bring in an army of outside consultants who tend to apply one-size-fits-all solutions in the name of ‘best practices.’” Instead, they suggest talking to staff during the brainstorming phase of transformation as a way to capitalize on your institutional knowledge as well as get buy-in from the people you need to use your technology.

### Implement, Test, Refine, Repeat

Digital transformation requires something of a startup mentality that rewards experimentation and creativity and sees failure as a learning opportunity. Determine your definition of an initiative’s success, and if it fails to deliver, try something else. Without that willingness to test and tweak, digital initiatives can quickly morph into “pet projects.”

Embracing that startup mentality can be more of a challenge in large, bureaucratic organizations. That’s why [Gartner predicts](https://www.gartner.com/smarterwithgartner/gartner-top-strategic-predictions-for-2020-and-beyond/) that through 2021, these initiatives will take large enterprises twice as long and cost twice as much as planned. The good news is that an agile SaaS approach helps organizations speed time-to-market for digital initiatives. Partnering with third-party SaaS solutions can speed up time-to-market for large enterprises by cutting through bureaucracy with easy-to-implement solutions. The majority of companies already use a SaaS tool to manage authentication, payments and messaging. 

### Serve Your Customers by Serving Your Workforce

[Many definitions](https://www.forbes.com/sites/jasonbloomberg/2018/04/29/digitization-digitalization-and-digital-transformation-confuse-them-at-your-peril/#46410592f2c7) of digital transformation are focused on becoming “customer-centric,” and there’s a lot to that idea. Amazon, for instance, has remained at the forefront of transformation through its single-minded focus on the customer, and retailers are learning to follow suit in order to survive.

However, if you focus all of your efforts on B2C transactions and neglect to empower your workforce with the latest tools, you’re not equipped for true transformation. Instead, many successful transformations start by giving staff easier access to information and streamlining day-to-day operations. 

This graph from [McKinsey](https://www.mckinsey.com/business-functions/organization/our-insights/unlocking-success-in-digital-transformations) shows the success rate of digital transformation based on various metrics. As you can see, collaboration and workforce protocols are distinguishing factors among companies where transformation has fulfilled its promise. The dark blue bars show the power of digital transformation.

![Graph-from-McKinsey](https://images.ctfassets.net/23aumh6u8s0i/3hGz7H6BvfP3780BfCpkm0/6929d3627a4eaeab2b2aa60580385212/graph-from-mckinsey)

## There Is No Finish Line for Digital Transformation

Of all the myths about digital transformation that need to be debunked, perhaps the biggest one is that it’s a process with an endpoint. After all, it’s not as though your fairy godmother can wave her wand, and then poof! Your business is transformed once and for all.

Rather, you commit to adopting new technologies as they develop, provided they meet your business’s needs. Your best allies will be your own team and trusted third parties who can ensure that you dedicate your resources where they will be most useful and best positioned for the future.

<include src="asides/AboutAuth0" />

What Digital Transformation Is (and What It Isn't)

Continued company growth underscores importance of identity management in digital transformation

**BELLEVUE, Wash. – July 14, 2020 –** The [Auth0](https://auth0.com/) Identity Platform, a product unit within Okta, today announced it has closed a $120 million round of Series F funding, which brings Auth0’s valuation to $1.92 billion and total capital raised to more than $330 million. The funds will help fuel continued innovation and go-to-market expansion, responding to global demand for a simple, extensible identity platform that provides secure access to any application. 

Led by Salesforce Ventures, the round included another new investor, DTCP, as well as participation by existing investors Bessemer Venture Partners, Sapphire Ventures, Meritech Capital, World Innovation Lab, Trinity Ventures, Telstra Ventures, and K9 Ventures.

Auth0’s Series F round comes a little more than a year after the close of its [$103 million Series E funding](https://auth0.com/blog/auth0-closes-103m-in-funding-passes-1b-valuation/) last May, which launched the company into ‘unicorn’ status. After growing 70% in 2019, Auth0’s rapid growth has continued through Q2 2020 despite the uncertainty of the current global economic environment.

Auth0 continues to quickly expand its customer base, underscoring that identity management plays a critical role in digital transformation and in enabling access to customer applications. Thousands of customers outsource their identity management to Auth0 to help offload the burden of maintaining complex systems and enjoy faster time-to-market and frictionless end-user experiences. 

“Auth0 is a leader in the large, fast-growing identity management market and has shown tremendous growth at scale,” said John Somorjai, EVP, Corporate Development & Salesforce Ventures at Salesforce. “Auth0’s expertise in end-to-end identity products is well-aligned with Salesforce's Customer 360 platform. We look forward to supporting their growth with this new strategic investment from Salesforce Ventures to drive further innovation for customers.” 

“Now, more than ever, safeguarding user access on all devices and connections is of paramount importance,” said Jack Young, partner and head of venture capital at DTCP. “Auth0 has positioned itself as a leader in Identity-as-a-Service and has gained the trust of application developers with its flexible, drop-in user identity management solution. We will use our European roots and strategic global network to help the Auth0 team continue along its growth track.”

“Achieving a Series F round of funding is an incredible milestone for our company, and we could not be more grateful to our new and existing investors for their support,” said Eugenio Pace, CEO, and co-founder of Auth0. “Nearly every app and service relies on secure authentication and seamless user experience. Our year-over-year growth is reflective of the persistent problem that our technology is solving, and we are so proud to be part of our customers’ journey.” 

Auth0 employs approximately 650 employees worldwide and continues to be recognized as a leading private company, with inclusion in the [Forbes 2019 Cloud 100](https://auth0.com/blog/auth0-is-named-to-the-forbes-2019-cloud-100/), [Deloitte’s Technology Fast 500](https://auth0.com/blog/auth0-ranked-as-one-of-north-americas-fastest-growing-companies/), and other [notable awards](https://auth0.com/press/awards/). 

## About Salesforce Ventures 

Salesforce is the global leader in Customer Relationship Management (CRM), bringing companies closer to their customers in the digital age. Salesforce Ventures, the global investment arm of Salesforce, invests in the next generation of enterprise technology that extends the power of the Salesforce Platform. Salesforce Ventures is building the world's largest ecosystem of enterprise cloud companies and extending that technology to customers. Portfolio companies receive funding, strategic advisory, and operating support, and can easily join [Pledge 1%](https://pledge1percent.org/) to make giving back part of their business model. Salesforce Ventures has invested in more than 400 companies, including DocuSign, GoCardless, Guild Education, nCino, Twilio, Zoom, and others across 22 countries since 2009. For more information, please visit [www.salesforce.com/ventures](https://www.salesforce.com/company/ventures/). 
 
## About DTCP

DTCP is an investment management group with $1.7 billion in assets under management and advisory from corporate and institutional investors, and a portfolio of over 60 companies. The group provides venture and growth capital, private equity, and advisory services to the technology, media, and telecommunications sectors. It operates and invests in Europe, North America, and Asia out of its Hamburg, San Francisco, Tel Aviv, and Seoul offices. To learn more about DTCP, visit [dtcp.capital](https://www.dtcp.capital/), [www.linkedin.com/dtcp-capital](https://www.linkedin.com/company/dtcp-capital/), or [@dtcp_capital](https://twitter.com/dtcp_capital) on Twitter.
 
<include src="asides/AboutAuth0" />

### Media Contacts
Jeana Tahnk 
Auth0 Global Communications 
[press@auth0.com](mailto:press@auth0.com)

Hannah Carroll 
Matter for Auth0 
[auth0@matternow.com](mailto:auth0@matternow.com)

Auth0 Announces $120M in Series F Funding

kaycie-east

As PR Manager, Kaycie supports public relations and global communications efforts for Auth0 in the AMER region. When not promoting the Auth0 brand, Kaycie can be found hiking, traveling, or searching for the next best bite to eat.

PR Manager, AMER Region

Kaycie East

Leading professional services provider to integrate Auth0 for digital transformation initiatives

**BELLEVUE, Wash. – February 26, 2020 –** The [Auth0](https://auth0.com/) Identity Platform, a product unit within Okta, today announced that [Cognizant](https://www.cognizant.com/) (Nasdaq: CTSH) has joined its [Partner Program](https://auth0.com/partners) and will use Auth0 as one of its main authentication providers for any of its customers’ identity management needs. Ranked 193 on the Fortune 500 list with nearly 300,000 employees, Cognizant is an integral partner in transforming global enterprises’ business, operating, and technology models for the digital era. 

“Cognizant’s broad portfolio of consulting, professional, and managed security services are designed to help our clients around the globe to meet their security challenges,” said Ryan Parthasarathy, Vice President of Cognizant Security. “Given the complexity of identity management, we’re proud to partner with a global expert and game-changer in the CIAM space to enhance our security offerings and deliver only the best for our customers.”

Known for its highly-scalable platform, Auth0 was recently ranked as a [Leader for CIAM](https://auth0.com/blog/auth0-named-a-leader-in-the-g2-winter-2020/) on G2, the world’s leading business solutions review website. With high-velocity growth and more than 9,000 customers worldwide, Auth0 is answering the demand for identity management with a simple, extensible, and powerful solution for any application, for any audience.

“We’re thrilled to partner with Cognizant, an experienced leader in complex identity projects, and combine our teams’ expertise with our extensible, flexible, and trusted platform to aid Cognizant customers in a successful and secure digital transformation journey,” said Bill Lapcevic, VP of business development of Auth0. “Identity management is a critical and complex step in any transformation process, and a strong CIAM system will help customers modernize their business in a quicker and more organized fashion to address identity and security needs.”

Learn more about the [Auth0 Partner Program here](https://auth0.com/partners) along with the recent [growth of Auth0’s global partner network](https://auth0.com/blog/auth0-partner-program-accelerates-global-growth/), now serving more than 60 partners worldwide.

For more information about Cognizant Security, please visit [www.cognizant.com/security](https://www.cognizant.com/security).

<include src="asides/AboutAuth0" />

### Media Contacts
Kaycie East 
Auth0 Global Communications 
[press@auth0.com](mailto:press@auth0.com) 
 
Ryan Schin 
Matter for Auth0 
[auth0@matternow.com](mailto:auth0@matternow.com)

Auth0 Expands Global Partner Network with Cognizant

IAM systems integrator enables digital transformation for Germany’s top companies

**LONDON – 7 January 2020 –** The [Auth0](https://auth0.com/) Identity Platform, a product unit within Okta, today announced a partnership with systems integrator [iC Consult Group](https://ic-consult.com/en/ic-consult-home/#services_img). The specialist in Identity and Access Management (IAM) is Auth0’s first partner covering the German market and works with 50% of major German companies on the DAX stock index. iC Consult Group also operates globally with 12 offices across the UK, Europe, America, and Asia.

The addition of iC Consult Group and [Auth0’s overall growth in DACH](https://auth0.com/blog/auth0-announces-growth-in-dach/) indicates demand for cloud-based identity management solutions that balance security and customer experience. According to a recent survey from Germany’s digital association Bitkom and KPMG, cloud is an important driver of [digital transformation](https://hub.kpmg.de/cloud-monitor-2019) with 73% of German companies using some form of cloud computing. iC Consult Group introduces a tremendous opportunity for Auth0 to help German customers increase their efficiency in managing user identities across digital apps and services.

“In the area of identity management, we’re seeing more of our customers deviate from on-premise to cloud-based alternatives. Auth0 addresses this need by providing a lightweight solution that is quick to implement and does not tie up unnecessary development resources. Because at the end of the day, it’s all about accelerating the digitization of services,” said Andre Priebe, Chief Technology Officer at iC Consult Group.

In addition to the classic enterprise IAM topics of governance, provisioning, Single Sign On (SSO) and identity federation, the systems integrator wants to focus more on consumer IAM, including social media logins like [Sign in with Apple](https://auth0.com/blog/learn-how-to-implement-sign-in-with-apple-easily/), and [Device Flow](https://auth0.com/blog/oauth-device-flow-no-hassle-authentication-as-seen-on-tv/) for the Internet of Things.

"We are thrilled to welcome iC Consult Group to our program. The move to the cloud requires a new approach and specific expertise. Combining Auth0's flexible and extensible identity platform with iC Consult Group's experience moving businesses into the cloud can be a true source of competitive advantage for our mutual customers,” said Bill Lapcevic, VP of business development at Auth0.

Expansion to Germany follows the recent [growth of Auth0’s global partner programme](https://auth0.com/blog/auth0-partner-program-accelerates-global-growth/) and brings the total number of European partners to 30. Learn more and join the [Auth0 Partner Program here](https://auth0.com/partners).

## About iC Consult Group

iC Consult Group and its companies – iC Consult, xdi360, IAM Worx, and Service Layers – specialize in Identity and Access Management (IAM). The services we provide include IAM Business Consulting, Architecture and Design, Implementation and Integration, Managed Services, and our Identity as a Service offering: Service Layers. With over 300 consultants, 30 IAM product partners, and more than 1000 successful projects, we have demonstrably achieved customer success.

For more than 20 years, we have been inspiring our renowned global customers from the automotive, logistics, pharmaceutical, and financial sectors – but not only with classic IAM. We are also at the forefront of innovative topics such as Customer IAM, Internet of Things, and API Management.

For more information, please visit [https://ic-consult.com](https://ic-consult.com).

<include src="asides/AboutAuth0" />

### Media Contacts:
Silvia Hänig 
[shaenig@wireside.com](mailto:shaenig@wireside.com) 
0173-3838572 
089-44848127 

Mark Fowler 
Racepoint Global for Auth0, EMEA 
[auth0@racepointglobal.com](mailto:auth0@racepointglobal.com) 
+44 (0) 77 1124 4113

Auth0 Expands Partner Programme to Germany with iC Consult Group

Sporting goods retailer’s commitment to constant digital innovation drives enhanced login

**BELLEVUE, Wash. – December 11, 2019 –** The [Auth0](https://auth0.com/) Identity Platform, a product unit within Okta, today announced that it has been selected by DICK’S Sporting Goods, a leading omnichannel sporting goods retailer, to provide a superior customer login experience for every customer (‘athlete’) who interacts with the online brand. Auth0 will power the login experience for DICK’S digital properties – website and mobile – and enable athletes to access information and merchandise with even more ease and security than before. 

DICK’S is a leading omnichannel sporting goods retailer that offers an extensive assortment of authentic, high-quality sports equipment, apparel, footwear, and accessories. Headquartered in Pittsburgh, PA, DICK’S caters to millions of athletes’ sporting goods needs on its digital website, [www.dickssportinggoods.com](http://www.dickssportinggoods.com). This past year, DICK’S embarked on a digital transformation project that included identity management as a critical component. 

In addition to implementing [Single Sign On](https://auth0.com/single-sign-on/), they also wanted to have a modern identity solution that offers leading-edge options, such as passwordless authentication. 

“Our athletes and their experience on our digital properties is one of the most important factors in retaining our loyal fan base and continuing to expand our business to new audiences,” said Bob Pecina, VP of Technology, DICK’S. “After a solid review of solutions on the market, Auth0 provided us with the ease-of-use and scalability we were looking for in an identity management solution. They could also achieve our time-to-market goals, which was a deciding factor with the upcoming holiday season.” 

DICK’S will roll out new login features across its digital brands in the next few months and continue to leverage Auth0’s many product features to continually enhance the user experience. 

“Working with DICK’S and the scale in which they need to support their massive fan base is so exciting, and is certainly something our platform is designed to handle,” said Ghazi Masood, VP of Americas for Auth0. “We are especially thrilled to support DICK’S during this holiday season, and provide its loyal athletes with the ability to digitally access what they need as easily and securely as possible.” 

Auth0 is proud to help DICK’S and other major enterprises stay ahead of the competition by creating a better login experience. For more information about [Auth0’s customers](https://auth0.com/customers), please visit the company’s website. 

<include src="asides/AboutAuth0" />

### Media Contacts

Kaycie East 
Auth0 Communications 
[press@auth0.com](mailto:press@auth0.com)

Alex Plew 
Matter for Auth0 
[auth0@matternow.com](mailto:auth0@matternow.com)

DICK’S Sporting Goods Turns to Auth0 for Industry-Leading Login Experience

shafiq-shivji

Shafiq leads Product Marketing for Auth0's Ecosystem and Extensibility domains. He brings vast experience from previous roles as a Product Manager and Sales Engineer working in adjacent SaaS industries like machine learning, web/mobile apps, and communications. He especially enjoys the creative process of conceiving and taking high-impact products to market.

Product Marketing Manager

Shafiq Shivji

The right digital initiatives can turn your brick-and-mortar locations into your biggest assets against e-commerce competitors

It wasn’t long ago that showrooming — the tendency of customers to examine a product in a store and then go online to compare prices and make the actual purchase — was considered one of the four horsemen of the so-called retail apocalypse.

However, in recent years, savvy retailers have learned how to use showrooming to increase revenue. More and more [_success stories_](https://www.forbes.com/sites/forbesbusinessdevelopmentcouncil/2018/05/16/how-brick-and-mortar-stores-are-making-a-comeback-with-millennials-and-gen-zers/#54db375c1640) feature traditional retailers aligning their digital and brick-and-mortar operations, so each drives sales for the other. Instead of driving customers away, they’re building brand loyalty by creating tailor-made experiences online and in person.

Historically, retailers found showrooming so damaging and difficult to counteract because customers engaged in their browsing anonymously. Retailers had no way of understanding their customers’ behavior or of appealing to them once they left the store. This lack of shared customer data robbed retailers of the ability to leverage their unique advantages against e-commerce competitors. Now, however, more CTOs are recognizing that smart [_identity management_](https://auth0.com/retail/) is the key to keeping customers within the sales funnel, regardless of where they make a purchase. Below, we’ll discuss how to implement an approach to identity that helps your digital and physical stores feed into each other’s operations and drive revenue growth.

<div class="alert alert-info alert-icon">
 
 Security vs. customer experience has been a longstanding challenge in retail, but retailers no longer have to choose one over the other. <a href="https://info.auth0.com/IdentityinRetailReport.html">Discover the intersection between CX and reliable security.</a>
</div>

## Create a Single View of the Customer

If you want to turn showrooming to your advantage, you have to create a seamless customer experience across all touchpoints, thereby providing a more compelling, personalized environment than online price-shopping. Designing this experience first requires a comprehensive understanding of your customer.

Implementing [_social login_](https://auth0.com/blog/how-to-use-social-login-to-drive-your-apps-growth/) across all your digital channels is a simple, efficient way to build a rich user profile. Social login confers several advantages, the first being that its simplicity increases the likelihood that customers will sign in since they don’t have to create a new set of credentials for your site.

Of course, customers who use social login then share a wealth of information about their attributes, interests, and location. Armed with this information, you can send more tailored and helpful recommendations their way—as well as guide customers back to your physical retail store. Social login is also crucial in creating the same experience across all digital touchpoints since their profile will be consistent regardless of where they sign in.

![Single view of the customer](https://images.ctfassets.net/23aumh6u8s0i/1Ro1NRBQRzpra6UhFFQDTR/74464aec53334c1931b02da0adbe4821/single-view-of-the-customer)

Building data-rich user profiles is only half the battle, though. That data can’t do anything to hang on to showrooming customers if it’s siloed on your digital storefront. To fully align your operations, it’s critical to integrate identity management with your existing CRM.

Auth0’s platform integrates with any CMS, analytics, or e-commerce platform, including [_Microsoft CRM_](https://auth0.com/docs/integrations/sso/dynamics-crm) and [_Salesforce_](https://auth0.com/docs/integrations/sso/salesforce). Integrating identity management with your existing SaaS tools enables you to share this single view of the customer with the systems that can put it to best use. For example, using [_geofencing_](https://www.salesforce.com/products/marketing-cloud/best-practices/geofencing-marketing/#) with your CRM can alert you to a customer browsing a store, with no need for login. Your sales team is now alerted and empowered by easy access to a customer’s profile. In some cases, you can even write a customized rule that if a customer enters and exits the store without purchasing, the CRM [_automatically alerts_](https://docs.microsoft.com/en-us/power-platform-release-plan/2019wave2/microsoft-flow/running-flows-geofence-generally) your digital marketing team to follow up with them.

The surgical precision of such a method is exactly the type of digital initiative that retail CTOs can get excited about; it’s not tech for tech’s sake, but a data-driven means of patching a revenue leak. Integrating customer data across channels is both cutting edge and a fairly simple way to streamline operations. When digital and physical stores share a rich and holistic view of the customer, it ensures that they are working collaboratively, not at cross-purposes.

## Introduce Endless-Aisle Technology

For a retailer, there’s nothing more disheartening than a customer who comes in search of a popular item, finds that it’s out of stock, and walks away saying, “I guess I’ll just order it on Amazon.” Endless aisle is the solution to this problem.

Endless aisle refers to the practice of providing customers with an in-store digital touchpoint from which they can order an unavailable product and have it shipped to their homes. Implementing endless aisle can be an effective method of wooing customers, even those who walked in only intending to showroom. For example, a touchscreen positioned next to a display can direct a customer to a “special release” version of the product available only through the retailer.

Endless-aisle tech also allows retailers to offer a wider variety of sizes, colors, or styles of any product, without the store having to stock them. It’s a way that CTOs can help achieve leaner inventory management without compromising on customer choice.

The possibilities expand further if you implement social login on your endless-aisle touchpoints since the reduced friction increases the likelihood that customers will actually use it to place an order. Auth0’s easy [_social login_](https://auth0.com/blog/how-to-use-social-login-to-drive-your-apps-growth/) has been demonstrated to improve conversion rates and registration. When a customer logs in — even if they don’t make a purchase — you have a record of the interaction and can follow up with email and targeted ads.

Various retailers have experimented with different approaches to endless aisle, from installing kiosks to setting up tablets to using “beacons” in store aisles to send [_push notifications_](https://blog.getenjoyhq.com/the-3-golden-rules-of-push-notifications/) directly to a customer’s smartphone. Regardless of which solution makes the most sense for your business, Auth0’s platform is device-agnostic, so using identity to make a purchase is as easy in the store as it is on a mobile app or website.

<include src="TweetQuote" quoteText="Learn about endless-aisle technology and how it can help you woo customers."/>

## Use Customer Data to Facilitate Reverse Showrooming

To fully seize on the revenue-driving potential of showrooming, you shouldn’t treat it as a one-way street, steering customers from brick-and-mortar locations to digital stores. Instead, you can use effective identity management to create a cyclical relationship between touchpoints, playing to the individual strengths of each.

Using your digital presence to encourage customers to show up in person is a phenomenon known as webrooming, or “[_reverse showrooming_](https://www.fool.com/investing/2019/03/19/call-it-reverse-showrooming-these-companies-are-ca.aspx).” With your single view of customer identity, you can send personalized email reminders, offers, and targeted ads to drive shoppers to stores.

Certain types of retailers are particularly well-positioned to capitalize on webrooming because their products all but require customers to try them on or sample them in person. [_Ulta Beauty_](https://www.fool.com/earnings/call-transcripts/2019/03/15/ulta-beauty-ulta-q4-2018-earnings-conference-call.aspx), for example, credited its in-store sales increase to “incorporating relevant product recommendations and replenishment reminders across digital channels” in what it called a “reverse channel shift.”

Customer data can also drive revenue and cut costs in ways that go beyond traditional marketing initiatives, as in the case of returns. A [_2018 CBRE report_](https://www.supplychain247.com/article/holiday_season_heightens_challenges_of_online_returns) found that returns comprise 8% of sales for brick-and-mortar retailers, while online shoppers return goods at levels from 15% to 30%. But with effective identity management, you can turn this behavior to your benefit. With well-organized, accessible data, you can direct customers to their local store to return the product they bought online. Not only does this allow for immediate restocking and save on shipping costs, but it also gives you a chance to make another sale once the customer is in the building. It’s just one example of the many creative, often overlooked, yet valuable ways a robust identity management system can allow CTOs to directly contribute to cost savings.

<include src="TweetQuote" quoteText="Learn how webrooming uses your digital presence to encourage customers to show up in person to your store."/>

## You Can Turn Showrooming from a Problem into a Solution

As long as you’re keeping customers in your sales funnel, and not losing them to the competition, showrooming can deliver some surprising benefits. For example, when a customer tries on a pair of shoes in the store but purchases them online, they’re far less likely to order the wrong size and put the retailer through an expensive returns process. However, unless your physical and digital channels are fully integrated, you’d have no way of knowing the important role your store played in that transaction, so you might mistakenly conclude that the store isn’t contributing to sales.

Once you have an identity management system in place that de-siloes your customer data, you can ensure that just because a customer walks out the door, you haven’t lost the chance to make a sale. If you’re in search of digital initiatives that directly address business needs, partnering with an identity management platform like Auth0 is an easy way to turn a loss into a win. Reach out to an [_Auth0 resource_](mailto:%20sales@auth0.com) for customized insight.

<include src="asides/AboutAuth0" />

"digital"