carla_urrea

I've been working as a software engineer since 2014, particularly as a backend engineer and doing system design. I consider myself a language-agnostic developer but if I had to choose, I like to work with Ruby, Python, and Elixir.  

After realizing how fun it was to create content and share experiences with the developer community I made the switch to Developer Advocacy. I like to learn and work with new technologies. 

When I'm not coding or creating content you could probably find me going on a bike ride, hiking, or just hanging out with my dog, Dasha. 

Senior Developer Advocate

Carla Urrea Stabile

Native login with passkeys allows you to integrate passkeys into your native applications and offers a smooth user experience with all the benefits of passkeys.

Native login with passkeys allows you to seamlessly integrate [passkeys](https://learnpasskeys.io/introduction) into your mobile applications. If you wanted to add passkeys before, you had to integrate a web redirect flow that uses Universal Login. 

Today, we are announcing Limited Early Access to Native Login with passkeys for Android applications. 

## How Does It Work? 

In order to use Native Login with passkeys in your Android application, there are a few requirements:

* **Enable and configure your passkey policy**: First of all, you need to enable passkeys for your tenant. Learn how to do it using [our documentation](https://auth0.com/docs/authenticate/database-connections/passkeys/configure-passkey-policy).
* **Configure a Custom Domain**: you can learn how to configure a custom domain using [our documentation](https://auth0.com/docs/customize/custom-domains).
* **Enable Android App Links Support**, which you can do following [our docs](https://auth0.com/docs/get-started/applications/enable-android-app-links-support).

Native login is available on the Android SDK from version 3.2.0 and Android API 28. 

### Sign Up 

To sign up, you’ll need to use the "`signupWithPasskey`" method from the "`AuthenticationAPIClient`". When successful, you can handle the passkey creation from your device using Android’s CredentialManager following [Android’s official docs](https://developer.android.com/identity/sign-in/credential-manager#create-passkey). Here’s an example implementation in Kotlin:

```java
val account = Auth0.getInstance("{YOUR_CLIENT_ID}", "{YOUR_DOMAIN}")

val client = AuthenticationAPIClient(account) 

client.signupWithPasskey(
            UserData(
                email = "jndoe@email.com"
            ), "{realm}"  
        ).start(object : Callback<PasskeyRegistrationChallenge, AuthenticationException> {
            override fun onSuccess(result: PasskeyRegistrationChallenge) {
                val passKeyRegistrationChallenge = result
                val request = CreatePublicKeyCredentialRequest(
                    Gson().toJson(
                        passKeyRegistrationChallenge.authParamsPublicKey
                    )
                )
                var response: CreatePublicKeyCredentialResponse?

        // start credential creation on the device 
                credentialManager.createCredentialAsync(requireContext(),
                    request,
                    CancellationSignal(),
                    Executors.newSingleThreadExecutor(),
                    object :
                        CredentialManagerCallback<CreateCredentialResponse, CreateCredentialException> {

                        override fun onError(e: CreateCredentialException) {
                        }

                        override fun onResult(result: CreateCredentialResponse) {

                            response = result as CreatePublicKeyCredentialResponse
                            val authRequest = Gson().fromJson(
                                response?.registrationResponseJson,
                                PublicKeyCredentials::class.java
                            )

       // once the device created the key pair and signed the challenge you can sign in to Auth0 
                            client.signinWithPasskey(
                                passKeyRegistrationChallenge.authSession,
                                authRequest,
                                "{realm}"
                            )
                                .validateClaims()
                                .start(object : Callback<Credentials, AuthenticationException> {
                                    override fun onSuccess(result: Credentials) {
                                        credentialsManager.saveCredentials(result)
                                        Snackbar.make(
                                            requireView(),
                                            "Hello ${result.user.name}",
                                            Snackbar.LENGTH_LONG
                                        ).show()
                                    }

                                    override fun onFailure(error: AuthenticationException) {
                                        Snackbar.make(
                                            requireView(),
                                            error.getDescription(),
                                            Snackbar.LENGTH_LONG
                                        ).show()
                                    }
                                })
                        }
                    })
            }

            override fun onFailure(error: AuthenticationException) {
                Snackbar.make(
                    requireView(),
                    error.getDescription(),
                    Snackbar.LENGTH_LONG
                ).show()
            }
        })
```

The `signupWithPasskey` method starts the passkey creation ceremony. It generates the challenge for the authenticator to sign once it has created the public key credential pair. In your case, your Android device acts as the authenticator and you create the key pair and sign the challenge when you use the `CreatePublicKeyCredentialRequest` method from Android’s Credential Manager. 

Then, you can use Android’s Credential Manager method `createCredential` or `createCredentialAsync` to start the creation. Once successful, you can use the result from the creation to send that data to Auth0 and sign in using the ``signinWithPasskey`` method, which is covered below.

### Login 

To sign in, you’ll have to first initiate the passkey challenge by using the `passkeyChallenge` method from the `AuthenticationAPIClient`. When the call is successful, you can initiate the credential retrieval using Android’s [`getCredential` method from the `CredentialManager`](https://developer.android.com/identity/sign-in/credential-manager#sign-in).

When your device retrieves the credential successfully, you can then initiate the sign-in process with Auth0. An example implementation could be:

```java
val account = Auth0.getInstance("{YOUR_CLIENT_ID}", "{YOUR_DOMAIN}")
val client = AuthenticationAPIClient(account)

client.passkeyChallenge(realm)
            .start(object : Callback<PasskeyChallenge, AuthenticationException> {
                override fun onSuccess(result: PasskeyChallenge) {
                    val passkeyChallengeResponse = result
                    val request =
                        GetPublicKeyCredentialOption(Gson().toJson(passkeyChallengeResponse.authParamsPublicKey))
                    val getCredRequest = GetCredentialRequest(
                        listOf(request)
                    )
                    credentialManager.getCredentialAsync(context,
                        getCredRequest,
                        CancellationSignal(),
                        executor,
                        object :
                            CredentialManagerCallback<GetCredentialResponse, GetCredentialException> {
                            override fun onError(e: GetCredentialException) {
                                Log.w(TAG, "Error fetching public key credential")
                                callback.onFailure(handleGetCredentialFailure(e))
                            }

                            override fun onResult(result: GetCredentialResponse) {
                                when (val credential = result.credential) {
                                    is PublicKeyCredential -> {
                                        val authRequest = Gson().fromJson(
                                            credential.authenticationResponseJson,
                                            PublicKeyCredentials::class.java
                                        )
                // initiate signin process with Auth0
                                        client.signinWithPasskey(
                                            passkeyChallengeResponse.authSession,
                                            authRequest,
                                            realm
                                        )
                                            .validateClaims()
                                            .addParameters(parameters)
                                            .start(callback)
                                    }

                                    else -> {
                                        Log.w(
                                            TAG,
                                            "Received unrecognized credential type ${credential.type}."
                                        )
                                        callback.onFailure(AuthenticationException("Received unrecognized credential type ${credential.type}"))
                                    }
                                }
                            }
                        })

                }
```

For more detailed examples, you can check out the [Android SDK sample folder on Github](https://github.com/auth0/Auth0.Android/tree/main/sample).

If you need [Java examples, you can check out this doc](https://github.com/auth0/Auth0.Android/blob/main/EXAMPLES.md#passkeys).

## What Use Cases Are Supported?

The initial early access release provides support for the following use cases:

* **Sign Up with a passkey**: users can register a new passkey for Auth0/your app and store it in the device credential manager for future use. 
* **Login with a passkey**: users can retrieve passkeys using the device’s credential manager and use them to log in. 

## How Can You Apply?

If you are interested in joining the early access program, please reach out to your account manager.

_Any products, features, or functionality referenced in this material that are not currently generally available may not be delivered on time or at all. Product roadmaps do not represent a commitment, obligation, or promise to deliver any product, feature, or functionality, and you should not rely on them to make your purchase decisions._

Native Login with Passkeys Is Now in Limited Early Access for Android Applications!

Abbie Carlson

As a Product Marketing Manager, I'm responsible for communicating the value of Identity for consumer apps as well as focusing on the developer experience. I'm forever curious about how Identity plays a role in our everyday lives as consumers and how a great Customer Identity solution can make or break a business through patron loyalty and retention. 

Outside of work can catch me watching Seattle sports, going to as many concerts as I can or listening to true crime podcasts.

Senior Product Marketing Manager - Developer Experience & Analytics

Keep scrolling to learn more about our newest releases, updates, and all things developer.

Being creative, finding solutions, and always looking to evolve. To me, that’s what encompasses a true developer. And maybe I’m living in Camelot, but honestly- what would apps be without the dev? (literally, we wouldn’t have any).

**Auth0 by Okta** understands that you, the developer, are here to, well, develop. 

And all that we can do is support you in your journey. Whether that’s at your 9-5  (more likely your 4-midnight) or on the weekends building your hobby app.

So with that, we want to share some new and updated products that can help solve your problems around all things Identity. 

## Highly Regulated Identity General Availability

**[Highly Regulated Identity General Availability](https://auth0.com/docs/secure/highly-regulated-identity)**. This Financial Grade Identity ™ solution suite delivers elevated security, privacy, and UX controls for sensitive customer operations beyond login— such as updating account information, accessing sensitive data, sending money, or making an open banking payment. Enable financial grade API protections, step-up security and consent. 

![Highly Regulated Identity General Availability](https://images.ctfassets.net/23aumh6u8s0i/7eRSbWJjEVlxClg7D8DdTM/8d675fdef576d67efbd56f6a9493e785/Uploaded_from_Coming_in_Hot__Auth0_s_Q2_Developer_Releases)
_Highly Regulated Identity Phase 1_

## Forms for Actions EA

**[Forms for Actions EA](https://auth0.com/docs/customize/forms)**. This feature provides a new visual editor for customers to build custom forms to extend login and signup flows within their tenant’s domain. This gives our customers better control over user experience and additional flexible building blocks. 

![Dashboard > Actions > Forms](https://images.ctfassets.net/23aumh6u8s0i/3DTIQSawDVsEGJhHIRJ4Gg/55df24a93d55e784fa0f01ee1e7ae14b/Uploaded_from_Coming_in_Hot__Auth0_s_Q2_Developer_Releases)

## Flexible Identifiers

**[Flexible Identifiers](https://auth0.com/docs/authenticate/database-connections/flexible-identifiers-and-attributes)**. Now, in EA... keep an eye out for GA (coming soon) This feature allows the use of multiple attributes such as email, phone number, and username as unique identifiers, either individually or in combination, to authenticate users. Including the option to configure Phone Number as a Sole Identifier.

![Flexible Identifiers](https://images.ctfassets.net/23aumh6u8s0i/SsqfcCZArhGlfn4vGMVul/39cc10bfa6e3e0cd6914d8c5ba0fea0a/Uploaded_from_Coming_in_Hot__Auth0_s_Q2_Developer_Releases)

We truly hope that these product updates and releases can help you continue to create, build, and solve problems- whether it’s a work or personal project. If you’d like to learn more about our other updates and releases (we’ve got a whole lot more to tell you about), take a look at our [Developer Release Guide](https://www.okta.com/resources/datasheet-developer-releases-auth0-by-okta-q2-2024/). And if you’d like to dive even deeper, please check out our combined [Customer Identity and Workforce Identity Release pdf](https://www.okta.com/resources/product-release-overview-q2-2024-wic-cic/). 

Outside of all these release updates, take a look at our developer resources at [**developer.auth0.com**](http://www.developer.auth0.com/).

Coming in Hot… Auth0’s Q2 Developer Releases

michael-swanson

I live in Austin, TX with my wife, Anneke, and our two kiddos, Ilya (5) and Everett (2). I am a native Texan but lived in multiple places across the southern US as a kid. I have family in Houston TX and Midland TX that we visit on a regular basis. Prior to joining Okta, I worked with early stage startups as a hands-on Product Manager, team lead, and product designer, while also writing (mostly frontend) code. 
<br>

When I am not working you can usually find me chasing my kids around, reading sci-fi or fantasy novels, or playing needlessly complex strategy board games with friends. I am also a huge Star Wars fan and am always down to talk about the latest Star Wars movies, TV, and/or books. Additionally, Anneke and I love to travel and have been all over the world together. Much of our travel focuses on getting out of the Texas heat, tasting and learning about wine, and sampling the amazing food we find along the way!


Senior Product Manager

Michael Swanson

Customers and trial customers on Enterprise and Professional plans can now customize signup and login flows to address unique needs.

Each company has unique user registration and login requirements, for example, needing to capture a first and last name during signup or requiring users to agree to terms and conditions before they can create an account. 

In order to meet specific business needs and use cases, companies often have to build and maintain different experiences – hosted pages and sites – within their account registration and login flow(s). Unfortunately, this approach slows down the time to market by introducing separate code bases that require localization and maintenance while also creating an inconsistent customer experience.

To solve this problem, we have introduced custom prompts for signing up and logging in to Universal Login. This capability is now open for early access (EA) and available to our customers and trial customers on Enterprise and Professional plans. 

## Addressing Unique Use Cases

With custom prompts for signup and login, our customers can customize and add new fields to existing signup and login prompts; this includes client and server-side validation to ensure that required data and requirements, such as Terms of Service (TOS) acceptance, are completed and validated before completing the signup or login process. 

Leveraging Universal Login and our extensibility framework, our customers can tailor these two experiences to address data capture, security, regulatory, and customer experience requirements. Use cases included:

- Add new fields in order to collect necessary customer data (name, phone number, email, preferences, consent, etc.) 
- Add new form elements for presenting and capturing TOS/privacy policy and opt-in before sign up
- Add custom content such as URLs, images, marketing information
- Localize custom text in different languages

## Getting Started

During open early access, this feature will be automatically available to all of our Professional and Enterprise customers and trial accounts. To get started, please check out our documentation [here](https://auth0.com/docs/customize/universal-login-pages/customize-signup-and-login-prompts). If you have any questions, please reach out to your Account Executive.  

Before closing, I want to give a shout-out to our customers who provided feedback during the limited EA. We had over 75 customers join and received invaluable feedback. This underscores the importance of this capability, which we’ll continue to evolve and shape based on customer feedback, so please let us know how it goes.  


_Any products, features, or functionality referenced in this material that are not currently generally available may not be delivered on time or at all. Product roadmaps do not represent a commitment, obligation, or promise to deliver any product, feature, or functionality, and you should not rely on them to make your purchase decisions._


Customizations for Sign up and Login Now in Open Early Access

Tailor registration flows to maximize conversion while meeting business requirements.

Sign-up and login are two critical entity points for your business. They not only provide a means for your company to collect customer data, present and collect consent, and authenticate and verify users and their data, but they also serve as moments to establish brand image and trust. Because of that, these experiences need to be localized, branded, and consistent for your customers and would-be customers.  

For each company, this will be different. This means that companies require the flexibility to modify sign-up and login forms with additional fields and elements to address their unique use cases, business needs, evolving regulatory requirements, and customer demands for transparent, convenient, and personalized experiences.  

And with that, **we’re excited to announce that new sign-up customization capabilities are now available in early access within our Universal Login experience!** This flexibility will ensure that our customers can tailor their sign-up flows to meet their specific use cases.

## How Does It Work?

Customers can customize existing signup prompts by adding custom content and form elements to meet diverse customer preferences, business, localization, and internationalization requirements. No need to host your own pages, which introduce different URLs and separate code bases that slow time to market and create an inconsistent customer experience. 

This includes client and server-side validation, leveraging the Pre User Registration trigger, to ensure that required data, such as Terms of Service acceptance, are completed and validated before completing the signup process.

![How Does It Work](https://images.ctfassets.net/23aumh6u8s0i/1ka3a5mkTZz8NLSNjO7HPW/acb847f03bc1854ddfe55b83f40be34b/New_Sign_Up_Customizations_Now_in_Early_Access.png)

## What Use Cases Are Supported?

The initial early access release will provide support for various use cases, including: 

* Collect necessary customer data (name, phone number, email, preferences, consent, etc.) 
* Present Terms of Service/Privacy policy and opt-in before signing up
* Display marketing information and trust signals with URLs and/or images
* Add custom text, links, images, URLs, etc. 
* Localize or customize custom text in different languages (Note: EA release may not include a full scope of localization capabilities)
* Experiment with different designs, copies, and elements 

## How Can You Apply?

If you are interested in joining the early access program, please reach out to your account manager.  

_Any products, features, or functionality referenced in this material that are not currently generally available may not be delivered on time or at all. Product roadmaps do not represent a commitment, obligation, or promise to deliver any product, feature, or functionality, and you should not rely on them to make your purchase decisions._


New Sign-Up Customizations Now in Early Access

andres

I’ve been at Auth0 since 2017. I’m currently working as a Product Manager for the Auth0 FGA and OpenFGA products. Previously, I worked in the teams that owned the Login and MFA flows. <br>
I spent my entire 20+ year career building tools for developers, wearing different hats. When I'm not doing that, I enjoy spending time with my family, singing in a choir, cooking, or trying new kinds of local cheese.

Product Manager

Andrés Aguiar

Limited early access is available for production usage; learn how you can apply!

In 2021, [we introduced you](https://auth0.com/blog/auth0-fine-grained-authorization-developer-community-preview-release/) to the Developer Preview of our new SaaS solution, Auth0 Fine-Grained Authorization (FGA). We had one goal —to simplify and streamline your experience with authorization-at-scale. Today, we're excited to bring you even closer to the future of authorization as Auth0 FGA launches into a Limited Early Access Program. A select group of customers now have the chance to integrate and use the product in their real-world production environments. 

## So, What Is Auth0 FGA?

[Auth0 FGA](https://fga.dev) enables developers to design authorization models, from coarse-grained to fine-grained, in a way that’s centralized, flexible, fast, scalable and easy to use. 

Auth0 FGA supports granting access at any level of granularity. You can use it to implement role-based access with complex hierarchies or atomic object-level access in any system. This makes it easy to enable collaboration between users, going far beyond typical role-based access control (RBAC). It also supports building custom roles into any system, empowering your customers to define how to manage access. Auditing capabilities in Auth0 FGA provide fundamental building blocks for security and compliance teams. The more we’ve spoken to customers about it, the more we’ve learned just how many use cases it can solve.

Auth0 FGA is a single place for you to define your authorization model, store your authorization data and make your authorization decisions — across all your apps and products.

Centralizing your authorization logic and decisions into a single service that has the flexibility to handle use cases across your different products gives you distinct advantages:

* **Simplify security auditing:** Implement explicit authorization rules that are easier to audit by internal and external parties.
* **Lower costs:** Standardize authorization across all of your applications, making it easier for developers to focus on building new products and features without worrying about building and maintaining authorization into each app. 
* **Deliver faster:** Ship new products and features faster with an extensible authorization model that scales with your business.
* **Enhance security logging:** Generate logs for all operations out-of-the-box, both reads and writes.
* **Empower your users: **Allow users to take control of granting access to their data directly in your application.
* **…All in a way that’s fast and reliable at scale:** A centralized service dedicated to fine-grained authorization should scale with you as your business and products grow. Since Auth0 FGA specializes in authorization and nothing else, it can be particularly optimized for access control patterns and use cases, improving the latency and reliability of your authorization approach.

## The Path to General Availability

Since we launched the product as a Developer Preview, we have onboarded several customers in a private beta release. These customers are now using Auth0 FGA for their production applications. During this period, we completed all the internal processes required to ship a product in early access with the quality Okta customers expect from a feature, reliability, security, and compliance perspective.

During this period, we've meticulously fine-tuned all aspects necessary for a top-notch product that meets the high standards Okta customers anticipate. This includes feature enhancement, reliability improvements, security, and compliance reviews.

We've also been busy enhancing Auth0 FGA with a host of features:

* We open sourced [OpenFGA](https://openfga.dev/), Auth0 FGA’s core, and donated it to the Cloud Native Computing Foundation.
* We added support for [inviting multiple stakeholders](https://docs.fga.dev/intro/dashboard#manage-collaborators) to collaborate on a single Auth0 FGA model.
* We added initial support for ABAC-like authorization with [Contextual Tuples](https://docs.fga.dev/modeling/basics/contextual-time-based-authorization).
* We implemented APIs that allow [subscribing to all changes](https://docs.fga.dev/api/service#/Relationship%20Tuples/ReadChanges) in an Auth0 FGA store or retrieving [all resources that a user can access](https://docs.fga.dev/integration/perform-list-objects).
* We've [enhanced](https://docs.fga.dev/modeling/migrating-schema-1-1) our Authorization Model Language, making it more intuitive to read and write.
* We added a [Command Line Interface](https://github.com/openfga/cli) tool to simplify how to manage Auth0 FGA.
* We shipped a SDK for [.NET](https://www.nuget.org/packages/OpenFga.Sdk) and [Python](https://pypi.org/project/openfga-sdk/)

## Applying for Auth0 FGA Limited Early Access Program (EAP)

The Auth0 FGA EAP is designed to enable customers to implement authorization in their production applications while helping Okta validate the solution. We are very confident in the product we build, but our standards for the products we ship as Generally Available are very high.

Given that when integrating with Auth0 FGA, you’ll call our APIs very frequently, minimal latency is important. To minimize latency, your application's services need to run as close as possible to the Auth0 FGA services. For that reason, we are initially accepting customers that are deploying their applications in the same data centers as our Early Access deployments. Auth0 FGA is currently available on the AWS cloud in the US, and it will be deployed to more regions and clouds in the future.

We believe Auth0 FGA is the future of authorization that will enable businesses of all sizes to manage authorization at scale, without the complexity, and we’re excited to bring it closer to the hands of our customers with this milestone. 

If you are interested in participating in the Limited Early Access Program, please **reach out to your account manager**, or contact the Auth0 FGA team in our [Discord channel](https://discord.gg/8naAwJfWN6).

Streamline Your Authorization Workflow with Auth0 FGA

diegopoza

System Engineer, geek, foodie, technology lover, speaker.

Sr Manager, Developer Advocacy

Diego Poza

Almost 90 millions Facebook users were affected by a breach that compromised access tokens to the platform.



On September 25th, 2018, Facebook learned from its engineering team that [a security vulnerability compromised around 50 million accounts](https://newsroom.fb.com/news/2018/09/security-update/). While the investigation is still in progress, Facebook already has defined the attack surface and vulnerabilities that led to the attack along with identity data that was compromised.

A feature that allows Facebook users to determine what their profile looks like to other people, known as ["View As"](https://www.facebook.com/help/288066747875915?helpref=faq_content), had a vulnerability that was exploited by attackers. 

![Facebook View As feature.](https://images.ctfassets.net/23aumh6u8s0i/2fEamNAYfwNcwaU1rOpoBy/ee3e16c5e6b6b4c7573882479ea46e6a/facebook-view-as-feature)

Through this vulnerability, attackers were able to steal Facebook access tokens. An [access token](https://auth0.com/docs/tokens/access-token) is a credential that can be used by an application to access an API. Its main purpose is to inform the API that the bearer of this token has been authorized to access the API and perform specific actions. In this case, an attacker could have used the Facebook access tokens to take over accounts.

One of the ways that Facebook uses access tokens is to persist login. As Facebook mentions on their [Security Update](https://newsroom.fb.com/news/2018/09/security-update/), these tokens are the "equivalent of digital keys that keep people logged in to Facebook so they don’t need to re-enter their password every time they use the app." Thus, for this type of data breach, changing the user's password doesn't provide risk mitigation. Instead, the digital keys need to be changed. Once Facebook understood the origin and nature of the attack, the engineering team carried out the following actions to mitigate any damage to the platform and to users:

- Facebook fixed the vulnerability in the "View As" feature.
- Facebook has informed law enforcement about the attack.
- Facebook has reset the access tokens of the almost 50 million accounts that were determined to be at risk in order to diminish any risk to the user data and to ensure their personal and digital security.
- As a precautionary step, Facebook has also reset the access tokens for another 40 million accounts. These accounts used the "View As" feature in the past year.

As a result of these security measures, about 90 million users will have to log back into the Facebook platform. Other applications that use Facebook login are also impacted and will require users to re-authenticate. Facebook wants to remain transparent and direct in the acknowledgment and communication of this security breach. Once affected users log back into their accounts, they will receive a notification at the top of their News Feed with an explanation of what has happened and what actions were taken.

![Facebook security breach user notification](https://images.ctfassets.net/23aumh6u8s0i/6dPmOhI9JO2lMpeVzhexwe/a74063a6782f8882ed81ef1ba0a972a9/facebook-data-breach-notification-access-tokens)

[Source](https://fbnewsroomus.files.wordpress.com/2018/09/42647794_340201783392972_4207828087510925312_n.png?w=960&h=551)

As a final precaution, Facebook has turned off the "View As" feature to run a security review as part of their investigation. As the security investigation is on its early stage, Facebook has yet to determine if any of the compromised accounts had their data accessed or misused. The identity or location of the attackers is also unknown at this time. Facebook vows to keep users updated on the evolution of the investigation. 

On a statement on his personal page, Mark Zuckerberg, Facebook CEO, issued a statement [summarizing the nature of the data breach](https://www.facebook.com/zuck/posts/10105274505136221). Part of his statement includes the assessment that new tools need to be developed to prevent attacks like this from being successful:

> "We face constant attacks from people who want to take over accounts or steal information around the world. While I'm glad we found this, fixed the vulnerability, and secured the accounts that may be at risk, the reality is we need to continue developing new tools to prevent this from happening in the first place. If you've forgotten your password or are having trouble logging in, you can access your account through the Help Center."

To stay tuned on this developing investigation, visit [Facebook Newsroom](https://newsroom.fb.com/) or follow [@facebook](https://twitter.com/facebook) on Twitter.


<include src="asides/AboutAuth0" />


Early Look at Facebook Access Token Security Breach

ef2eecee7655f814bd7a9228ba0c6992?s=200 avatar

ef2eecee7655f814bd7a9228ba0c6992?s=200

I'm passionate about startup culture, leadership and employee engagement, coming from the experience of having left big corporate, packed up with my wife and kids and moved from Australia to the US to pursue startup life.

Director of Culture

Clayton Moulynox

“Auth0 introduces pre-release program, Zero To Launch, giving qualifying customers exclusive early access to new features and functionality.”



The pace of innovation in this new world of always-on cloud services is phenomenal.  At Auth0 we live and breathe it everyday – continually releasing updates, service enhancements and amazing new features.

<include src="TweetQuote" quoteText="The pace of innovation in this new world of always-on cloud services is phenomenal."/>

More often than not these improvements to our service stem from the way our customers and partners use our platform.  This eco-system continually challenges us with new use cases, scenarios and requirements - customers, technology partners and solution providers themselves pushing to drive innovation in what they do.  Frankly, it makes me pretty excited!

## 3…2…1… Zero To Launch

<div class="row" style="padding-bottom: 40px;">
<div class="col-xs-12 col-md-3" style="text-align: center;"><img style="margin: 0; margin-bottom: 20px; max-width: 100px;" src="https://images.ctfassets.net/23aumh6u8s0i/1mfMhHJkKI4CRbU9n22BPd/f04bfbc0e9d2320e5a7489f2ae8e334b/logo" alt="" /></div>
<div class="col-xs-12 col-md-9">

That’s why today I’m pleased to announce our new pre-release program, Zero To Launch.  This program will give qualifying customers and partners exclusive early access to new service enhancements and features plus support and resources to get things happening.  It’s seems a fitting way to continually give more value back to the incredible eco-system of customers and partners who challenge us to do more.

Of course, during the pre-release period, we’ll be eagerly listening out for your feedback and gaining a deeper understanding of how you’re using the new features. It’ll help us make final tweaks to UI and documentation as well as helping our engineering and support teams prepare for general availability.  This isn’t beta testing – features released through Zero To Launch can be used in your live projects.
</div>
</div>

## What’s in it For You?


<div class="row" style="padding-bottom: 40px;">
<div class="col-xs-12 col-md-3" style="text-align: center;"><img style="margin: 0; margin-bottom: 20px; max-width: 100px;" src="https://images.ctfassets.net/23aumh6u8s0i/6oFO0P1QmCrdsiuCcD4Lem/6cca13771d651a1c43077e12aa8952f9/3" alt="" /></div>
<div class="col-xs-12 col-md-9">

I haven’t met too many devs, system architects or even just general technology types who don’t love getting their hands on something new.  You can expect to gain knowledge, to be first and to create something new.  It’s a chance to work with like minded people who enjoy pushing the boundaries to create something better.  In fact, we’re developing a recognition and rewards component to ensure you’re honored for your valuable contributions…you could be our first Auth0 MVP!

From a business perspective, it also allows you to look forward and plan – maybe fix a problem, unlock new ways of working, remove a blocker from an existing project or interact with customers in new and different ways.
</div>
</div>

## Mission 1: API Authorization-as-a-Service

In launching the program, we’re also launching availability of the first pre-release feature. If you have an API that stores data from users or exposes data from a service and you want to open that API to 3rd party developers, like Facebook or Dropbox does with their APIs, then this is for you. Kick-start a 3rd party developer ecosystem faster than ever before!


## Get on Board

Zero To Launch is currently by invitation only.  Customers and Partners must meet certain criteria including being a paid subscriber or [**recognized technology or solution partner**](https://auth0.com/partners).  If you haven’t received an invitation but think this sounds pretty awesome, then feel free to [**reach out to me directly**](mailto:clayton@auth0.com?subject=ZeroToLaunch) to see if you qualify.


"early access"