Oliver Wang

A product manager at Auth0 focuses on  Ecosystem and Extensibility.  With an engineering background, Oliver always puts developers' experience first.  He has mixed industrial experience as a Product Manager, Software Engineer and Data Analyst. This diverse profile unites different team members to deliver value to our customers. Besides work, you can catch him up on a ski hill in the Canadian Rockies.

Product Manager, Ecosystem

Unlock a more secure extensibility experience with Node 18 latest LTS.

You can unlock an even simpler developer experience when extending Auth0 – with Node.js 18 now available for Actions, Rules, and Hooks.

For security and compliance purposes, we strongly encourage you to stay current in Node versions. Starting today, Auth0 customers will see the option to upgrade from Node 12/16 to Node 18. This allows customers to leverage the long-term support (LTS) offered by Node.js 18.

## What Does This Mean for Our Developers?

Although Node.js 12 and 16 will remain available, their usage may not be consistent with industry standards due to the end of LTS. It is important to note that as of September 11, 2023, the [Node.js community](https://github.com/nodejs/release#release-schedule) will stop supporting Node 16, including software patches, security fixes, and beyond.

When creating new Actions, Developers will see Node 18 as the **`RECOMMENDED`** and **`DEFAULT`** option. Node 16/12 turns into the **`NOT RECOMMENDED`** option. Existing Actions will remain on Node 16/12. However, developers can upgrade existing Actions to Node 18 by creating a new version of the existing Action and selecting Node 18. Please refer to our updated [Migration to Node 18 documentation](https://auth0.com/docs/troubleshoot/product-lifecycle/deprecations-and-migrations/migrate-actions-nodejs-16-to-nodejs-18) for guidance on upgrading your code to Node.js 18.

For customers using Node 18 Beta, bump up your Actions version today to switch to Node 18 GA by September 11, 2023, before we end support for Node 18.

## Benefits of Node 18

Node 18 offers a number of benefits compared to previous Node versions:

* **Integrated global `fetch`:** In previous node versions, the `fetch` API had to be installed via a third-party package. In Node 18, `fetch` is available as a native feature, reducing lines of code and streamlining HTTP requests. In addition to `fetch`, other global APIs are available by default in Node 18, such as `FormData`, `Headers`, `Request`, and `Response`.
* **Updated JavaScript engine:** Older Node iterations executed JavaScript via Google V8. Node 18 executes JavaScript using the updated version 10.1 to help boost the performance of web applications.
* **Built-in testing:** Previous Node versions lacked built-in test runners. Node 18 instead allows you to create and execute tests without intervention from a third-party package before adding your code to Actions.

## Move to Actions for a Standalone-Node Execution Experience

Tired of updating Node versions frequently or need different Node versions for different extensibility products? Try Actions today. Actions allow you to apply different Node versions to individual Actions with more flexibility, so you don’t have to restrict all your Actions to one Node version under global tenant settings.

Actions is our next-generation extensibility platform, designed to replace Rules and Hooks. As a result, our plan is to support every current and long-term supported Node version through Actions exclusively.

This means that we will be ending Node support for Rules and Hooks in the future. To get ahead of this, customers should [upgrade from Rules and Hooks to Actions](https://auth0.com/extensibility/movetoactions).

We want to hear from you. Please share any feedback on your experience with our extensibility tools and Actions in our [Developer Community](https://community.auth0.com/).


Node 18 Now Available for Actions, Rules, and Hooks

darin-laframboise

Expert in Ecosystem strategies. Expert in driving product roadmaps and building long-term growth strategies. Can make quick, data-minded, impact-focused decisions to keep projects on track. Deep background in analytics and data engineering.

Director, Product Management

Darin LaFramboise

Actions is the next generation of extensibility

To improve our extensibility offering, we are deprecating Rules and Hooks. We are focusing our attention on Actions as a unified extensibility product for developers, and we will continue to add features and functionality to Actions. We recognize the value Rules and Hooks have provided over the years and know that it will take some time to migrate existing Rules and Hooks to Actions. This is why we are extending our migration deprecation window through November 18, 2024. We want to make this transition as smooth as possible. As part of this announcement, we recommend taking a moment to[ review all the functionality we have provided through Actions.](https://auth0.com/blog/actions-now-generally-available/)

## What’s Changing?

Over the next 18 months, we will be winding down support for Rules and Hooks in our products and navigating all developers to use Actions as the main place for customization and extensibility. This has been the case since we[ introduced Actions](https://community.auth0.com/t/introducing-auth0-actions-beta/52274) in 2020. Rules and Hooks will continue to receive full maintenance support until end of life; however, no new functionality will be introduced. This has been the case since we first introduced Actions in 2020. 

### Hooks End of Life

We plan to fully remove Hooks from all tenants by November 18, 2024.

![Preparing for Rules and Hooks End of Life](https://images.ctfassets.net/23aumh6u8s0i/6aqh2QuYAjpTdykXSw89fP/343eb829e41bf2cd2ad9a7dae7dee31a/actions-post.png)

#### October 16, 2023

Hooks will no longer be available to new tenants created as of October 16, 2023. Existing tenants with active Hooks will retain Hooks product access through end of life.

#### November 18, 2024

Hooks will be removed from **all** tenants on November 18, 2024. Migrations must be completed by this date, as all Hooks will be removed at end of life on November 18, 2024.

### Rules End of Life

We aim to fully remove Rules from all tenants on November 18, 2024. We acknowledge that a few remaining gaps in functionality exist between Rules and Actions, and we are actively working to resolve these gaps in advance of removal from new tenants. You can see all known gaps in our[ documentation](https://auth0.com/docs/customize/actions/limitations).

#### October 16, 2023

Rules will no longer be available to new tenants created as of October 16, 2023. Existing tenants with active Rules will retain Rules product access through end of life.

#### November 18, 2024

Rules will be removed from all tenants on November 18, 2024. Migrations must be completed by this date as all Rules will be removed at end of life on November 18, 2024.

## What’s the Next Step?

For new extensibility use cases, start with Actions. For existing Rules and Hooks, begin your migration, if possible.

As you begin transitioning to Actions, please let us know if you run into any difficulties or blockers. We want to make this transition as easy as possible. To get additional support 

* For self-service customers, join the discussion on our [Community page](https://community.auth0.com/t/rules-and-hooks-nearing-end-of-life/107038) to ask questions and find support. 
* For Enterprise customers, please reach out to your Technical Account Manager for any inquiries. 

 

We are here to help. We have documentation on[ migrating from Hooks to Actions](https://auth0.com/docs/customize/actions/migrate/migrate-from-hooks-to-actions) and[ migrating from Rules to Actions](https://auth0.com/docs/customize/actions/migrate/migrate-from-rules-to-actions). We also have a dedicated[ Move to Actions](https://auth0.com/extensibility/movetoactions) page that highlights feature comparisons,[ an Actions demo](https://www.youtube.com/watch?v=UesFSY1klrI), and other resources to help you on your migration journey.

Preparing for Rules and Hooks End of Life

Drag-and-drop extensibility for your identity flow

## Okta’s No-Code Approach for Easy Extensibility

Security threats? Regulatory requirements? Privacy laws? User journey expectations? The identity landscape keeps evolving — and increasing in complexity. Keeping up with these changes puts pressure on devs as they try to secure and manage identity flows  — often requiring custom code.

Extensibility is at the core of the Okta Customer Identity Cloud. and Actions Integrations is our answer to all that code-intensive complexity. Instead of building and maintaining custom code, Actions Integrations are easily integrated third-party solutions that can be quickly added to extend your identity flow.


## Drag-and-Drop Extensibility with Actions Integrations

Customers looking to purchase an identity product in the market expect security, privacy, compliance, and ease of use as table stakes, but they also have additional needs beyond what standard identity platforms offer in their core products. They want to customize their identity workflow. No single company can provide a complete identity solution that covers all possible scenarios. Instead of building new capabilities from scratch or trying to understand both Okta and third-party APIs, Actions Integrations allows you to make third-party connections directly, without code. 

Actions Integrations are partner-built and supported drag-and-drop solutions that solve common identity needs that aren’t addressed out of the box by Okta Customer Identity Cloud.

Actions Integrations have been in Beta on our Marketplace for several months while we added additional security and usability features. With the move to general availability, we’ve invested in the security and observability of integrations internally at Okta and added additional tooling for our field support teams to better assist developers who rely on integrations.

## Extending Your Identity Flow with Partner-Built Integrations

With our expanding partner ecosystem, we’re able to provide extensible solutions for a growing number of use cases. Whether adding security measures in heavily regulated industries such as healthcare and financial services or wanting to understand who your customers are for targeted marketing tactics, our Marketplace houses integrations for a number of identity scenarios. Some of our popular categories include:

* Identity proofing: Verify the identity of end users.
* Consent management: Capture and track consent and contact preferences throughout the customer journey.
* Customer data platforms: Collect valuable customer data to feed into downstream systems such as CRMs to create custom online experiences.
* Progressive profiling: Gather more information about users than they provided at initial signup to build a progressive profiling flow.

## How Do I Get Started Using Actions Integrations? 

The Auth0 Marketplace hosts all available integrations where developers can find the pieces that are missing from their identity flow. Simply navigate to the Marketplace in your Auth0 Dashboard or through [Marketplace](http://marketplace.auth0.com), and add the integrations you’d like to try to any tenant; no code is required. These integrations do not count against the extensibility limits defined in our pricing plans. 

If you can’t find an integration that fits your exact needs, we encourage you to explore custom [Actions](https://auth0.com/docs/customize/actions), our pro-code approach to extending Okta Customer Identity Cloud capabilities with custom logic. We also welcome developers and partners to build an integration of your own. Building and launching an Action Integration in our Marketplace allows you to participate in the growing CIAM economy and take advantage of the upcoming growth areas we’re continuing to uncover. 

Visit [auth0.com/integrate](http://auth0.com/integrate) to get started on your integration journey. We have resources to help you, from discovery and exploration to building and launching your integration on Marketplace. 

## Next Steps

Not sure what you’re looking for, or want to know more about the Marketplace and extensibility? Check out [auth0.com/marketplace](http://auth0.com/marketplace), where we have featured content on integration categories, specific partner integrations, and other resources to get you started on your extensibility journey.

Actions Integrations Are Now GA

alexa-bio

Alexa is a Product Marketing Manager on the Auth0 platform team. With a partner and product marketing background, she is focused on growing our marketplace ecosystem working closely with new and existing partners.

Product Marketing Manager

Alexa Jacky

Stacking integrations from the Auth0 Marketplace enables custom identity use cases with no-code ease

As they compete for attention and conversions in a crowded global marketplace, online retailers and eCommerce companies face a number of challenges. For example:

* **Customers expect personalized omnichannel experiences** at every stage of the buying journey
* **Users want to engage with their apps or services at any time, from any device, in a secure and safe manner** — and they don’t want to spend time with cumbersome account creation
* **The loss of the third-party cookie and tighter app restrictions are threatening marketing strategies** that rely upon cookies and app-based tracking and are forcing a larger dependence on first-party data

The brands that will not only survive but thrive in this dynamic environment will be those that are best able to implement fundamental identity capabilities and extend beyond the identity basics.

But with a developer team that’s busy enough already, it’s important for the business (and for developer sanity) to satisfy identity requirements as quickly — and with as little custom code to write or maintain — as possible.

## Identity Enables Online Retail and eCommerce

Identity may not be top of mind for retailers, but the identity function is essential to helping eCommerce companies:

* **Maximize conversions and revenue** by[ minimizing friction in any and every customer interaction](https://auth0.com/resources/whitepapers/identity-insights-101)
* **Meet user expectations** by[ powering personalized experiences](https://auth0.com/case-studies/coles-group)
* **Manage risk** by addressing regulatory requirements and privacy laws and by addressing[ identity-specific security threats](https://auth0.com/resources/whitepapers/state-of-security-identity-report)

A customer identity and access management (CIAM) solution with the right set of out-of-the-box features can help engineering teams to avoid a whole lot of pain and expense.

For example,[ CIAM has been a core enabler of cosmetic giant Lush’s consumer-oriented initiatives](https://auth0.com/case-studies/lush-cs), powering a range of features including single sign-on (SSO) and guest checkout, as well as the centralization of the point-of-sale (POS) system for the entire business. In particular, extensive out-of-the-box functionality allowed Lush to implement these features with a limited developer team while ensuring the pace of transformation didn’t compromise customer privacy or system security.

While out-of-the-box functionality is important, the real world is a complex and dynamic beast (as anyone who’s ever done a year-over-year roadmap comparison understands). Being able to accommodate change and tailor identity to your unique needs — and doing both without drawing too heavily upon developers — is the difference between CIAM as a necessary component of your application stack and CIAM as an operational and competitive advantage.

![Auth0 Marketplace](https://images.ctfassets.net/23aumh6u8s0i/16QlWAA6ZN2lnMATb3RbMu/3e305e33068ab6a5afb1419500972b4c/Marketplace_Partner_Spotlight_Separator_V01B_3x.png)

## Actions Integrations and the Auth0 Marketplace

A modern CIAM solution can tackle the identity basics (e.g., signups, logins, account updates, password retrievals, etc.), but satisfying advanced use cases often requires transacting with other business systems and third parties to execute complex conditional flows.

Building such advanced logic from scratch is a major undertaking requiring specific skill sets, tools, and knowledge; worse still, it’s inefficient because each use case is a custom coding exercise with little that can be reused.

Alternatively, having a simple but effective (read: powerful, flexible, efficient, etc.) way to make identity work with your other business systems allows developers to quickly implement customized identity solutions without the time, expense, and headaches associated with custom coding projects… and that’s where[ extensibility](https://auth0.com/extensibility) comes into play.

Since launching in late 2020,[ the Auth0 Marketplace](https://marketplace.auth0.com/) has helped developers quickly find and install third-party identity solutions for their applications and APIs.

[Actions Integrations](https://auth0.com/blog/auth0-no-code-actions-integrations-now-available-in-beta/) makes it even easier to extend Auth0 with partner-built innovations, often with no-code, drag-and-drop ease; in fact, you can even ‘stack’ these integrations like building blocks to keep up with new needs and address advanced use cases.

To illustrate, let’s look at some examples…

## Prevent Fraudulent Registrations

One of the major objectives for consumer-facing companies is to convert prospects into first-time customers, and this makes fraudulent registrations (or signup fraud) especially problematic because:

* [Leveraging a customer data platform (CDP)](https://auth0.com/blog/why-you-should-integrate-customer-identity-and-your-customer-data-platform/), customer flows are often optimized based upon data that shows how users interact with a user interface and ultimately ‘convert’ — but fraudulent registrations pollute this data, significantly complicating business analytics activities.
* To maximize conversions, consumer businesses especially must minimize friction during the registration process — but lowering barriers for legitimate users also lowers the barriers for abusers.

While authentication (e.g., logging in with a username and password) shows that a user has the credentials that correspond to a particular account, it doesn’t prove that the user is who they say they are — that’s where[ identity proofing](https://auth0.com/blog/what-is-identity-proofing-and-why-does-it-matter/) comes in, by using additional verifications to create a high degree of confidence that your users are who they claim to be.

Here’s how a sign-up flow works when identity proofing is integrated:

* A new user clicks “sign up” on your website
* The sign-up flow calls upon[ the identity-proofing solution](https://marketplace.auth0.com/categories/identity-proofing)
* The identity proofing solution verifies the user’s identity using phone carrier verification
* Customer identity data is captured and collected by the[ CDP](https://marketplace.auth0.com/integrations/tealium)

By making signup fraud much more challenging to commit, identity proofing meaningfully alters the economics for bad actors and, in doing so, protects your customers, your reputation, and the integrity of the data stored in your CDP.

## Protect and Enrich Existing User Accounts

In addition to protecting against signup fraud, incorporating identity proofing into user workflows can also protect against account takeovers (ATO) and enrich user profiles with ‘golden data’ like age and demographic information.

For example:

* A returning user performs some action, like logging in or attempting to update account details
* Due to the perceived risk associated with the action (and perhaps incorporating other risk signals), the identity stack calls upon the identity-proofing solution as a safeguard
* The identity proofing solution validates the user’s identity, ensuring that the activity is not from a bad actor attempting to take over the account; or, if the user is accessing the service via a mobile app, a[ mobile verification integration](https://marketplace.auth0.com/integrations/incognia-authentication) validates the device ID to confirm the user’s identity
* With the user’s identity validated, the action is permitted, and the data associated with the user’s activity is sent to[ the CDP](https://marketplace.auth0.com/integrations/tealium) to build out the profile

Depending upon the risk signals or significance of the action, the identity-proofing solution may employ document scanning (e.g., passport, driver’s license) and cross-validation as the verification mechanism. When this is the case, the CDP can be enriched with information that may not yet be a part of the user’s profile.

![Auth0 Marketplace](https://images.ctfassets.net/23aumh6u8s0i/6U3nuyVYlbcg9i0C36khkU/61a068d638a5ee2753facbcf5924e55c/Marketplace_Partner_Spotlight_Separator_V01A_3x.png)

## Stop Fraudulent Checkouts

The previous examples involve sending data to the CDP, but the CDP data can also be leveraged within the identity flows. For instance, here’s how data from a CDP can combine with an identity-proofing solution to stop a fraudulent checkout:

* A threat actor masquerading as a user logs in, browses products and adds items to the cart
* The CDP collects and stores behavioral data from this session. The data can then be used to help determine that the risk threshold is exceeded — e.g., the total purchase amount exceeds the real customer’s typical habits, or the IP geo-location is outside the real customer’s region, etc.
* The threat actor fails the identity proofing verification, and the purchase is stopped, protecting the customer and the retail brand from the effects of fraudulent purchases

## Reward Your Loyal Customers

Retail brands can suffer reputational harm when resellers buy premium products (e.g., sneaker drops, limited edition collaborations, small batch cosmetics, etc.) only to mark up the price on a third-party marketplace.

By restricting who is able to purchase these products, retailers can reward loyal customers and protect their brand:

* A user logs in
* The CDP provides customer data that can then be used to indicate whether or not the user exceeds a certain ‘loyalty’ threshold (e.g., based on purchase history)
* If a user exceeds the threshold, then the site/service shows them premium offers
* The user adds a premium product to their cart and initiates the checkout
* Identity proofing validates the user’s identity to guard against an account takeover and ensure that the purchaser is a loyal customer

Additionally, the same building blocks can be used to encourage preferred channel adoption. For example, many retailers reserve limited edition products only for users of their mobile app. Web users could be presented with a message saying, “To see promotional offers, please switch to the app.” If the user’s device has already been verified in a past interaction, then the purchase can proceed; otherwise, the identity stack calls a short verification flow. 

Customer lifetime value is rooted in personalized offers, promotions, and pricing, which depend on rich customer profiles stored in CDPs. To build these profiles, brands collect customer data across various channels and systems, with the mobile app being perhaps the most valuable channel.

## A World of Extensions and Opportunities

Extensibility is a core Auth0 principle.[ Our identity platform](https://auth0.com/resources/videos/platform-introduction-video-2020) is designed to be easy to deploy and even easier to tailor to your unique business needs, so you never have to choose between customizability and ease of deployment.

We’re excited about the potential unlocked by the rich ecosystem of third-party integrations, as they allow our customers to continually add new capabilities as needed.

Whether you prefer the pro-code approach of[ Actions](https://auth0.com/docs/customize/actions) or the no-code convenience of Actions Integrations found within[ the Auth0 Marketplace](https://marketplace.auth0.com/), we encourage you to explore the options to see which of your identity and identity-related use cases already have a ready-built solution just waiting to be integrated!

Why Easy Extensibility is an Online Retail Essential

auziros:jeana-tahnk

Jeana has been in the tech industry for 15+ years, both as a communications professional and writer. As Director of Global Communications at Auth0, she works with her internal team and external agencies to amplify the company's visibility worldwide and establish its leadership in the identity industry. When she is not working, she can most likely be found on a field watching one of her three kids playing sports, or cleaning up after her one-year-old retriever who chews everything.

Senior Director, Global Communications

Jeana Tahnk

Trusted integrations from industry-leading third-party solutions extend Auth0's functionality to solve increasingly complex identity needs

**BELLEVUE, Wash. – Sept. 22, 2020 –** The [Auth0](https://auth0.com/) Identity Platform, a product unit within Okta, today announced the launch of [Auth0 Marketplace](https://marketplace.auth0.com), a trusted partner integrations catalog that enables customers to quickly extend the core functionality of the Auth0 platform and use it as an identity solutions hub for their specific needs. Auth0 Marketplace, with its ever-growing breadth of verified partner integrations, provides customers with the extensibility, customization, and confidence to meet their identity needs of today and tomorrow.

Auth0 Marketplace gives customers the power and flexibility to combine Auth0 with adjacent technologies, enabling them to put identity at the forefront of larger projects such as digital transformation, threat detection, compliance, customer conversion, and more. The identity management landscape is increasingly complex, fueled in large part by new security threats, regulatory requirements, privacy laws, and user convenience demands. Yet its function within enterprises is simultaneously becoming more critical, making extensibility a pivotal feature within any identity platform. 

Auth0 Marketplace leverages Auth0's inherently extensible platform even further and supports solutions that cover a wide range of identity needs, including Consent Management, Identity Proofing, Log Streaming, Security, SMS/Email, Single Sign On, Social Login, and more. All integrations have been verified for security and functionality, and are easily discoverable. Once integrations are selected, installation wizards and guides help customers enable these new partner solutions quickly. 

The launch of Auth0 Marketplace reveals two new categories of partner integrations: 

* [**Consent Management**](https://marketplace.auth0.com/categories/consent-management): Obtain and maintain user consent records for collecting data (e.g., via cookies) for ongoing adherence to data privacy regulations like GDPR, CCPA, etc. Auth0 Marketplace features new partner integrations from MyLife Digital, OneTrust, and others. 

* [**Identity Proofing**](https://marketplace.auth0.com/categories/identity-proofing): Verify a user's identity based on real-world factors (e.g., biometrics) and additional factors before granting access. Auth0 Marketplace launches with new partner integrations from Onfido, Vouched, ID DataWeb, Caisson, and others. 

Auth0's existing integrations are now discoverable and available in [Auth0 Marketplace](https://marketplace.auth0.com/), including recently-launched Log Streaming from Splunk, Datadog, Azure Event Grid, and Amazon EventBridge. 

"Consent management, together with identity management, provide a powerful solution for the adherence to the many data privacy policies, like GDPR and CCPA, that continue to crop up and provide incredible hassles for companies," said Kevin Kiley, Chief Revenue Officer at OneTrust. "This issue and need will not go away. Being a premier launch partner in Auth0 Marketplace gives us visibility with Auth0's thousands of customers, and provides them with an integral technology that is more important than ever with today's numerous privacy laws." 

"We are excited to be part of the Auth0 Marketplace launch and have our solution serve as an integral component for Auth0 customers' identity architectures," said Rick Hofmann, VP of Global Partnerships and Alliances at Onfido. "As companies look to accelerate and scale their digital transformation, being able to remotely tie a user to their real, physical identity at onboarding and at other points along the customer journey, is critical to reducing fraud and building customer trust. We look forward to servicing additional audiences via Auth0 Marketplace."

By becoming part of Auth0 Marketplace, partners can participate in the growing demand for digital identity solutions and showcase their innovative products to Auth0's 9,000+ customers worldwide.

"Launching Auth0 Marketplace is a great milestone for the company and further highlights the demand for an extensible identity platform. Giving customers the power to fully adapt Auth0 to their needs widens their ability to build a secure, end-to-end holistic identity solution. Auth0 Marketplace partners represent the integrations that matter for identity," said Shiven Ramji, Chief Product Officer at Auth0. "Auth0 Marketplace will open the door to external innovation and make it easier for our customers to work with Auth0 as a true hub for identity management."

'[**Introducing Auth0 Marketplace**](https://auth0.com/blog/introducing-auth0-marketplace)' provides more detail about how to discover and enable integrations that help businesses solve identity. In addition, Auth0 will be hosting a webinar on October 7th to take a deep dive into Auth0 Marketplace and how it can help customers. Please visit the [registration page](https://auth0.com/resources/upcoming-webinars/auth0-marketplace-webinar) for more details. Companies that wish to become part of Auth0 Marketplace can find more information at the [Auth0 Partners page](https://auth0.com/partners). 
 
<include src="asides/AboutAuth0" />

### Media Contacts
Jeana Tahnk 
Global Communications 
Auth0 
press@auth0.com

Hannah Carroll 
Matter for Auth0 
auth0@matternow.com

Auth0 Marketplace Launches and Provides Even Greater Extensibility for Building Identity Solutions

andres

I’ve been at Auth0 since 2017. I’m currently working as a Product Manager for the Auth0 FGA and OpenFGA products. Previously, I worked in the teams that owned the Login and MFA flows. 
I spent my entire 20+ year career building tools for developers, wearing different hats. When I'm not doing that, I enjoy spending time with my family, singing in a choir, cooking, or trying new kinds of local cheese.

Product Manager

Andrés Aguiar

Leverage Auth0’s extensibility to send SMS MFA messages using the provider that best aligns with your business

Auth0 supports different options for enabling MFA to protect user account access: push notifications, authenticator apps like Google Authenticator, and one-time codes delivered through email, SMS, or third party products such as Duo.

Until now, Auth0 has integrated with Twilio as an SMS provider, which has been a great solution for our customers. However, some customers require additional flexibility when selecting SMS providers. For example, larger organizations may use a single provider for multiple purposes and want to leverage that provider for SMS MFA to consolidate payments and enjoy volume discounts.

Organizations have a number of SMS providers they can choose from depending on their business needs. There are a number of factors to consider when selecting an SMS provider: 

* **Cost:** Some SMS providers may offer more favorable pricing and pricing models than others based on the region or country to which you want to send messages.
* **Integration with your existing software infrastructure:** You may already have a provider that helps you consolidate a single view of all the communications with your users, and you want to keep using it.
* **Compliance:** You might require certain certifications from your SMS provider, which not all vendors can provide.
* **Quality of service:** Some SMS providers may have better deliverability rates than others based on the region or country of the receiver.

Selecting the right provider can yield considerable cost savings to your business and deliver a better user experience to your customers. With this in mind, we are pleased to announce that **you can now use _ANY_ provider** for delivering SMS MFA messages. Auth0 is **the first cloud identity product** that gives you that option.

## Extending Auth0

Auth0 has a powerful and scalable extensibility platform where you can write your own code that can be executed when needed. One of the extensibility points is Auth0 Hooks, which are serverless functions that Auth0 calls when a certain event happens.

You can write code to send SMS messages in our new "Send Phone Message Hook." 

To achieve this, you need to follow three simple steps:

* Create a new "Send Phone Message" [Hook from the Hooks Dashboard’s section](https://manage.auth0.com/dashboard/#/hooks) and give it a name. In this case, you'll be creating one to deliver messages using [AWS’s Simple Notification Service](http://aws.com/sns).

![Simple Notification Service 1](https://images.ctfassets.net/23aumh6u8s0i/4pGiT6S8Awe5kDzwsih44N/093c530a25c70d7945df5b130dc7b86a/1_create-new-hook)

![Simple Notification Service 2](https://images.ctfassets.net/23aumh6u8s0i/5k4AYgPss1iRbZmBFUaSU6/da0b0a2d2bca64872926b17be0870cd9/2_new-hook)

* Write the code to send a text message or use a [full example of how to send text messages with Amazon SNS](https://auth0.com/docs/mfa/send-phone-message-hook-amazon-sns).

![Amazon SNS](https://images.ctfassets.net/23aumh6u8s0i/2pqPsBOiS1bOBaOMX9gtzh/88c2847a5495b6620fa4b719bff6efa5/3_sns-hook)

* Configure the SMS MFA Factor to deliver messages using the Phone Message hook:

![SMS MFA](https://images.ctfassets.net/23aumh6u8s0i/2QTRc0KOhiqTxPWbxrTBWw/8fcfda5305900bf23e1280314164b9af/4_sms-provider)

## Using Your Vendor of Choice

We included documentation on how to implement SMS Delivery with [Amazon SNS](https://auth0.com/docs/mfa/send-phone-message-hook-amazon-sns), [Twilio](https://auth0.com/docs/mfa/send-phone-message-hook-twilio), [Infobip](https://auth0.com/docs/mfa/send-phone-message-hook-infobip), [TeleSign](https://auth0.com/docs/mfa/send-phone-message-hook-telesign), [Vonage](https://auth0.com/docs/mfa/send-phone-message-hook-vonage), [Mitto](https://auth0.com/docs/mfa/send-phone-message-hook-mitto), and [Esendex](https://auth0.com/docs/mfa/send-phone-message-hook-esendex). Just copy and paste the examples in your Hook code and start sending messages using your product of choice.

## Enhance Security With MFA
Auth0 provides the most usable and friction-free multi-factor authentication experience in the market. 

You get a state-of-the-art end-user experience for enrolling and authenticating with multiple factors, like push notifications and one-time password (OTP) apps, right out-of-the-box.

Just enable multi-factor authentication in the Auth0 Dashboard and immediately improve the security of your applications and users!

<include src="asides/AboutAuth0" />

Enable SMS MFA Using Any Provider

Vittorio

Vittorio Bertocci is a Principal Architect for Auth0. Before Auth0, he had a lengthy career with Microsoft, where Vittorio worked with Fortune 100 and Global 100 companies, including working on Microsoft’s Azure Active Directory team as principal program manager focusing on the developer experience. He contributed to the inception and launch of Microsoft's claims-based platform components (Windows Identity Foundation and ADFS, ADAL and MSAL SDKs, ASP.NET middleware). Vittorio is a well known speaker, educator and published author.

Principal Architect

Vittorio Bertocci

Choosing the right customization strategy can make the difference between success and failure in your next identity project.

Every identity professional is familiar with that vaguely frustrating feeling arising from working on a scenario that is _almost_ perfect. If only that user store could support OpenID Connect… If only that legacy app could be slightly modified… Similar deviations from the canonical scenarios are the true norm, making it hard to provide a solution that only relies on the out of the box features commonly found in identity products.

Businesses, system integrators, and software vendors deal with those challenges following what looks like a disjointed set of different strategies. Some take a brute force approach and code every identity functionality from scratch. Others implement their identity functions deploying installable instances of server products, or rely on operating system features, and take advantage of the degree of control that can be achieved by running your private instance. Yet others rely on IDaaS (Identity-as-a-Service) offerings, leveraging whatever extensibility technology is offered to adapt the defaults to the specific needs of their particular scenarios.

<include src="TweetQuote" quoteText="How do you know if the identity solution you are evaluating will give you the power and flexibility your scenarios require? The answer is in their extensibility features.#taoofextensibility"/>

In that apparent chaos, choosing the strategy that best fits your requirements isn’t easy. To help with that difficult task, we authored a whitepaper that compares and contrasts the main approaches to identity customization. By placing every strategy on a continuum based on the expressive power and ease of implementation dimensions, we expose individual strengths and weaknesses while offering you a logical progression you can use as a reference when considering hybrid approaches. Here’s the chart that summarizes it all:

![IDENTINOMICS](https://images.ctfassets.net/23aumh6u8s0i/2NFqrjWN3ckUWRyfyc0U0H/f1ed9f13daaddd38bb02a5f97415c6cd/IDENTINOMICS)

The strategies considered cluster around two macro approaches, one which favors full control at the price of taking more responsibility in the implementation (lower left quadrant) and one where most functionality is outsourced to a service, with the expressive power bounded by the extensibility choices of the selected service (top right quadrant). You’ll have to download the whitepaper to find out the whole story, but let me give you a spoiler alert here. 

At Auth0 we believe in the power of outsourcing identity concerns to a service run by professionals, but we are also strong believers in the power of code. This is why we deem the IDaaS+code approach to be the one offering the absolute best compromise: identity essentials taken care of by an easy to use service while retaining the ability to address last-mile customizations with code — the same control and power you’d have if you would have coded everything from scratch.

Download the [Identity in the Real Word: the Tao of Extensibility](https://auth0.com/resources/whitepapers/tao-of-extensibility) whitepaper.

Auth0 Principal Architect Vittorio Bertocci’s new whitepaper can help CTOs, architects, and developers understand the trade-offs between the different customization strategies offered by today’s identity solutions, explaining how to pick the right one for each scenario in the “Tao of Extensibility.”

<include src="TweetQuote" quoteText="Today’s identity products approach customization with many different strategies. Auth0 Principal Architect @vibronet evaluates the strengths of each approach. #taoofextensibility"/>

<include src="asides/AboutAuth0" />

New Whitepaper: The Tao of Extensibility

abhishek-hingnikar

I am a Specialist Solutions Engineer at Auth0. I specialize in Identity and Access Management and enjoy building software. I have experience developing software in several frameworks and a variety of domains. I enjoy traveling, cooking, and building robots!

Specialist Solutions Engineer

Abhishek Hingnikar

Extend Auth0's core functionality to support Sign In with Apple in your application.

<div class="alert alert-info alert-icon">
 
 Integrated support for Sign In with Apple is now available in Auth0 as a beta feature! <a href="https://auth0.com/blog/try-sign-in-with-apple-in-your-auth0-apps-today/">Implement Sign In With Apple now</a>.
</div>

Last Thursday, [we took a look at Sign In with Apple](https://auth0.com/blog/what-is-sign-in-with-apple-a-new-identity-provider/), the new identity provider features Apple released at WWDC 2019. In that post, we included simple steps to add support for Sign In with Apple in a Node.js application. Today, we're going to show you how you can support Sign in with Apple without adding any special code to your app — thanks to [Auth0's Custom Social Connections](https://auth0.com/docs/connections/social/oauth2), Apple is just one of the many [identity providers](https://auth0.com/docs/identityproviders) you can leverage when connecting to Auth0.

## Extending Auth0’s Core Functionality

We recently wrote about our [vision and guiding principles](https://auth0.com/blog/the-developer-first-identity-platform-auth0-story-and-future/). Developers don’t want to feel like they are constrained by their tools and libraries, especially with an infrastructure component like authentication. Extensibility within our product is a first class citizen, and this is reflected by the fact that 87% of our customers extend the platform. One of the extensibility points we provide allows for adding a new federated authentication method, as highlighted below. This is what we will use to add support for Sign In with Apple:

![Auth0’s extensibility options](https://images.ctfassets.net/23aumh6u8s0i/76ZZsR3TMEJbf9WBnLMRma/7e91db2ea59764168e13721b2db8829a/auth0-engine-custom-connections)

## Prerequisites

To add support for Sign In with Apple, you'll need to have an Auth0 Tenant [set up with a custom domain](https://auth0.com/docs/custom-domains), as well as a web application configured to use Auth0 for authentication at that domain. You can get an application up and running in a few simple steps by using any of our [quick starts](https://auth0.com/docs/quickstarts). Note that for the purpose of this post, your application can use any development stack: Node.js, ASP.NET, Java, and so on.

## Register with Apple

Once you have your application set up, you'll need to create an Apple App ID and a Services ID. We covered these steps in detail in our [previous post](https://auth0.com/blog/what-is-sign-in-with-apple-a-new-identity-provider/#Implementing-Sign-In-with-Apple), but in summary the steps are:

* Create an [Apple Developer Account](https://developer.apple.com)
* Go to ["Certificates, IDs, & Profiles"](https://developer.apple.com/account/resources/certificates/list) -> [ "Identifiers"](https://developer.apple.com/account/resources/identifiers/list/serviceId) -> "Register an App ID"
* Choose "App IDs" as the identifier type and hit "Continue"
* Provide a description and a Bundle ID (reverse-domain name style, i.e., `com.mycustomdomain`)
* Scroll down and check "Sign In with Apple", then "Continue" followed by "Register"
* Back at the "Certificates, IDs, & Profiles" section, click the blue icon next to "Identifiers"
* Choose "Services IDs" and click "Continue". Fill in the description and identifier (`com.mycustomdomain.webapp`)
* After checking "Sign In with Apple", click on "Configure"
* Define your "Web Domain" (`mycustomdomain.com`) and "Return URL" (`mycustomdomain.com/callback`)
* Click "Save", and then "Continue" followed by "Register"

Once you have your Services ID, you'll need to verify your domain with Apple:

* On the "Certificates, IDs, & Profiles" page, click your newly created Services ID
* Hit the "Configure" button next to the "Sign In with Apple" feature, then click "Download" 
* Copy the `apple-developer-domain-association.txt` file to your application server and make it accessible at `https://mycustomdomain.com/.well-known/apple-developer-domain-association.txt` (see our [previous post](https://auth0.com/blog/what-is-sign-in-with-apple-a-new-identity-provider/#Implementing-Sign-In-with-Apple) for a detailed example)
* When this is ready, click "Verify" on your Services ID configuration page. If no error is raised, you are good to go

## Create a Custom Social Connection

In the next step, you’ll add Apple to the collection of identity providers you can integrate with via Auth0.

After you've registered your application with Apple, visit the Auth0 Dashboard and go to **Connections > Social**, scroll to the bottom, and click **Create Custom**.

Most of the information you'll need to create this custom connection has been established in previous steps. To generate the client secret, do the following:

* Head to ["Keys"](https://developer.apple.com/account/resources/authkeys/list) under the "Certificates, Identifiers, & Profiles" section of your Apple developer dashboard
* Click on the round, blue icon to add a new key
* Enter a "Key Name" and check the "Sign In with Apple" option
* Click on "Configure" to make sure the "Choose a Primary App ID" field is filled with your App ID
* Hit "Save", "Continue", and then "Register"
* Download the key, move to its own directory, and rename to `authkey.p8`. Make a note of the Key ID
* Use a JWT library with support for the ES256 algorithm to generate the client secret from the key — the example below uses Node.js, but libraries for other languages can be used in a similar fashion

To use this script, create a new file called `generate-secret.js` in the same directory as the key and add the following code:

```js
const jwt = require("jsonwebtoken");
const fs = require("fs");

const privateKey = fs.readFileSync("./authkey.p8");
const token = jwt.sign({}, privateKey, {
 algorithm: "ES256",
 expiresIn: "60 days",
 audience: "https://appleid.apple.com",
 issuer: "TEAM_ID",
 subject: "com.mycustomdomain.webapp",
 keyid: "KEY_ID"
});

console.log("The token is:", token);
```

> **Note:** You will need to replace `com.mycustomdomain.webapp` with the identifier for your Services ID and replace `TEAM_ID` with your Team ID, which can be found [here](https://developer.apple.com/account/#/membership). You'll also need to replace `KEY_ID` with the Key ID you noted earlier.

Run this script to generate your client secret:

```bash
node generate-secret.js
```

With this, you have almost everything you need to complete the custom social connection! Returning to your Auth0 dashboard, make sure your custom social connection fields look like this:

* **Name:** `Apple`, or any name you choose
* **Client ID:** your Services ID identifier, e.g., `com.mycustomdomain.webapp`
* **Client Secret:** the string generated in the previous step
* **Fetch User Profile Script:**

 ```js
 function (accessToken, ctx, cb) {
 const jwt = require('jsonwebtoken@7.1.9');
 const jwksClient = require('jwks-rsa@1.1.1');
 
 const client = jwksClient({
 jwksUri: 'https://appleid.apple.com/auth/keys',
 cache: true
 });
 
 const idToken = ctx.id_token;
 const decoded = jwt.decode(idToken, {complete: true});
 const {kid, alg} = decoded.header;

 client.getSigningKey(kid, (err, key) => {
 if (err) {
 console.log(err);
 return callback(err);
 }
 const signingKey = key.publicKey || key.rsaPublicKey;
 
 jwt.verify(idToken, signingKey, {
 issuer: 'https://appleid.apple.com',
 audience: 'com.mycustomdomain.webapp',
 algorithms: [alg]
 }, (err, profile) => {
 if (err) return cb(err);
 profile.id = profile.sub;
 cb(null, profile);
 });
 });
 }
 ```
* **Authorization URL:** `https://appleid.apple.com/auth/authorize`
* **Token URL:** `https://appleid.apple.com/auth/token`
* **Scope:** `email name`
* **Custom Headers:**
 
 ```json
 {
 "UserAgent": "Auth0",
 "Accepts": "application/json"
 }
 ```

Once you have everything filled out correctly, click **Create** and enable this connection for your application.

And that's it for set up! 

## Using Sign In with Apple

To try it out, make sure your application is running and give it a visit. When you visit your login page, you should now see an option for Sign In with Apple:

![Login page](https://images.ctfassets.net/23aumh6u8s0i/4koCt6YbjXzQbGbt00affl/a0c196a8f93f3b7f6f4ea75e6adc01ab/login-page)

Click "Continue with Apple", then enter your Apple ID and password:

![Apple credentials](https://images.ctfassets.net/23aumh6u8s0i/7C7TdNTFutvWyWcdsdJsas/594d3a6de274f7f99c3f6827fea734bd/apple-credentials)

You will be asked to verify a new device. Click "Allow":

![Verify device](https://images.ctfassets.net/23aumh6u8s0i/ouXAZobxgZZKtkDR6NFtW/7b2d78d5242f42dd0586c1a73f29537c/verify-device)

Next you'll be given a verication code. Make a note of this code, click "Done", and then enter the code on the "Two-Factor Authentication" screen:

![2FA](https://images.ctfassets.net/23aumh6u8s0i/52IPsCq25vPdRzE9MpYuuO/fa6dd59fb20d9aafb8f81caa8ae02545/2FA)

When this is done, you'll have the option to edit your name and choose whether you'd like to share or hide your email. Make your choice, then click "Continue":

![Email preferences](https://images.ctfassets.net/23aumh6u8s0i/4wtIHL0LNQqhTd6SsKU5x4/1db29403d5c797a22693e1b290a7a787/email-preferences)

You are now signed in with Apple!

![Logged in](https://images.ctfassets.net/23aumh6u8s0i/7J3lSENs4GOIGkfaCe269P/497f957787a9de1e4a2db66987836897/logged-in)

## Coming Soon

We’re working hard to add Sign In with Apple as one of our core integrations, which will make supporting this option in your application as [easy as turning on a switch](https://auth0.com/learn/social-login/). Stay tuned!

Implement Sign In with Apple using Auth0 Extensibility

auziros:bobby-johnson

Bobby is a full-stack developer, advocate, and evangelist at Auth0. He is a passionate engineer with an interest in learning and teaching new technologies, using open source software, and engaging the greater software development community. His experience ranges from building line-of-business applications for financial professionals with Russell Investments and Milliman to distributed social content apps with Cheezeburger and Steller.

Developer Advocate Engineer

Bobby Johnson

Learn about the four-year-long journey Auth0 took to deliver the tools needed by both field engineers and our customers to implement last mile identity solutions quickly.

Previously, we wrote about the emerging pattern of [Serverless Extensibility](https://auth0.com/blog/why-is-serverless-extensibility-better-than-webhooks/). Examples of the concept are popping up in many of the services you use daily like [Twilio](https://www.twilio.com/functions) and here at [Auth0](https://auth0.com/). In this post, I will talk about challenges our customers were facing with our Auth0 Identity product, and how this led us down the path toward implementing the [extensibility](https://auth0.com/extensibility) pattern in a variety of features.

## The problem

![NASA Engineers working on MAVEN](https://images.ctfassets.net/23aumh6u8s0i/3KQXnuCX6H4EROaqBq3hRh/e3e24c8007258b4f7b45f0aef852cebd/engineers_working_on_the_high-gain_antenna_of_the_MAVEN_spacecraft)

*Placed into the public domain by [NASA](http://mars.jpl.nasa.gov/multimedia/images/?s=1) using [Creative Commons](https://creativecommons.org/publicdomain/zero/1.0/)*

In the early days at Auth0, there were two groups: Core and Field Engineering. Core focused on the core functionality of the authentication product, and the field engineers helped customers use the product in their applications. The company was discovering what customers needed in the product.

Our customers' focus was on the authentication transaction. A lot of interesting features can attach to the process of someone trying to login:

- Profile Enrichment
- Progressive Profiling
- Authorization
- Claims Transformation

Customers will come up with an unlimited supply of feature requests. We could not possibly build every feature at once.

Moreover, sometimes building features into the core product for customers is not the right approach. We needed a way to try ideas out. An idea may sound great, but in practice be problematic. Investing core engineering resources to these ideas is very expensive.

> **"The primary use case for extensibility at Auth0 was to empower field engineers to work on the last mile solutions for the customer without involving core engineering."** 
> Eugenio Pace - Co-Founder, CEO

If every interaction with a customer involved identifying an idea, putting it in the backlog and coming back to them at a later date, it would add friction to the process and turn customers away.

For example, we had customers who wanted to do profile enrichment. They used services like [FullContact](https://www.fullcontact.com/) to look up a new user and grab related information about them such as their company, role, and social media accounts. FullContact is just one service as there are several others. We had prospects that were depending on these capabilities to have confidence in using us as a platform, and without it would not become customers.

## Custom code extensibility

![NASA's "Webb-cam" Captures Engineers at Work on Webb at Johnson Space Center](https://images.ctfassets.net/23aumh6u8s0i/6UpPFk1QXmAs5xequW3Wpj/23c899dfcde145fb664480ffddd2cd9f/34827899312_571fa2a976_k)

*[NASA](https://www.flickr.com/photos/gsfc/34827899312) licensed under [Creative Commons 2.0](https://creativecommons.org/licenses/by/2.0/)*

To solve this problem, we introduced a method of adding custom code into the platform that could be defined by customers. The inspiration for custom code extensibility as a solution came from spreadsheets. Excel has significant functionality out of the box, but you can always add a function, macro or calculation that better reflects your goal. Moreover, you can write them yourself directly in Excel, removing the dependency on Microsoft engineers.

> **"We wanted a similar experience for our users. A user should be able to log in to the dashboard, write a small amount of node.js code that executes later during authorization transactions."** 
> Eugenio Pace - Co-Founder, CEO

Like Excel, we wanted to offer users a really simple experience for customizing our product through code. We believed a user should be able to write their logic in an editor, debug it in place, and make it live in production, all without having to stand up a service. This differed from the prevalent approach at the time for dealing with customization through webhooks, which were hosted by the user.

We quickly implemented an MVP to prove out the concept. It created a process boundary between the core Auth0 stack and the customer's code. It primarily prevented well behaved, well-intentioned code from accidentally bringing down the authorization service or other sandboxed code.

Although the MVP had its limitations, it proved that the user experience for customization could be greatly improved, aligning well with our philosophy of "Identity made simple for developers."

## Evolving customization features

![NASA engineers cleaning mirror with carbon dioxide snow](https://images.ctfassets.net/23aumh6u8s0i/2NQmBSwzenRP0r4HFvU0hZ/1b0447fd2fa9bc307d91d3772f94f6c9/17402277412_5e2834517c_k)

*[NASA](https://www.flickr.com/photos/gsfc/17402277412) licensed under [Creative Commons 2.0](https://creativecommons.org/licenses/by/2.0/)*

Custom code extensibility is exposed in our customer dashboard in three ways: Auth0 Rules, Hooks, and Extensions.

**[Auth0 Rules](https://auth0.com/docs/rules/current)** were the first publically available use case where our customers could easily add custom functionality to their authorization flow directly in the dashboard. Rules execute after authentication but before authorization. We offer a gallery of Rule templates that make it easy for customers to address common scenarios out of the box. Because Rules are code though, customers can easily customize the logic further to meet their specific needs.

A customer clicks a button to add a new Rule, selects one from a set of standard templates which they can customize with a simple editor right in their browser. When saved, the Rule is active on their account for all authentication requests.

![Rules UI](https://images.ctfassets.net/23aumh6u8s0i/A8nlyZBGaECLAhpZ2k9CK/892d84cff88e39e3a51a370ba302964b/rules)

Rules allow you to easily customize and extend Auth0's capabilities. They can be chained together for modular coding and can be turned on and off individually.

Rules were really powerful but were limited only to login. Once customers got a taste of rules, they started to ask us for more places where they can customize the product, and so Hooks were born.

**[Auth0 Hooks](https://auth0.com/docs/hooks)** allow you to customize the behavior of Auth0 using custom code that is executed against several extensibility points. Not only can you introduce customization during the client credentials exchange, but also pre and post user registration. Hooks also take advantage of a more feature rich editor.

![Hooks UI](https://images.ctfassets.net/23aumh6u8s0i/5z6VxLuwFqfKdKRba9vA6W/f63a755d3c63187999e262867c1fdff0/hooks)

While both Auth0 Rules and Hooks give you fine-grained control of the authentication pipeline, **[Auth0 Extensions](https://auth0.com/docs/extensions)** are mini-applications that extend the Auth0 identity product with 3rd party integrations.

They do not directly tie to any specific event in the system. Instead, they can invoke any Auth0 API, can configure the customer tenant, deploy Hooks or Rules on installation and even have an associated user interface. They are extremely powerful and opened up many use cases.

![Extensions UI](https://images.ctfassets.net/23aumh6u8s0i/3z6SONf0xAGkS2UBQavAUL/ce74f139ed89bb283121f9f69abe7482/extensions)

Auth0 Extensions are written using the Webtasks infrastructure. Customers can select an Extension from our gallery and provide a set of configuration options to begin using one.

This is just the beginning. We're constantly looking to enable richer and richer customization in our product, and you'll continue to see us opening new doors as we learn.

## The impact on our sales engineers and customers

![NASA engineers celebrating curiosity](https://images.ctfassets.net/23aumh6u8s0i/5pFHSx1biEJCYLFEKsuh6g/c75c5def4fcb853016d4d68e853ea9e7/celebrating_curiosity)

*Placed into the public domain by [NASA](https://commons.wikimedia.org/wiki/File:Celebrating_Curiosity.jpg) using [Creative Commons](https://creativecommons.org/publicdomain/zero/1.0/)*

Adding extensibility to the identity product opened up a window of customization where field engineers could work independently from core engineering. They could deliver customizations very quickly without waiting weeks or even days, enabling many successful sales engagements.

> **"In some cases, we were able to deliver demos where we implemented feature requests in the demo during the meeting. It was amazing for field engineers and our customers."** 
> Eugenio Pace - Co-Founder, CEO

Putting extensibility into the hands of customers also gives us great insights into where the market is going. If we see an extension being implemented again and again through the use of custom code, that is a validation of that feature and an opportunity to add in the core product.

Multi-Factor Authentication came about this way. MFA was not a switch on the dashboard initially. It was merely a rule you applied to your account. Over time, our customers' usage of this rule indicated MFA was an important feature to have in the core product.

For more examples, take a look at our [rules repository](https://github.com/auth0/rules) on Github. Every single one comes from a real-world customer use case.

> **"Every event in the life cycle of the user can be expressed through code and in that way we can support any backend out there in a flash. No matter how customers encrypt or hash passwords; whatever they do is supported because they can provide the details using custom code."** 
> Sandrino Di Mattia - Engineering Lead

## The impact on our business

![Happy Employees](https://images.ctfassets.net/23aumh6u8s0i/3tb9Pbddo96TUGVZMxu68U/39443eb09615ed15655b82f45bc54862/culture-2)

Not only did we make our customers happier, opening up customization provided us a direct return on revenue. Looking at our data, we found our customer retention increased up to 10x for those users that took advantage of customizing. Not only that, but our largest deals depend on these customizations even today, bringing 70% of our cloud revenue.

## Summary
In the past four years, we've been exploring how to better enable our users to customize and extend our SaaS. On our journey, we discovered the Serverless Extensibility pattern provided a great solution. We found that allowing extensions to be authored in-line provided tremendous value both to our customers and to the business. It allowed us to close more deals and deliver customer features much more quickly and cheaply than before. 

_I would like to thank [Eugenio Pace](https://twitter.com/eugenio_pace), [Sandrino Di Mattia](https://twitter.com/sandrinodm) and [Tomasz Janczuk](https://twitter.com/tjanczuk) for taking time out of their busy schedules to be interviewed for this post._

<include src="asides/AboutAuth0" />

Our Journey toward SaaS Customization and Extensibility at Auth0

Webhooks are a clean and simple way to add extensibility points into your SaaS, but Serverless Extensibility removes several points of friction on your customers.

So you have shipped your first SaaS and customers are beating down your door to sign up and hand you buckets of money. Your code is tight. Your servers are humming. The venture capitalists are talking IPO. Everything's coming up roses.

Then it starts; Some customers want complex data flow logic added, others want instant notifications via SMS for each order placed, and then there is a host of other SaaS systems they all want you to integrate with.

How do you handle these requirements? You obviously can't do them all, so you have to choose, meaning some customers will be left unsatisfied and possibly move off your product. Beyond that, there is a different problem. Any work that you decide to do for these one-offs takes away from focusing on your core value proposition, and adds additional maintenance and supports costs.

This problem is, of course, nothing new. Every successful internet service has experienced it in some form since long before web 2.0 was a thing.

## Webhooks Are the Answer!

A common solution is to introduce Webhooks into your platform. They are relatively straightforward to implement; identify the critical extension points of your platform, craft the perfect payload at each point, wire up a subscription administration interface and release it to your customers.

![Webhook Diagram](https://images.ctfassets.net/23aumh6u8s0i/1Cap5PMOy7LJ7NqrCKZ7s7/c42169ef82ce9bec57cb9c34f444ee74/webhook-model)

You don't have to build the customizations. Your engineering team can stay focused on solving the core business for your SaaS.

- You don't have to build the customizations. Your platform can stay tight and focused on solving the business problem it was intended to address.
- You don't have to host the custom logic anymore. The code triggered by the webhook runs completely isolated and secure from your platform and your other customers, dramatically reducing the resources needed to keep your SasS up and running.
- Customers are free to choose any language or technology stack they prefer to process the Webhook payloads.
- You enable other SaaS providers and partners to build integrations with your product to satisfy their customers.

## The Flip Side of Webhooks

Webhooks have effectively allowed you to externalize the customization overload on your platform. What you may not realize is that you have effectively placed that burden directly on your customers.

Mary, who heads IT at one of your customers, a 20 person law firm in Atlanta, did not sign up for this. Your Webhook strategy created a bunch of ongoing work for her and her team.

- She has to figure out how to build the service the Webhook is calling. It needs to be robust and resilient under load.
- She has to find hosting for this service. Heroku and AWS may be great options for this, but Mary may be completely unfamiliar with them.
- She needs to consider security concerns with exposing the service to the internet. Setting up HTTPS is no cakewalk.
- On top of all this, she needs to find a monitoring solution that will alert her to outages or problems, not to mention dealing with being on call to address them.

In a big company, this is even more of a challenge. Budgets need to be considered and appropriated. Coordinating between different departments deciding who is going to build it, deploy it and pay for it can become an impediment. Large SaaS products like Salesforce may require engaging an integration team.

All of this contributes to taking longer to deliver the value the customer wanted in the first place.

<include src="TweetQuote" quoteText="Webhooks are deceptively simple on the surface."/>

Webhooks are deceptively simple on the surface. Many platforms offer Webhooks, but consuming them has a high barrier to entry. Your customers need to think carefully about pursuing them. They are committing to the maintenance of that infrastructure for a very long time. All of this contributes to taking longer to deliver the value the customer wanted in the first place.

![Hidden Complexity](https://images.ctfassets.net/23aumh6u8s0i/2QmCGX1FCBJZxRO59tG1F9/6be6268dca75d89775063232fea63cc9/hidden-complexity)

## Serverless Extensibility, Going Beyond Webhooks

A new approach is starting to emerge in the industry, one that we call Serverless Extensibility. Instead of placing the burden on customers, SaaS products can leverage a Serverless platform to allow users to author and execute extensions directly in the product.

![Serverless Extensibility](https://images.ctfassets.net/23aumh6u8s0i/5T68DlpINImq6GgvWXaaAU/a17cb497333e3623376f3b1e92ff0cff/serverless-extensibility)

Users can now create custom extensions within the product using an inline code editor, choosing from a pre-defined selection. At runtime, The SaaS calls out to a Serverless provider to securely execute the code.

Serverless Extensibility makes it much easier and faster to customize your product and get the value to your users. Not only that, but it saves your customers money as they substantially reduce up-front development cost, and they no longer have to deal with ongoing hosting and maintenance. Removing that friction and cost means higher user retention, which our data shows can be as high as 10x.

## Serverless Extensibility in the Wild

### Auth0

Here at Auth0, we have been working on extensibility for a while. We are known for offering the simplest set of tools to solve the most complex identity use cases. With Auth0 Identity, you can easily authenticate and authorize apps and APIs with any identity provider running on any stack, device, or cloud.

For several years customers have been able to execute arbitrary Node.js code during the authorization process using [Rules](https://auth0.com/docs/rules/current). Several templates are available or they can create an empty Rule to customize right in the management dashboard.

Recently, we added [Hooks](https://auth0.com/docs/hooks), allowing users to customize the behavior of Auth0 at credential exchange, or at pre and post user registration extension points.

![Auth0 Hook Editor](https://images.ctfassets.net/23aumh6u8s0i/2giTBcb9fDHDMAQAe4YKjz/c7fcf8b9c7e9ff6b91b836249e7b5d38/hooks-editor2)

Using Auth0's extensibility has enabled our customers to easily customize the product to handle custom business logic and integrate with a variety of 3rd party services.

### Twilio

Twilio is a cloud communications platform that provides building blocks to add messaging, voice, and video to your web and mobile applications.

With Twilio, you can provision a phone number that accepts calls, faxes, MMS or SMS messages. You can quickly respond to the incoming events using TwiML, an XML based message format that allows you to define simple non-interactive responses. For interactivity, you need to configure a Webhook processor that interacts with the Twilio API.

Twilio recently augmented their Webhook based extensibility with [Twilio Functions](https://www.twilio.com/blog/2017/05/introducing-twilio-functions.html). In the introduction presentation at Signal 2017, Carter Rabasa explained the reasoning this way.

> **"The first thing that Twilio tells you to do is download a web application. And then we ask you to go deploy that web application to some server, somewhere."** 
> Carter Rabasa - Product Manager @ Twilio

Now you can easily create a function that handles incoming voice calls or messages right in the Twilio console. When saved, the function is deployed to a serverless environment and can now be attached to incoming events.

![Twillio Editor](https://images.ctfassets.net/23aumh6u8s0i/3KldDEc7tzPjEJsYxrOoWy/f81658b330a71432a553f8ff5d3d4f44/twilio-editor)

Using Twilio Functions enables customers to now on board much more quickly to using Twilio's platform, than was previously possible.

### Stamplay

Stamplay is a business automation platform that provides the ability to connect any application, database or service regardless of if data is sitting in the cloud or on-premises.

With Stamplay, you can plug in a large and growing list of integrations and use them to orchestrate communication between systems based on event triggers. It offers a beautiful point-and-click task editor that allows any business professional to wire together interactions.

In January of 2016, Stamplay released Code Blocks, a built-in extensibility point that solved a specific need in their product. Giuliano Lacobelli introduced it this way.

> **"Sometimes you cannot get around the need for some custom code."** 
> Giuliano Lacobelli - Co-Founder @ Stamplay

Now Stamplay customers can create custom integrations within the inline editor, and use them directly on Stamplay's drag and drop environment.

![Stamplay Editor](https://images.ctfassets.net/23aumh6u8s0i/46BGeqb2Z8vlohgWhM9wEK/694b8ba3597091badefdc6f8ab2cc502/stamplay-editor2)

Using Stamplay Blocks allows customers to go well beyond the out-of-the-box integrations, providing a stickier experience.

## Summary

Webhooks are a clean and easy way for you to add extensibility points into your SaaS, but they can put an extra ongoing burden on your customers.

Serverless Extensibility removes as much friction as possible, allowing customers to customize the usage of your platform in a secure, scalable, and reliable way that is offered directly in the product.

Removing this friction makes customers stickier to your product, allowing them to focus on their core business and more quickly to deliver value to the market.

Why is Serverless Extensibility better than Webhooks?

Former Auth0 Employee

Jon Gelsey

Company revenue grows 3x year-over-year as customer base extends across multiple industries. Auth0 will use the new funds to double down on security, extensibility and simplicity.

**BELLEVUE, WA** — (Marketwire, June 27, 2017) - [Auth0](https://auth0.com/about), the leading Identity as a Service platform, today announced it has raised $30 million in a Series C financing led by late-stage investor [Meritech Capital Partners](http://www.meritechcapital.com/) and that George Bischof, Managing Director at Meritech Capital Partners, has joined Auth0’s Board of Directors. All existing major investors also participated, including Bessemer Venture Partners, Trinity Ventures, and K9 Ventures. NTT DOCOMO Ventures, Japan’s largest mobile carrier, and [Telstra Ventures](https://telstraventures.com/), the venture capital arm of Australia’s largest mobile carrier, participated as well, endorsing the easy-to-integrate enterprise scale platform that secures billions of logins every year. Auth0 will use the funds to further expand its geographic footprint, and to accelerate the growth of its identity platform with an increased subscriber and talent acquisition focus. 

“Identity has become even more mission critical as businesses become increasingly digital. In our dozens of calls with customers, it was clear that Auth0’s value proposition is resonating in the market. Developers can leverage Auth0’s extensible and easy to integrate identity platform and free up their cycles to work on the core application,” said George Bischof, Managing Director at Meritech Capital Partners. ”Auth0 subscriber adoption is exponentially expanding and we are excited to support their rapid growth.”

![Auth0 Board of Directors](https://images.ctfassets.net/23aumh6u8s0i/4Q2T2wz8ufCArbORCAeowl/3a9966211a214369b99e4baa258ebfe3/about-bod)

Funding comes as Auth0 caps off a yet another year of record growth, which saw revenue increase by nearly 3x year-over-year as the company added 1,250 new companies to its worldwide subscriber base across multiple industries. New customers include Atlassian (SaaS), News Corp (Media) and Houghton Mifflin Harcourt (Publishing). The company has also opened an office in London to serve the EMEA region, announced that it will open an office in Sydney, doubled employee headcount, and launched the [Auth0 Extend](https://auth0.com/extend/) product line, a new Serverless extensibility platform. The Series C funding will help Auth0 further extend its reach as an identity-as-a-service platform, offering deep identity security features, doubling down on simplicity and extensibility, as well as adding new features to the platform to better suit the needs of modern enterprises.

“At this time of constant threats and data breaches, modern enterprises require the strongest possible identity solution. Furthermore, in these new times, companies are racing to bring new products to market and facing both intense pressure to grow revenue and customers as well as fierce competition. They need to consolidate all their identity needs in one single end-to-end platform that works out of the box and can be easily extended to support all applications and use cases,” said Jon Gelsey, Auth0 CEO. “We are honored by the confidence placed in us by our investors, as well as by the trust displayed by our subscriber base as we seek to accelerate their business goals. Our subscribers are among the [most sophisticated enterprises](https://auth0.com/customers) in the world, and they continually drive and inspire us to create an even better set of services.”

Auth0 is an enterprise-grade platform for modern identity. It provides companies with a service that eliminates the complexity of authentication for applications and APIs, all accessible through a developer friendly dashboard. Their technology makes it easy to implement even the most complex identity solutions for their web, mobile, and internal applications and APIs.

<include src="asides/AboutAuth0" />

## About Meritech Capital Partners

Meritech Capital Partners is a leading provider of late-stage venture capital to category- defining private technology companies, and has been one of the top performing venture firms of the past decade. With over $3 billion under management, Meritech leads investments into companies with proven and differentiated technology, rapidly-growing revenue and experienced management teams. Meritech investments in industry-leading companies include Box, Cloudera, Cornerstone OnDemand, Coupa, Facebook, Fortinet, Mulesoft, NetSuite, Proofpoint, PopCap, Salesforce.com, Sourcefire, Tableau and Zulily. Meritech is located in Palo Alto, CA and can be found at [www.meritechcapital.com](http://www.meritechcapital.com). 

For more information visit [https://auth0.com](https://auth0.com) or follow [@auth0 on Twitter](https://twitter.com/auth0).

Cloud Identity Leader Auth0 Adds $30 Million Series C

53f70144dc9d7c76455fa91f858d4cec?s=200 avatar

53f70144dc9d7c76455fa91f858d4cec?s=200

Guest Author

Tomasz Janczuk

Customize Auth0 platform with Node.js using Auth0 Hooks, a new extensibility mechanism powered by Webtasks.

<div class="alert alert-danger alert-icon">
 
 We are deprecating Auth0 Rules and Hooks by November 18, 2024. To learn more about what's changing, check out the <a href="https://auth0.com/blog/preparing-for-rules-and-hooks-end-of-life/">deprecation announcement blog post</a>.
</div>

Auth0 Hooks are a new extensibility mechanism in Auth0 that allows you to customize the behavior of our platform using Node.js.

-----

## Developers love code and extensibility

Customization flexibility has always been an integral part of the Auth0 platform. Until now, you could use [Auth0 Rules](https://auth0.com/docs/rules) to execute arbitrary Node.js code during an authorization transaction. Today, we are introducing [Auth0 Hooks](https://auth0.com/docs/auth0-hooks), a new and improved mechanism to extend the Auth0 platform using code.

![Auth0 Hooks in Webtask Editor](https://images.ctfassets.net/23aumh6u8s0i/7AhEd6rE5LSLZ32DLUJ3Ax/15c33539f6464608a138ce0e499bee8c/wt-editor-auth0-hooks) 

## Better developer experience

While Auth0 Hooks are building on the same underlying [Webtask](https://webtask.io) technology we have developed to run Auth0 Rules, several aspects of the developer experience are improved:

* Using the [management dashboard](https://auth0.com/docs/auth0-hooks/dashboard) you can create, move in and out of production, and edit hooks for selected extensibility points in the Auth0 platform.

![Auth0 Hooks dashboard](https://images.ctfassets.net/23aumh6u8s0i/5kHLjW7V9ovSFHxRAXhxxC/2dbccc8615c5308bb6c2adc7860f7ca4/manage-hooks) 

* You edit hooks in the Webtask Editor, which offers a much richer featureset compared to the experience you are used to with Auth0 rules. 
* Syntax completion allows you write the code faster without referring to documentation. 
* Integrated secret management improves the security of your code by providing a mechanism to securely store secrets while making them conveniently available in code. 
* Integrated runner allows you to test your code without leaving the webtask editor. 
* Real-time logs simplify debugging by streaming the output generated by your code. 
* GitHub integration allows you synchronize your hook with code stored in a github repository. Updating your hook is as simple as pushing to GitHub. 

## What can you do today

The initial release of Auth0 Hooks supports customizing the behavior of Auth0 at three new extensibility points: 

* [Client Credentials Exchange](https://auth0.com/docs/hooks/extensibility-points/credentials-exchange) allows you to change the scopes and add custom claims to issued access tokens. 
* [Pre User Registration](https://auth0.com/docs/auth0-hooks/extensibility-points/pre-user-registration) allows you to intercept creation of a new database user to enforce custom password policy, or employ application specific logic to prevent the signup. 
* [Post User Registration](https://auth0.com/docs/auth0-hooks/extensibility-points/post-user-registration) allows you to perform any actions as a result of a succcessful creation of a new database user, e.g. send a message to Slack, or create a record in your CRM system. 

This is just the beginning. We are going to be adding many more extensibility points in the Auth0 platform using the Auth0 Hooks mechanism in the future. 

## Auth0 Hooks vs Auth0 Rules

Introduction of Auth0 Hooks does not affect any existing Auth0 Rules. Your rules continue to work unchanged.

Auth0 Hooks provide a foundation for a new extensibility mechanism in Auth0. All future extensibility points in the platform will build on top of Auth0 Hooks. We are also planning to add support in Auth0 Hooks for the same things you use Auth0 Rules for today. 

## Differences with Auth0 Rules

If you have been using Auth0 Rules before, these are some of the key differences in the development experience when moving on to Auth0 Hooks:

* In Auth0 Rules, you are editing code on the Auth0 management dashboard. When using Auth0 Hooks, you edit code in the Webtask Editor. 
* When using Auth0 Rules, you are specifying rule configuration common to all rules on the Auth0 management dashboard. Auth0 Hooks allow you to specify secret configuration directly in the Webtask Editor, and separately for each hook. 
* When developing Auth0 Rules, you can dry run a rule from within the Auth0 management dashboard. Auth0 Hooks can be tested from within the Webtask Editor using the integrated runner and access to real-time logs. 
* Auth0 management HTTP APIs offer a way to manipulate Auth0 Rules using any HTTP client. Auth0 Hooks are managed using [Webtask management APIs](https://webtask.io/docs/101). 

## Aside: Auth0 Extend

We have recently released a product called [Auth0 Extend](https://auth0.com/extend/). This product enables companies to provide an easy extension point where customers can run arbitrary JavaScript code. With [Auth0 Extend](https://auth0.com/extend/), customers can create custom business rules, scheduled jobs, or connect to the ecosystem by integrating with other SaaS systems, like Marketo, Salesforce, and Concur. All using plain JavaScript and NPM modules.

## Learn more

> Give your customers enterprise identity integration, frictionless SSO across your products and adaptive authentication with MFA and Anomaly Detection. [All of this with a flip of a switch](https://auth0.com/b2b-enterprise-identity-management).

Check out the [Auth0 Hooks documentation](https://auth0.com/docs/auth0-hooks) or head over directly to the [Auth0 Hooks management dashboard](https://manage.auth0.com/#/hooks) to create your first hook.

"extensibility"