evan-sims

Evan is a software engineer on the DX-SDKs team at Auth0, and his pronouns are He/Him. He's passionate about helping developers build great (and secure!) software, a big fan of PHP, Laravel, Symfony, and WordPress, and an avid FOSS contributor. Before joining Auth0, he created free and open-source software supporting humanitarian aid and citizen journalism efforts. Once upon a time, he worked as a technical designer in the video games industry; he's more focused on playing them these days. He loves reading, traveling, spending time outdoors with his partner, and writing his blog autobiographies in the third person.

SDK Engineer

Evan Sims

Integrate Auth0 in your Laravel applications with no code by using the new Laravel SDK.

[Laravel](https://laravel.com/) is a tremendously popular web application framework — with good reason! Now in its 10th generation, the framework has built up a robust and mature foundation that’s not just battle-tested but genuinely delightful to build applications with. Laravel has elevated the entire PHP experience to a new level thanks to its incredibly passionate developer community. These days it’s nearly become as synonymous with PHP as Rails has with Ruby. And with PHP running on [at least 80% of web servers](https://kinsta.com/blog/is-php-dead/), that’s a big deal. For a good reason, companies like Disney, Warner Brothers, Twitch, and The New York Times have embraced Laravel.

Auth0 has offered a Laravel SDK for many years — our first release dates back to 2014! A lot has changed since then, and like all our SDKs, we’ve evolved to fit the times and the community’s needs. Every new release is an opportunity to iterate, improve, and create a better developer experience.

Early last year, [we released v7 of our Laravel SDK](https://github.com/auth0/laravel-auth0/), which was a big one. We rewrote the SDK from the ground up to take advantage of [PHP 8](https://stitcher.io/blog/new-in-php-8) and [Laravel 9](https://kinsta.com/blog/laravel-9/) and restructured everything on top of our massively upgraded core [PHP SDK v8](https://github.com/auth0/auth0-php). For the first time, developers could integrate authentication with Auth0 in their Laravel apps in less than ten lines of code, and it was great!

But we wondered — what if you could do it with zero lines of code?

Over the last few months, we’ve been striving to create that experience for our Laravel developers, and as of [v7.8 release](https://github.com/auth0/laravel-auth0/releases/tag/7.8.0), we’ve reached that milestone (and so much more).


## With Great Power...

Laravel is a robust framework created to support practically any kind of application developers might want to build. It’s one of those rare frameworks that has managed to strike a harmonious balance between powerfully customizable and highly opinionated. And when it comes to something as critical to an application as authentication, if you’re going to tackle the subject, you better be sure you’re striking that same balance successfully. It should “just work” while also being flexible enough to mold to the most niche scenarios.

Admittedly in the past, our Laravel SDK has not always hit that mark on addressing those niches, particularly in supporting monolithic apps; that is, apps that serve JSON APIs with token-based authorization as well as modern frontends with session-based authentication, in the same codebase. The community asked us to create a better solution, but there were some technical hurdles to work through first.

Traditionally, our SDK exposed authentication through a single API, which made integration super simple but meant that, on occasion, developers had to figure out how to support some exotic use cases using just a single SDK configuration. It simply didn’t always work as elegantly as one would hope.

With v7.8, we went back to the drawing board to address this. We took a deep dive into the core of Laravel’s Authentication APIs, drilling into the framework’s source code, and began laying the groundwork for a whole new approach that let us support every type of application (yes, even those tricky monolithic apps!) in exciting new ways. We even learned some new tricks along the way!


## Real Artists Ship

Efforts toward these ends [began with 7.2](https://github.com/auth0/laravel-auth0/releases/tag/7.2.0), where we started working on the foundation of our new approach. We started by building the support we needed to do this right. We began by releasing support for native Laravel sessions, persistent session storage, and support for Laravel’s native caching APIs. We built experimental [Octane](https://laravel-news.com/laravel-octane-for-scale) support for supercharged applications. We improved reliability by achieving 100% code coverage and implemented mutation testing and triple-filtered static analysis to ensure we caught as many edge cases as possible. We cut a new release each month, bringing us closer to our new goal: a no-code solution that addresses all our customers' requests.

And today, finally, with 7.8, we’ve reached our goal. There’s so much to share, but we’ll distill it down to the headline features:


### Changing of the Guard(s)

With 7.8, we released two completely new Guards that leverage every aspect of Laravel’s powerful Authentication API. These new Guards — one for session-based authentication and the other for token-based endpoint authorization — enable support for applications of all types and use cases, finally addressing the demands of those monolithic app developers.

Previously, you had to write the following code:

```php
Route::middleware(['guard:auth0', 'auth0.authenticate'])->get('/messages', function () { 
    // ...
});
```

Today you just write as follows:

```php
Route::get('/messages', function () {
    //...
} })->middleware('auth'); 
```

We created a suite of new middleware and services that support using these Guards without any integration work within the application. There are no editing files, defining middleware, or Kernel changes; it just works. Authentication is immediately available, and any routes configured to use Laravel’s native `‘auth’` middleware for limiting access to authenticated sessions instantly work with Auth0. **Zero lines of code!**

Previously, you had to define your guards and provider...

```
// config/auth.config: 
return [ 
    'guards' => [ 
        'auth0' => [ 
            'driver' => 'auth0.guard', 
            'provider' => 'auth0-provider', 
        ]
    ],
    'providers' => [ 
        'auth0-provider' => [ 
            'driver' => 'auth0.provider', 
            'repository' => \Auth0\Laravel\Auth\User\Repository::class, 
        ]
    ],
];
```
...and modify the Kernel:

```php
// app/Http/Kernel.php: 
use Illuminate\Foundation\Http\Kernel as HttpKernel; 

class Kernel extends HttpKernel 
{
protected $middlewareGroups = [ 
    'web' => [ 
        \App\Http\Middleware\EncryptCookies::class, 
        \Illuminate\Cookie\Middleware\AddQueuedCookiesToResponse::class, 
        \Illuminate\Session\Middleware\StartSession::class, 
        \Illuminate\View\Middleware\ShareErrorsFromSession::class, 
        \App\Http\Middleware\VerifyCsrfToken::Class, 
        \Illuminate\Routing\Middleware\SubstituteBindings::Class, 
        \Auth0\Laravel\Auth\Guard::class, 
    ]; 
} 
// routes/web.php: 
use Auth0\Laravel\Http\Controllers\{Callback, Login, Logoutl}; 
Route::group(['middleware' => ['web', 'guard:auth0'], static function (): void {
    Route::get('/login', Login::class)->name('login'); 
    Route::get('/logout', Logout::class)->name('logout'); 
    Route::get('/callback', Callback::class)->name('callback');
    }); 
```

Today, this is all you need to do:

```php
// Nothing! 🎉
```

And for the first time, we now support Laravel’s powerful native Authorization API, which enables developers to write permissions-based gates and policies that can use Auth0’s RBAC with APIs for fine-grained access control.

This is what you had to write previously:

```php
Route::middleware(['guard:auth0', 'auth0.authenticate'])->group(function () { 
    Route::get('/messages', function () { 
        return response("You're authorized to read messages."); 
    })->can('auth0.authorize:read:messages'); 
}); 
```
Here is what you have to write today:

```php
Route::get('/messages', function () { 
    return response("You're authorized to read messages."); 
})->middleware('auth')->can('read:messages'); 
```

### Auth0 CLI: First-Class Configuration

To support these new guards, we completely reinvented our SDK configuration API — and ended up building something profoundly flexible and capable. Our new configuration API enables us to support an infinite number of Guard instances in memory at any given time, supporting every conceivable need a developer might have for their application’s authentication needs — which is particularly important for Octane applications.

Our goal with the new configuration API was to simplify the integration experience dramatically, taking a sometimes lengthy explanation process involving application configuration instructions and `.env` file editing down to just a few error-proof steps.

What we arrived at was a whole new configuration experience powered by the Auth0 CLI. The CLI is an exciting tool that guides developers in managing their tenants through an elegant command-line interface. It was a perfect fit for simplifying one of the biggest challenges of getting started with the SDK, so we baked in native support for the CLI. Now, the JSON expressed by the CLI can be used to directly configure an application’s Auth0 SDK integration. **For the first time, you can configure your tenant and SDK in a single command.** It’s pretty awesome!


### The Quickest of Quickstarts

We’re always looking for ways to improve a developer’s first experiences with our SDKs, and that all begins with the quickstart. These starter applications demonstrate how a developer can integrate base applications with fully functional authentication as efficiently as possible — ideally resulting in a working app in 5 minutes or less.

Now that we’ve achieved no-code and integrated the Auth0 CLI, developers can do this with their Laravel application in **less than a minute**.

We re-wrote our Laravel quickstarts from the ground up to showcase this new configuration approach and demonstrate these new features, which cut the length of our quickstart in half. We also reworked the GitHub repository so developers can use it as a starting template for new Laravel applications with a single command.

Want a fully functional Laravel 9 application with Auth0 authentication out of the box? You got it!

```
composer create-project auth0-samples/laravel
```

Ready to configure it? Done!

```
./auth0 apps create \ 
--name "My Laravel Application" \ 
--type "regular" \ 
--auth-method "post" \ 
--callbacks "http://localhost:8000/callback" \ 
--logout-urls "http://localhost:8000" \ 
--reveal-secrets \ 
--no-input \ 
--json > .auth0.app.json 
```

You have a ready-to-ship app with completely functional authentication and access control.

## Integration Comparison

Let's compare how you would have integrated Auth0 previously with how you do it today.

### The old-days integration

Previously, you should have started with the installation:

```
$ composer global require laravel/installer 
$ laravel new example-app 
$ cd example-app 
$ composer install 
$ composer require auth0/laravel 
```

Then, you should have created an application in the [Auth0 dashboard](https://manage.auth0.com/)...

![Setup — Auth0 Application Creation](https://images.ctfassets.net/23aumh6u8s0i/4QoFmUwS0wdwyaHrQe5Ynr/444d87da9a8fabb23ad449dbc83de48b/09_-_Setup___Auth0_Application_Creation.png)

...and configured it:

![Setup (Continued) — Auth0 Application Configuration](https://images.ctfassets.net/23aumh6u8s0i/S2eVoxkVBulc96Ei8KrOn/1f2c5d6eedcbea27533337c60ccfd644/10_-_Setup__Continued____Auth0_Application_Configuration.png)

Back to your application, you should have configured it with the Auth0 registration data:

```
AUTH0_DOMAIN="..." 
AUTH0_CLIENT_ID="..." 
AUTH0_CLIENT_SECRET="..." 
AUTH0_COOKIE_SECRET="..." 
AUTH0_AUDIENCE="..." 
```

You should have defined your Guards and provider:

```php
// conflg/auth.config: 
return [ 
    'guards' => [ 
        'auth0' => [ 
            'driver' => 'auth0.guard', 
            'provider' => 'auth0-provider', 
        ]
    ], 
    'providers' => [ 
        'auth0-provider' => [ 
            'driver' => 'auth0.provider', 
            'repository' => \Auth0\Laravel\Auth\User\Repository::class,
        ]
    ], 
];
```

You should have defined your middleware in the Kernel:

```php
// app/Http/Kernel.php: 
use Illuminate\Foundation\Http\Kernel as HttpKernel; 

class Kernel extends HttpKernel 
{
    protected $middlewareGroups = [ 
        'web' => [ 
            \App\Http\Middleware\EncryptCookies::class, 
            \Illuminate\Cookie\Middleware\AddQueuedCookiesToResponse::class, 
            \Illuminate\Session\Middleware\StartSession::class, 
            \Illuminate\View\Middleware\ShareErrorsFromSession::class, 
            \App\Http\Middleware\VerifyCsrfToken::Class, 
            \Illuminate\Routing\Middleware\SubstituteBindings::class, 
            \Auth0\Laravel\Auth\Guard::class,
        ];
} 
```

You should have added support for authentication...

```php
// routes/web.php: 
use Auth0\Laravel\Http\Controllers\fCallback, Login, Logout}; 

Route::group(['middleware' => ['web', 'guard:auth0'], static function (): void {
    Route::get('/login', Login::class)->name('login'); 
    Route::get('/logout', Logout::class)->name('logout'); 
    Route::get('/callback', Callback::class)->name('callback');
    }); 
```

...and optionally configure the application's routing:

```php
Route:middleware('guard:auth0', 'auth0.authenticatel)->group(function () { 
    Route::getr('/messages', function () { 
        return response("You're authorized to read messages."); 
    })->can('auth0.authorize:read:messages'); 
});
```

### Today's integration

With the new SDK, you integrate Auth0 in your Laravel application in two easy steps.

First step, create a new application:

```
$ composer create-project auth0-samples/laravel
```

Second step, configure your application through the Auth0 CLI:

```
./auth0 apps create \
--name "My Laravel Application" \
--type "regular" \
--auth-method "post" \
--callbacks "http://localhost:8000/callback" \
--logout-urls"http://localhost:8000"\
--reveal-secrets \
--no-input
--json > .auth0.app.json
```

Optionally, configure its routing this way:

```php
Route::get('/messages', function () { 
    return response("You're authorized to read messages."); 
})->middleware('auth')->can('readmessages'); 

```

## Conclusion

At Auth0, we never stop innovating, and our SDKs are absolutely no exception. With v7.8, we’ve achieved a powerful no-code integration, an incredibly streamlined configuration scheme powered by the Auth0 CLI, and we now offer our quickest quickstarts ever. We’re proud of our latest Laravel release, but more importantly, we’re excited to see what developers build with it. We wouldn’t have gotten here without the valuable feedback of our developer community, and we’re excited to continue building the future of authentication in Laravel together.


Authentication with Laravel: Raising the Bar with a No Code Future

alexa-bio

Alexa is a Product Marketing Manager on the Auth0 platform team. With a partner and product marketing background, she is focused on growing our marketplace ecosystem working closely with new and existing partners.

Product Marketing Manager

Alexa Jacky

Customizing identity flows by stacking no-code integrations allows dev teams to innovate efficiently

As healthcare delivery models evolve and digital information unlocks new possibilities, a vast array of ecosystem participants face pressure to:

* **Build and manage consolidated patient portals** that link patients, patient advocates, and extended healthcare teams and that extend across multiple service providers.
* **Empower patients** with convenient self-service options and quicker access to appointment information, test results, diagnoses, forms, documentation, and their healthcare providers.
* **Provide rapid virtual care and assistance,** overcoming distance and time constraints and increasing accessibility of healthcare (and related) services.


<br>
From established healthcare providers to newcomers aspiring to dominate entirely new markets, the organizations best positioned to succeed will be those that are best able to implement fundamental identity capabilities and extend beyond the identity basics.

All the while — and in everything they do — healthcare organizations have to comply with complex regulatory requirements (e.g., HIPAA, GDPR), which vary by jurisdiction and are often layered (i.e., state laws versus federal laws).

But with developer resources already in short supply and with a healthcare organization's primary applications rightfully commanding the lion's share of attention, engineering organizations need to satisfy identity requirements as quickly — and with as little custom code to write or maintain — as possible.

For example, Jay Anslow, Senior Software Engineer at [Babylon Health, shared with us that](https://auth0.com/case-studies/babylon-health), "We estimated that it would take a team of eight staff at least a year to meet our new requirements with a home-built solution. As well as the cost of having that team, it would have delayed our timeline, so we wouldn't have been able to get our functionality out the door as quickly."

## Identity Enables the Healthcare Ecosystem

Identity, particularly as it relates to securing sensitive data and complying with privacy regulations, has been a foundation of healthcare since long before the digital revolution — but as healthcare delivery organizations (HDOs) embraced new information formats and leveraged the Internet for collaboration, communications, service delivery, and other functions, customer identity and access management (CIAM) systems became essential elements of healthcare organizations' technology stacks.

On top of the transition that was already happening, the COVID-19 pandemic "caused a seven to ten-year acceleration in consumer and digital trends," [according to Richard Schwabacher, Senior VP of Digital Health and Chief Digital Officer at BioReference](https://auth0.com/case-studies/bioreference). The result is that "Securing, transmitting, and authorizing patient access to health information digitally is now critical to the practice of medicine and core to what is needed from a modern digital health solution."

And CIAM is vital to this functionality. Out of the box, leading CIAM solutions include many features that can help healthcare organizations meet new needs, allowing even small engineering teams to:

* [Create patient-centric experiences](https://auth0.com/case-studies/bioreference), built around each individual’s needs and preferences;
* [Enable a vast, interconnected, and growing healthcare ecosystem](https://auth0.com/case-studies/providence); and
* [Simultaneously meet security, privacy, and convenience](https://auth0.com/security) needs, rather than trading off between these necessary elements.

But while out-of-the-box functionality is important, the real world is a complex and dynamic beast (as anyone who's ever done a year-over-year roadmap comparison understands). Being able to accommodate change and tailor identity to your unique needs — and doing both without drawing too heavily upon developers — is the difference between CIAM as a necessary component of your application stack and CIAM as an operational and competitive advantage.

## Actions Integrations and the Auth0 Marketplace

A modern CIAM solution can tackle [the healthcare identity basics](https://auth0.com/healthcare) (e.g., signups, logins, account updates, password retrievals, etc.), but satisfying advanced use cases often requires transacting with other business systems and third-parties to execute complex conditional flows.

However, identity is a very difficult and specialized domain. Here's a quick exercise: think of a subject that you know a lot about, something where you're truly an expert. And now, think about how non-experts oversimplify the problems in that area and are overconfident in their ability to solve them. Sure, it's not _impossible_ for them to do so, but it will likely take much more time and effort than they imagined, and the implementation would potentially fail to address corner cases and other complexities.

Identity is like that! An in-house developer team could drop everything else and focus considerable effort on extending an identity implementation by building (and maintaining) a custom solution to every new use case — or they could leverage a straightforward way to make identity work with other business systems quickly and effectively.

And that's where [extensibility](https://auth0.com/extensibility) comes into play.

Since launching in late 2020, [the Auth0 Marketplace](https://marketplace.auth0.com/) has helped developers quickly find and install third-party identity solutions for their applications and APIs.

[Actions Integrations](https://auth0.com/blog/auth0-no-code-actions-integrations-now-available-in-beta/) make it even easier to extend Auth0 with partner-built innovations, often with no-code, drag-and-drop ease; in fact, you can even 'stack' these integrations like building blocks to keep up with new needs and address advanced use cases.

To illustrate, let's look at some examples of how [identity proofing](https://marketplace.auth0.com/categories/identity-proofing), [mobile device verification](https://marketplace.auth0.com/integrations/incognia-authentication), [customer data platforms](https://marketplace.auth0.com/integrations/tealium), and [consent management](https://marketplace.auth0.com/categories/consent-management) integrations can be combined and conditionally employed to contribute to a strong security posture and create positive experiences for customers.

### Registering, logging in, and scheduling appointments

To meet growing expectations for convenience, healthcare organizations must make it easy for patients to register and schedule appointments — but at the same time, the signup process must be secure and must address compliance requirements.

Here's how third-party integrations can help satisfy these simultaneous needs:

* The patient initiates the registration process/account creation
* The sign-up flow within the identity engine calls upon an identity-proofing solution to verify the patient's identity
* Next, the flow calls upon a consent management solution to ensure the patient understands and agrees with how their information will be handled with respect to regulations
* Finally, the identity engine encourages the patient to enroll in [multi-factor authentication (MFA)](https://auth0.com/docs/secure/multi-factor-authentication/enable-mfa) as an added security measure; if the patient agrees, then the flow walks them through the process

To simplify future logins, the identity engine can employ mobile device verification when the patient attempts to access healthcare services via the organization's mobile app.

Once logged in, a patient can schedule an appointment:

* The patient selects "schedule appointment."
* The identity engine uses MFA to verify it is indeed the patient attempting to make the appointment
* If the patient passes the MFA challenge, the appointment is confirmed

Note that this process can be augmented by employing [Adaptive MFA](https://auth0.com/docs/secure/multi-factor-authentication/adaptive-mfa) and limiting MFA's use to when a risk threshold is exceeded.

### Changing/updating personal information

Healthcare organizations handle an enormous volume of sensitive data, including personally identifiable information (PII) and protected health information (PHI). Consequently, it's vital that only authorized users can access and modify information.

Here's a potential identity flow for patient self-service:

* The logged-in patient clicks on "update my profile."
* If the patient is using the mobile app, then the identity engine can call upon a mobile verification solution; otherwise, the identity engine can employ an identity-proofing solution
* With the patient's device or identity verified, they are now authorized to change their information
* If the information being changed is of sufficient sensitivity (e.g., relating to financial or insurance records), then the identity engine can engage MFA as an added layer of security/confirmation
* The patient's information is saved
* The identity engine passes the updated information to the CDP

### Securely accessing healthcare documents and services

Delivering healthcare services requires holding and managing access to huge numbers of documents, from information forms to lab results. Enabling patients to access their healthcare documents eases the workload for staff and can accelerate care.

In addition, telehealth reached new levels of adoption during the pandemic to help protect vulnerable people and reduce the spread of COVID-19 — but with healthcare fraud a real risk, it's important to verify that a patient is who they say they are.

Here's how identity can help. Suppose a logged-in patient clicks to access a particular health document or service. Depending upon the situation, the identity engine can conditionally branch into a number of paths:

* If the patient is using the mobile app, then the flow can call upon a mobile verification solution.
* If the patient is using a new or different device, then the identity engine can initiate an MFA challenge.
* And for especially sensitive information, then the identity engine can call upon an identity-proofing solution.

With verification complete, the patient is now able to access the document or service.

Note that these flows can also incorporate risk scoring and behavioral validation. For example:

* The identity engine can check the patient's device posture against a third-party risk service: if a risk threshold is exceeded, then a higher level of verification can be employed.
* The identity engine can check behavioral data against the patient's CDP profile: for instance, if the patient usually accesses their healthcare portal from a particular geography but in this attempt is somewhere new, then additional verification may be warranted.

### Paying bills

Healthcare organizations also hold vast amounts of financial records — including bills, bank account details, and insurance information — that must be safeguarded. But at the same time, making it easy for patients to view and pay their bills is important.

Fortunately, identity flows can allow patients to view, download, and pay invoices remotely through a third party or an in-house app:

* The logged-in patient navigates to a bill and attempts to open/view it
* The identity engine calls upon mobile verification to confirm the patient's device; alternatively, the identity engine can upon a CDP to confirm the patient's location
* If the device is not recognized or the patient is logging in from a new location, then the identity stack can initiate an MFA challenge
* With the patient's identity verified, they are able to open the bill and access the billing/payment system

## A World of Extensions and Opportunities

Extensibility is a core Auth0 principle. [Our identity platform](https://auth0.com/resources/videos/platform-introduction-video-2020) is designed to be easy to deploy and even easier to tailor to your unique business needs, so you never have to choose between customizability and ease of deployment.

Plus, with [a long list of security and privacy certifications](https://auth0.com/docs/secure/data-privacy-and-compliance) and[ the option to deploy the Auth0 Identity Platform in a private cloud](https://auth0.com/resources/whitepapers/private-cloud-deployment), healthcare organizations can be confident that their identity implementations help meet their regulatory requirements.

We're excited about the potential unlocked by the rich ecosystem of third-party integrations, as they allow our customers to continually add new capabilities as needed.

Whether you prefer the pro-code approach of [Actions](https://auth0.com/docs/customize/actions) or the no-code convenience of Actions Integrations found within [the Auth0 Marketplace](https://marketplace.auth0.com/), we encourage you to explore the options to see which of your identity and identity-related use cases already have a ready-built solution just waiting to be integrated!

Extending CIAM to Enable Modern Healthcare Applications

Stacking integrations from the Auth0 Marketplace enables custom identity use cases with no-code ease

As they compete for attention and conversions in a crowded global marketplace, online retailers and eCommerce companies face a number of challenges. For example:

* **Customers expect personalized omnichannel experiences** at every stage of the buying journey
* **Users want to engage with their apps or services at any time, from any device, in a secure and safe manner** — and they don’t want to spend time with cumbersome account creation
* **The loss of the third-party cookie and tighter app restrictions are threatening marketing strategies** that rely upon cookies and app-based tracking and are forcing a larger dependence on first-party data

The brands that will not only survive but thrive in this dynamic environment will be those that are best able to implement fundamental identity capabilities and extend beyond the identity basics.

But with a developer team that’s busy enough already, it’s important for the business (and for developer sanity) to satisfy identity requirements as quickly — and with as little custom code to write or maintain — as possible.

## Identity Enables Online Retail and eCommerce

Identity may not be top of mind for retailers, but the identity function is essential to helping eCommerce companies:

* **Maximize conversions and revenue** by[ minimizing friction in any and every customer interaction](https://auth0.com/resources/whitepapers/identity-insights-101)
* **Meet user expectations** by[ powering personalized experiences](https://auth0.com/case-studies/coles-group)
* **Manage risk** by addressing regulatory requirements and privacy laws and by addressing[ identity-specific security threats](https://auth0.com/resources/whitepapers/state-of-security-identity-report)

A customer identity and access management (CIAM) solution with the right set of out-of-the-box features can help engineering teams to avoid a whole lot of pain and expense.

For example,[ CIAM has been a core enabler of cosmetic giant Lush’s consumer-oriented initiatives](https://auth0.com/case-studies/lush-cs), powering a range of features including single sign-on (SSO) and guest checkout, as well as the centralization of the point-of-sale (POS) system for the entire business. In particular, extensive out-of-the-box functionality allowed Lush to implement these features with a limited developer team while ensuring the pace of transformation didn’t compromise customer privacy or system security.

While out-of-the-box functionality is important, the real world is a complex and dynamic beast (as anyone who’s ever done a year-over-year roadmap comparison understands). Being able to accommodate change and tailor identity to your unique needs — and doing both without drawing too heavily upon developers — is the difference between CIAM as a necessary component of your application stack and CIAM as an operational and competitive advantage.

![Auth0 Marketplace](https://images.ctfassets.net/23aumh6u8s0i/16QlWAA6ZN2lnMATb3RbMu/3e305e33068ab6a5afb1419500972b4c/Marketplace_Partner_Spotlight_Separator_V01B_3x.png)

## Actions Integrations and the Auth0 Marketplace

A modern CIAM solution can tackle the identity basics (e.g., signups, logins, account updates, password retrievals, etc.), but satisfying advanced use cases often requires transacting with other business systems and third parties to execute complex conditional flows.

Building such advanced logic from scratch is a major undertaking requiring specific skill sets, tools, and knowledge; worse still, it’s inefficient because each use case is a custom coding exercise with little that can be reused.

Alternatively, having a simple but effective (read: powerful, flexible, efficient, etc.) way to make identity work with your other business systems allows developers to quickly implement customized identity solutions without the time, expense, and headaches associated with custom coding projects… and that’s where[ extensibility](https://auth0.com/extensibility) comes into play.

Since launching in late 2020,[ the Auth0 Marketplace](https://marketplace.auth0.com/) has helped developers quickly find and install third-party identity solutions for their applications and APIs.

[Actions Integrations](https://auth0.com/blog/auth0-no-code-actions-integrations-now-available-in-beta/) makes it even easier to extend Auth0 with partner-built innovations, often with no-code, drag-and-drop ease; in fact, you can even ‘stack’ these integrations like building blocks to keep up with new needs and address advanced use cases.

To illustrate, let’s look at some examples…

## Prevent Fraudulent Registrations

One of the major objectives for consumer-facing companies is to convert prospects into first-time customers, and this makes fraudulent registrations (or signup fraud) especially problematic because:

* [Leveraging a customer data platform (CDP)](https://auth0.com/blog/why-you-should-integrate-customer-identity-and-your-customer-data-platform/), customer flows are often optimized based upon data that shows how users interact with a user interface and ultimately ‘convert’ — but fraudulent registrations pollute this data, significantly complicating business analytics activities.
* To maximize conversions, consumer businesses especially must minimize friction during the registration process — but lowering barriers for legitimate users also lowers the barriers for abusers.

While authentication (e.g., logging in with a username and password) shows that a user has the credentials that correspond to a particular account, it doesn’t prove that the user is who they say they are — that’s where[ identity proofing](https://auth0.com/blog/what-is-identity-proofing-and-why-does-it-matter/) comes in, by using additional verifications to create a high degree of confidence that your users are who they claim to be.

Here’s how a sign-up flow works when identity proofing is integrated:

* A new user clicks “sign up” on your website
* The sign-up flow calls upon[ the identity-proofing solution](https://marketplace.auth0.com/categories/identity-proofing)
* The identity proofing solution verifies the user’s identity using phone carrier verification
* Customer identity data is captured and collected by the[ CDP](https://marketplace.auth0.com/integrations/tealium)

By making signup fraud much more challenging to commit, identity proofing meaningfully alters the economics for bad actors and, in doing so, protects your customers, your reputation, and the integrity of the data stored in your CDP.

## Protect and Enrich Existing User Accounts

In addition to protecting against signup fraud, incorporating identity proofing into user workflows can also protect against account takeovers (ATO) and enrich user profiles with ‘golden data’ like age and demographic information.

For example:

* A returning user performs some action, like logging in or attempting to update account details
* Due to the perceived risk associated with the action (and perhaps incorporating other risk signals), the identity stack calls upon the identity-proofing solution as a safeguard
* The identity proofing solution validates the user’s identity, ensuring that the activity is not from a bad actor attempting to take over the account; or, if the user is accessing the service via a mobile app, a[ mobile verification integration](https://marketplace.auth0.com/integrations/incognia-authentication) validates the device ID to confirm the user’s identity
* With the user’s identity validated, the action is permitted, and the data associated with the user’s activity is sent to[ the CDP](https://marketplace.auth0.com/integrations/tealium) to build out the profile

Depending upon the risk signals or significance of the action, the identity-proofing solution may employ document scanning (e.g., passport, driver’s license) and cross-validation as the verification mechanism. When this is the case, the CDP can be enriched with information that may not yet be a part of the user’s profile.

![Auth0 Marketplace](https://images.ctfassets.net/23aumh6u8s0i/6U3nuyVYlbcg9i0C36khkU/61a068d638a5ee2753facbcf5924e55c/Marketplace_Partner_Spotlight_Separator_V01A_3x.png)

## Stop Fraudulent Checkouts

The previous examples involve sending data to the CDP, but the CDP data can also be leveraged within the identity flows. For instance, here’s how data from a CDP can combine with an identity-proofing solution to stop a fraudulent checkout:

* A threat actor masquerading as a user logs in, browses products and adds items to the cart
* The CDP collects and stores behavioral data from this session. The data can then be used to help determine that the risk threshold is exceeded — e.g., the total purchase amount exceeds the real customer’s typical habits, or the IP geo-location is outside the real customer’s region, etc.
* The threat actor fails the identity proofing verification, and the purchase is stopped, protecting the customer and the retail brand from the effects of fraudulent purchases

## Reward Your Loyal Customers

Retail brands can suffer reputational harm when resellers buy premium products (e.g., sneaker drops, limited edition collaborations, small batch cosmetics, etc.) only to mark up the price on a third-party marketplace.

By restricting who is able to purchase these products, retailers can reward loyal customers and protect their brand:

* A user logs in
* The CDP provides customer data that can then be used to indicate whether or not the user exceeds a certain ‘loyalty’ threshold (e.g., based on purchase history)
* If a user exceeds the threshold, then the site/service shows them premium offers
* The user adds a premium product to their cart and initiates the checkout
* Identity proofing validates the user’s identity to guard against an account takeover and ensure that the purchaser is a loyal customer

Additionally, the same building blocks can be used to encourage preferred channel adoption. For example, many retailers reserve limited edition products only for users of their mobile app. Web users could be presented with a message saying, “To see promotional offers, please switch to the app.” If the user’s device has already been verified in a past interaction, then the purchase can proceed; otherwise, the identity stack calls a short verification flow. 

Customer lifetime value is rooted in personalized offers, promotions, and pricing, which depend on rich customer profiles stored in CDPs. To build these profiles, brands collect customer data across various channels and systems, with the mobile app being perhaps the most valuable channel.

## A World of Extensions and Opportunities

Extensibility is a core Auth0 principle.[ Our identity platform](https://auth0.com/resources/videos/platform-introduction-video-2020) is designed to be easy to deploy and even easier to tailor to your unique business needs, so you never have to choose between customizability and ease of deployment.

We’re excited about the potential unlocked by the rich ecosystem of third-party integrations, as they allow our customers to continually add new capabilities as needed.

Whether you prefer the pro-code approach of[ Actions](https://auth0.com/docs/customize/actions) or the no-code convenience of Actions Integrations found within[ the Auth0 Marketplace](https://marketplace.auth0.com/), we encourage you to explore the options to see which of your identity and identity-related use cases already have a ready-built solution just waiting to be integrated!

Why Easy Extensibility is an Online Retail Essential

Dan McCorriston

Senior Product Marketing Manager

Auth0’s Actions gives developers customizable, extensible capabilities, as well as low and no-code options.

**TL; DR:** Few developers have expertise in all areas of both technology and business needs. There’s just not enough time, so many look for solutions that let them focus on their core competencies. The Auth0 platform, for example, solves most identification management needs, which frees the developer from learning how to code a CIAM solution from scratch.

But every developer, and their solution, has their own unique set of scenarios they need to solve. They want to have a rapid implementation of an authentication solution yet also provide the capability to build custom code to solve common identity extensibility use cases – like payments, subscription management, or signing terms of services.

Auth0’s Actions toolset - which launched last year - gives developers customizable, extensible capabilities, as well as the option of low and no-code Actions Integrations through the Auth0 Marketplace.

# What’s New

![Auth0 Actions](https://images.ctfassets.net/23aumh6u8s0i/6U3nuyVYlbcg9i0C36khkU/61a068d638a5ee2753facbcf5924e55c/Marketplace_Partner_Spotlight_Separator_V01A_3x.png)

## Marketplace for Private Cloud

Auth0 is excited to announce that the Auth0 Marketplace is now available to our Private Cloud customers. What that means is all Auth0 customers that utilize our Private Cloud product have to access SSO, Social Connections, and Log Streaming Integrations and will soon also be able to access Actions Integrations.

## What is Private Cloud?

Auth0 Private Cloud provides the flexibility and agility offered by cloud deployments but allows a customer to maintain the control and security they need to protect their customers and their businesses. Many customers that have high security and regulatory concerns - those in the financial services industry, for example - may require certain standards of uptimes, updates, failovers, and support for their deployments. The Auth0 Private Cloud deployment models come in both Standard and Managed levels, depending on the customer’s requirements.

Now that Private Cloud customers have access to the Auth0 Marketplace, Ecosystem Partners have a new and expanded pool of potential customers to reach through building and publishing Actions Integrations into the Marketplace. There’s never been a better time to become an Ecosystem Partner and market your Action Integration through the Auth0 Marketplace.

## Wait... There’s More

Auth0 is always delivering more tools, features, and options for developers to give them the support and capabilities they need to customize their customer’s experience through pro-code flexibility. We’re very excited about the latest iteration of our extensibility toolset  - Actions - which will soon be our unifying extensibility toolset, taking over from Rules and Hooks. Actions enable developers to write custom code hosted by Auth0 that extends the behavior of their authentication flows to fit virtually any use case.

Some key features include:

* Version Control which enables you to draft, review, and test custom code and flow configurations within a single user interface.
* Flow editor and Monaco Editor with Syntax Highlighting, giving you the capability to visually drag and drop Actions to build custom identity flows as well as write JavaScript functions with validation, IntelliSense code completion, and type definitions.
* Serverless extensibility so your code is hosted and maintained by Auth0.
* Developers can also look through our catalog of no-code Actions Integrations in the Auth0 Marketplace to help save coding time and expense.

<br>

![Auth0 Actions](https://images.ctfassets.net/23aumh6u8s0i/16QlWAA6ZN2lnMATb3RbMu/3e305e33068ab6a5afb1419500972b4c/Marketplace_Partner_Spotlight_Separator_V01B_3x.png)
<br>

## Why It Matters

Soon, Auth0 will deprecate Rules and Hooks, with Actions being the sole unifying extensibility toolset. The date has not been set, but you can plan ahead and start your migration now. Migrating to Actions is an easy step-by-step process that you can follow along in this [new guide in Docs](https://auth0.com/docs/customize/actions/migrate-from-rules-to-actions) as well as guidance from our [developer community](https://community.auth0.com/t/guide-migrate-your-custom-rules-to-auth0-actions/68915).

Auth0 Actions: Looking Back, What’s Ahead?

darin-laframboise

Expert in Ecosystem strategies. Expert in driving product roadmaps and building long-term growth strategies. Can make quick, data-minded, impact-focused decisions to keep projects on track. Deep background in analytics and data engineering.

Director, Product Management

Darin LaFramboise

Actions Integrations reduce the amount of custom code you need to write, maintain, and update. 

[Actions launched recently](https://auth0.com/blog/actions-now-generally-available/) as the next evolution of extensibility with Auth0, picking up where our legacy extensibility tools Rules and Hooks leave off. Actions unifies the Auth0 extensibility experience in one place. With it, we took the power of Rules and Hooks and created a greatly improved developer experience with features such as an industry-standard VS Code style editor, typescript, draft mode, version control, improved secret management, and an expanded library of NPM modules. Actions gives developers the ability to customize Auth0 using the full spectrum of coding options from pro-code to [low-code](https://auth0.com/blog/what-is-low-code-how-low-code-can-speed-digital-transformation/), with the addition of no-code Actions Integrations.

Actions Integrations, as our new zero-code layer, offers an easy experience to extend Auth0 with partner-built innovations with no coding required. Now you can implement key integrations such as Identity Verification or Consent Management to your workflow without writing or maintaining a single line of code, the provider of the integration takes care of that. To use Actions Integrations, simply install an integration from the Auth0 Marketplace and drag-and-drop it into your Actions workflow. Then with only a few configuration settings, the integration is part of your tenant.

Actions Integrations, currently in Beta, are now available through the [Auth0 Marketplace](https://marketplace.auth0.com/) and in Actions in the Auth0 Dashboard. This marks an essential milestone in how you can leverage innovations from Marketplace Partners into your Customer Identity Access Management (CIAM) workflows. Through Actions and Marketplace, we are creating an ecosystem of sustainable, and ever-growing plug-and-play partner integrations that allows developers to solve many identity extensibility scenarios faster and without extra code.

Pro-Code custom Actions will continue to be a core feature of Auth0, with all the support you’ve come to expect. By adding Actions Integrations to our offerings, we give you the option to replace the custom code for common solutions with no-code integrations and leave the custom code layer for unique use cases to you. This reduces your overall maintenance and risks associated with custom code.

## Plug & Play Extensibility

### Endless innovation, centrally maintained

Satisfy your identity requirements right out-of-the-box without having to write custom code. Actions Integrations are reusable modules that are centrally maintained by a vetted Marketplace Partner. Integrations are designed to be maintained by the Partners with updates propagating automatically to all instances.This results in faster time-to-market while greatly reducing maintenance costs and resource drain associated with code updates that can result in having to rebuild Rules and Hooks.

### Common use cases

Actions Integrations exist for the most common use cases of custom extensibility. These currently include:

*   **ID DataWeb:** Real time and self service global identity verification
*   **Eva:** Second-factor voice biometric 
*   **Scaled Access:** Delegated user access management
*   **One Trust:** Consent and user preferences management
*   **Incognia:** Mobile identity proofing with address verification
*   **Incognia:** Mobile login with location behavioral biometrics
*   **SecZetta:** Real-time, risk-based authentication
*   **Yoonik:** Second-factor facial biometric
*   **Infobip:** Global SMS messaging
*   **Amazon:** Simple Notification Service (SNS) for microservices and serverless applications by Amazon
*   **ClickSend:** Global SMS messaging
*   **Cumul.io:** Self-service data visualization platform
*   **DataGuard:** Consent and user preference management
*   **Esendex: SMS authentication
*   **Mitto:** Global SMS messaging
*   **Plivo:** SMS authentication
*   **Telesign:** Global SMS messaging
*   **Vonage:** Global SMS messaging

<br>

With [Auth0 Marketplace](https://marketplace.auth0.com/), we are building partnerships to deliver innovations that further reduce your need to code features from scratch. After the public launch of Actions Integrations, we will continue to grow our Marketplace catalog, adding more services and modules to help you expand and customize your CIAM implementation.

We encourage you to start using Actions integrations to satisfy any of the common use cases that apply to you. And of course, if you encounter any questions or have any comments, please direct them to our team of identity specialists.

"no-code"