Madhuri

Madhuri is a Senior Engineer at Okta CIC, working in the IAM-Protocols team. The team focuses on building the core identity for the Auth0 product and keeping up to date with the latest industry standards.

Sr Software Engineer

Madhuri Ravindra Mohan

Abbie Carlson

As a Product Marketing Manager, I'm responsible for communicating the value of Identity for consumer apps as well as focusing on the developer experience. I'm forever curious about how Identity plays a role in our everyday lives as consumers and how a great Customer Identity solution can make or break a business through patron loyalty and retention. 

Outside of work can catch me watching Seattle sports, going to as many concerts as I can or listening to true crime podcasts.

Senior Product Marketing Manager

Auth0 now offers the option to choose between two access token profiles: the Auth0 token profile, which remains the default, and RFC 9068.

Imagine if you could charge every single one of your devices with one, single charger.

Your smartphone, the family printer, your kiddo’s tablet, and your work computer. How great would this be? You’d no longer be searching your junk drawer for that one, specific cord.

Similarly, access tokens are the lifeblood of an IAM (Identity and Access Management) infrastructure, impacting gateways, microservices and teams. Consequently, changing access token formats can be costly, time-consuming, and a pain.

This issue led to the IETF standards community brainstorming and then publishing a new standard detailing how to encode and validate an OAuth 2.0 JWT access token. The standardization process, led by Vittorio Bertocci, has been captured in [this insightful blog](https://auth0.com/blog/how-the-jwt-profile-for-oauth-20-access-tokens-became-rfc9068/).

We’re happy to announce that [RFC 9068](https://datatracker.ietf.org/doc/html/rfc9068) is now Generally Available on Auth0 for all customers. We continue to focus on enabling everyone to safely use any technology, and we hope that RFC 9068 supports you and your team’s Identity solutions. Let’s talk about how to use it.

## Access Token Profiles in Auth0

Auth0 now offers the option to choose, on a per-API basis, between two access token profiles: the Auth0 token profile, which remains the default, and RFC 9068. 

Based on the selected access token profile for an API, the format of the generated JWT access token changes. The main differences are:

* The RFC 9068 profile incorporates the jti claim, providing a unique identifier for the JWT.
* The Auth0 profile uses the azp claim to represent the client ID, whereas the RFC 9068 profile uses the client_id claim.
* The RFC 9068 profile does not use the gty claim, which is an Auth0-specific claim that represents the authentication flow.

![Auth0 Access Tokens Documentation](https://images.ctfassets.net/23aumh6u8s0i/6pPIMde7wHJ2Qld3EnJpWk/cb0136c98aae0449623a92abed71ec77/Uploaded_from_JWT_Access_Token_Profile_-_Community_blog)
_Image snapshot of how tokens of two different profiles look, highlighting the difference. To learn more, please refer to [Auth0 Access Tokens Documentation](https://auth0.com/docs/secure/tokens/access-tokens/access-token-profiles)._

Adopting the RFC 9068 profile offers several advantages. Your Auth0 access tokens will be directly interoperable with API gateways and servers that follow the standard, eliminating the need for custom token validation. This flexibility facilitates changing Identity Providers if you need to at some point. Additionally, you can leverage SDKs and tools that support RFC 9068, aligning with well-vetted Identity standards and evolving best practices.

## Generate a RFC 9068-Compliant Access Token

The RFC 9068 token profile is Generally Available and supported across all tenants and plans.
You can generate an RFC 9068-compliant access token using the same process as obtaining any access token: create a client, configure an API, and request a token.

To create a client, you can simply follow the normal process as explained in our [Get Started guide](https://auth0.com/docs/get-started/auth0-overview/create-applications). The RFC 9068 profile works for all application types and grant-types.

### Configure an API

Go to [Dashboard > Applications > APIs](https://manage.auth0.com/#/apis), and select **+ Create API**.

The **JSON Web Token (JWT) Profile** field determines the format of the API access tokens issued. The available values are Auth0 and RFC 9068.

![API creation](https://images.ctfassets.net/23aumh6u8s0i/2gT2erLX8IsL6kQkBpw4Br/153a7c9e338603a7fce90c9900a37899/Uploaded_from_JWT_Access_Token_Profile_-_Community_blog)  
_Image snapshot of the API creation page where the user can configure an access token profile. To learn more, refer to [Register APIs](https://auth0.com/docs/get-started/auth0-overview/set-up-apis)_

### Get an access token

As an example, let's see how you can request an access token with client_credentials grant via cURL:

```
curl --request POST \
     --url https://YOUR_AUTH0_DOMAIN/oauth/token \
     --header 'content-type: application/json' \
     --data '{"client_id":"YOUR_CLIENT_ID","client_secret":"YOUR_CLIENT_SECRET","audience":"https://your-api-endpoint","grant_type":"client_credentials"}'
```

Replace the placeholders `YOUR_AUTH0_DOMAIN`, `YOUR_CLIENT_ID`, and `YOUR_CLIENT_SECRET` with the respective values from your client configuration.

This request generates a response as the following:

```
{ 
   "access_token":"eyJhbGciOiJSUzI1NiIsInR5cCI6Im...",
   "scope":"read:blogs",
   "expires_in":86400,
   "token_type":"Bearer"
}
```

The generated access_token will be RFC 9068 compatible. 

This works for all grant-types for the API. Simply follow the normal flow of a grant-type and you will get RFC 9068 compliant access tokens. Easy!

![RFC 9068-compatible access token](https://images.ctfassets.net/23aumh6u8s0i/3A1b8A9PPlJMP7DU5TDwRp/c6d7282fc62b5ec56ba8f29149e235ec/Uploaded_from_JWT_Access_Token_Profile_-_Community_blog)
_Image snapshot of a RFC 9068-compatible access token generated using a `client_credentials` grant type_

## An Ode to the Great...

Now, this post wouldn’t be complete without taking some time to acknowledge the brains behind RFC 9068, Vittorio Bertocci. 

Vittorio was and will continue to be a titan of the Identity industry. Not only was Vittorio a luminary genius in his own right, but he was a funny, witty and authentic human being. His legacy will forever be woven into the work we, and our fellow Identity friends, create for the next years, decades, and beyond. (To read a bit more about our beloved Vittorio, take a look at our celebratory blog about his life [here](https://auth0.com/blog/in-celebration-of-vittorio-bertocci/)). 

![Vittorio’s](https://images.ctfassets.net/23aumh6u8s0i/3kJu2VorZXI0DBWP7kzRPC/60c662efc764cd30c069639bf6748af4/Uploaded_from_JWT_Access_Token_Profile_-_Community_blog)

To continue Vittorio’s legacy and his passion for giving back to the community, we’d love to share two causes that were incredibly important to Vittorio:

- [Questbridge](https://www.questbridge.org/donate): providing higher education to lower income students.
- [Pancan](https://pancan.org/ways-to-give/): pancreatic cancer research.

JWT Access Tokens Profiles, Now in GA

Calah Vargas

Calah Vargas is the Associate Manager of Product Led Growth, focusing on nonprofits, startups, and partnerships. She works on product marketing and customer marketing initiatives. Outside work, you can find her cooking, trying new restaurants, and traveling with friends and family.

Associate Manager, PLG

Upgrading made easy: from in-house authentication to modern login flows, flexible user profiles, and the convenience and security of passkey

Imagine you’re working on a monolithic application that includes a home-grown authentication system. Over the years, the authentication function has received upgrades here and there to improve security and to stay reasonably up-to-date in a changing world.

Sooner or later — perhaps triggered by considering different growth paths and how best to make use of developer time — you start to recognize that your in-house Identity stack is a limiting factor:

* Integrating with partners and other technology components requires custom work
* Maintenance obligations are distracting from work on your core app
* Meeting regulatory requirements for privacy is an ongoing challenge 
* Providing different access privileges to different types of end users is becoming more complicated than ever anticipated
* With every breach headline, you’re reminded of the constant need to strengthen security

Shopper Approved found themselves in a similar situation — in 2017, the company’s ambitions were outgrowing the home-grown Customer Identity capabilities of their monolithic PHP app.

With that realization, the search was for a third-party authentication solution.

# Why Shopper Approved chose Auth0 by Okta 

Since its launch in 2010, [Shopper Approved](https://www.shopperapproved.com/) has helped over 20,000 eCommerce brands — from mom-and-pop shops to global enterprises — generate more online trust, visibility, and conversions.

> “We knew we wanted to replace our login and authentication mechanism, and we needed a solution that would ‘tango’ with our [Laravel](https://laravel.com/) front-end templating engine,” Christopher Budge, Shopper Approved’s CTO recalled, “but we didn't know which direction we wanted to go in.”

<include src="QuoteCard" body="The Self-Service pricing was really attractive to us. The other providers that we found were prohibitively expensive for what was initially an experimental project, and not a lot of them had the adaptability that we needed to integrate into our existing application." name="Christopher Budge" title="CTO" team="" company="Shopper Approved" />

While searching online for ideas and options, Budge came across Auth0 — and, in particular, the Self-Service plans.

> “The other providers that we found were prohibitively expensive for what was initially an experimental project, and not a lot of them had the adaptability that we needed to integrate into our existing application.”

The Self-Service option gave Budge and the wider team plenty of time to perform due diligence. “_We looked for a long time before ultimately deciding upon Auth0,_” he shared. “_The more I dug into it, the better it looked._”

The ability to explore the solution in a hands-on manner, without a commitment, helped the team to make an informed choice. Budge explained that:

<include src="QuoteCard" body="I got together with our technical lead and programming contractor, and they started playing with it — and then they said, 'Yeah, we think this is going to work." name="Christopher Budge" title="CTO" team="" company="Shopper Approved" />

While every organization’s Identity journey is unique, here’s how Shopper Approved implemented Auth0.

## Migrating Users from the Legacy System to Auth0	

No matter how much preparation is done, a migration is always a nervy thing. As it turns out, those nerves were unnecessary — Shopper Approved’s migration from their legacy, home-grown authentication system to Auth0 went off without a hitch.

Budge recalled, “_We weren't sure how well our system would adapt to having its old authentication system ripped out and something new put in its place, but the migration actually exceeded expectations. Within 24 hours, we were able to ingest our entire user database into Auth0 and have them set up as users able to log in._”

However, migrating users was simply the foundation for modernizing the experience for Shopper Approved’s customers, with Budge adding, “_The universal login allows for such a smooth application login and flow. And our marketing team has really appreciated the customization and branding options that allow us to deliver a better customer experience._”

### Letting quickstarts guide the way

One of the first things Budge’s team did was explore Auth0’s step-by-step [quickstart guides](https://auth0.com/docs/quickstarts) to get a feel for the overall migration process.

“The quickstart guides were dead easy. Plus, between your host documentation and the notes in GitHub, it’s really, really easy as a developer to figure out ‘where am I and where do I need to go?’” and ‘What’s next?’”

![quickstarts](https://images.ctfassets.net/23aumh6u8s0i/58lZcrqemW0dCDEIrlLxef/fd17a831afcbbe647abd73d3420e9d95/01-migration.png)

### Leveraging SDKs

SDKs reduce the developer effort required to implement specific use cases, and Budge’s team found exactly what they needed among Auth0’s 40+ SDK libraries.

“Your SDKs are written really well, and your APIs are documented really well. So, code-wise, it’s extremely easy to interact with the platform — you can get going and don’t really have to think hard about it.”

![SDKs](https://images.ctfassets.net/23aumh6u8s0i/1cSZQDXlQ1VDHD7RFG71vu/6922a4a4409f3bab6453b7b48f12541e/02-migration.png)

## Building User Profiles

User data can come from many sources, including your own databases as well as social, legal, and enterprise identity providers. Some examples include Google, Facebook, Active Directory, and SAML.

In Shopper Approved’s case, there was an added complication — practically every user profile that had ever been created in their system still existed, and collectively, many of these profiles had inconsistent and incomplete data. But, perhaps counterintuitively, the upgrade actually presented an opportunity to clean up the user database. Budge’s migration script identified existing user records that were poorly formatted, allowing the team to quickly correct any issues — ultimately improving the overall structure of the company’s user data and laying a strong foundation for efficient scalability.

“The way your user profiles are set up — they’re just really easy to understand, manipulate, and customize. The data structure was easy to map to what we had and what we needed.” Maybe even more importantly, Budge recalled that “It just worked. When we were playing around with it, we saw that it does exactly what [your documentation](https://auth0.com/docs/manage-users/user-accounts/user-profiles) says it does.”

![User Profiles](https://images.ctfassets.net/23aumh6u8s0i/3EfvAVkkj9Ornz9JcTH5CJ/1783bd310eb0cd0722dbbe754aa606c4/03-migration.png)

## Innovating With Identity: Exploring Passkeys

The Identity domain is always evolving, with new specifications, standards, and [regulatory requirements](https://auth0.com/security) frequently appearing.

Unsurprisingly, one of the reasons why Budge was so eager to introduce a leading off-the-shelf solution was that it would allow the company to keep pace with these changes — while at the same time allowing the team to apply their finite resources on their core value proposition. In short, he knew that choosing Auth0 meant that Shopper Approved’s CIAM needs would be met today, tomorrow, and as far into the future as he could imagine.

Like many CTOs, Budge had closely been following [passkeys](https://learnpasskeys.io/) — FIDO credentials that are discoverable by browsers or housed within native applications to enable — and was excited by their potential to provide [a highly secure and very convenient user authentication experience](https://auth0.com/blog/webauthn-and-passkeys-for-developers/).

> “I’ve been watching passkeys for a long time, and — literally the day I got [the announcement that they were available](https://auth0.com/blog/activate-passkeys-let-users-log-in-without-password/) — I jumped right in. We really enjoyed rolling them out early to our organization, and we’ve had zero issues. And it’s great that we didn’t have to build passkey support ourselves!”
> _Christopher Budge_

![Passkeys](https://images.ctfassets.net/23aumh6u8s0i/3qOGVNCBexcnp5LqxkAcNB/7a0c5eaa7bdb2cd37987795f7a504712/passkeys.png)

## Enjoying Ongoing Value

Budge’s hopes for lower support and maintenance obligations have come to fruition. “We have not had to spend a single development hour at all on user authentication and login — it's never failed, and it's never broken.”

Similarly, the upgraded security is evident. 

> “We've had many security researchers and penetration testers try to break in. Every time they run smack-dab into Auth0.”

<include src="QuoteCard" body="We have not had to spend a single development hour at all on user authentication and login — it's never failed, and it's never broken." name="Christopher Budge" title="CTO" team="" company="Shopper Approved" />

### Get started in minutes — for free — with no humans (other than yourself) required!

We’ve always tried to make things less complex for developers, which is why [our Self-Service plans](https://auth0.com/pricing) allow you to create a trial account with nothing more than an email address. During your 22-day trial period, you can create a simple app, configure its look and behavior, and explore the Auth0 solution in detail — giving you plenty of time to really get your hands dirty.

![Get started](https://images.ctfassets.net/23aumh6u8s0i/3s3e2u6XsF3BitzYgE3TpY/1097a71343e41a488444684c12c2c248/identity_journey.png)

Plus, anyone using our products can take advantage of resources including [quickstarts](https://auth0.com/docs/quickstarts), [40+ SDKs](https://auth0.com/docs/libraries), [detailed guides](https://developer.auth0.com/resources/guides/web-app/nextjs/saas-basic-authentication), and [extensive (but easy-to-follow) documentation](https://auth0.com/docs/articles) to help get started and implement a strong Customer Identity function.

In fact, with only a few lines of code, you can have Auth0 integrated into any app, written in any language, and in any framework.

[Try for free](https://auth0.com/signup?utm_source=whitepaper&utm_medium=auth0&utm_campaign=whyauth0) and see for yourself.


A Customer Identity Migration Journey

Samuel Frank

Sam Frank is Auth0's Sr. Product Manager for new initiatives. He works within the Auth0 Lab to commercialize the team's new ideas so they're available for builders everywhere. As a former platform product manager and startup product lead, he knows the challenges that developers face when creating new apps and he leverages those experiences to focus our teams efforts delivering the next generation of identity tools.

Senior Product Manager

The Customer Identity Cloud platform can now reference NFTs as profile data and as a means to grant access.

The [Auth0 Lab team](http://labs.auth0.com/) has released a pair of [Marketplace integrations](https://auth0.com/marketplace) bringing more [Web3 capabilities](https://marketplace.auth0.com/categories/web3) to the Okta Customer Identity Cloud ecosystem. As the Web3 ecosystem matures, we’re finding that on-chain data, like NFTs (non-fungible tokens), can be used in the identity ecosystem. 

[Our integration](https://marketplace.auth0.com/integrations/auth-0-inc-fetch-nfts) is a simple NFT fetch [Action](https://auth0.com/docs/customize/actions) that retrieves a list of NFTs the user owns. With them, you can make all sorts of IAM-based decisions. If you’re interested in the Auth0 Lab team’s continued Web3 research, come join the conversation on [Twitter](https://twitter.com/Auth0Lab) and [Discord](https://discord.gg/xkbkz9rZcD).

## NFTs in Identity and Access Management (IAM)

By now, you’ve probably heard of NFTs. If not, here [is a helpful explainer](https://www.nytimes.com/interactive/2022/03/18/technology/nft-guide.html). At their core, NFTs are digitally transferable tokens. Tokens have a long history in identity and access management. They are the keystone of authorization in many apps, primarily through the issuance of [JSON web tokens](https://jwt.io/). 

NFTs could be a big extension to token-based IAM. NFTs are flexible, secure, and easily transferable by their nature of using blockchain consensus algorithms to establish ownership and transference. Like with cryptocurrencies, only a specific private key in a wallet can prove ownership. They can help organizations manage capacity problems because you can limit the number of NFTs you mint. This scarcity helps manage supply while still allowing for a robust secondary market. This makes them ideal for ticketed events and venues, like stadiums, trains, and other physically limited spaces.

One of the biggest barriers to mainstream NFT adoption is the usability hurdle of working with blockchains. With our latest integrations, Auth0 Lab seeks to make it easy. Developers can query a user’s NFTs and incorporate them as identity data in their applications, even controlling access based on a user’s ownership of an NFT. We’re excited to see how developers use these new tools when implementing web3 functionality into their applications.

## Token Gating

[Token Gating](https://tokenizedhq.com/token-gating/) is the practice of managing access to resources based on a user’s Web3 NFTs. Notable examples include [‘members only’ communities](https://rarible.com/blog/9-membership-nfts/) of NFT collectors. This exclusivity extends to video games like [Alien Worlds](https://alienworlds.io/), the [largest web3 game](https://www.statista.com/statistics/1266486/blockchain-games-user-number/) at the end of 2022. NFTs are central to the game and unlock certain content, or game locations are only accessible with specific NFTs. [TravelX](https://travelx.io/) is working on another use case around airline tickets.

Token gating is interesting because of the openness of the attestation. Instead of IAM data being stored on a proprietary server, it’s on a public blockchain for anyone to use and see. We’re just witnessing the first experiments in how that data is used. 

## EVM Compatible, Open Source Coming Soon

The current integration works on all [Ethereum virtual machine (EVM) compatible](https://gocrypto.com/en/what-are-evm-compatible-blockchains/) blockchains. This means you’ll have access to NFTs available on some of the largest NFT marketplaces like [OpenSea](https://opensea.io/). You’ll be able to pull from [Ethereum](https://ethereum.org/en/), [Polygon](https://polygon.technology/), [Avalanche](https://www.avax.network/), [Binance Smart Chain](https://www.bnbchain.org/en), and others. EVM blockchains are the oldest programmable blockchains, and the ecosystem is well supported.

The Auth0 Lab team is working on open-source the code so it can be modified and moved to other blockchain platforms. That process takes some time, so keep an eye out by following us on [Twitter](https://twitter.com/Auth0Lab) or heading to our [GitHub organization](https://github.com/auth0-lab) and give it a follow.

## Unlocking NFTs for Your Application

### How it Works

The Auth0 Lab [fetch-nfts integration](https://marketplace.auth0.com/integrations/auth-0-inc-fetch-nfts) works by relying on a few other pieces of infrastructure.

1. It utilizes the [Sign in with Ethereum integration](https://auth0.com/blog/sign-in-with-ethereum-siwe-now-available-on-auth0/) that SpruceID released in the Auth0 Marketplace in 2022. This allows the integration to grab a public blockchain address for the user, which is critical to querying an NFT smart contract to know if they own an NFT. If a user logs in with a method other than Sign in with Ethereum, NFTs won’t be fetched.
2. During [setup and configuration](https://marketplace.auth0.com/integrations/auth-0-inc-fetch-nfts?tab=install), specify a list of NFT contracts that you’d like the [Auth0 Actions](https://auth0.com/actions) code to query. You’ll also need to specify an API key for [The Graph](https://thegraph.com/en/), a service that queries blockchain data.
3. With a public key in hand, and a list of NFT contracts to search, the Actions code calls out to The Graph’s APIs to query the necessary NFT contracts. It returns a list of caip-22 asset references that your Action adds to the [ID token](https://auth0.com/docs/secure/tokens/id-tokens) as claims.
4. From there, you can utilize the data in your application to make any decision, like token gating access, that you feel necessary!

### Installation

Check out our [installation](https://marketplace.auth0.com/integrations/auth-0-inc-fetch-nfts?tab=install) guide to get started!

## What’s Next?

The Auth0 Lab team is actively exploring the best ways to enable developers to build applications that rely on Web3 identity constructs and help bridge the Web2 and Web3 worlds. You can follow our progress on [Twitter](https://twitter.com/auth0lab). If you’re interested in speaking with the team, join our [Discord](https://discord.gg/xkbkz9rZcD) and start a thread.

The [Auth0 Marketplace](https://marketplace.auth0.com/) is looking for Web3 partners to build new extensions onto Auth0. Visit [https://auth0.com/integrate](https://auth0.com/integrate) to learn more.

Web3 NFTs for Identity and Access Control, Now Available on Marketplace

Damian Schenkelman

Damian was one of Auth0's earliest employees. He loves building products for developers and taking things from 0 to 1.
<br><br>
He played key roles in implementing product features and growing the engineering organization in the early stages, and later on defining Auth0's architecture for scale and creating new products. Today he helps shape Auth0's long term strategy and leads Auth0Lab, a small and amazing team doing research and development of forward-looking products.
<br><br>
He spends his spare time with family, and friends, exercising, and catching up on all things NBA.

VP R&D (Auth0Lab)

ENS and Auth0 Lab are partnering to seamlessly make ENS profile data available to application developers

The [Ethereum](https://ethereum.org/en/) network is a popular programmable blockchain; its ecosystem is the one where a lot of active software development is happening. To identify user accounts across the blockchain, Ethereum uses [addresses](https://ethereum.org/en/developers/docs/accounts/). Since its inception in 2015, it has grown to over 198 million [unique addresses](https://etherscan.io/chart/address) and 450 thousand [daily active addresses](https://etherscan.io/chart/active-address) at the time of writing. A big reason for its popularity is that Ethereum allows developers to create and manipulate constructs beyond the network's built-in cryptocurrency ([Ether](https://ethereum.org/en/developers/docs/intro-to-ether/)).

![Graphic 01](https://images.ctfassets.net/23aumh6u8s0i/30tKSg9BZ3iQxWmOV2a85G/2a6879311b5dda35abaaf566f6bd84a5/01-fetch-ens-post.png)

![Graphic 02](https://images.ctfassets.net/23aumh6u8s0i/76xsHVURfZ2bOHIKdfxN1A/d5fb9b92669d3b8493212f24d7837f79/02-fetch-ens-post.png.png)

The problem with these addresses is that while they are very machine friendly, they are not very user friendly. An address is a 42-character hexadecimal string, e.g., `0x06012c8cf97bead5deae237070f9587f8e7a266d`. They are not easy to remember and are long and complicated, making it easy to input them incorrectly.

## Enter ENS

In 2016 Nick Johnson [proposed](https://eips.ethereum.org/EIPS/eip-137) creating the Ethereum Name Service (ENS) constructed to solve the aforementioned problems with Ethereum addresses. ENS was presented as a service that _"provides flexible resolution of short, human-readable names to service and resource identifiers"_. Now, [ENS](https://ens.domains/) is a leading decentralized naming system based on the [Ethereum blockchain](https://ethereum.org/en/developers/docs/intro-to-ethereum/). At the time of writing, it has nearly two million registered names, owned by hundreds of thousands of owners. 

ENS maps human-readable names like `alice.eth` to machine-readable identifiers such as Ethereum addresses, providing Web3 usernames. Moreover, it allows users to choose what data, like "avatar" and "email", they want to make available as part of their public, portable profile. This profile can serve as the record for any number of dapps, and now Web2 apps as well.

![Avatar](https://images.ctfassets.net/23aumh6u8s0i/7pV4xMlvqW2SPbnTyQvQoh/c40e753d90f4439ef8751bf10d146ebd/03-fetch-ens-post.png.png)

Using the [ENS Profile integration](https://marketplace.auth0.com/integrations/ens-profile) from the [Auth0 Marketplace](http://marketplace.auth0.com/), when a user [signs in with Ethereum](https://auth0.com/blog/sign-in-with-ethereum-siwe-now-available-on-auth0/), Auth0 will fetch the ENS profile data from the Ethereum network and make it available as [ID Token](https://auth0.com/docs/secure/tokens/id-tokens) claims. That enables you to develop applications leveraging users' ENS profiles and update your application logic to communicate with the Ethereum blockchain.

## Reap the Benefits

The **ENS Profile** integration has several benefits for both developers and end-users:

* **Leverage public user profiles:** As a developer, you can use any ENS record as part of your application. That allows you to support user profile-related functionality without implementing [CRUD](https://en.wikipedia.org/wiki/Create,_read,_update_and_delete) logic and UI for it.
* **Reduce user friction:** Users often dislike having to spend time re-creating profiles for each application. Once users configure the appropriate [ENS profile records](https://docs.ens.domains/ens-improvement-proposals/ensip-5-text-records), you can display user-friendly usernames and profile pictures and automatically send emails to them. Users will not need to re-enter their profile data into the application, improving the user experience.  
* **Seamlessly integrate with a growing ecosystem:** **ENS Profile** requires minimal changes to your code and allows your application to take advantage of Web3 constructs and its user base. User profile data from ENS is available in ID Tokens. Having ENS data in the ID Token means you don't need to update your application with dependencies and logic that retrieves ENS profile data from the Ethereum network. Instead, Auth0 and the **ENS Profile** integration abstract that from you, allowing you to integrate with Web3 constructs in your application with minimal friction.

The following shows how an application might display the ENS name and avatar (bottom-left corner) after a user signs in:

![ENS](https://images.ctfassets.net/23aumh6u8s0i/5J4W3iSTYSDT3uV8oFzOjr/c213868a315a8fc2d0d7c22635508518/04-fetch-ens-post.png.jpg)

## How It Works

The integration needs the user's Ethereum address to fetch data from ENS, and developers must have the [Sign-in with Ethereum](https://auth0.com/blog/sign-in-with-ethereum-siwe-now-available-on-auth0/) integration installed to use **ENS Profile**.

When users sign in with Ethereum, the integration will query their ENS profile. The integration retrieves ENS data from the Ethereum network through one or more providers. These providers expose APIs, so you don't have to connect directly to the Ethereum network to read data from it, providing ease of use. For your flexibility, the **ENS Profile** integration supports any of these providers:

* [Infura](https://infura.io/product/ethereum)
* [Pocket](https://www.pokt.network/pocket-gateway-ethereum-mainnet)
* [Ankr](https://www.ankr.com/protocol/public/)
* [Alchemy](https://www.alchemy.com/supernode)
* [Etherscan](https://etherscan.io/apis)
* [Cloudflare](https://developers.cloudflare.com/web3/ethereum-gateway/)

After retrieving the profile data, the integration will add it to the ID Token that is issued as part of the user login flow. The following [ENS records](https://docs.ens.domains/ens-improvement-proposals/ensip-5-text-records) will be available as ID Token claims ([namespaced](https://auth0.com/docs/secure/tokens/json-web-tokens/create-namespaced-custom-claims) with `https://ens.eth` to avoid collisions):

* `https://ens.eth/name (the domain name)`
* `https://ens.eth/email`
* `https://ens.eth/description`
* `https://ens.eth/url`
* `https://ens.eth/notice`
* `https://ens.eth/keywords`
* `https://ens.eth/com.github`
* `https://ens.eth/com.peepeth`
* `https://ens.eth/com.linkedin`
* `https://ens.eth/com.twitter`
* `https://ens.eth/io.keybase`
* `https://ens.eth/org.telegram`
* `https://ens.eth/avatar`
* `https://ens.eth/content`

The following is one example of an ID Token payload that is available after installing the integration:

```
{
  "https://ens.eth/email": "jane.doe@example.com",
  "https://ens.eth/url": "https://twitter.com/janedoe",
  "https://ens.eth/com.github": "https://github.com/janedoe",
  "https://ens.eth/com.twitter": "https://twitter.com/janedoe",
  "https://ens.eth/avatar": "https://www.gravatar.com/avatar/e2a7e0fbfb2c1d9aeb01fd03648da78e?s=256&d=identicon&r=PG",
  "nickname": "janedoe.eth",
  "name": "",
  "picture": "https://s.gravatar.com/avatar/e2a7e0fbfb2c1d9aeb01fd03648da78e?s=480&r=pg&d=https%3A%2F%2Fcdn.auth0.com%2Favatars%2Fjd.png",
  "updated_at": "2022-06-09T17:11:37.685Z",
  "iss": "https://test-issuer.us.auth0.com/",
  "sub": "oauth2|siwe|eip155%3A1%3A0xde399eB33C579feeB87737B4D44932778C00FBcD",
  "aud": "k5bD0kOBesIwHzL0LVojBcn1DQnPiQD6",
  "iat": 1654794700,
  "exp": 1654830700,
  "auth_time": 1654794697
}
```

That's it. You will be able to use any of the ENS related token claims as part of your application logic just like you have been doing so far.

We can't wait to see what you build with this!

## What's Next?

The Auth0 Lab team is actively exploring the best ways to enable developers to build applications that rely on Web3 identity constructs and help bridge the Web2 and Web3 worlds. You can follow our progress on [Twitter](https://twitter.com/auth0lab). If you're interested in speaking with the team, join our [Discord](https://discord.gg/xkbkz9rZcD) and start a thread.

The [Auth0 Marketplace](https://marketplace.auth0.com/) is looking for Web3 partners to build new extensions onto Auth0. Visit [https://auth0.com/integrate](https://auth0.com/integrate) to learn more.



Fetch ENS profile data using Auth0

joey devilla headshot 900px

I’m a Senior Developer Advocate at Auth0, and I like to work on various technologies. I’ve developed software for all sorts of platforms, from CD-ROM and the PalmPilot to my current area of focus, mobile phones, IoT devices, and AI. When I’m not looking for strange new platforms to write software for, I’m playing a strange old instrument — the accordion!

Senior Developer Advocate

Joey deVilla

Learn how to use user and app metadata in Auth0 user profiles to store additional information about your users.

Working with Auth0 User and App Metadata in iOS Apps

Working with Auth0 User and App Metadata in Android Apps

Learn how to implement login, logout, and user profiles in Android apps using Kotlin and Auth0.

Get Started with Android Authentication Using Kotlin: Part 2

Get Started with Android Authentication Using Kotlin: Part 1

Learn about the three kinds of information stored with each Auth0 user account and how to access them in your Android apps.

Working with Auth0 User Profile Information and Metadata in Android Apps

Vittorio

Vittorio Bertocci is a Principal Architect for Auth0. Before Auth0, he had a lengthy career with Microsoft, where Vittorio worked with Fortune 100 and Global 100 companies, including working on Microsoft’s Azure Active Directory team as principal program manager focusing on the developer experience. He contributed to the inception and launch of Microsoft's claims-based platform components (Windows Identity Foundation and ADFS, ADAL and MSAL SDKs, ASP.NET middleware). Vittorio is a well known speaker, educator and published author.

Principal Architect

Vittorio Bertocci

A first-person account of how modern open identity standards are made

From Idea to Standard: How the JWT Profile for OAuth 2.0 Access Tokens Became RFC9068

JWT Profile for OAuth 2.0 Access Tokens with Vittorio Bertocci

## The Overview

In this episode of _Identity, Unlocked_, the CTO and co-founder of Auth0, Matias Woloski, appears as acting host and interviews Vittorio Bertocci, principal architect at Auth0 and the regular host of _Identity, Unlocked_, on the JWT profiles for OAuth2 access tokens specification. 

This spec describes how to encode OAuth2 access tokens in use JWT format in an interoperable way, by giving a minimal list of claims, how to emit a JWT depending on specific aspects of the request, and most importantly, describes how to validate an incoming token based on very specific rules. The document also features sections on security and privacy, highlighting common pitfalls and suggesting ways to prevent and minimize issues.

Vittorio walks Matias through the creation process of this spec, beginning with recognizing that, despite encoding access tokens in JWT was common practice across the industry, there was no guidance on how to do so in any existing standard. After gathering examples of JWT access tokens issued by several different identity products and services, Vittorio presented the general idea for this new spec at the [2019 OAuth Security Workshop](https://osw2019.sec.uni-stuttgart.de/). After receiving interest, he proceeded to produce and propose an internet draft at [IETF104](https://datatracker.ietf.org/meeting/104/materials/slides-104-oauth-sessa-jwt-profile-for-access-token-00).

Once the spec was adopted as an official working group item, the workgroup provided an overflow of feedback and the discussions went into much greater and productive detail. While not every interaction in the workgroup is going to be worthwhile or a game changer, Vittorio explains that the working group process is key for producing high quality, widely applicable documents that have been vetted for security and correctness by some of the best experts in the industry. The [specification document ](https://tools.ietf.org/html/draft-ietf-oauth-access-token-jwt-12)has now been approved and submitted for IESG publication, one step closer to reaching the status of the official standard.  

Matias and Vittorio speak further about how using this spec JWT profile tokens will make it possible to develop truly interoperable SDKs, allowing developers more time to devote on creating their apps, rather than focusing on low-level implementation differences. Vittorio also hopes this spec will stop the use of ID tokens in place of access tokens, streamline the code required to handle authorization, and help to keep privacy considerations into account when designing API solutions.

The episode closes with a call for action. The work of identity standards groups touches everyone in our industry, but not everyone is represented. Participation is easier than ever, and contributions are welcome - Vittorio encourages reaching out to him for help, extending an invitation to anyone who would like to take part in the process but don’t know where to start.

## Key Takeaways

What is the JWT profile spec, in a nutshell:

<iframe width="100%" height="230px" scrolling="no" style="border: none" src="https://identityunlocked.auth0.com/player/c4eb1494"></iframe>

How a spec evolves from an idea:

<iframe width="100%" height="230px" scrolling="no" style="border: none" src="https://identityunlocked.auth0.com/player/226f297c"></iframe>

The JWT profiles for OAuth2 access tokens spec through the workgroup process:

<iframe width="100%" height="230px" scrolling="no" style="border: none" src="https://identityunlocked.auth0.com/player/9a3722e2"></iframe>

Vittorio explains the potential advantages of this JWT spec:

<iframe width="100%" height="230px" scrolling="no" style="border: none" src="https://identityunlocked.auth0.com/player/f870c54e"></iframe>

Vittorio’s Call to Action: 

<iframe width="100%" height="230px" scrolling="no" style="border: none" src="https://identityunlocked.auth0.com/player/56147e11"></iframe>

### Links/Resources:

- Connect with Matias Woloski on [LinkedIn](https://www.linkedin.com/in/matiaswoloski/)
- Connect with Matias Woloski on [Twitter](https://twitter.com/woloski)

<br>

- Connect with Vittorio Bertocci on [LinkedIn](https://www.linkedin.com/in/vittoriobertocci/)
- Connect with Vittorio Bertocci on [Twitter](http://www.twitter.com/vibronet)

<br>

- Learn more about [Identity, Unlocked](https://identityunlocked.auth0.com/public/49/Identity%2C-Unlocked.--bed7fada/episodes)
- Learn more about [Auth0](https://auth0.com/)
- Learn more about the sponsor for this season, the [OpenID Foundation](https://openid.net/foundation/)

<include src="asides/IdentityUnlocked" />

<include src="asides/AboutAuth0" />

Identity, Unlocked... Explained: Season 2, Ep 8

kapehe-jorgenson

Kapehe is an R&D Content Engineer for Auth0 with a passion for learning and teaching. With her primary focus on ReactJS and JavaScript, she is impressed with what code can create for the web. Technology and web development are constantly evolving and naturally bring that need for continual learning. She enjoys writing tutorials, hosting local meetups, and learning with others to expand coding knowledge.

R&D Content Engineer

Kapehe Jorgenson

See how quick it is to add the user's country and time zone to user data using Auth0 Rules



Ready for a quick bite of information?

In this article, we will talk about Auth0 Rules and how awesome they are in adding specific log in allowances, restrictions, or extra functionality.

We will be focusing specifically on the rule that adds the user's country and time zone to their profile information. That way, we can see where our users are logging in from and how much of a global impact our application is having!

> The use case and need for this specific rule is dependant on the application.

## But What is an Auth0 Rule?

[Auth0 Rules](https://auth0.com/docs/rules) allow us to add specific "rules" to our application quickly. By flipping a switch in our Auth0 Dashboard, we could set user roles, turn on multi-factor authentication (MFA), or force email verification.

Let's set one up!

> Already have an app set up with Auth0 authentication? Go ahead and skip to the "Auth0 Rules" section of this article!

<include src="TweetQuote" quoteText="Auth0 Rules allow us to add specific rules to our application quickly!"/>

## Grabbing an App

Let's set up an application. For our example today, we will be using [this GitHub Repo](https://github.com/auth0-blog/vue-events-auth) from [this article](https://auth0.com/blog/beginner-vuejs-tutorial-with-user-login/) on authenticating a Vue app.

Run the following commands in the terminal to `clone` and `cd` into the project:

```bash
git clone https://github.com/auth0-blog/vue-events-auth.git
```

```bash
cd vue-events-auth
```

Now that we are in our Vue application, let's go set up our Auth0 app! Don't worry, we'll come back to this app!

> Auth0 Rules can be used anywhere an Auth0 application is being used.

## Setting up Auth0

To begin, we will need an Auth0 account. We can sign up for a <a href="https://auth0.com/signup" data-amp-replace="CLIENT_ID" data-amp-addparams="anonId=CLIENT_ID(cid-scope-cookie-fallback-name)">free Auth0 account here</a>. Once we are logged in, follow these steps to set up an Auth0 application:

1. Go to the [**Auth0 Dashboard**](https://manage.auth0.com/#/) and click the "+ CREATE APPLICATION" button.
2. Name the new app and select "Single Page Web Applications". Hit "Create".
3. In the **Settings** for the new Auth0 application, add `http://localhost:8080` to the **Allowed Callback URLs**, **Allowed Logout URLs**, **Allowed Web Origins**. 
4. Hit "Save Changes" at the bottom of the page.

## Linking the Auth0 Application to our Vue Application

Next, let's return to our application, and we'll do the following steps:

- Install dependencies: `npm install`
- Create a new file in the root of the project: `auth_config.json`
- Input the following code and update it to be your specific credentials:

```json
{
  "domain": "your-domain.auth0.com",
  "clientId": "yourclientid"
}
```

These values can be found in your "Settings" tab of the Auth0 Application we just created earlier!

- To start the app: `npm run serve`
- View the app: [http://localhost:8080](http://localhost:8080)

We should now see this!

![Initial view of the Vue app home page](https://images.ctfassets.net/23aumh6u8s0i/1KwQetS3dUWYpj4GZOETEO/0a12b9796a12a24cd0ecc9b2c59f98e1/app-view-tiny)

## Auth0 Rules

Let's head back to our [Auth0 Dashboard](https://manage.auth0.com/#/). Once there, let's click on ["Rules"](https://manage.auth0.com/#/rules) in the left-hand menu. Now, let's click on the "+ CREATE RULE" button.
 
![Picture of "Create Rule" button](https://images.ctfassets.net/23aumh6u8s0i/1ZHizCdOr0dZa0g47htu24/c4dde708f4dedee4037d87f950f698a6/create-rule)

## Adding in the "Country" Rule

For this quick bite tutorial, we will be activating the Auth0 Rule that will add the user's country and time zone to their user data.

We have already clicked on "+ CREATE RULE" so now we should see a long list of different rules. Find the one that says "Add country to the user profile" and click on it.

We'll see a bunch of code showing the rule and how it works, but all we need to do to activate this rule is to click the "SAVE CHANGES" button.

And that's it! If we return to the "Rules" dashboard, we should now see that rule listed:

![Rule dashboard view of added rule](https://images.ctfassets.net/23aumh6u8s0i/1jPbg1hg1fqmwpnTuveO8z/2b0fb8274f2a7fa40c09b352c062e0f7/rule-added-view)

<include src="TweetQuote" quoteText="I just added an Auth0 Rule to my Vue application!"/>

## Getting User's Country

Let's double-check that this works! To do so, we will need to add a `console.log` into our code to see the user's data.

In our Vue project, navigate to `src/auth/index.js` and input the following line at the bottom:

```js
// src/auth/index.js

// code at top of the file

      } finally {
        // Initialize our internal authentication state
        this.isAuthenticated = await this.auth0Client.isAuthenticated();
        this.user = await this.auth0Client.getUser();
        this.loading = false;
        console.log(this.user); // THIS LINE IS NEW!!
      }
    }
  });
  return instance;
};
```

Go back to our [`localhost:8080`](http://localhost:8080/), open up dev tools (right click and hit "Inspect"), and hit "Console" so that we can see when the `console.log` is initiated.

Log in to the application, follow the instructions for logging in, and once logged in, we'll see the user's object show up in the console.

![User data in dev tools showing country and time zone data](https://images.ctfassets.net/23aumh6u8s0i/6SBLIIsp6XnrQfOdAWR0vy/d46787f550fa86352ba4748179da1fc0/user-data-with-country)

As we can see in the photo, two lines are showing my country and time zone!

```json
https://example.com/country: "YOUR COUNTRY"
https://example.com/timezone: "YOUR TIME ZONE"
```

Now we have our user's country and time zone data!

## That's All Folks!

Without having to write the logic out ourselves, the Auth0 Rule gave us that extra bit of functionality that we may need for our project.

There are so many [Auth0 Rules](https://manage.auth0.com/#/rules) to choose! Try them out and let us know in the comments below which one has helped you out the most!

---


Adding Country to a User's Profile with Auth0 Rules

diegopoza

System Engineer, geek, foodie, technology lover, speaker.

Sr Manager, Developer Advocacy

Diego Poza

Learn how Profile Enrichment and Progressive Profiling help you target customers more effectively

Good marketing hinges on communicating the usefulness of your product. That means knowing who your customers are and how they'll use your product.

But you can't tell your customers apart if they are all just a name attached to an email address. You have no idea what they need from your product, where they work, or who they are. If your company hosts videos for businesses, HR will use the product differently than developers. So why would you market to them the same way?

Profile enrichment and progressive profiling are two ways you can build a robust view of your customers to differentiate them. This will allow you to boost your marketing and sales techniques by appealing to who your customers are, and how they want to use your product.

![Progressive Profiling Separator 1](https://images.ctfassets.net/23aumh6u8s0i/3LgzjxxOCjpgPxIGVnyPum/c2a45e609bfae5429f85cac07712c4d5/02body)

## Progressive Profiling

[Progressive profiling](https://auth0.com/blog/progressive-profiling/) is a great technique for getting more information from your customers. Instead of asking your users a million questions when they sign up, you ask them a few questions each time they log in.

Think of it as making a little small talk with them every so often when they log on, rather than asking for a three-hour long conversation the first time you meet. So, when you ask questions progressively, you can get needed information without adding a lot of friction to your sign-up process (consider that [86%](http://www.sampleforms.org/wp-content/uploads/2012/12/How-to-optimize-registration-forms.jpg) of customers say that they will leave a website if the sign-up form is too long!).

For example, the first time someone logs in, you might ask for:

* Their name
* Their email address
* Their password

During their second login, or at purchase, you might ask for:

* Their address
* Their birthday
* Their phone number

On the third login, follow up by asking for:

* Their company
* How many people work for them
* Their industry

You can set up and customize a [progressive profiling strategy with Auth0](https://auth0.com/docs/user-profile/progressive-profiling#implementing-progressive-profiling-with-auth0). You can put in any questions in any order you want.

While progressive profiling is certainly a useful tool, you aren't going to get to ask users every single thing you want to know, no matter how many logins you spread it out over. When you want demographic data, that's when you turn to the raw power of profile enrichment.


![Progressive Profiling Separator 2](https://images.ctfassets.net/23aumh6u8s0i/4QLyxXCCZVqCrkR6sUP4g8/8dc592f919af025c8467cc723809d526/03body)

## Profile Enrichment

There is a lot of information out there about your users that your sales and marketing teams are probably itching to get their hands on. But just as you can't ask someone for all of it, nobody in your company is going to sit down and manually look up pieces of information to add to every profile, either. It's simply not possible.

That's where profile enrichment comes in.

Profile enrichment is when you automatically grab publicly available information and add it to a user's profile. You do this by integrating 3rd-party demographic data APIs into your application using [Auth0 Actions](https://auth0.com/blog/introducing-auth0-actions/). Actions are snippets of code that run at specific events in the identity workflow, such as when the user logs in or signs up for an account.

For enrichment, your Action would trigger an API that grabs the data for you, and then deposit that information into the profile that every user gets when they sign up through Auth0.

![Auth0 Action diagram for Post User Registration flow](https://images.ctfassets.net/23aumh6u8s0i/4pA9D9DqICIoC8dJcyfQX7/8d1850e82032c85c581141cb6ed9690d/post_user_registration_action_flow.png)

Let's say you wanted to enrich the profiles of your users beyond the basic information they provided when they signed up for their accounts. You could use an Action that triggers immediately after a user signs up for an account that connects to business-centered data APIs to gather additional demographic information about them: where they work, their role, how many people are in their company, and their work-related social media accounts. The Action would then add this information to the user’s profile.

Now you know how many employees their company has, where they're located, and what their job title is — all without forcing users to fill out a sign up-form.

![Actions Marketplace](https://images.ctfassets.net/23aumh6u8s0i/7jcBRZSw4P7uwsLHtanUtf/b8051b29d9aa27bce1e057ac651dae56/Actions_Marketplace.png)

There are a number of [pre-built Actions available in Auth0’s Marketplace](https://marketplace.auth0.com/features/actions), and you or your development team can build your own custom actions with Auth0’s built-in development environment and insert them into the appropriate point of the identity flow using our drag-and-drop no-code identity flow management interface.

## Marketing with Your Enriched Profiles

Keeping more information on your users turns them from a single datapoint into an actual human that you can connect with as more than just a generic customer. Your marketing and sales teams have plenty of options as to what to do with all the information that transforms users into people.

* **Personalize your emails.** From birthday offers to targeted onboarding, sending something other than another sales-y email will pay off. According to MailChimp, segmented email campaigns see about a [15% higher open rate](http://mailchimp.com/resources/research/effects-of-list-segmentation-on-email-marketing-stats/) across the board when compared to non-segmented email campaigns. So whether you're sending tips specifically to customer success reps or alerting your enterprise liaisons to new features in their plan, using segmented campaigns will help you reach customers.
* **Boost your conversions.** Let's say someone signed up for your free trial. Of course, you grabbed their email, worked your API magic, and came back with information on their company and position there. Now that you know they work for a mid-sized PR company, you can help your marketing and sales people connect with that user to help them realize the value of your product in the PR space. If they connect with questions, you can point them right to the things that matter most to PR people.
* **Customize your marketing campaigns.** When you have demographic data on users, you can translate that into better marketing campaigns. Maybe you find that 25% of users are startups with fewer than 30 people, or that the majority of your enterprise customers generate reports on a weekly basis. Or maybe you find that teen boys in cities use your app more than any other group. Any of these pieces of information can help you shape marketing campaigns that speak directly to the interests of those groups.

## Aside: Power Your Profiles with CIAM

Before you can build more detailed profiles of your customers, you need a way to give them secure access to your services, as well as govern, collect, analyze, and securely store that customer data. That’s what CIAM — Customer Identity and Access Management — is for.

CIAM sits at the intersection of security, customer experience, and analytics. Providing an easy, frictionless way for users to onboard and log in is critical for driving conversions and building customer loyalty. Protecting sensitive data from malicious intrusion and taking steps to prevent data breaches is central to a sound security policy and compliance with data privacy laws. And compiling user data into a single source of truth is essential to understanding your customers.

<iframe width="600" height="338" src="https://www.youtube.com/embed/belLEwjr9zQ" title="YouTube video player" frameborder="0" allow="accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture" allowfullscreen></iframe>

CIAM has an increasingly central role in how companies create their digital identities and manage their customer relationships. Companies are allocating more resources to their access management solutions, either from day one or as part of a larger digital transformation.

[**Visit our CIAM page to find out more about how it can improve your customers’ experience while ensuring security.**](https://auth0.com/ciam) It’s packed with articles, reports, white papers, and everything you need to know about Customer Identity and Access Management.

## Conclusion

To market effectively, you need to understand both your product and your customers. Understanding your product is the easy part — you spend every day with it. But getting to know your customers is a unique challenge.

Yes, you can do focus groups and send out surveys, but neither of those will reach every single customer. When you institute progressive profiling and profile enrichment, you're guaranteed a window into every customer's identity. From there, it's a matter of putting that information to use so you can knock your marketing out of the park.

How Profile Enrichment and Progressive Profiling Can Boost Your Marketing

Airline industry cybersecurity - map your customer journey, incorporate passwordless registration, and profile enrichment to create a more enjoyable and secure UX.



Digital transformation starts with the customer. Understanding the full scope of a customer's journey and the numerous points at which s/he interacts with your company's products and services will serve as a guide when modernizing operations. This is especially important for airlines. While many might think that the flight is the only important part of the customer journey in air travel, critical communications take place starting from the customer's initial decision to buy tickets and book a flight through post-flight feedback and promotions.

![Customer flow and journey map in air travel experiences](https://images.ctfassets.net/23aumh6u8s0i/1e3QvqlOXJrYn7vvc7xiS2/0a5f087a19ce3842a8baf14ddc2f19c1/customer-communication-flow-for-air-travel)

While many airlines will have similar maps for their customers, you can tailor this to your specific brand using resources from companies like [ProsperWorks](https://www.prosperworks.com/blog/the-importance-of-customer-journey-mapping) and [Appcues](https://www.appcues.com/blog/user-journey-map) that delve into user personas and more advanced tools for approaching your research. However you go about visualizing the path your customer(s) take with your company, this exercise will help you notice the best places to make digital improvements.

## Enhance The Customer Journey: Key Tools In A Successful Digital Transformation

Once you've mapped out your customer journey, including details like booking processes and post-flight surveys that might be unique to your organization, it's time to hone in on key pain points. The customer's initial login experience and profile creation are areas that touch on and can help solve several issues at once.

### Passwordless Registration

Modernizing the first major point at which a customer or potential customer engages with your company online ensures a top-notch experience and sets the stage for enhanced security in the future. With [Auth0 Passwordless](https://auth0.com/passwordless), on the front end, you can offer one time codes or “magic links” delivered via SMS or e-mail.

![Slack, Medium, and Google login screens](https://images.ctfassets.net/23aumh6u8s0i/1dta6aEEQtIDZsZM95GKB5/341d5a8a1c593af4c61cec4b2f703a24/pwdless)

<include src="TweetQuote" quoteText="Modernize the first major point at which a customer engages with your company online: account registration."/>

([Source](https://auth0.com/blog/auth0-passwordless-email-authentication-and-sms-login-without-passwords/))

Instead of prompting customers to re-enter a password every single time, passwordless login can ease any frustration and mitigates risk of churn early on when you need to delight your users the most.

On the back-end, your team can combine passwordless login with additional security features like [anomaly detection](https://auth0.com/docs/anomaly-detection), suspicious logins, and centralized session revocation to build out a robust authentication system that double-checks each user truly is who they say they are.

For example, Auth0 partners with ThisData to [add specific alerts](https://thisdata.com/blog/how-to-add-suspicious-login-alerts-to-auth0/) regarding suspicious logins. After creating a ThisData account in the Auth0 dashboard, just add the Login Anomaly Detection Rule in the Access Control section.

![Adding a Login Anomaly Detection Rule in the Auth0 Access Control section](https://images.ctfassets.net/23aumh6u8s0i/6Xctx1Te0DCJX2HGkLDr0w/469da26559db8ea7e20e57515255fba8/create_rule)

([Source](https://thisdata.com/blog/how-to-add-suspicious-login-alerts-to-auth0/))

Auth0 [Rules](https://auth0.com/docs/rules/current) extend security features so that you can build and customize a solution on the back-end that supports all of your customers as they browse travel deals, flight times, select an itinerary, pay, check-in, and more. Not only will customers have an easier time exploring — you can ensure them that your app is a safe environment in which to share their personal information.

<include src="TweetQuote" quoteText="Auth0 Rules extend security features so that you can build and customize a solution on the back-end that supports all transactions with your customers. "/>

### Profile Enrichment

To better understand your customers and deliver more customized offerings throughout their journey, it's important to acquire all of the publicly available information you can to underpin your strategy. [Profile enrichment](https://auth0.com/blog/how-profile-enrichment-and-progressive-profiling-can-boost-your-marketing/) is a tool that captures this data using third-party data APIs, such as [Clearbit](https://help.clearbit.com/hc/en-us/articles/115004646673-Enrichment-Overview). Again, working with Auth0 Rules, you can integrate this information into a 360-view of any of your customers:

![360-view of a customer's data using Clearbit](https://images.ctfassets.net/23aumh6u8s0i/4hegzXlz6MgwIeQK9Xqkhr/ec786f6ea738ee3be28a8626c6761056/clearbit-bi)

([Source](https://auth0.com/blog/how-profile-enrichment-and-progressive-profiling-can-boost-your-marketing/))

You can capture important points such as their location, employer, Facebook interests, and email address. Of course, given the strict rules about customer data in the wake of [GDPR](https://auth0.com/gdpr), it's important to communicate to your customers what data you've acquired, how, and why. Then, be sure you give them the option to edit or even opt out if they'd like. But it's also important that they understand how allowing you to view and work with this information can benefit them. For example, you can send them special deals in their geographic area or even tailor in-flight menu options that support a healthier lifestyle (if this is a clear interest of theirs).

Profile enrichment is a powerful feature that gives a team a more comprehensive understanding of its travelers and unveils myriad ways to support them along their path.

## Staying Secure in the Airline Industry

We mentioned this earlier and will say it again: in a challenging environment, airlines need all the support they can get in terms of security. The three resources above — a customer journey map, passwordless login, and profile enrichment — will help your company comply with laws like GDPR and help you build customer trust and loyalty down the line.

While physical security has been beefed up worldwide from more cameras, TSA guards, agents, guidelines, and rules, and even canines, it's cybersecurity that deserves equal if not more attention. Making sure you really know who is traveling on your aircraft — when, from where, their travel history, payment methods, and even friends and relatives — is all valuable data that, when stored in a central location and in an accessible format, can keep your entire company and all of its stakeholders safe.


3 Tools For Digital Transformation in the Airline Industry

Unlock more value with Social Login, Progressive Profiling, and Profile Enrichment with Auth0.



Strong customer intelligence systems have been [proven](https://www.metrilo.com/blog/why-is-customer-intelligence-important-growing-ecommerce?ref=9d75) to drive growth. Collecting valuable data about your users' app behavior, including their login time(s) and duration(s), purchase histories, locations, and personal information, such as gender and interests, will go a long way toward crafting highly targeted marketing strategies and relevant product updates.

But what is the most efficient way to go about doing this? How do you collect this information without bothering your users? More importantly, given all of the pushback against Facebook and Cambridge Analytica's [collection of user data](https://auth0.com/blog/cambridge-analytica-and-facebook/), how do you assure your users that their information is safe and that you remain transparent about how you are capitalizing on it?

Outsourcing your customer intelligence can give you peace of mind, knowing that the process for amassing the data is well organized, efficient, and secure. Relying on a professional provider wholly focused on this task will also help you comply with rapidly approaching regulatory deadlines, like [GDPR](https://auth0.com/blog/get-ready-for-gdpr/) in Europe and a slew of [related laws](https://auth0.com/blog/gdpr-effect/) worldwide. If you're found to be out of compliance (i.e., your customer data is not secure), your business could face fines of up to €20 million or 4% of the global annual revenue (whichever is greater) — and this doesn't account for lasting damage to your brand and reputation.

Figuring out your system for customer intelligence will help you avoid potentially irreversible mistakes and underpin a strong foundation for growth.

## 1. Start with Social Login

[Social Login](https://auth0.com/learn/social-login/) is a feature that allows companies to have a comprehensive view of each of their customers and better understand their needs. By incorporating data from providers like LinkedIn, Amazon, Google, and many more, you can build a full image of these individuals as consumers — adding not only their names and photographs but also the specific brands they follow:

![Social login combines data about your user from multiple sources](https://images.ctfassets.net/23aumh6u8s0i/60MmcpnBYSRRfFKw3sO0MU/880a80f9bff7e4b12882c20673a54a49/social-login-incorperates-data-from-multiple-sources)

A manager like Auth0 supports 30+ social providers. Depending on your customer base and the type of information you're seeking, you might choose Facebook for personal data or PayPal for purchase history.

<include src="TweetQuote" quoteText="Auth0 supports 30+ social identity providers allowing you to access a comprehensive view of each of your customers and better understand their needs."/>

![Auth0 supports 30+ social identity providers](https://images.ctfassets.net/23aumh6u8s0i/15gOn35FNBq4hd4TgUFhsk/765b3a31cb1bb1894d3319fd8ab594c9/auth0-supports-over-30-social-identity-providers)

It's relatively simple to add a [Social Login feature](https://auth0.com/learn/social-login/) to your app. In Auth0’s Management Dashboard, click Connections and then Social. From there, just flip on the switch of the selected social network provider, and choose the applications you would like to use from this provider. Since each provider has already verified the users on their platform, this cuts down on the risk of letting in fake accounts.

Incorporating Social Login can be a simple fix that opens the door to numerous avenues for growth. For example, if you're creating [email campaigns](https://auth0.com/blog/5-killer-email-strategies-for-lifecycle-marketing/) to engage and upsell your current customers, it's critical that these be personal and not generic. Relying on subtle details that you've picked up on your customers via Social Login can make or break your ROI on such a campaign.

## 2. Incorporate Progressive Profiling to Collect Data Gradually

To reduce friction on your platform and avoid wasting users' time by having them fill out lengthy forms, [progressive profiling](https://auth0.com/blog/progressive-profiling/) is another tool for gradually building up a customer's profile each time they interact with your product. For example, you might begin with something as simple as requesting their first and last name, along with an email address:

<p style="text-align: center;">
  <img src="https://images.ctfassets.net/23aumh6u8s0i/24vgqp2L8eKEFwIjSazJ2s/9db1aa44455fda4f477db2d8d587b6aa/auth0-supports-progressive-profiling-to-build-up-user-data-over-time" alt="Auth0 supports progressive profiling to build-up user data over time" width="323"/>
</p>

From there, you might ask for additional details on the second or third login, such as:

* Address
* Birthday
* Phone number

All of these answers come together in a full view of each user:

![Auth0 user profiles have a data rich user experience](https://images.ctfassets.net/23aumh6u8s0i/4Q8gl93fS4HAr59B7hlVoT/38e5e4218bc1ddb6d57e765a8314ee93/auth0-user-profiles-have-a-data-rich-user-experience)

Rich user profiles can allow you to brainstorm appropriate product updates. For example, if a major subset of your users is located in a particular country, you might consider adding a language option to your app or website to smooth their experience.

User details can be as granular as the types of devices users are logging in with. You can harness this information to optimize the content you publish. If the majority of users are on mobile devices, you might consider full-screen advertising formats, such as Instagram, that can amplify your message and provide a more immersive brand experience.

If you are organized with your customer intelligence, opportunities to be creative with your user data are vast.

### 3. Add Profile Enrichment to Your CRM

To build an even more robust customer view, automatically grab publicly available information with a [profile enrichment](https://auth0.com/blog/how-profile-enrichment-and-progressive-profiling-can-boost-your-marketing/) tool. Integrating third-party data APIs, such as [Clearbit](https://clearbit.com/) or FullContact, into your application will allow you to cast an even wider net for customer information.

The quickly growing CRM tool [ProsperWorks](https://www.prosperworks.com/), for example, works with the [FullContact Person API](https://www.fullcontact.com/developer/customers/prosperworks/) to allow users to add names, photos, and additional data from social profiles into sales contacts.

<p>
  <img src="https://images.ctfassets.net/23aumh6u8s0i/5IvzWDciRT2xHmmm1YeoL2/2e041b63a64178e9b8ed0deffc48d659/display-contact-details-next-to-messages-for-a-richer-understanding-of-your-users" alt="Display contact details next to messages for a richer understanding of your users" />
  <small>
    <a href="https://www.fullcontact.com/developer/customers/prosperworks/">[Source]</a>
  </small>
</p>

When an email exchange appears with an external contact, that contact's personal details are displayed next to the message, allowing a sales representative to have a richer understanding during an exchange and brainstorm ways to connect on a more meaningful level. Deeper engagement between sales and prospects or converted customers will only support acquisition and retention down the line.

At the end of the day, a CRM tool helps you manage data quickly and effectively — but you can utilize it for far more than the sales function. Adding a customer intelligence feature on top of an existing CRM will expand your knowledge base and help you gain more value from what you had considered a single-function piece of software.

Your ability to cross-check each of your customers with profile enrichment will cut down on fake or unwanted accounts. Each time you expand your understanding of your users with a new data capture, you can weed out profiles that return errors or anomalies — or investigate them further.

<include src="TweetQuote" quoteText="Auth0 can give you #CustomerIntelligence and allow you to innovate like never before. Closely observing user behavior can bring to light new ideas for your business."/>

## Innovate with Customer Intelligence

Enhanced customer intelligence systems can help your company innovate in myriad ways. Closely observing user behavior can bring to light new ideas for your business. The online dating app [Bumble](https://bumble.com/), for example, recently picked up on the trend that many of its users were also searching for new jobs and friends and exchanging money with subscriptions on other apps. This allowed Bumble to roll out a new line of services:

<p>
  <img src="https://images.ctfassets.net/23aumh6u8s0i/5p18jiIuKSSXSCG68SkNuN/f4a426ea2aae9716fd684b3c74cca594/bumble-releases-new-products-based-on-user-trends" alt="Bumble releases new products based on user trends" />
  <small>
    <a href="https://bumble.com/">[Source]</a>
  </small>
</p>

Deliberate, professional, and tight customer intelligence can allow you to develop entirely new revenue streams. While you can try to do this in-house, many find that it is an excellent capability to turn over to an external provider that spends 24/7 staying on the cutting edge of their specific software, making sure it is as efficient and safe as it can be for customers and end users.


3 Tools to Improve Your Customer Intelligence

1097492785caf9ffeebffeb624202d8f?s=200 avatar

1097492785caf9ffeebffeb624202d8f?s=200

Prosper is a great speaker, community leader, open source hacker, technical consultant, and a fervent Developer Advocate. He is a full-stack software engineer who has worked on biometric, health and developer tools. Prosper recently co-founded a startup called Eden that’s focused on improving the quality of lives in Nigeria and currently leads the engineering team. He also co-founded forloop, the largest developer community in Africa.

Former Auth0 Employee

Prosper Otemuyiwa

Learn how to enhance your users' profile by adding FullContact to your authentication process.




**Profile Enhancement** is the ability to enhance user profiles by fetching user data from an external source. In an application, upon sign up of a new user, actions should be taken to automatically augment the user profile with additional public information. FullContact, the renown leading contact platform for professionals, teams, and businesses makes profile enhancement a breeze by providing substantial data.

![FullContact Signup](https://images.ctfassets.net/23aumh6u8s0i/30v7GdLYQcNOkzIkQZOdnF/0ac80e0f97f17a4cc45873fc879b9f7c/signup)

## Typical Scenario

A new user signs up to a platform, say *platformxyz.com.* The signup form only provides fields for *email address*, *first name*, *last name* and *phone number*. Once the user fills the form and hits the submit button, the user is registered and automatically logged in.

*platformxyz.com* immediately queries an external service for more information on the user via one of the parameters used to sign up, e.g the email address.

Now, the user has an enhanced profile because data has been fetched from an external source during the login process. The platform didn’t even ask the user to explicitly fill so many form fields to provide additional personal information. That’s **Profile Enhancement** right there. Imagine the possibility of adding that to your own applications without stress!

## Let's Get Started

[FullContact](https://www.fullcontact.com/) keep contacts in sync across multiple devices and gives you up-to-date contacts with public data, including photos, jobs, and social profiles. It views company profiles for your contacts, including size, founded date, and many more.

In this post, you’ll learn how to implement **Profile Enhancement** via **FullContact** in your [Auth0](https://auth0.com) app in just 5 simple steps.

## 1. Sign up for a FullContact Account

Browse to [fullcontact.com](https://www.fullcontact.com) and create a free account, as shown below.

![FullContact Signup](https://images.ctfassets.net/23aumh6u8s0i/30v7GdLYQcNOkzIkQZOdnF/0ac80e0f97f17a4cc45873fc879b9f7c/signup)

## 2. Get Your API Key

Head over to the [developer portal](https://portal.fullcontact.com/signin) and sign in with your credentials as shown below.

![Sign in to FullContact](https://images.ctfassets.net/23aumh6u8s0i/6XNiLPFd8OVih2MpV0AeGl/f9bd776bc964c775fc3f1f0a51c8c81a/signin)

_Sign In Page_

You will go through a series of verifications for your account as shown below.

![Enable API access](https://images.ctfassets.net/23aumh6u8s0i/2YxBcXK81zzVSYoaOvaDWc/a0a7a13bf8739a7f1db9cbfbef420145/enableapiaccess)

_Verification Process_

Once you are verified successfully, you will be directed to the home page where your **API Key** will be displayed as shown below.

![Welcome](https://images.ctfassets.net/23aumh6u8s0i/6Py1RvrU55cD2nwr8BFtQu/e4b0ad3a1832e3735683aa3237a01f1a/welcome)

Please take note of your **FullContact’s** API key, as you will be needing it later.

## 3. Set Up an Auth0 App

In the [Auth0 Dashboard](https://manage.auth0.com) create your client Application, as shown in the following screenshot.

![Assign Type Of Application](https://images.ctfassets.net/23aumh6u8s0i/7dZ7agAeBKjMcUaCy0kNQ3/3c29d33eca8bd94b190a3802463a6d14/assigntypeofapplication)

_Create an Auth0 app_

Once you are done with that, head over to the **Settings** section of the dashboard and take note of your **Domain**, **Client ID** and **Client Secret** as shown below:

![Auth0 Credentials](https://images.ctfassets.net/23aumh6u8s0i/2YvGtpsGKICqkHUGmUe5vA/93f3d7d8fdad074e98ada5df2f48784b/auth0credentials)

_Get your Auth0 Credentials_

Clone this [sample app from GitHub](https://github.com/auth0-blog/auth0-fullcontact), open up `auth0-variables.js` and add your Auth0 credentials like so:

```js

var AUTH0_CLIENT_ID='xxxxxxxxxxx';
var AUTH0_DOMAIN='xxxxxxx.auth0.com';
var AUTH0_CALLBACK_URL=location.href;

```
_auth0-variables.js_

**Note:** Don’t forget to put your url, *http://localhost:8080*, in the **Allowed Callback URLs** and **Allowed Origins (CORS).**

## 4. Integrate FullContact

In the Auth0 dashboard, Click on the **Rules** section in the main navigation, then create a rule via the **“Create Rule”** button located at the top right of the page.

![Rules](https://images.ctfassets.net/23aumh6u8s0i/NvBaqV0exTA8cIdr0Wh49/ef803322f69ce4305e0b4b3997cbb7e1/rules)

_Create a new rule from the Auth0 Management Dashboard_

A list of available rules existing on the Auth0 dashboard will be presented to you as shown in the diagram below. Choose the **“Enrich Profile with FullContact”** rule.

![Select Rules](https://images.ctfassets.net/23aumh6u8s0i/4q5TSydcQyRgoFntFH9FrE/4c4a4b1dddb4ece6b942f79cc145165e/selectrules)

_Click on the Enrich Profile with Full Contact Rule_

This rule is designed to get the user profile from FullContact using the users’ email. If the users’ email address is available with FullContact, it fetches the user’s profile and adds a new property *fullContactInfo* to the **user_metadata** that is returned.

After clicking on the rule, the rule editor will show up. Here, you can see the code that integrates **FullContact** with your login process.

![Rules Editor](https://images.ctfassets.net/23aumh6u8s0i/3SHT9AWLSm2D0O60cAOQ9C/84bb47ce63c4fdb0f2ab801b99f75d4e/ruleseditor)

_Rule Editor_

Get your **FullContact** API key and paste it in the **rule editor**. Replace `FULLCONTACT_KEY` default value with this key.

**Note:** In your rule editor, you will see a slack integration that alerts errors generated while gathering data from **FullContact**. Feel free to delete this integration if it’s not needed for your application.

## 5. Run and Test Your App

Open up your browser and run the app like so:

![Auth0 Login Widget](https://images.ctfassets.net/23aumh6u8s0i/2Hm7XJ3o2FVfXNN3GbODPq/72933f35a8d0d629cac32de6ed4bdbfa/auth0loginwidget)

Log into your application. You will see the user profile gotten from **FullContact** in the console as shown in the image below.

![Total information](https://images.ctfassets.net/23aumh6u8s0i/1xCzuDDiZsTvtpwfzCYcDw/0bda5a4538248138048e004227cec017/totalinfo)

Just look at the enormous amount of data returned for this logged-in user. Facebook, Google, LinkedIn, GitHub and other forms of data that identifies the user. Oh yeah, that’s the power of **FullContact** in enhancing a user’s profile.

## Conclusion

It is very simple to integrate **FullContact** in your authentication process when building an app that uses **Auth0**.

**FullContact** allows you to enhance user profiles in your application without much ado. It handles it for you, so you don’t stress your users by giving lengthy forms that ask for personal data. Supercharge your application today with **FullContact** and **Auth0!**


Adding FullContact to your Auth Process For Profile Enhancement

647b1eea820b3fc8a5aee0383930b888

Pablo Terradillos

Good news! We have redesigned the user's profile page in order to make use of the new API v2.

**TL;DR**

  * We have redesigned the user's profile page to use the new [API v2](https://auth0.com/docs/apiv2).
  * API v2 brings an improved way of [handling metadata](https://auth0.com/docs/apiv2Changes#8). In short, metadata will be stored in a separate section (__app\_metadata__ and __user\_metadata__) on the user structure and not merged with root attributes, which had caused confusion before.
  * The data you've modified in our previous dashboard version or using API v1 is now under __app\_metadata__.
  * This is a change on the __Dashboard__, not on the runtime. There are __no breaking changes__ to your apps.



Good news! We have redesigned the user's profile page in order to make use of the new [API v2](https://auth0.com/docs/apiv2).

User's data is now separated in three sections, each one with different meanings according to what it represents.

### User Identity Section

On the main section you will find essential data such as the user's email and login access information.

![](https://images.ctfassets.net/23aumh6u8s0i/6LbA0xu4dya03bD8aExG8T/21358da3d094afc2a08fa652ed1ed4af/new-profile-1)

### Metadata Section

The __Metadata__ section is the part of the user's data that you can modify.

In the previous user's profile, the _metadata_ was merged with the user's root-level attributes which created some confusion. To make everythig more explicit and easier to find, we've decided to keep it separate.

![](https://images.ctfassets.net/23aumh6u8s0i/4V8oIZct9VAUovYhncaUZu/66bc7ba25550102849126c70eb67ae9d/new-profile-2)

If you modified user attributes in the past through the dashboard, you will find the additional attributes under __app\_metadata__  after this change (since the dashboard was using API v1).

> [Learn more](https://auth0.com/docs/apiv2Changes#8) about when to use __app\_metadata__ vs __user\_metadata__.

### Identity Provider Attributes Section

Last but not least, there's the __Identity Provider Attributes__ section. Here you will find all the information retrieved from the authentication provider (e.g. Facebook, Twitter, Google, SAML, your own provider, etc.).

![](https://images.ctfassets.net/23aumh6u8s0i/5bXOtYXCdeKnvzGcrFCY7o/a7b5279bd5595a509804a3b11591045a/new-profile-3)

This data is read-only. Let's say you'd like to modify the picture that is coming from the Facebook profile. You won't be able to change the attribute in the __Identity Provider Attributes__ section. Instead you need to set the `picture` attribute in the `user_metadata` property and then in your application you would do:

```
<img src="<%= user.user_metadata.picture || user.picture %/>">
```

The previous code snippet tries to use the `picture` property from `user_metadata` and if it doesn't exist it uses the default (`user.picture`).

### Raw JSON

Finally, you can easily take a look at the raw JSON format that will be served by our API at the new __Raw JSON__ tab.

![](https://images.ctfassets.net/23aumh6u8s0i/3jXo0J6Xek3EupwcorE8tc/cda8de0de8dad94eca98f1301d9335f4/new-profile-4)

"profile"