ana-cidre

Ana Cidre is a passionate advocate for the developer community and leads the Developer Advocacy team at Auth0. She's committed to fostering a more inclusive and diverse tech world, drawing on her technical background and strategic vision to improve developer experiences and build meaningful connections.

<br>

As the founder of GalsTech, an initiative supporting women in tech in Galicia, and through her active efforts to create welcoming spaces for underrepresented groups, Ana's dedication to diversity and inclusion extends beyond her daily work.

<br>

Ana has a proven track record of building global Developer Relations teams, cultivating active developer communities, and crafting impactful educational content. She maintains a strong connection to the community through speaking engagements and direct interaction with developers.

Sr Manager, Developer Advocacy

Ana Cidre

Discover the latest releases, updates, events, and developer-related things from Auth0!

This month, Auth0 takes a big step toward the future of identity—one where AI agents, natural language interfaces, and human users coexist securely. April’s updates are centered on helping developers build for this new reality.

From Auth for GenAI, a developer-first identity solution purpose-built for AI agents and secure delegation, to the new MCP Server, which lets AI tools manage tenant configuration with natural language, this release is packed with tools that make complex auth feel simple, even in AI-first workflows.

Let’s take a look at what’s new, what’s in preview, and what you can start building with right now.

## Updates You Don’t Want to Miss

![Auth for GenAI](https://images.ctfassets.net/23aumh6u8s0i/LOv2KdQtOpluI2cySqCHR/a7ef46e280fb92ec35892b88ff91abf7/auth_for_genai.png)

### Auth for GenAI – Developer Preview now available

Generative AI is transforming how apps interact with users and how users interact with data. But securing those interactions hasn’t always been easy. That’s why we built [Auth for GenAI](https://auth0.com/blog/introducing-auth-for-genai-launching-identity-for-ai-agents/), now in **Developer Preview**.

This new solution brings together everything you need to securely build AI-powered applications, whether you're embedding AI agents, enabling human-in-the-loop workflows, or orchestrating actions across third-party APIs.

**Highlights:**

* **User Authentication** for AI agents, with support for linking, impersonation, and delegation
* **Token Vault** to securely manage and refresh access tokens for third-party APIs (e.g., Gmail, Slack, GitHub)
* **Async Authorization** to support workflows that require delayed human approval
* **Fine-Grained Authorization (FGA)** for document-level permissions in Retrieval-Augmented Generation (RAG)

Works with LangChain, LlamaIndex, GenKit, and Vercel’s AI SDK.

> [Get started with Auth for GenAI](https://auth0.com/ai/docs)

### Auth0 MCP Server – Natural language meets tenant management

The new [Auth0 MCP Server](https://auth0.com/blog/announcement-auth0-mcp-server-is-here/) brings the power of natural language interfaces directly to your Auth0 tenant.

Using the **Model Context Protocol (MCP)**, you can now authorize AI tools like **Claude Desktop, Cursor, or Windsurf** to safely interact with your tenant—whether that's updating configurations, deploying Actions, or managing APIs—all through secure, context-aware requests.

**Highlights:**

* **Secure login** via OAuth 2.0 Device Flow
* **Credential storage** via system keychain
* **Rich management APIs**, including support for tenant logs, app configuration, and more
* **Built-in access controls**, so AI agents only do what they’re allowed to.

> If you want to learn more about Auth0 MCP Server, you can read the announcement [here](https://auth0.com/blog/announcement-auth0-mcp-server-is-here/).

### Token Vault – Secure access to external APIs (Early Access)

Managing API access on behalf of users can be tricky—especially when it comes to storing and refreshing third-party tokens securely. Enter **Token Vault**, now in **Early Access** for Public Cloud tenants.

**Token Vault** allows your applications and AI agents to call external APIs—like Google Calendar, GitHub, or Microsoft Graph—**on behalf of the user**, without you having to build and maintain complex refresh workflows or custom integrations.

**Why it matters:**

* **Delegated API Access** – Securely call downstream APIs on the user’s behalf using short-lived access tokens.
* **No Refresh Token Handling** – Auth0 manages token storage and refresh cycles for you.
* **Supports Top Providers** – Integrates with popular identity providers like Google, GitHub, and Microsoft.
* **AI-Ready** – Designed to work seamlessly with **Auth for GenAI**, enabling AI agents to act on behalf of users across different services.

> Learn more in the [Token Vault documentation ](https://auth0.com/docs/secure/tokens/token-vault).

Or see how it works with GenAI apps: [Call APIs on User’s Behalf](https://auth0.com/ai/docs/call-others-apis-on-users-behalf).

<br>

<div class="alert alert-info alert-icon">
<i class="icon-budicon-487 icon-info"></i>
  <strong>Note:</strong> 
  <b>Token Vault is currently available only for Public Cloud tenants. Contact your Technical Account Manager to enable Early Access.</b><br> 
</div>

### More cool features we have shipped to improve your experience: 

#### Real-Time logs for Actions – Now Generally Available 

Debugging just got a whole lot easier. **Real-Time Logs for Actions**, Custom Database Scripts, and Custom Social Connections is now **GA**. Developers can now see console outputs (like `console.log`) in real-time directly from the Auth0 Dashboard. Find it under **Dashboard > Monitoring > Action Logs**

#### Mobile Driver’s License verification – Limited Early Access

We’re excited to introduce the **Mobile Driver’s License (mDL) Verification Service**, now in **Limited Early Access**. This new capability enables businesses and platforms to enrich user profiles during sign-up or login using **trusted, government-issued identity data**. Whether embedded in your **authorization flows** via our Forms widget or triggered **on-demand**, mDL verification unlocks a seamless, secure identity experience.

#### New US Public Cloud Region – prod-us-5 Now Live

Auth0 is growing with you. We’ve launched a new US Public Cloud environment: **`prod-us-5`**. This expansion increases regional capacity and performance for onboarding new Auth0 Public Cloud customers—while maintaining full support for **Auth0’s Authentication and Management capabilities**. 

## Community and Events

We’ve been on the road sharing ideas, best practices, and demos around the future of identity and AI.

### Where were we in April

![Where were we in April](https://images.ctfassets.net/23aumh6u8s0i/3gnJPuk7MKY2aGhRdzK2oV/25de7a9593747c5235ddb060596c0f2a/EventsApril.jpg)

* **VoxxedDays Amsterdam (Apr 3):** Deepu shared AI authorization strategies for LangChain and OpenFGA
* **Apidays Singapore (Apr 15–16):** Daizen covered scaling SaaS platforms for enterprise readiness
* **AWS Summit Amsterdam (Apr 16)**
* **React Miami (Apr 17–18)**
* **PyCon DE (Apr 23–25):** Juan Cruz Martinez presented on secure human-in-the-loop AI interactions
* **CityJS London (Apr 23–25)**
* **Vue.js Global Summit ‘25 – AI Edition (Apr 29–30):** Ramona Schwering’s talk: *Developer’s Guide to Not Summoning Skynet*
* **AWS Summit London (Apr 30)**

Thanks to everyone who stopped by &mdash; we loved connecting with builders across the world.

### Where we’ll be in May

**Looking ahead to May, you’ll find us at a variety of developer and tech-forward events across the globe. Come chat identity, APIs, AI, and all things dev with the Auth0 team:**

* **ADC Conference (5-7 May): **Ramona will be giving a talk, “The AI Developer's Guide to Not Accidentally Summoning Skynet.”
* **Infobip Shift (May 6) – **Carla will be talking about “Securing AI: A Journey Through Access Control Systems.”
* **API Days New York - Generation AI (May 14) – **Ramona will be talking about security and AI
* **Dublin Tech Summit (28-29 May)** – Two days of tech talks, networking, and developer energy

Planning to attend? Let us know—we’d love to meet up!

## That’s a Wrap for April

As AI becomes more integrated into the software we build, so does the need for thoughtful, secure identity design. With **Auth for GenAI**, **Token Vault**, the **MCP Server**, and new features like **mDL Verification** and **Real-Time Logs**, we’re here to help you ship smarter, safer, and more scalable apps.

Stay secure.<br>
Keep shipping.<br>
We’re here if you need us.


April 2025 in Auth0: Auth That Works for Humans and AI

37590801?s=460&v=4

A software engineer who dreams about non-electric sheep and autonomous vehicles and likes to champion security.

Software Engineer

Dan Arias

Learn how to use TypeScript to build a feature-complete Fastify API. Tutorial on how to use TypeScript with Fastify to create, read, update, and delete data.

Fastify and TypeScript Tutorial: Build a CRUD API

Discover the latest releases, updates, events, and all things developer-related from Auth0!

Identity is foundational, but building and scaling it well is hard. That’s where we come in. Each month, we surface the updates most relevant to you, things you can actually use, build with, and ship. Here’s what shipped in March 2025 and why it matters.

## Updates You Don’t Want to Miss

### Event Streams for User Lifecycle - Public Beta

Tracking changes to user profiles, like when a user is created, updated, or deleted, hasn’t always been straightforward. Until now, most teams had to rely on workarounds like Actions or digging through logs.

With Event Streams, you can now subscribe to real-time user lifecycle events and route them to a **Webhook, Event-Stream** or **AWS EventBridge**, making it easier to build automations, sync data, or trigger downstream systems whenever user data changes regardless of the connection used.

**Highlights:**

* Get notified when users are created, updated, or deleted
* Route events to webhooks or EventBridge with minimal setup
* No need to poll the Management API or monitor logs manually

> Event Streams is currently in **Public Beta**, and we’re looking for developers to test and share feedback. Check out the [Auth0 Docs](https://auth0.com/docs/deploy-monitor/events/create-an-event-stream) to get started.

### Advanced Customizations for Universal Login (Early Access) - Organizations, MFA TOTP, and Password Reset Challenge!

Back in February, we introduced Advanced Customizations for Universal Login (ACUL), giving you full control over login and signup screens. Now we’re extending that flexibility even further.

As of March, ACUL now supports building custom, client-rendered versions of additional key screens—including organization flows, MFA TOTP (Time-based one-time password) screens, and related reset password challenges.

**Highlights:**

* Customize Organization screens like Accept Invitation and Organization Picker
* Fully brand MFA TOTP enrollment and challenge screens
* Tailor Reset Password challenges across OTP, email, push, and SMS flows

This release also includes updates to the ACUL SDK, Auth0 CLI, Deploy CLI, and Terraform Provider—all with support for these new screens. (Note: the TypeScript SDK includes a breaking change—check the changelog for details.)

> We’re continuing to expand support across the full Universal Login experience. Check out the [docs](https://auth0.com/docs/customize/login-pages/advanced-customizations) to get started today.

### 🇯🇵 Japanese Language Support Added to Auth0 Dashboard and Docs

To support our developer community in Japan (and global teams building for Japanese users), the **Auth0 Dashboard and Documentation are now available in Japanese**.

**How it works:**

* Browser language preference set to Japanese? The dashboard and docs will load in Japanese automatically.
* Prefer manual control? Use the language switcher in the top-right corner.

This makes it easier for devs in Japan and beyond to build secure identity solutions with less friction.

### Breached Password Detection for Password Reset Flows is Now Available!

Breached Password Detection is getting a major upgrade. Until now, it only applied during sign-up and login and now, it also protects the **password reset flow**.

That means users can no longer reset their password to something that’s already known to be compromised, reducing both security risks and unnecessary password changes down the line.

**Highlights:**

- Prevent password resets to known breached credentials
- Expanded coverage now includes sign-ups via the Management API
- Improves account protection across the entire password lifecycle

> This update brings stronger security and a better user experience with minimal configuration. Check the [docs](https://auth0.com/docs/secure/attack-protection/breached-password-detection) to get started.

### Custom Phone Providers and Unified Phone Experience Now Generally Available

Custom Phone Providers and the Unified Phone Experience are now GA, giving you more control and simplicity when building phone-based authentication flows.

With **Custom Phone Providers**, you can use your own SMS provider and customize messages across Phones as ID, MFA, and Passwordless. It’s fully supported in Auth0 CLI, Deploy CLI, and Terraform for seamless integration with your CI/CD workflows.

The **Unified Phone Experience** simplifies configuration by consolidating phone settings and templates in one place. New tenants will use this by default, and existing tenants can opt-in anytime.

>  [Learn how to get started in the docs](https://auth0.com/docs/customize/phone-messages/unified-phone/use-auth0s-unified-phone-experience-for-multi-factor-authentication)

### More cool features we have shipped to improve your experience: 

**Swift Package Manager Support for Guardian SDK**

Integrating Auth0 Guardian into your iOS projects is now easier than ever. With support for Swift Package Manager (SPM), you can add Guardian directly in Xcode without manual setup or external dependency management. This update simplifies mobile integration and streamlines authentication setup in your Apple ecosystem.

**Credential Guard Now Available for Private Cloud on Azure**

Credential Guard is now supported for customers running Auth0 in Private Cloud on Azure. This enhancement offers faster breach detection, up to 250% quicker than traditional automated tools, along with global password protection coverage in 200+ regions and real-time threat intelligence powered by a dedicated security team.

**Actions – Execution Error Logs Now Available**

We’ve introduced better observability for unhandled execution errors in Actions. A new event type is now available in the Auth0 Dashboard under Monitoring > Logs and can also be streamed to your existing Log Stream platforms. You’ll also find a dedicated filter for Actions-related errors, helping you monitor and debug custom logic more efficiently.

## Community and Events

At Auth0, we’re all about showing up for developers, whether it's at a major conference or a local meetup. March was packed with great conversations around identity, security, and the future of application development.

### Where We Were in March

Here’s a quick look at where we’ve been and the awesome developer communities we connected with:

* **All Things Open AI** – March 17–18
* **NAVIGATE Kongress 2025**
* **Gartner IAM Summit London**
* **Tech.eu Summit** – March 25–26

![Community and Events](https://images.ctfassets.net/23aumh6u8s0i/65ZQfEpouwgVrXBqsDIEa8/243d53c9255ae9e5ffcb8b71f74a2773/Community_and_Events_-_March.jpg)

Thanks to everyone who dropped by to talk shop with us. We loved chatting about secure AI integrations, passwordless strategies, and how developers are solving identity challenges at scale.

### Where We’ll Be in April

We’re keeping the momentum going in April! If you're attending any of these, come say hi; we'd love to meet you and hear what you're building.

* **VoxxedDays Amsterdam (April 3rd)** – Don’t miss **Deepu’s talk** on *Securing the Future of AI: Authorization Strategies for RAG Systems with LangChain4J and OpenFGA*
* **Apidays Singapore 2025 (April 15–16th) – Daizen Ikehara **will discuss "Is your SaaS scalable? 4 things to consider to support large organizations."
* **AWS Summit Amsterdam (April 16th) **
* **React Miami (April 17–18th)**
* **PyCon DE (April 23–25th) – Juan Cruz Martinez **will present on "Secure 'Human in the Loop' Interactions for AI Agents."​
* **CityJS London (April 23rd–25th) **
* **Vue.js Global Summit '25 – AI Edition (April 29–30th) – Ramona Schwering** will deliver "Developer's Guide to Not Summoning Skynet."​
* **AWS Summit London (April 30th)**

Stop by our booth, catch a talk, or just grab some Auth0 swag; we’re excited to connect!

That’s all for March! <br>
We’ll be back next month with even more updates to help you build secure, scalable, and modern identity solutions. In the meantime, build something great and let us know how we can support your journey.

Stay secure. <br>
Keep shipping. <br>
We’re here if you need us.

March 2025 Updates: What’s New in Auth0 (Developer Edition)

In the ever-evolving world of application development, managing identity is no small feat. But with the right tools, you can streamline your security and user management like never before. In this recap, we’ll dive into the latest updates from Auth0, showcasing how we’re enhancing your development experience with new features, integrations, and updates that bring both simplicity and power to the forefront.

Let’s explore the key updates you’ll want to know about and see how they can help you streamline your identity management, bolster security, and deliver more powerful, user-centric applications.

## Updates You Don’t Want to Miss

![Auth0 Next.js SDK](https://images.ctfassets.net/23aumh6u8s0i/40qRm7ybg04Di2kdebAuQc/745efea8a558a7c7e8c51a6b9bb03326/auth0_nextjs_sdk.png)

### Next.js SDK v4 (GA) Released

If you’re a **Next.js** developer, this update will significantly enhance your workflow. With **Next.js SDK v4**, now fully compatible with **Next.js 15** and **React 19**, you can take advantage of cutting-edge features like:

* **Middleware-Based Authentication**: A streamlined approach that makes authentication management easier and reduces maintenance.
* **Improved Security**: Encrypted cookies replace outdated logic, bringing your app's security up to date.
* **Better Session Management**: Features like rolling sessions and custom database support ensure a smoother user experience.

> This update is designed to help you take full advantage of the latest web development advancements without sacrificing security or performance.

### Advanced Customizations for Universal Login (Early Access)

For customers who want to take their Universal Login experience to the next level, we’ve launched Advanced Customizations for Universal Login (ACUL) in Early Access. ACUL enables you to create fully custom, client-rendered versions of each Universal Login screen. With ACUL, you get full control over every pixel of the login and signup screens.

Supported flows include Single Step Signup/Login, ID First Signup/Login with various authentication methods (password, passwordless, passkeys, etc.), and more.

This is just the beginning, with more features and a new configuration UI coming in the months ahead. [Check out the online documentation](https://auth0.com/docs/customize/login-pages/advanced-customizations) for all the details, and start building today!

### Okta Universal Logout Integration Now Supported in Auth0

For teams using **Okta** to manage their workforce identity, we’re rolling out [Universal Logout](https://auth0.com/blog/okta-universal-logout-integration-now-supported-in-auth0/) integration with Auth0. This update means you no longer need to build a global token revocation endpoint. Instead, when Okta detects a change in risk, it will automatically revoke sessions and refresh tokens.

> It’s a simple **integration** with minimal configuration, but the **security** benefits are huge, making it easier for you to ensure your applications are always up-to-date and protected.

### Custom Token Exchange – Early Access

We’re thrilled to announce[ Custom Token Exchange](https://auth0.com/docs/custom-token-exchange-early-access) in Early Access. This OAuth grant-type feature allows you to exchange security tokens for other tokens, such as access tokens and offers flexibility using Actions for custom logic.

This new feature enables advanced use cases like:

* Migrating users to Auth0
* Integrating external IDPs
* Exchanging Auth0 tokens for different audiences

> **Custom Token Exchange** provides the flexibility you need to handle sophisticated integrations where regular federation and OIDC flows aren’t feasible.

### More cool features we have shipped to improve your experience: 

- **Optimised TOTP Enrollment for Mobile Devices:** We’ve made the process of enrolling in TOTP (Time-Based One-Time Password) on mobile devices more intuitive. Check out [**Auth0 Temporary OTP**](https://auth0.com/docs/secure/multi-factor-authentication/auth0-guardian#temporary-one-time-passwords) for more details!

- **Email OTP Verification – Email OTP(One Time Password) Verification:** is now Generally Available (GA), providing an additional layer of security during signup and password reset. This feature requires **Universal Login** and can be enabled by changing the **Verification Method** from Verification Link to OTP in your connection settings.

- **Usage Metrics Dashboard for Auth0 FGA:** We’re introducing the **Usage Metrics Dashboard** for **Auth0 Fine-Grained Authorization (FGA)**. This new tool gives teams deep visibility into their authorization usage, enabling more efficient monitoring and management of monthly active users, total number of tuples, and monthly average requests per second.

- **New Private Cloud Region in India:** We’ve expanded our Private Cloud availability by adding a new region in Hyderabad. This follows the Mumbai AWS region in India, providing additional flexibility, reduced latency, and improved data residency options for Auth0 customers in the region.

### Deprecations

**Node.js 12 and 16 Extensibility Runtimes Deprecation:** We’re phasing out the Node.js 12 and 16 runtimes for extensibility integrations, such as Actions, Rules, Hooks, Custom Database Connections, and Custom Social Connections. If you’re using these runtimes, we strongly recommend migrating to Node.js 22, which is our recommended runtime for all new and existing extensibility integrations.

**Unwarranted Session Removal After User Updates (Deprecated):** In a bid to improve the user experience, we’ve deprecated the automatic invalidation of user sessions when performing database connection user updates with unchanged email or `email_verified` attributes. This change will ensure that the session invalidation behavior aligns more closely with the email verification flows. 

## Community and Events

### Partnering with LangChain and LlamaIndex

As Generative AI (GenAI) applications become more powerful, securing these systems becomes essential. The "[Auth for GenAI](https://auth0.com/blog/auth-for-genai/)" initiative is here to help developers integrate strong authentication and authorization into their GenAI applications, ensuring sensitive data is protected when interacting with external APIs and data sources.

We’re thrilled to announce our partnerships with [LangChain](https://auth0.com/blog/building-a-secure-rag-with-python-langchain-and-openfga/) and [LlamaIndex](https://auth0.com/blog/genai-llamaindex-js-fga/)—two leading frameworks in the GenAI space. Together, we’re demonstrating how Auth0 can seamlessly integrate with these tools to secure your AI applications.

Key aspects of our collaboration include:

* **Framework-Specific SDKs** to simplify the integration of Auth0’s authentication and authorization solutions.
* **Informative Developer Content** that offers best practices, guides, and examples for secure GenAI app development.
* **Fine-Grained Access Control** using **Auth0 FGA (Fine-Grained Authorization)**, which ensures that AI applications can securely access external data sources and APIs.

This partnership is a great step toward building secure, scalable, and compliant AI applications. We’re excited to collaborate with **LangChain** and **LlamaIndex**, and provide developers with the tools and resources they need to build the next generation of secure AI-powered systems.

> Together, we’re building the future of secure **Generative AI**. Let’s innovate and secure the AI applications of tomorrow!

* [Building a Secure RAG with Python, LangChain, and OpenFGA](https://auth0.com/blog/building-a-secure-rag-with-python-langchain-and-openfga/)
* [Build a Secure RAG Agent Using LlamaIndex and Okta FGA on Node.js](https://auth0.com/blog/genai-llamaindex-js-fga/)

### Events

At Auth0, we’re passionate about engaging with the developer community and sharing insights at events worldwide. Whether we’re speaking at conferences, hosting workshops, or simply connecting with like-minded developers, we’re excited to be part of the conversations shaping the future of identity and security. Here’s a look at where we’ve been recently and where you can catch us next!

#### Where Were We?

In the past few weeks, we’ve had the privilege of attending some amazing events and meeting incredible developers:

* [JFokus](https://www.jfokus.se/talks/1839) – February 3-6
* [Developer Week](https://www.developerweek.com/) – February 11-13
* [DevWorld Amsterdam](https://devworldconference.com/) – February 27-28

![Events](https://images.ctfassets.net/23aumh6u8s0i/4t1GBeVZ6OXdhXZ2CFbTHs/d1ef9abcb6f96fdaa98143c6890623e0/events2025.jpg)

It’s been a blast connecting with the community, and if you joined us at any of these events, we hope you had a chance to chat with the team and explore what’s new with Auth0.

Looking ahead, we’ve got a busy schedule and can’t wait to meet more of you at these upcoming events:

* [All Things Open AI](https://allthingsopen.ai/) – March 17-18
* [Tech.eu Summit](https://tech.eu/event/2025/summit-london/) – March 25-26

Make sure to swing by our booth if you’ll be at any of these events, we’d love to talk all things identity, security, and the future of AI-powered applications!

That’s all for this month! We’re committed to keeping you updated with the latest and greatest features to help you build secure, scalable applications. Stay tuned for more in March!


February 2025 Updates: What's New in Auth0

deepu-sasidharan

Deepu is a polyglot developer, Java Champion, and OSS aficionado. He mainly works with Java, JS, Rust, and Golang. He co-leads JHipster and created the JDL Studio and KDash. He's a Staff Developer Advocate at Okta. He is also an international speaker and a published author.

Staff Developer Advocate

Deepu K Sasidharan

arpit-jain

Arpit is a skilled engineering manager and software developer who specializes in Java, JS, and cloud-native technologies. He actively contributes to the developer community and focuses on enhancing the developer experience. Arpit also mentors aspiring developers.

Senior Engineering Manager

Arpit Jain

The Auth0 Terraform provider has many new features and updates. Learn all about what's new.

The [Auth0 Terraform Provider](https://registry.terraform.io/providers/auth0/auth0/latest/docs) allows you to automate the configuration of Auth0 resources like applications, connections, actions, and more. You can also use it to manage users and groups. With the Auth0 Terraform provider, you can automate almost everything you can do via the management UI.

**Check out our blog post to get started with Auth0 and Terraform.**

<include 
    src="LinkCard" 
    title="Get Started with the Auth0 Terraform Provider" 
    link="https://auth0.com/blog/get-started-with-auth0-terraform-provider/" 
    description="Learn how to get started with the Auth0 Terraform Provider to automate your identity infrastructure." 
    img="https://images.ctfassets.net/23aumh6u8s0i/315vJcTNAjaIgQZWxlovOf/a1839ed3bff28c3da8969642252c86a6/terraform-auth0-logo"
/>

## What's New in the Auth0 Terraform Provider

The latest versions (1.4 to 1.7) of the Auth0 Terraform provider have many new features and updates. Here are the top **six** features to look out for.

### Auth0 Forms

[Auth0 Forms](https://auth0.com/features/forms) is a robust visual editor that enables you to create custom, dynamic forms seamlessly integrating with your authentication workflows.

> [Available from v1.7.3](https://registry.terraform.io/providers/auth0/auth0/latest/docs/resources/form)

<AmpContent>
  <amp-youtube
      data-videoid="jkzwN2xwO5w"
      layout="responsive"
      width="480" height="270">
  </amp-youtube>
</AmpContent>
<NonAmpContent>
  <div class='embed-container' style="position: relative; padding-bottom: 56.25%; height: 0; overflow: hidden; max-width: 100%;margin-bottom:40px;"><iframe style="position: absolute; top: 0; left: 0; width: 100%; height: 100%;" src='https://www.youtube.com/embed/jkzwN2xwO5w' frameborder='0' allowfullscreen></iframe></div>
</NonAmpContent>

Forms offer a secure and controlled experience within your tenant's domain, eliminating the need for external site redirects. You can manage Auth0 Forms and [Flows](https://auth0.com/docs/customize/forms/flows) via Terraform, enabling you to automate the creation and management of forms and flows.

```hcl
# Create an Auth0 Form
resource "auth0_form" "sample_form" {
  name = "KYC Form"

  start = jsonencode({
    coordinates = { x = 0, y = 0 }
    next_node = "username_step"
  })

  nodes = jsonencode([{
    id   = "username_step"
    type = "STEP"
    config = {
      components = [{
        category = "FIELD"
        config = {
          max_length = 50
          min_length = 1
          multiline  = false
        }
        id        = "full_name"
        label     = "Your Name"
        required  = true
        sensitive = false
        type      = "TEXT"
        },
        {
          category = "BLOCK"
          config = { text = "Continue" }
          id   = "next_button_3FbA"
          type = "NEXT_BUTTON"
      }]
      next_node = "$ending"
    }
    coordinates = { x = 500, y = 0 }
  }])

  ending = jsonencode({
    after_submit = {
      flow_id = auth0_flow.sample_flow.id
    }
    coordinates = { x = 1250, y = 0 }
    resume_flow = true
  })

  style = jsonencode({ css = "h1 { color: white; text-align: center; }" })
}

# Create an Auth0 Flow to use the Form
resource "auth0_flow" "sample_flow" {
  actions = jsonencode([{
    action = "UPDATE_USER"
    allow_failure = false
    id            = "update_user_metadata"
    mask_output   = false
    params = {
      changes = {
        user_metadata = { full_name = "{{fields.full_name}}" }
      }
      connection_id = auth0_flow_vault_connection.sample_connection.id
      user_id       = "{{context.user.user_id}}"
    }
    type = "AUTH0"
  }])
  name = "Flow KYC update data"
}

# Create a Flow Vault Connection to use in a Flow
resource "auth0_flow_vault_connection" "sample_connection" {
  app_id = "AUTH0"
  name   = "Auth0 M2M Connection"
  setup = {
    client_id     = var.auth0_client_id # The M2M app must be authorized to use the Auth0 Management API
    client_secret = var.auth0_client_secret
    domain        = var.auth0_domain # without https:// in the domain
    type          = "OAUTH_APP"
  }
}
```

### Machine-to-Machine Access for Organizations

[Machine-to-Machine (M2M) Access for Organizations](https://auth0.com/docs/manage-users/organizations/organizations-for-m2m-applications) enables you to define the organizations that a given application can access for each API using the Client Credentials Flow. This enables customers to sell and operate their services in M2M environments properly, cover scenarios with consumption devices with limited user experience capabilities, and simplify configuration and usage.

This is being implemented so that M2M Apps can be associated with a given organization, as currently done for Connections. This will enable that application to request an access token for that specific Organization.

> Note: This feature is available from B2B Professional, Enterprise, and Enterprise premium plans.

> [Available from v1.7.0](https://registry.terraform.io/providers/auth0/auth0/latest/docs/resources/organization_client_grant)

```hcl
# Create an Auth0 Organization
resource "auth0_organization" "my_organization" {
  name         = "auth0-inc"
  display_name = "Auth0 Inc."

  branding {
    logo_url = "https://example.com/assets/icons/icon.png"
    colors = {
      primary         = "#f2f2f2"
      page_background = "#e1e1e1"
    }
  }
}

# Create a new Auth0 M2M application
resource "auth0_client" "sample_client" {
  name                = "MyCoolApp"
  description         = "My Cool App Client Created Through Terraform"
  app_type            = "non_interactive"
}

# Create a Client Grant for the Client
resource "auth0_client_grant" "my_client_grant" {
  client_id = auth0_client.sample_client.id
  audience  = "https://passkeys-demo.eu.auth0.com/api/v2/"
  scopes    = ["create:foo", "create:bar"]
}

# Create a Client Grant for the Organization
resource "auth0_organization_client_grant" "sample_organization_client_grant" {
  organization_id = auth0_organization.my_organization.id
  grant_id       = auth0_client_grant.my_client_grant.id
}
```

## Bring Your Own Key (BYOK)

[Bring Your Own Key](https://auth0.com/docs/secure/highly-regulated-identity/customer-managed-keys/customer-managed-keys-management-api) allows you to securely replace your tenant’s top-level encryption key with a key of your own, hence gaining control of your key material in Auth0’s hardware security module (HSM). It allows compliance with specific secret custody and key provenance requirements. Once you have uploaded your key, data encryption and decryption operations use that key to encrypt your tenant's secrets and data.

> Note: This feature is available as Early Access on Enterprise plans with the Highly Regulated Identity add-on.

> [Available from v1.7.0](https://registry.terraform.io/providers/auth0/auth0/latest/docs/resources/encryption_key_manager)

```hcl
# Modifying the key_rotation_id causes the keys to be rotated/rekeyed.
resource "auth0_encryption_key_manager" "sample_key_manager_initial" {
  key_rotation_id = "da9f2f3b-1c7e-4245-8982-9a25da8407c4"
}

resource "auth0_encryption_key_manager" "sample_key_manager_rekey" {
  key_rotation_id = "68feba2c-7768-40f3-9d71-4b91e0233abf"
}

# To initialize the process of providing the root key by the customer, create a
# `customer_provided_root_key` block.
resource "auth0_encryption_key_manager" "sample_key_manager" {
  customer_provided_root_key {
  }
}

# The public_wrapping_key and wrapping_algorithm should be available to
# be used to wrap the new key by the customer
output "key_manager" {
  depends_on = [auth0_encryption_key_manager.sample_key_manager]
  value = {
    public_wrapping_key = auth0_encryption_key_manager.sample_key_manager.customer_provided_root_key.*.public_wrapping_key
    wrapping_algorithm  = auth0_encryption_key_manager.sample_key_manager.customer_provided_root_key.*.wrapping_algorithm
  }
}

# The root key should be wrapped using the specified algorithm by the customer and Base64 encoded.
resource "auth0_encryption_key_manager" "sample_key_manager" {
  customer_provided_root_key {
    wrapped_key = "your_base64_encoded_wrapped_root_key"
  }
}
```

## Customize Signup and Login Prompts

[Customize Signup and Login Prompts](https://auth0.com/docs/customize/login-pages/universal-login/customize-signup-and-login-prompts) is a feature that allows customers with a Custom Domain and Custom Page Template enabled to add custom fields and content to their app’s signup and login prompts.

> [Available from v1.7.0](https://registry.terraform.io/providers/auth0/auth0/latest/docs/resources/prompt_screen_partial)

Customize Signup and Login Prompts supports two use cases.

- **Custom content**: Custom content is static content like text, links, or images placed directly on the signup and login prompts.
- **Data capture**: Data capture uses form elements dynamically added to the signup and login prompts, which is useful for collecting and validating user consent or user-produced data like a surname.

```hcl
# For managing a single prompt screen
resource "auth0_prompt_screen_partial" "login" {
  prompt_type = "login"
  screen_name = "login"
  insertion_points {
    form_content_start = "<div>Form Content Start</div>"
    form_content_end   = "<div>Form Content End</div>"
  }
}

# For managing multiple prompt screens
resource "auth0_prompt_screen_partials" "prompt_screen_partials" {
  prompt_type = "login-passwordless"

  screen_partials {
    screen_name = "login-passwordless-email-code"
    insertion_points {
      form_content_start = "<div>Form Content Start</div>"
      form_content_end   = "<div>Form Content End</div>"
    }
  }

  screen_partials {
    screen_name = "login-passwordless-sms-otp"
    insertion_points {
      form_content_start = "<div>Form Content Start</div>"
      form_content_end   = "<div>Form Content End</div>"
    }
  }
}
```

## Self-Service Single Sign-On

[Self-Service Single-Sign On (SSO)](https://auth0.com/docs/authenticate/enterprise-connections/self-service-SSO) provides business-to-business (B2B) customers with the tools needed to delegate SSO setup to their enterprise customers. This enables your B2B customers to configure and manage their own ways of logging in to your SaaS application.

Self-Service SSO provides a packaged experience that Auth0 customers can offer to their business customers so that they can set up their own SSO access. Customers can take advantage of this time-saving feature to reduce support costs and time-to-value for their business customers.

> Note: This feature is available as limited Early Access on Enterprise plans.

> [Available from v1.5.0](https://registry.terraform.io/providers/auth0/auth0/latest/docs/resources/self_service_profile)

```hcl
resource "auth0_self_service_profile" "my_self_service_profile" {
  user_attributes {
    name        = "sample-name"
    description = "sample-description"
    is_optional = true
  }
  branding {
    logo_url = "https://mycompany.org/v2/logo.png"
    colors {
      primary = "#0059d6"
    }
  }
}
```

## SCIM Configuration

[System for Cross-domain Identity Management (SCIM)](http://www.simplecloud.info/), is a [protocol](https://tools.ietf.org/html/rfc7644) and [schema](https://tools.ietf.org/html/rfc7643) used by enterprise organizations for provisioning, de-provisioning, and managing user identity-related information across systems in a standardized way. SaaS developers selling their SaaS apps and services to large enterprises may be asked, or even required, by those customers to implement a SCIM-based API to integrate with the user provisioning tooling they use.

With support for [inbound SCIM](https://auth0.com/docs/authenticate/protocols/scim/configure-inbound-scim), SaaS application builders will be able to:

- Use the Auth0 Dashboard or APIs to quickly and easily enable support inbound SCIM user provisioning and de-provisioning workflows to their Auth0 user identity stores
- Get out-of-box support for top Workforce IDPs that implement outbound SCIM (including Okta Workforce Identity Cloud and Azure AD) without needing to build or self-host any custom endpoints

> Note: This feature is available on Enterprise plans.

> [Available from v1.4.0](https://registry.terraform.io/providers/auth0/auth0/latest/docs/resources/connection_scim_configuration)

```hcl
resource "auth0_connection" "my_enterprise_connection" {
  name         = "my-enterprise-connection"
  display_name = "My Enterprise Connection"
  strategy     = "okta"

  options {
    client_id              = "1234567"
    client_secret          = "1234567"
    issuer                 = "https://example.okta.com"
    jwks_uri               = "https://example.okta.com/oauth2/v1/keys"
    token_endpoint         = "https://example.okta.com/oauth2/v1/token"
    authorization_endpoint = "https://example.okta.com/oauth2/v1/authorize"
  }
}

# A resource for configuring an Auth0 Connection SCIM Configuration, specifying `user_id_attribute` and `mapping`.
# Only one can be specified for a connection.
resource "auth0_connection_scim_configuration" "my_conn_scim_configuration" {
  connection_id     = auth0_connection.my_enterprise_connection.id
  user_id_attribute = "attribute1"
  mapping {
    auth0 = "auth0_attribute1"
    scim  = "sacim_attribute1"
  }
  mapping {
    auth0 = "auth0_attribute2"
    scim  = "sacim_attribute2"
  }
}
```

## Learn More

I hope that you found this article helpful. Here are some additional resources to learn more about Auth0 and DevOps.

- [Get Started with the Auth0 Terraform Provider](https://auth0.com/blog/get-started-with-auth0-terraform-provider/)
- Be a DevOps Hero\! Automate Your Identity Infrastructure with Auth0 CLI and Ansible
- [Deploy Secure Spring Boot Microservices on Amazon EKS Using Terraform and Kubernetes](https://auth0.com/blog/terraform-eks-java-microservices/)
- [Shhhh... Kubernetes Secrets Are Not Really Secret\!](https://auth0.com/blog/kubernetes-secrets-management/)
- [Auth0 CLI Basics \- Lab](https://developer.auth0.com/resources/labs/tools/auth0-cli-basics#introduction)

You can also sign up for our [newsletter](https://a0.to/nl-signup/java) to stay updated on everything about identity and security.

If you liked this tutorial, chances are you'll enjoy the others we publish. Please follow [@auth0 on Twitter](https://twitter.com/auth0) and [subscribe to our YouTube channel](https://youtube.com/oktadev) to get notified when we publish new developer tutorials.


What's New in the Auth0 Terraform Provider?

Abbie Carlson

As a Product Marketing Manager, I'm responsible for communicating the value of Identity for consumer apps as well as focusing on the developer experience. I'm forever curious about how Identity plays a role in our everyday lives as consumers and how a great Customer Identity solution can make or break a business through patron loyalty and retention. 

Outside of work can catch me watching Seattle sports, going to as many concerts as I can or listening to true crime podcasts.

Senior Product Marketing Manager - Developer Experience & Analytics

Keep scrolling to learn more about our newest releases, updates, and all things developer.

As builders and developers, you know how quickly the Identity landscape can change and pivot. And here at Auth0, we’re right there with you. To be in the loop, you gotta always be two steps ahead.

You’re shaping the future of Identity as you build and scale your app. You’re adding to open-source projects to support the wider good. And you’re learning as you go and adopting new standards to stay on top of it all.

With that, we want to share some new and updated releases that can help you continue to grow, support, and learn in this ever-changing Identity world.

[**Auth0 Plans Just Got an Upgrade**](https://auth0.com/blog/auth0-plans-got-an-upgrade/) 🎉 Auth0’s vision is to free any consumer or SaaS application user to safely use any technology. This means giving developers the products that help make building, deploying, and scaling applications easy. In the last few years, we’ve added more capabilities that allow developers to battle malicious attacks and attackers.

We’re happy to bring you more on our Free, Essential, Professional, and Enterprise Plans. A few highlights to mention- the Free Plan now includes 25,000 MAUs and a Custom Domain. 10 Organizations are now available on our B2C Plans and Unlimited[^1] Organizations on our B2B Plans as well as increased MFA offerings so you can mitigate the growing threat of AI-based attacks.

![Free plan](https://images.ctfassets.net/23aumh6u8s0i/sFytL92hG7PJErfIvOoJc/c6facc7de0415a1b8db32b206809b457/Uploaded_from_Staying_up_to_date_in_Identity__Auth0_s_Q3_Developer_Releases)

_These are just our Free Plan updates. Take a look at our [blog](https://auth0.com/blog/auth0-plans-got-an-upgrade/) to learn more about the plan changes._

[**Forms**](https://auth0.com/docs/customize/forms) ✨ Frictionless sign-up and login experiences are crucial for winning over customers and staying competitive. Today's businesses need tools that support efficient and secure operations but also help drive customer retention and growth, adapt to unique security needs, and unify and activate data across multiple apps and systems.

Forms enables developers and UX teams to streamline orchestration and create custom Identity flows tailored to their company's needs. This flexibility helps you build a more seamless user experience.

![Dashboard > Actions > Forms](https://images.ctfassets.net/23aumh6u8s0i/58pMHDbyfqe0thBPLzu4ij/5a4ac70a7a9be3d280b9dc4945158061/Uploaded_from_Staying_up_to_date_in_Identity__Auth0_s_Q3_Developer_Releases)

**What’s Next? Auth for GenAI** 🤖 Auth for GenAI is a series of features that allows you to confirm that your AI agents have the right and least privileged access to sensitive information. In addition, Auth for GenAI can call APIs securely on behalf of users to integrate with other apps and is capable of securely implementing on-demand user authentication when background or async AI agents need user confirmation for actions.

![auth0.ai](https://images.ctfassets.net/23aumh6u8s0i/FumWILM0KMtXGUdXuZxYw/0cc2ccf921997f0f0d3802f3dfdd8dd0/Uploaded_from_Staying_up_to_date_in_Identity__Auth0_s_Q3_Developer_Releases)

Interested? Join our waitlist [here](http://auth0.ai/) to be the first to find out when these features become available.

We hope that these product updates and releases support you in this ever-changing world of Identity and security. If you’d like to learn more about our other updates and releases (we’ve got a lot more to tell you about), take a look at our [Developer Releases Guide](https://www.okta.com/resources/datasheet-developer-releases-auth0-by-okta-q3-2024/). And if you’d like to dive even deeper, please check out our combined [Customer Identity and Workforce Identity Release Guide](https://www.okta.com/resources/product-release-overview-q3-2024-wic-cic/).

Outside of all these release updates, take a look at our developer resources at [www.developer.auth0.com](http://www.developer.auth0.com/).

[^1] : _subject to system limitations_

Staying up to date in Identity… Auth0’s Q3 Developer Releases

Being creative, finding solutions, and always looking to evolve. To me, that’s what encompasses a true developer. And maybe I’m living in Camelot, but honestly- what would apps be without the dev? (literally, we wouldn’t have any).

**Auth0 by Okta** understands that you, the developer, are here to, well, develop. 

And all that we can do is support you in your journey. Whether that’s at your 9-5  (more likely your 4-midnight) or on the weekends building your hobby app.

So with that, we want to share some new and updated products that can help solve your problems around all things Identity. 

## Highly Regulated Identity General Availability

**[Highly Regulated Identity General Availability](https://auth0.com/docs/secure/highly-regulated-identity)**. This Financial Grade Identity ™ solution suite delivers elevated security, privacy, and UX controls for sensitive customer operations beyond login— such as updating account information, accessing sensitive data, sending money, or making an open banking payment. Enable financial grade API protections, step-up security and consent. 

![Highly Regulated Identity General Availability](https://images.ctfassets.net/23aumh6u8s0i/7eRSbWJjEVlxClg7D8DdTM/8d675fdef576d67efbd56f6a9493e785/Uploaded_from_Coming_in_Hot__Auth0_s_Q2_Developer_Releases)
_Highly Regulated Identity Phase 1_

## Forms for Actions EA

**[Forms for Actions EA](https://auth0.com/docs/customize/forms)**. This feature provides a new visual editor for customers to build custom forms to extend login and signup flows within their tenant’s domain. This gives our customers better control over user experience and additional flexible building blocks. 

![Dashboard > Actions > Forms](https://images.ctfassets.net/23aumh6u8s0i/3DTIQSawDVsEGJhHIRJ4Gg/55df24a93d55e784fa0f01ee1e7ae14b/Uploaded_from_Coming_in_Hot__Auth0_s_Q2_Developer_Releases)

## Flexible Identifiers

**[Flexible Identifiers](https://auth0.com/docs/authenticate/database-connections/flexible-identifiers-and-attributes)**. Now, in EA... keep an eye out for GA (coming soon) This feature allows the use of multiple attributes such as email, phone number, and username as unique identifiers, either individually or in combination, to authenticate users. Including the option to configure Phone Number as a Sole Identifier.

![Flexible Identifiers](https://images.ctfassets.net/23aumh6u8s0i/SsqfcCZArhGlfn4vGMVul/39cc10bfa6e3e0cd6914d8c5ba0fea0a/Uploaded_from_Coming_in_Hot__Auth0_s_Q2_Developer_Releases)

We truly hope that these product updates and releases can help you continue to create, build, and solve problems- whether it’s a work or personal project. If you’d like to learn more about our other updates and releases (we’ve got a whole lot more to tell you about), take a look at our [Developer Release Guide](https://www.okta.com/resources/datasheet-developer-releases-auth0-by-okta-q2-2024/). And if you’d like to dive even deeper, please check out our combined [Customer Identity and Workforce Identity Release pdf](https://www.okta.com/resources/product-release-overview-q2-2024-wic-cic/). 

Outside of all these release updates, take a look at our developer resources at [**developer.auth0.com**](http://www.developer.auth0.com/).

Coming in Hot… Auth0’s Q2 Developer Releases

Introducing updated self-service plans and pricing that scale with your company

<div class="alert alert-info alert-icon">
  <i class="icon-budicon-487"></i>
  <strong>UPDATE:</strong><br> 
  This information was modified on December 11th, 2023. The new plans and feature offerings are now universally available for everyone.<br> 
</div>

We're excited to share with you our updated and revamped plan offerings for Auth0, which powers Okta Customer Identity Cloud.

Effective November 1st, 2023 we launched changes to our plan offerings and pricing structure. Changes listed below:

* **Our free plan now supports up to 7,500 MAUs vs the previous 7,000.**
    * More than 65,000 active tenants enjoy this plan today.
    * Our always-free plan continues to offer social login, DB connection for securely storing identity information, branded login, extensibility and security capabilities (brute force and suspicious IP throttling), and support for 5 regions (US, UK, EU, JP, AUS). 
    * We also recently added [passkeys support](https://auth0.com/blog/activate-passkeys-let-users-log-in-without-password/) to the free plan.
* Our pricing structure has been updated to more predictably scale as you grow:
    * B2C Essentials pricing now starts at $35/Mo for 500 Monthly Active Users (MAUs)
    * B2B Essentials pricing now starts at $150/Mo for 500 MAUs
    * You can now purchase 20,000 MAUs on B2C Essentials with your credit card.
* [Auth0 Teams](https://auth0.com/docs/get-started/tenant-settings/auth0-teams#access-the-teams-dashboard), a new feature that aggregates usage across all tenants for seamless oversight that includes updated tenant limits with the ability to consolidate tenants.
* The below capabilities that can be added to your plan through our “[Let’s Chat](https://auth0.com/contact-us?place=header&type=button&text=contact%20sales)” form. You will need to move to a new plan with a yearly spend of $10,000 or more to take advantage of these options but we plan to include these add-ons via our self service plans (with a lower minimum) in the first half of 2024:
    * New multi-factor authentication (MFA) add-ons, expanding access to MFA capabilities that were previously only available to enterprise customers.
    * Increased enterprise connection limits on the B2B Professional Plan.
    * We have increased our maximum MAU tier limit on our self-service plans.

> It’s important to note that we are not making changes to any existing plans as a result of this update. However, if you make changes to your subscription, the new plan and pricing structure will be applied.

## Pricing & Payment Updates

We last updated our Essentials and Professional plan pricing in May of 2021. With the above changes the following pricing updates became effective on November 1st, 2023. **Keep in mind, this only applies to new sign ups and any subscription changes.**

* B2C Essentials pricing will now start at $35/Mo for 500 MAU, up from $23/mo for 1,000 MAU. 
* B2B Essentials prices will now start at $150/Mo up from $130/Mo for 500 MAU
* B2C Professional prices will stay the same, starting at $240/Mo for 1,000 MAU
* B2B Professional will now only be available by invoice, via our sales team, rather than credit card. 

The price adjustment on B2C Essentials creates increased transparency and price predictability as your MAUs scale on our platform, reducing the risk of customers who grow from B2C Essentials into higher plans being shocked by a price change. While the scaling rate of B2C Essentials is increasing, we’re committed to enabling customers to stay on their chosen plan for longer by making it possible to remain on a self-service plan when surpassing the previous MAU limit of 10,000.

In addition to the above plans, check out the [Auth0 for Startups program](https://auth0.com/startups), our [Auth0 for Non-Profits](https://auth0.com/nonprofits) offers, as well as our always-free plan.

### Payment options

With the above changes, we are committed and will continue to support customers that want to pay us monthly through their credit cards on plan tiers that previously supported this functionality. We will now also allow customers with a yearly spend over $10,000 to contact our sales team to purchase an annual contract paid via invoice. 

Keep in mind, any new tenants created will be subject to the new pricing structure outlined above.

![Payment options](https://images.ctfassets.net/23aumh6u8s0i/7trs7tiGY0Ea5rQ2GmU0D3/952fb21eac9f2306c58d1a3e1bb4a14a/pricing-02.jpg)

`*` Can only be purchased by contacting our Sales team directly or via the ["Contact Sales"](https://auth0.com/contact-us?place=header&type=button&text=contact%20sales) form. Please note you will need to move to a new plan with a yearly spend of $10,000 or more to take advantage of these options but we plan to include these add-ons via our self service plans (with a lower minimum) in the first half of 2024.<br> 
`**` Previously, each tenant was a separate subscription, so only one tenant of any type was allowed per plan.

## Introducing Auth0 Teams:

We understand at times it’s difficult to manage resource access, keep track of and juggle multiple tenants. Auth0 Teams aggregates usage across all tenants for seamless oversight. The addition of this feature will enable the management of administrators and multiple tenants from a single, centralized location.

### Increased tenant limits

Tenant limits are being increased as part of this update.

These new limits will be displayed on both our [pricing page](https://auth0.com/pricing) and in your tenant’s [subscription settings](https://manage.auth0.com/#/tenant/billing/subscription). 

![Increased tenant limits](https://images.ctfassets.net/23aumh6u8s0i/6c62XnCJPnWmP72v55PIlY/f33f1ad5bf8c52375a25c92f74bd73db/pricing-01.jpg)

**With the launch of Auth0 Teams, you can now link existing tenants together under one account. It’s important to note that:**

* The owner of a team and/or the admin on the tenant are the only individuals that can group tenants.
* Tenants cannot be unlinked without the assistance of Auth0 Customer Support. If you linked a tenant and need to unlink it, please contact Support by submitting a ticket in the [Auth0 Support Center.](https://support.auth0.com/)

> Keep in mind, if you choose to stay on your current plan, you will be allowed a single tenant.

### How is this different than current Auth0 offerings?

As a part of this pricing change, customers will have the opportunity to link multiple tenants to the same subscription. Usage will be aggregated across tenants and will be billed at the subscription level. This allows customers with development and staging tenants to have access to the same features within said tenants, without having to purchase additional subscriptions. Along with these changes, we’re also introducing official tenant limits that align with the positioning of our various offerings. 

### Steps on how to migrate to Auth0 Teams

Information about this process can be [found here](https://auth0.com/docs/get-started/tenant-settings/auth0-teams). If you want to migrate to Auth0 Teams, you must upgrade your plan in your tenant’s[ subscription settings](https://manage.auth0.com/#/tenant/billing/subscription) to have Teams automatically enabled for you.

## Additional Feature Offerings:

### Enterprise MFA Add-ons:

Multi-factor authentication ([MFA](https://auth0.com/docs/secure/multi-factor-authentication)) can block 99.9% of account hacking attacks. So, without being too obvious, implementing MFA within your Identity solution is pretty important. It’s imperative to prevent credential based attacks, and we want to make this easier for our customers to have access to this security feature. And so we’re introducing** Enterprise MFA Lite.**

Auth0 now allows you to use additional MFA capabilities that were previously only available to enterprise customers. Enterprise MFA Lite allows you to add any MFA factor to [Professional Plans](https://auth0.com/pricing) for an additional fee. This includes the support of [SMS](https://auth0.com/docs/secure/multi-factor-authentication/multi-factor-authentication-factors/configure-sms-voice-notifications-mfa) and push & voice notifications (SMS charges for MFA are charged separately by carriers supported by Auth0). Under Enterprise MFA Lite, subscriptions will be limited to one MFA factor on the subscription. However, this enhancement will give broader access to additional MFA protocols to support a wider range of use cases. 

### Enterprise Connection Limits:

**[Enterprise Connection](https://auth0.com/docs/authenticate/enterprise-connections)** limits are increasing from three connections to five connections on the B2B Professional Plan. This will allow for more of our SaaS customers to scale better. As a reminder, there is no limit on Okta Enterprise Connections for customers on all of our B2B plans. 

### Monthly Active Users (MAU) Tiers:

We are introducing [Essential](https://auth0.com/pricing) and [Professional](https://auth0.com/pricing) MAU tiers above the previous 7,000 and 10,000 MAU limits on B2B and B2C Plans, respectively. This change will allow you to better evaluate cost as you anticipate scaling on the Auth0 platform. 

Again, if you would like to take advantage of these options, please contact our team by completing this [form](https://auth0.com/contact-us?place=header&type=button&text=contact%20sales). Please note you will need to move to a new plan with a yearly spend of $10,000 or more to take advantage of these options but we plan to include these add-ons via our self service plans (with a lower minimum) in the first half of 2024.

If you have further questions, please reach out to the [Auth0 Community](https://community.auth0.com/) (free plans) or submit a ticket in the[ Auth0 Support Center](https://support.auth0.com/) (paid plans).

## FAQs

* **Will the free plan still be available after November 1st, 2023?**
    * Yes, the free plan will continue to be available.
* **What’s the benefit of grouping tenants?**
    * All of your tenants can be managed in one place.
    * Entitlements, usage, etc. will be viewed together.
    * Increased security.
* **What is an Auth0 Team?**
    * Provides a single point of visibility and control over your Auth0 resources by providing centralized governance, compliance, and secure collaboration at scale. More information about Auth0 Teams can be found [here](https://auth0.com/docs/get-started/tenant-settings/auth0-teams#access-the-teams-dashboard). 
* **What if my tenants are already grouped?**
    * Nothing changes unless you make changes to your subscription.
    * If you make changes to your current plan, you will need to regroup your tenants since the plan structure differs.
* **What if I have multiple plans?**
    * Tenants will need to be grouped via [Auth0 Teams](https://auth0.com/docs/get-started/tenant-settings/auth0-teams#access-the-teams-dashboard).
* **What if my company is a development agency (dev shop)?**
    * Contact [Support](https://support.auth0.com/) to request an exemption. 
* **Can I stay on my current plan?**
    * Yes, assuming you are using one tenant and are within your usage limits you can stay on your current plan.
    * We will provide you with at least 90-days notice if we decide to move existing customers that are within their usage limits to the new plan structure.
* **Where can I find the new Terms of Service?**
    * Our updated Terms of Service can be found [here.](https://www.okta.com/auth0-pss-self-service/)
* **I’m on an enterprise plan and I have a self service tenant(s) as well. Do I have to move those to my enterprise plan?**
    * Yes, and it will be more beneficial for you to manage all tenants under a single account that has enterprise capabilities.
* **Can I pay by invoice now rather than credit card?**
    * Yes, for plans above $10,000/year you can sign a contract and pay by invoice rather than by credit card. To take advantage of this, please [contact us](https://auth0.com/contact-us).
* **What happens if I have more than 7 admins?**
    * New plans released on November 1st will only get up to 7 admins.
* **Can I get more than 10K MAUs on a self service plan?**
    * Yes, we now include MAU tiers beyond 10K MAU
* **Which MFA factors can be used with the Enterprise MFA add-on on professional plans?**

* **✅ Included**
    * SMS Notifications
    * Push Notifications
    * Voice Notifications
* **❌ Not Included**
    * WebAuthn with security keys
    * WebAuthn with device biometrics
    * Email Notifications

Pricing Changes for Auth0

I stream, blog, and make youtube videos about tech stuff. I love coding, I love AI, and I love building stuff!

Juan Cruz Martinez

With the introduction of Next.js 14, Server Actions are now stable, but what are Server Actions, and how can they be used to fetch and update data from external APIs?

**Next.js** is a React framework that enables static site generation (SSG), server-side rendering (SSR), and incremental static regeneration (ISR). It is known for its performance, scalability, and ease of use.

One of the most exciting new features in Next.js 14 is Server Actions. Server Actions allow you to execute server-side code without creating dedicated API routes.
Server Actions can be helpful in various tasks, such as fetching data from external APIs, performing business logic, or even updating your database.

<AmpContent>
<amp-youtube
    data-videoid="z4JnIYIrvSE"
    layout="responsive"
    width="480" height="270">
</amp-youtube>
</AmpContent>
<NonAmpContent>
<div class='embed-container' style="position: relative; padding-bottom: 56.25%; height: 0; overflow: hidden; max-width: 100%;margin-bottom:40px;"><iframe style="position: absolute; top: 0; left: 0; width: 100%; height: 100%;" src='https://www.youtube.com/embed/z4JnIYIrvSE' frameborder='0' allowfullscreen></iframe></div>
</NonAmpContent>

## Understanding Next.js Server Actions

[Server Actions](https://nextjs.org/docs/app/api-reference/functions/server-actions) have been a part of Next.js since version 13. However, in version 14 of the framework, Server Actions are stable and incorporated by default as a framework feature.

You can use Server Actions for a variety of use cases, but they are well-suited for the following ones:

- **Fetching data from external APIs**: Server Actions can fetch data from external APIs without compromising performance or security.
- **Performing business logic**: Server Actions can perform business logic that requires server execution, such as validating user input or processing payments.
- **Updating your database**: Server Actions can update your database without creating separate API routes.

### How Server Actions work

Next.js Server Actions are asynchronous JavaScript functions that run on the server in response to user interactions on the client. Server Actions are made possible by a number of complex technical processes, but the basic idea is as follows:

1. In the client, a user action or business logic condition triggers a function call to a Server Action. For the developer, this is no different than calling an async function.
2. Next.js will serialize the request parameters (such as any form data or query string parameters) and send them to the server.
3. The server will then deserialize the request parameters and execute a function that represents the Server Action.
4. Once the Server Action has finished executing, the server will serialize the response and send it back to Next.js. Next.js will then deserialize the response and send it back to the front end.
5. When the promise resolves, the front end will continue its client-side execution.

### The syntax for defining Server Actions

You can define Server Actions in two places:

- In the server component that uses it.

```jsx
// app/page.ts
export default function ServerComponent() {
  async function myAction() {
    'use server'
    // ...
  }
}
```

- Or in a separate file for reusability.

```jsx
// app/actions.ts
'use server'
 
export async function myAction() {
  // ...
}
```

### How to invoke Server Actions

To invoke a Server Action in Next.js, you can use one of the following methods:

1. Using the `action` prop.

You can use the `action` prop to invoke a Server Action from any HTML element, such as a `<button>`, `<input type="submit">`, or `<form>`.

For example, the following code will invoke the `likeThisArticle` Server Action when the user clicks the "Add to Shopping Cart" button:

```html
	<button type="button" action={likeThisArticle}>Like this article</button>
```

2. Using the `useFormState` hook.

You can use the `useFormState` hook to invoke a Server Action from a `<form>` element.

For example, the following code will invoke the `addComment` Server Action when the user submits the form:

```javascript
'use client'

import { useFormState } from 'react';
import { addComment } from '@/actions/add-comment';

export default function ArticleComment({ initialState }) {
  const [state, formAction] = useFormState(addComment, initialState)

  return (
    <form action={formAction}>
      Add Comment
    </button>
  )
}
```

3. Using the `startTransition` hook.

You can use the `startTransition` hook to invoke a Server Action from any component in your Next.js application.

For example, the following code will invoke the `addComment` Server Action.

```javascript
	'use client'
	
	import { useTransition } from 'react';
	import { addComment } from '@/actions/add-comment';
	
	export default function ArticleComment() {
	  const [isPending, startTransition] = useTransition()
	
		function onAddComment() {
			startTransition(() => {
				addComment('This article is nothing but great!');
	    });
		}
	
	  return (
	    <button onClick={() => onAddComment()}>
	      Add Comment
	    </button>
	  )
	}
```

The `startTransition` hook ensures that the state update batches with other state updates that are happening at the same time. Using `startTransition` can improve the performance of your application by reducing the number of re-renders that are required.

### Which method should I use?

The best method for invoking a Server Action depends on your specific needs. If you need to invoke a Server Action from a `<form>` element, then use the `formAction` prop. If you need to invoke a Server Action from a component, then use the `startTransition` hook.

## Sending Data to an External API Using Server Actions

Now that we have a basic understanding of Server Actions let’s build some real-world examples, like using Server Actions to send data to a third-party API.

To start, you’ll create a Server Action that will trigger from a form submission. As you'll see later, this differs from other functions triggered by JavaScript function calls.

Create a new Server Action, `addComment`. This new function will expect one single parameter of the type [FormData](https://developer.mozilla.org/en-US/docs/Web/API/FormData/FormData); here is an example:

```javascript
// /services/actions/comment
'use server'

export async function addComment(formData) {
  const articleId = formData.get('articleId');
  const comment = formData.get('comment');
  const response = await fetch(`https://api.example.com/articles/${articleId}/comments`, {
    method: 'POST',
    headers: {
      'Content-Type': 'application/json',
    },
    body: JSON.stringify({ comment }),
  });
  const result = await response.json();
  return result;
}
```

That’s all you need to do to create a Server Action. Let’s focus on invoking this function when the user submits a form.

Let’s create a new component that will render the “Add Comment” form:

```javascript
import { addComment } from '@/services/actions/comment'
 
export default async function ArticleComment(props) {
  return (
    <form action={addComment}>
      <input type="text" name="articleId" value={props.articleId} />
      <input type="text" name="comment" />
			<button type="submit">Add Comment</button>
    </form>
  )
}
```

Done! You have a fully functional Server Action triggered from a form submission, but if you tried it out, you’ll notice that it looks unresponsive, meaning that the user is not aware that something is happening as there is no “loading” or “saving” activity shown. Let’s fix that next.

### Displaying the loading state

We can use the `useFormStatus` hook to display a loading state while a form is being submitted. As a hook, it can only live in a client component and can only be used as a child of a `form` element using a Server Action.

Let’s now update our current component, `ArticleComment`, and replace the `button` with a custom component of our creation called `AddCommentButton`.

```javascript
import { addComment } from '@/services/actions/comment'
import { AddCommentButton } from '@/components/AddCommentButton'
 
export default async function ArticleComment(props) {
  return (
    <form action={addComment}>
      <input type="text" name="articleId" value={props.articleId} />
      <input type="text" name="comment" />
			<AddCommentButton />
    </form>
  )
}
```

And, of course, you’ll have to create such a component:

```javascript
'use client'
 
import { useFormStatus } from 'react-dom'
 
export function AddCommentButton() {
  const { pending } = useFormStatus();
 
  return (
    <button type="submit" aria-disabled={pending}>
      Add
    </button>
  )
}
```

Now, when the form is submitted, the new status will be reflected in the variable `pending` and will adjust the `button` component accordingly. You can expand this code to provide more visual feedback to the user and create a better user experience.

## Submitting Files to Server Actions

If you need to send more than JSON serializable data, like texts and numbers, or more specifically, if you need to submit and handle file uploads, don’t worry. Server Actions have you covered!

You can submit files to Server Actions the same way you have worked with Server Actions so far, by using a form submission with an `<input type="file />` or libraries like `dropzone`. There’s nothing especially different that needs to happen on the client side for it to work.

On the server side, things could be different depending on your needs. For example, you could save the file, transform the file, etc. The process to retrieve the file would be the same.

Let’s look at a sample Server Action that handles a file upload and transmits the file to an API using a stream:

```javascript
// /services/actions/upload-file
'use server'

export async function uploadFile(formData) {
  const comment = formData.get('file');
  const arrayBuffer = await file.arrayBuffer();
  const buffer = new Uint8Array(arrayBuffer);
  await new Promise((resolve, reject) => {
    upload_stream({}, function (error, result) {
      if (error) {
        reject(error);
        return;
      }
      resolve(result);
    })
    .end(buffer);
  });
}
```

It is that simple!

> You must know that there is a size limitation imposed on Server Actions, which is 1 MB by default, though it can be customized. For more information, check the official [Server Action’s size limitation](https://nextjs.org/docs/app/api-reference/functions/server-actions#size-limitation) documentation.

## Best Practices for Using Server Actions

We have covered so much already about Server Actions, but the topic is so extensive that it won't fit in a single article. At least it wouldn't be practical, but I don't want to leave you without first sharing some of my recommendations and best practices to work with Server Actions and stay further. I also share some tips on accessing protected resources using Auth0 and Next.js Server Actions.

- **Decouple of Server Actions**. As we mentioned above, it is possible to write Server Actions in a separate file, but in case you don’t expect to re-utilize your function, you could write the same in a Server Component. But, as we learned from experience or the book "Clean Code", separation of concerns is important to keep the code easier to understand, maintain, reuse, and test. So, try to keep a separation between components and actions.
- **Don’t disregard the client side.** As the line between server and client blurs in the magic of Server Components, it can be easy to forget or disregard the proper handling of the UI. For example, moving from validations to the server could reduce a few lines of code but sacrifice user experience.
- **Cache the results of Server Actions.** If a Server Action returns data that is not frequently changing, you can cache the results so that they do not have to be fetched from the server every time. Avoiding unnecessary data fetching can improve the performance of your application.
- **Use Server Actions to handle errors gracefully.** If a Server Action fails, you should handle the error gracefully and return a meaningful error message to the user.
- **Protect your Server Actions.** When it comes to security, don’t think of your Server Actions any differently than you would if the same code lived in an API endpoint. Server Actions need to be secured and protected from unauthorized access.

## Calling a Protected API Endpoint

Protected APIs are not publicly accessible and require some form of authentication or authorization before they can be accessed. This is important for protecting sensitive data and preventing unauthorized access.

There are multiple mechanisms you can implement to protect APIs, for example:

- **API Keys:** API keys are a simple and effective way to protect APIs. They are secret strings that are given to authorized clients. When a client sends a request to an API, it must include its API key in the request. The API will then check the API key to ensure that it is valid before processing the request.
- **Access Tokens:** Access tokens are another way to protect APIs. They are short-lived tokens that are generated by an authentication server and are sent to an application in response to a successful user authentication. The application then uses the access token to access the API by sending it in its requests. Access tokens can be implemented in various forms, with a popular option being [JSON Web Tokens (JWTs)](https://jwt.io).

### API Keys to protect API endpoints

An API key is a secret string of characters that is used to identify and authenticate an application when making requests to an API. API keys are typically used to protect APIs from unauthorized access and to track usage.

While API keys can identify a specific project or application making an API call, they do not identify the individual user making the request. This is a significant security limitation, as it allows anyone with the API key to access the API, regardless of who they are.

To learn more about API keys and how OAuth 2.0 can help mitigate some of its drawbacks, I recommend reading [Why You Should Migrate to OAuth 2.0 from API Keys](https://auth0.com/blog/why-migrate-from-api-keys-to-oauth2-access-tokens/)

API keys implementation varies from project to project, so depending on how your target API implements API keys, it may vary the way you use Server Actions to make calls to the API.

Let’s rebuild our `addComment` Server Action to pass an API key to the target API.

```javascript
// /services/actions/comment
'use server'

export async function addComment(formData) {
	const articleId = formData.get('articleId');
	const comment = formData.get('comment');
  const response = await fetch(`https://api.example.com/articles/${articleId}/comments`, {
    method: 'POST',
    headers: {
      'Content-Type': 'application/json',
    'x-api-key': process.env.CMS_API_KEY // 👈 New Code
    },
    body: JSON.stringify({ comment }),
  });
  const result = await response.json();
  return result;
}
```

The server function remains the same, with the exception of passing a new parameter on the request headers. In the example above, the header name is `x-api-key`, but it may be different depending on the API.

Because Server Actions run in the server, it is safe to read the API keys from environment variables, though you should make sure your environment provider is safe to do so. For example, if you deploy using Vercel, all [environmental variable values](https://vercel.com/docs/projects/environment-variables) are automatically encrypted at rest.

API keys are great for multiple scenarios, but sometimes, your API needs to be aware of the user performing the action. For example, our current API is not aware of who is creating the comment, and though it could be added as a payload, it wouldn’t be safe if we couldn’t verify that it was the user who performed the operation.

### Access Tokens to protect API endpoints

Access tokens are used in token-based authentication, enabling applications to access APIs. The application receives an access token following a successful user authentication and authorization process. This token is then passed as a credential when making API calls. The presented token informs the API that the bearer has been authorized to access the API and perform specific actions defined by the scope granted during authorization.

So we can break the process in a two-step process:

- Authentication: Identifying a user and retrieving an access token
- Calling an endpoint: Using the received and verifiable access token to call the API endpoint

The process of authenticating, generating, verifying, and securely handling Access Tokens is a daunting and time-consuming task where a mistake can compromise the data and safety of your systems, so it is common for application builders to rely on existing authentication and authorization providers, for example, [Auth0](https://auth0.com/).

Authentication is outside the scope of this guide, but if you want to learn more about authentication or you want to know how to implement Auth0 authentication to your Next.js application, please follow the steps on this [quick guide](https://auth0.com/docs/quickstart/webapp/nextjs/interactive) or the complete [guide on Next.js Authentication](https://auth0.com/blog/ultimate-guide-nextjs-authentication-auth0/). And if you don’t have an Auth0 account yet, you can <a href="https://a0.to/blog_signup" data-amp-replace="CLIENT_ID" data-amp-addparams="anonId=CLIENT_ID(cid-scope-cookie-fallback-name)">sign up for a free Auth0 account</a>.

Once your users are authenticated, you can rewrite your Server Action as follows:

```javascript
// /services/actions/comment
'use server'
import { getAccessToken } from '@auth0/nextjs-auth0' // 👈 New Code

export async function addComment(formData) {
  const accessToken = await getAccessToken(); // 👈 New Code
  const articleId = formData.get('articleId');
  const comment = formData.get('comment');
  const response = await fetch(`https://api.example.com/articles/${articleId}/comments`, {
    method: 'POST',
    headers: {
      'Content-Type': 'application/json',
    'Authorization': `Bearer ${accessToken.accessToken}`, // 👈 New Code
    },
    body: JSON.stringify({ comment }),
  });
  const result = await response.json();
  return result;
}
```

In this new flow, you’ll need to retrieve the Access Token from your session. The Auth0 SDK makes this easy with the method `getAccessToken`. After that, you can simply pass the token to the request using the `Authorization` header.

Next, in the third party or external API, you can verify the token to ensure it’s not compromised, and you can decode the token to obtain additional information, such as the user, permissions, and more.

## Conclusion

Server Actions are a fantastic new feature in Next.js that allows developers to do more with less code by eliminating much of the boilerplate required to write API codes and their subsequent calling code.

In this guide, we covered the fundamentals of Server Actions to delve into the particularities of calling third-party public and protected API endpoints.

Next.js has many exciting new features, and I'll be exploring more of them in future posts. So, if you would like me to cover any specific Next.js feature, please drop a comment below.

Thanks for reading!

Using Next.js Server Actions to Call External APIs

mimi-chakravorti

I help define the Okta brand and bring it to life. I’m a part of the Brand Team within the Studio that works on brand strategy, naming, brand management, brand messaging and research. I am excited to help build our brand that not only reflects who we are today, but also helps us define our future.
<br>
I’ve spent most of my career helping some of the world’s biggest companies create their brands and tell their stories. Having done stints in advertising, research and media, most recently I was at Landor & Fitch, a leading global branding agency.
<br>
I’m a San Francisco Bay Area native and have lived in London and New York before finding my way back to the East Bay- Lafayette, to be exact. When I’m not working, I'm most likely running after my two young kids.

VP, Brand - The Studio - The Studio

Mimi Chakravorti

Since Okta acquired Auth0 in 2021, we’ve been continually aligning and integrating our teams and technologies.

Today, we’re excited to introduce the new icon and wordmark for **Auth0 by Okta!** We believe the new icon better reflects Okta’s strategy and the relationship between Workforce Identity Cloud, Customer Identity Cloud, and the Auth0 platform. 

Read on to learn a bit about the meaning behind it.

## Why the Change?

First, let’s call out what is not changing — we have not changed any URLs, APIs, or code libraries. “Auth0 by Okta” is still the same platform you know and love, and the Auth0 name remains.

With the new wordmark and icon, we reflect how the Auth0 technology is an integral part of Okta’s success and strategy. These updates evolve the Auth0 by Okta logo and wordmark to feel like part of the Okta brand family, using the Okta font and rounded shapes.

This new icon brings Auth0’s heritage forward into its place as a foundational technology of Okta and its flagship product line — Okta Customer Identity Cloud.

## New Wordmark and Icons

![New Wordmark and Icons](https://images.ctfassets.net/23aumh6u8s0i/5jPPy94Y0qylVsZeWWWKYe/65e9aa6d49e931cbc874a90886238eca/new-brand.jpg)

As a reminder of our structure, here’s how to look at it:

* **“Okta”** is one company — The World’s Identity Company.
* **“Okta Workforce Identity Cloud” **is our flagship IAM offering. Its icon alludes to the way you can bring together disparate technologies that enable your people to do their best work, all while creating a safe perimeter.
* **“Okta Customer Identity Cloud, powered by Auth0” **is our flagship CIAM offering. Its icon is an evolution of the Auth0 logo and alludes to the way you can bring together amazing experiences that are personalized to the individual, all while protecting their Identity. It carries the Okta brand promise of enterprise-level scale, support, and expertise.
* **“Auth0 by Okta”** is the technology that powers Customer Identity Cloud. Developers will continue to see this name in the code and APIs, as well as developer resources and tooling. We use the same icon as Customer Identity Cloud.

Note: Because Customer Identity Cloud and Auth0 by Okta are the same technology, you’ll likely encounter both names.

## What to Expect

You’ll notice changes to display names and icons throughout the experience and in communications. As we update things over the coming months, you may encounter both the old and new visuals. We appreciate your patience as we change these elements on a rolling basis.

## What You Need to Do

If you’re a customer, you do not need to do anything. There won’t be any interruptions to services based on these changes.
If you’re a partner who needs these icons to update your co-marketing materials, please contact [partners@okta.com](mailto:partners@okta.com).

Branding Updates

andrew-hughes

Andrew is a senior web app developer with 15+ years of experience and solid expertise with React, Node, and React Native, as well as tons of SQL/NoSQL knowledge. He has performed complicated back-end API integrations for clients, including payment platforms like Stripe and PayPal along with InfusionSoft and WordPress. His extensive professional background also includes working with PHP, Laravel, Java, and Swift/iOS.

Andrew Hughes

Create a CRUD (create, read, update, and delete) application using Spring Boot and Vue.js.

Build a Simple CRUD App with Spring Boot and Vue.js

Peter-Wheeler-author

Peter leads marketing, community, and customer engagements at Auth0.org. 
With a visceral passion for effective and sustainable Corporate Social Responsibility, Peter develops non-performative programs and engagements for social impact organizations globally. He believes all organizations deserve the opportunity to use technology as a force for good and provide solutions and support to help heroes save the world. Peter prides himself on being a polymath, entrepreneur, innovator, founder, proud failpreneur, strategic marketer, process improver, and sales enabler driving positive impact. Say hi on <a href="https://www.linkedin.com/in/jpeterwheeler/">LinkedIn</a>.



Senior Marketing Manager, Social Impact

Peter Wheeler

Reflections on Product Impact and improving our Self Service process

This entry is a celebration of the launch of our new workflow for Social Impact Organization customers who want our Self Service products.

But the topic I want to cover is a little more universal and a little more important for the team here – providing the best care we can for those who care for others.

**TL;DR:** This being a long post about shortening a process is not a joke lost on me. If you want to experience the new validation process without reading this, visit https://auth0.org/get-started.

## Our Destination Is Product Impact

This past November, I was delighted to make the announcement that we were extending our cost-savings offer for nonprofits and social impact organizations to also include 50% off on Self Service plans.

This was not a small undertaking. We had multiple platforms to access: to verify the organization’s eligibility, adjust their pricing, document, and ensure the account launched properly. 

We, of course, iterated and improved regularly – something that Auth0 is known for. What we also did is take our instantaneous Self Service onboarding process and create a time to live of up to one month, averaging 22 days - something we don’t want to be known for.

## What Was a Beautiful Customer Journey?

We launched with a process that takes up to a month, and with so many steps, we needed to publish a guide explaining how to get the offer. But we launched.

Making sure social impact organizations could get the product discounted is important to us – but we sacrificed speed and simplicity to get our launch. 

It’s easy to excuse. In an enterprise environment, diligence is life. There are features and pricing tiers and stakeholders to involve. Talking to someone - sales, an engineer, support - that’s part of the process. Our customers receive white-glove treatment, and it’s perfectly fine to introduce that to a select group of our Self Service customers.

As a marketer, an entrepreneur, and a customer, it wasn’t OK. A lot of what I love about Auth0 self-service is that it is product led. We have free plans for everyone. It’s totally DIY, and we provide documentation and plugins, and support to keep it that way. I should be able to add authentication to my project while I tinker at 2 am – or whenever I have time, not wait on a multitude of processes.

## Getting Back on the Right Path

Because I wanted to, and because we had so many steps, I have spent my time here personally onboarding every self-service social impact customer that came to Auth0. I have met some amazing people who work for inspiring organizations. We’ve shared and continue to share these stories through case studies and posts about these organizations, like [NCBI](https://auth0.com/blog/social-impact-innovations-national-council-for-the-blind-ireland/) and [Every.org](https://auth0.com/resources/whitepapers/case-study-everydotorg). 

Even though I love it, this method is not sustainable as we grow. So many customers, so few working hours.

Beyond what they’re working on, our very patient and very open social impact customers clued me into their frustrations with our onboarding and other elements of the process that made their experience different and less than the process for-profit customers enjoy.

## A New Companion for the Journey

To make sure we’re giving the cost savings to organizations that fall within our eligibility criteria, that don’t take part in hate speech, that is who they say there are - we rely on third-party agencies. These agencies are known as “validators.” When I entered this space, I learned validation platforms operate reactively - meaning a nonprofit or charity can already be a member or indexed by the system - making approval easy, and if they weren’t already in the system, applying would initiate a process to get them verified and validated. This takes time, and even in the case of “easy, already in the system,” validation was still a manual process for us, the customer, and the verification organization. 

I started exploring the corporate social impact ecosystem, and another companion on our journey, Mitch Stein ([CEO of pond](https://www.joinpond.com/), a great marketplace, and a different upcoming post), let me know of a set of entrepreneurs pivoting their social impact app into a validations-and-beyond company, [Percent](https://poweredbypercent.com/).

I met with team Percent, and their platform used a proactively filled database - pre-validating organizations at a rapid pace to eradicate future wait time. They were also able to check a box that I thought couldn’t be - they were able to add automation to the process to get customers to the “next steps” while keeping it all Auth0 - eliminating the need for a separate guide.

Less than one month of integration, building, and testing later (thank you, Flor and the ever-so-patient Auth0 Marketing Engineering Team) - we’re live!

## Welcome to Our Emerald City

So here we are. We are launching again. An updated version and an updated process. A better customer experience for the nonprofit organizations we cherish.

If you’re a nonprofit that is listed with [TechSoup](https://app.ngok.techsoup.org/Default.aspx?vendorAppId=07ae4c97-f7a0-4c2e-bd1a-9480e0d971bd) - feel free to continue to validate [here](https://app.ngok.techsoup.org/Default.aspx?vendorAppId=07ae4c97-f7a0-4c2e-bd1a-9480e0d971bd). 

If you’re one of the nonprofit organizations that may not be with TechSoup, visit [https://auth0.org/get-started](https://auth0.org/get-started) and enjoy our new validation system powered by [Percent](https://wearepercent.com/).

If you read this far, that’s where we’re at on our product impact journey as we continue to explore and improve our customer journey. Thank you for following along, and never hesitate to reach out.

Peter

Product Impact Update - Rapid Self Service TTL

darin-laframboise

Expert in Ecosystem strategies. Expert in driving product roadmaps and building long-term growth strategies. Can make quick, data-minded, impact-focused decisions to keep projects on track. Deep background in analytics and data engineering.

Director, Product Management

Darin LaFramboise

Actions Integrations reduce the amount of custom code you need to write, maintain, and update. 

[Actions launched recently](https://auth0.com/blog/actions-now-generally-available/) as the next evolution of extensibility with Auth0, picking up where our legacy extensibility tools Rules and Hooks leave off. Actions unifies the Auth0 extensibility experience in one place. With it, we took the power of Rules and Hooks and created a greatly improved developer experience with features such as an industry-standard VS Code style editor, typescript, draft mode, version control, improved secret management, and an expanded library of NPM modules. Actions gives developers the ability to customize Auth0 using the full spectrum of coding options from pro-code to [low-code](https://auth0.com/blog/what-is-low-code-how-low-code-can-speed-digital-transformation/), with the addition of no-code Actions Integrations.

Actions Integrations, as our new zero-code layer, offers an easy experience to extend Auth0 with partner-built innovations with no coding required. Now you can implement key integrations such as Identity Verification or Consent Management to your workflow without writing or maintaining a single line of code, the provider of the integration takes care of that. To use Actions Integrations, simply install an integration from the Auth0 Marketplace and drag-and-drop it into your Actions workflow. Then with only a few configuration settings, the integration is part of your tenant.

Actions Integrations, currently in Beta, are now available through the [Auth0 Marketplace](https://marketplace.auth0.com/) and in Actions in the Auth0 Dashboard. This marks an essential milestone in how you can leverage innovations from Marketplace Partners into your Customer Identity Access Management (CIAM) workflows. Through Actions and Marketplace, we are creating an ecosystem of sustainable, and ever-growing plug-and-play partner integrations that allows developers to solve many identity extensibility scenarios faster and without extra code.

Pro-Code custom Actions will continue to be a core feature of Auth0, with all the support you’ve come to expect. By adding Actions Integrations to our offerings, we give you the option to replace the custom code for common solutions with no-code integrations and leave the custom code layer for unique use cases to you. This reduces your overall maintenance and risks associated with custom code.

## Plug & Play Extensibility

### Endless innovation, centrally maintained

Satisfy your identity requirements right out-of-the-box without having to write custom code. Actions Integrations are reusable modules that are centrally maintained by a vetted Marketplace Partner. Integrations are designed to be maintained by the Partners with updates propagating automatically to all instances.This results in faster time-to-market while greatly reducing maintenance costs and resource drain associated with code updates that can result in having to rebuild Rules and Hooks.

### Common use cases

Actions Integrations exist for the most common use cases of custom extensibility. These currently include:

*   **ID DataWeb:** Real time and self service global identity verification
*   **Eva:** Second-factor voice biometric 
*   **Scaled Access:** Delegated user access management
*   **One Trust:** Consent and user preferences management
*   **Incognia:** Mobile identity proofing with address verification
*   **Incognia:** Mobile login with location behavioral biometrics
*   **SecZetta:** Real-time, risk-based authentication
*   **Yoonik:** Second-factor facial biometric
*   **Infobip:** Global SMS messaging
*   **Amazon:** Simple Notification Service (SNS) for microservices and serverless applications by Amazon
*   **ClickSend:** Global SMS messaging
*   **Cumul.io:** Self-service data visualization platform
*   **DataGuard:** Consent and user preference management
*   **Esendex: SMS authentication
*   **Mitto:** Global SMS messaging
*   **Plivo:** SMS authentication
*   **Telesign:** Global SMS messaging
*   **Vonage:** Global SMS messaging

<br>

With [Auth0 Marketplace](https://marketplace.auth0.com/), we are building partnerships to deliver innovations that further reduce your need to code features from scratch. After the public launch of Actions Integrations, we will continue to grow our Marketplace catalog, adding more services and modules to help you expand and customize your CIAM implementation.

We encourage you to start using Actions integrations to satisfy any of the common use cases that apply to you. And of course, if you encounter any questions or have any comments, please direct them to our team of identity specialists.

Auth0 No-Code Actions Integrations Now Available in Beta

michael-bui

I'm a software developer with a background in consulting and experience in technical leadership roles. The majority of my career has been with using .NET to build applications across the full-stack and for mobile, desktop, and web. My main area of interest is in agile software development and building cross-platform applications using technologies like Flutter and Xamarin.Forms.

These days I do more work using Flutter. Besides using it professionally to build applications, I've done a talk at a meetup, maintain a blog where I post about Flutter in <a href="https://dexterx.dev">DexterX</a> and contribute to and maintain various open-source projects.

Sofware Developer

Michael Bui

Update the Flutter wishlist app to use Auth0 authentication so that the user has to log in and the app accesses a secured API.

Build a Flutter Wishlist App, Part 3: Finishing the App with User Authentication and a Secured API

diegopoza

System Engineer, geek, foodie, technology lover, speaker.

Diego Poza

The new updates offer some reversals and clarifications worth paying attention to.


<div class="alert alert-info alert-icon">
  <i class="icon-budicon-487"></i>
  <strong>What are the NIST Password Guidelines?</strong><br> 
  The NIST Password Guidelines are also known as <a href="https://pages.nist.gov/800-63-3/sp800-63-3.html">NIST Special Publication 800-63B</a> and are part of the NIST’s digital identity guidelines. They were originally published in 2017 and most recently updated in March of 2020 under” Revision 3 “or” SP800-63B-3. They are considered the most influential standard for password creation and use policies by many <a href="http://www.cs.umd.edu/~jkatz/security/downloads/passwords_revealed-weir.pdf"> password cracking experts</a>.<br> 
</div>

According to the Verizon Data Breach Investigations Report, compromised passwords are responsible for [81% of hacking-related breaches](https://enterprise.verizon.com/resources/reports/dbir/). Needless to say, a key part of overall information security is securing your users’ passwords.

However, while there are a lot of conventional password security practices that seem intuitive, a lot of them are misleading, outdated, and even counterproductive.

That’s where the National Institute of Standards and Technology (NIST) password guidelines (also known as [NIST Special Publication 800-63B](https://pages.nist.gov/800-63-3/sp800-63-3.html)) come in. Although they’re required only for federal agencies, they’re considered the gold standard for password security by [many experts](http://www.cs.umd.edu/~jkatz/security/downloads/passwords_revealed-weir.pdf) because of how well researched, vetted, and widely applicable they are for the private sector.

In fact, many [corporate security teams are already using the NIST password guidelines](https://venturebeat.com/2017/04/18/new-password-guidelines-say-everything-we-thought-about-passwords-is-wrong/) as a baseline to provide something even more powerful than policies: credibility. So if you’re looking for what actually works for password security in 2020, here’s what the NIST says you should be doing (in plain English).

## New Password Creation Guidelines

Password security starts with the physical creation of that password. However, it’s not just your users’ responsibility to ensure their passwords are up to par &mdash; it’s also up to you to ensure that the passwords are strong enough (especially in light of how [the FTC handled the TaxSlayer case](https://biglawbusiness.com/cybersecurity-enforcers-wake-up-to-unauthorized-computer-access-via-credential-stuffing/)).

Here’s what the NIST guidelines say you should include in your new password policy.

### 1. Length > Complexity

Conventional wisdom says that a complex password is more secure. But in reality, password length is a much more important factor because a longer password is harder to decrypt if stolen.

Here’s a great example of how password length benefits you more than complexity on a technical level:

![Complexity of Passwords](https://images.ctfassets.net/23aumh6u8s0i/7zLMdDrj4rEC2IBL5BR2sN/cfc2a70bfbf520f7b439685894975a6c/passwords)
<p align="center">This is why <b>the NIST guidelines call for a strict eight-character minimum length.</b></p>

However, additional research shows that requiring new passwords to include a certain amount of complexity can actually make them less secure. And that’s why NIST has also removed all password-complexity requirements from their guidelines.

For example, many companies require that users include special characters, like a number, symbol, or uppercase letter, in their passwords to make them harder to decrypt. 

Unfortunately, many users will add complexity to their password by simply capitalizing the first letter of their password or adding a “1” or “!” to the end. And while it technically does make a password more difficult to crack, most password-crackers worth their salt know users tend to follow these patterns and can use them to reduce the time needed to decrypt a stolen password. 

Additionally, as password complexity increases, users tend to reuse passwords from account to account, increasing the risk that they could be the victim of a [credential stuffing attack](https://auth0.com/blog/reducing-the-impact-of-credential-stuffing-attacks/) if one account is breached. 

So instead of forcing users to create more complex passwords, ask them to create longer ones if you want to improve password security.

### 2. Eliminate Periodic Resets

Many companies ask their users to reset their passwords every few months, thinking that any unauthorized person who obtained a user’s password will soon be locked out. However, frequent password changes can actually make security worse.

It’s difficult enough to remember one good password a year. And since users often have numerous passwords to remember already, they often resort to [changing their passwords in predictable patterns](https://www.sans.org/security-awareness-training/blog/time-password-expiration-die), such as adding a single character to the end of their last password or replacing a letter with a symbol that looks like it (such as $ instead of S).

So if an attacker already knows a user’s previous password, it won’t be difficult to crack the new one. The NIST guidelines state that periodic password-change requirements should be removed for this reason.

## Password Authentication Guidelines

The way you authenticate a password when a user logs in can have a massive impact on everything related to password security (including password creation). Here is what NIST recommends regarding the actual input and verification of passwords.

### 1. Enable “Show Password While Typing”

Typos are common when entering passwords, and when characters turn into dots as soon as they’re typed, it’s difficult to tell where you went wrong. This motivates users to pick shorter passwords that they’re less likely to mess up, especially on sites that allow only a few login attempts.

So if a user can choose, when alone, to have the password displayed during typing, they have a much better shot at entering lengthy passwords correctly on the first try.

### 2. Allow Password “Paste-In”

If passwords are easier to enter, your users are more likely to use a longer, more complex password in the first place (which is more secure). That’s where “paste-in” password functionality is now advantageous &mdash; if entering passwords is as simple as copying and pasting them into a password field; it encourages safer behavior.

This is especially important considering how many passwords the average person has to remember these days and the tools people are using to manage them all.

For example, a [survey by NordPass](https://nordpass.com/blog/password-habits-statistics/) found that 70% of people in the United States and the United Kingdom have more than ten passwords (20% have over 50). And many people have started using password managers to generate and store their passwords. So by allowing paste-in functionality this also allows people to use the auto-fill function of password managers to streamline the authentication process and stay safe at the same time.

### 3. Use Breached Password Protection

The new NIST password guidelines require that every new password be checked against a “blacklist” that includes dictionary words, repetitive or sequential strings, passwords taken in prior security breaches, variations on the site name, commonly used passphrases, or other words and patterns that cybercriminals are likely to guess.

Some [platforms, like Auth0](https://auth0.com/breached-passwords/), take this to another level and check real-time login attempts against a blacklist, ensuring that users are protected even if their passwords are leaked publicly:

<include src="Vidyard" id="fCqj5aaDQT6DgL55yYqczd" />

### 4. Don’t Use “Password Hints”

Some companies try to help users remember complex passwords by offering a hint or requiring them to answer a personal question.

However, with the constant dissemination of personal information on social media or through social engineering, the answers to these prompts are easy to find, making it easy for attackers to breach your user’s accounts. So this practice is now forbidden by the NIST guidelines.

### 5. Limit Password Attempts

Many attackers will attempt to breach an account by logging in over and over again until they figure out the right password (brute-force attack). And a great way to stop these kinds of attacks is to limit the number of login attempts that are allowed before locking the account.

The average attacker will need a lot more attempts than the average typo-prone user. So by including a cutoff or delay, you’ll drastically increase the amount of time an attacker will need to break in (to the point where it’s almost pointless to try).

### 6. Use Multi-Factor Authentication

[Multi-factor authentication](https://auth0.com/multifactor-authentication/) (MFA), also known as two-factor authentication (2FA), requires that users demonstrate at least two of the following in order to log in:

1. “something you know” (like a password)
2. “something you have” (like a phone)
3. “something you are” (like a fingerprint)

**The NIST guidelines now require the use of multi-factor authentication for securing any personal information available online**. However, their guidelines are very specific on what qualifies as a valid form of authentication and what does not.

For example, in the new guidelines, email joins voice-over-internet protocol (VoIP) on NIST’s list of channels that are not acceptable for MFA because they’re not considered out-of-band (OOB) authenticators (they’re not truly a “separate channel” because they do not necessarily prove possession of a second device).

So even if you’re using two-factor authentication, you’ll want to review the NIST guidelines to ensure that the channels you’re using meet NIST standards.

### The SMS Controversy

A previous version of the NIST password guidelines stated that using SMS as a second channel for authentication may not meet OOB requirements and could be disallowed in the future.

This led to a deluge of articles released by the security world declaring the death of SMS-based 2FA. However, the next revision of the NIST guidelines contained no explicit mention of SMS deprecation, leading to confusion.

![Nist guidelines](https://images.ctfassets.net/23aumh6u8s0i/2STV4YKmHKKMmB4xtRBt5u/c478850d37b6aa648fa5bdf87faed42e/sms-controversy)

After [lobbying from the CTIA](https://blogs.sap.com/2017/07/06/rollback-the-united-states-nist-no-longer-recommends-deprecating-sms-for-2fa/), NIST backtracked on its concerns, explicitly including SMS as a valid channel for OOB authentication.

Nevertheless, some concerns about SMS authentication remain valid. [SMS channels can be attacked](https://auth0.com/blog/what-the-new-nist-guidelines-mean-for-authentication/) by smartphone malware and SS7 hacks. In addition, message forwarding and number changes mean that access to messages does not always prove possession of a device.

NIST has not ignored this uncertainty. Their guidelines do insist that authenticators make sure the user’s telephone number is associated with a specific physical device when SMS (or voice) 2FA is used. They further recommend that authenticators watch for behavior such as device swapping, SIM changes, and number porting, which could indicate a compromised channel.

However, the removal of recommendations against SMS indicates that this [widely used 2FA channel is far from dead](https://blogs.sap.com/2017/07/06/rollback-the-united-states-nist-no-longer-recommends-deprecating-sms-for-2fa/). It remains much more secure than email and is an effective way to reduce your reliance on passwords.

## Password Storage Guidelines

Many security attacks have nothing to do with weak passwords and everything to do with the authenticator’s storage of passwords. Here’s what NIST recommends for ensuring passwords are stored securely.

### 1. Secure Your Databases

Your users’ passwords will be stored in a database (or several). So, to protect them, it’s important that access to these databases is limited to essential personnel only.

However, most companies’ databases aren’t as secure as you’d expect.

“The big thing that bothers me is when I go to a customer’s site. Usually, their [database] configuration is so weak that it’s easy to exploit. You usually don’t need buffer overflow or SQL injection [attacks] because the initial setup of the database is totally insecure,” Slavik Markovich, CTO of Sentrigo, told [Dark Reading](https://www.darkreading.com/risk/hackers-choice-top-six-database-attacks/d/d-id/1129481).

So to ensure that your users’ passwords are stored safely, you’ll want to ensure that your databases are secured from the [most common attacks](https://www.darkreading.com/risk/hackers-choice-top-six-database-attacks/d/d-id/1129481) at all times.

Additionally, keep in mind that any authentication credentials your administrators use should follow the NIST guidelines as well since that’s how attackers often gain access.

### 2. Hash Users’ Passwords

Password database breaches are going to happen. However, you can still protect your users in the event they do by hashing their passwords before you store them. For example, [Patreon’s](https://www.wired.com/2016/06/hacker-lexicon-password-hashing/) databases were breached in 2015. But thanks to a strong hashing scheme (bcrypt), the attackers were unable to use the credentials they acquired because they couldn’t revert the password hashes to the original passwords.

The NIST guidelines require that passwords be salted with at least 32 bits of data and hashed with a one-way key derivation function such as Password-Based Key Derivation Function 2 (PBKDF2) or Balloon. The function should be iterated as much as possible (at least 10,000 times) without harming server performance.

In addition, they recommend an additional hash with a salt stored separately from the hashed password. That way, even if the hashed passwords are stolen, brute-force attacks would prove impractical.

## Focus on User Experience to Improve Password Security

Cybersecurity and user experience are often at odds with each other. But the NIST password guidelines are pretty clear: strong password security is rooted in a streamlined user experience.

Your users will always do what makes their lives easiest (and [research shows](https://www.darkreading.com/informationweek-home/password-reuse-abounds-new-survey-shows/d/d-id/1331689) they’ll do so even if they know that behavior compromises their password security). So if you create the kind of user experience that uses this tendency to encourage safe behavior, it helps you both keep their data secure.

_Want to learn more about finding the magical balance between UX and security? [Check out this blog post that lays out our philosophy](https://auth0.com/blog/balancing-ux-and-security-at-auth0/)._


NIST Password Guidelines and Best Practices for 2020

tadej-slamic

With over a decade in the software industry, I've helped startups launch their first product, assisted FTSE100 enterprises with digital transformation, been a part of the fintech boom, and helped particle accelerators cool down. I enjoy architecting and creating scalable backends and crafting modern mobile, web, and desktop apps.

CTO at Shortcut AS

Tadej Slamic

Learn how to use Spring and Java to build a feature-complete API. Learn how to use Spring Boot to create, read, update, delete, and validate data.

Spring Boot Tutorial: Build a CRUD API (Java)

Learn how to use TypeScript to build a feature-complete Express API. Tutorial on how to use TypeScript with Express to create, read, update, and delete data.

Node.js and TypeScript Tutorial: Build a CRUD API

kapehe-jorgenson

Kapehe is an R&D Content Engineer for Auth0 with a passion for learning and teaching. With her primary focus on ReactJS and JavaScript, she is impressed with what code can create for the web. Technology and web development are constantly evolving and naturally bring that need for continual learning. She enjoys writing tutorials, hosting local meetups, and learning with others to expand coding knowledge.

R&D Content Engineer

Kapehe Jorgenson

Let's dive into the updates that Node.js version 14 gives us!



That's right! Node.js version 14 is here! 🎉

Whether you have upgraded your Node version already or are thinking about doing it soon, let's discuss some of the things that this new version gives us! We'll even chat about older versions and what to expect there in the coming months.

<AmpContent>
    <amp-twitter width="375"
      height="472"
      layout="responsive"
      data-tweetid="1252616090422775809">
    </amp-twitter>

</AmpContent>

<NonAmpContent>

  <blockquote class="twitter-tweet"><p lang="en" dir="ltr">Node.js v 14 is here! 🎉💚 <a href="https://t.co/iB7dK5uljY">https://t.co/iB7dK5uljY</a></p>&mdash; Node.js (@nodejs) <a href="https://twitter.com/nodejs/status/1252616090422775809?ref_src=twsrc%5Etfw">April 21, 2020</a></blockquote> 
  <script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script>

</NonAmpContent>

## How to Upgrade

Want to upgrade your current Node.js version? Following the instructions [here](https://nodejs.org/en/download/current/) to download for any operating system: macOS, Windows, and Linux. We will find that Node.js 14.0.0 includes npm 6.14.4.

## What's New?

There are many things to look forward to with this major release. Some of the new features include:

1. The once experimental feature, Diagnostic Reporting, is now stable!
2. V8 has been upgraded to V8 8.1
3. Node Streams have been updated
4. Removal of Experimental Modules Warning

Let's walk through these!

To find the full list of changes, you can [visit this page](https://nodejs.org/en/blog/release/v14.0.0/). 

<include src="TweetQuote" quoteText="That's right! Node.js version 14 is here! 🎉"/>

### Diagnostic Reporting is now stable!

Diagnostic reporting generates a JSON-formatted file that can aid in diagnosing problems. When things go wrong in your app, like slow performance or memory leaks, it's helpful to have a full report on where issues are occurring. Even if our app were to crash, this report would have information on that as well. We can run this report in development, testing, or production.

Back when Node.js v12 was released, [diagnostic reporting](https://nodejs.org/api/report.html) was experimental. We now have it as a stable feature in this new version. 

To run the report, run the following in your command line:

```bash
node --report-uncaught-exception --report-on-signal \
--report-on-fatalerror app.js
```

Let's break down this command:

* `--report-uncaught-exception`: The report will generate on uncaught exceptions. We want to make sure all errors are caught and handled.
* `--report-on-signal`: This will allow for reports to be generated when a specific signal is sent to the Node.js process.
* `--report-on-fatalerror`: Reports all the fatal errors. It lets us know of all the errors that would cause our js applications to stop working.
* `app.js`: Where we are running the diagnostic report.

> There are many different variations to this command. Visit [this page](https://nodejs.org/api/report.html) for the official docs on diagnostic reporting in Node.js and other ways to use the command.

<include src="TweetQuote" quoteText="Diagnostic Reporting is now stable in Node.js v14!"/>

### V8 upgraded to v8.1

This Node.js v14.x release also comes with the newly upgraded [Javascript engine: v8.1](https://v8.dev/blog/v8-release-81)!

There are a handful of things that were added into this version; one that we'll cover here is the [nullish coalescing operator](https://wiki.developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Operators/Nullish_Coalescing_Operator).

The nullish coalescing operator looks like this: `??`. The operator returns the results of the expression to the right of the operator only when the expression to the left of it is `null` or `undefined`. Otherwise, the results from the left expression are returned. Let's see that in action:

```javascript
const newVersion = null ?? 'Does this work?';
console.log(newVersion);
// expected output: "Does this work?"

const nullishTest = 0 ?? 55;
console.log(nullishTest);
// expected output: 0
```

The value on the left-hand has to be `null` or `undefined` for the right-hand value to be ran. So in the second example, it was a `0` on the left; because that is not `null` or `undefined`, it returned with the `0` number.

This helps a lot with values that are returned `null` or `undefined` when we were not expecting them to do so. So if something happens in our app and it returns `null`, the operator moves on to maybe an error message or a default value (the value on the right-hand side of the operand) and gives the user something to see.

Some other things that are in v8.1 include:

* [Optional Chaining](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Operators/Optional_chaining)
* [Intl.DisplayNames](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Intl/DisplayNames)
* [Enables calendar and numberingSystem options for Intl.DateTimeFormat](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Intl/DateTimeFormat)

### Streams

Streams can help with many things in Node, here are a few:

* Handling data
* Handling writing/reading files
* Network communication

Streams have not been recently added (they've been around for a while), but consistency has improved. [Some examples that were mentioned](https://medium.com/@nodejs/node-js-version-14-available-now-8170d384567e#4f1c) were:

* `http.OutgoingMessage` is similar to `stream.Writable`. To learn more about `stream.Writable`, visit [this docs page](https://nodejs.org/api/stream.html#stream_class_stream_writable).
* `net.Socket` behaves exactly like `stream.Duplex`. To learn more about `stream.Duplex`, visit [this docs page](https://nodejs.org/api/stream.html#stream_class_stream_duplex).

A [blog post by Michael Dawson and Bethany Griggs recommends](https://medium.com/@nodejs/node-js-version-14-available-now-8170d384567e#4f1c) that if your application relies heavily on streams, start testing now! This will help us get ready for the Node.js v14 LTS release in October 2020.

The full stream module official documentation can be found [here](https://nodejs.org/api/stream.html).

### Removal of Experimental Modules Warning

When running an ECMAScript Modules (ESM) in Node.js, we would get an "Experimental Warning". That warning has now been removed. That's it! It's still experimental, the warning has just been removed. 

![GitHub view of warning text being removed](https://images.ctfassets.net/23aumh6u8s0i/2gZ5cHBFGnWCndRMuCjrZQ/3c5129df9fd6b9394f8d69e4bcb7f064/experimental-modules-warning)
([Source](https://github.com/nodejs/node/commit/22b6997abae339202d77877368f50ae52b890c44))

ESM is JavaScript's standard module system. It helps with managing variables, organizing functions, and grouping things that would make sense in our code. To learn more about this feature, check out [the official documentation](https://nodejs.org/api/esm.html).

ESM is the best module format thanks to its simple syntax, async nature, and tree-shakeability.

## Experimental Additions

In this version update, we see a couple of experimental additions. Those include:

1. [Experimental Async Local Storage API](https://nodejs.org/api/async_hooks.html#async_hooks_class_asynclocalstorage)
2. [Experimental Web Assembly System Interface](https://nodejs.org/api/wasi.html)

Head on over to the [official Node.js v14 docs](https://nodejs.org/api/) to find out all the updates and experiments! 

## What About Older Versions?

Nervous about what is going to happen to your older versioning? Not ready to upgrade just yet? The older versions will lose their support soon, but we've got time! The LTS version release status is "long-term support", which typically guarantees that critical bugs will be fixed for a total of 30 months.

We can see the support and release line here:

![Current release schedule](https://images.ctfassets.net/23aumh6u8s0i/77cPUuzd0qRGBtZCPHrqSm/e99ec8aab7ac969895cd2b0f9d263ef3/release-timeline)
([Source](https://nodejs.org/en/about/releases/))

<include src="asides/Node" />

## Conclusion

This Node.js release is exciting, and after looking at some of the new updates, I'm super excited to try it! Let me know if you have updated your Node.js version and what you think of version 14. 

---


Node.js v14: What's New?

joan-pepin

As CSO, Joan is responsible for the holistic security and compliance of Auth0's platform, products, and corporate environment. She brings 20 years of experience to the role, with a career that has spanned a wide variety of industries, including healthcare, manufacturing, defense, ISPs, and MSSPs. <br /><br />Previously, Joan served as Business Information Security Officer (BISO) at Nike, Inc, CISO, and VP of Security at Sumo Logic, and held different positions at Guardent/Verisign/Secureworks organization. Joan holds a patent for developing the methodology to assess whether a communication contains an attack. <br /><br />She is also is a well-recognized thought leader and has spoken at major events, such as RSA, WhiteHat Security Summit, and Forrester Security Summit, and is frequently called upon for her expertise and commentary in Cloud Security and Compliance in large-scale and DevOps/CI environments.

Chief Security Officer (CSO)

Joan Pepin

Insights from giving our business continuity plan a COVID-19-induced update



What are the critical things your company needs to keep its doors open? 

Many companies have a Business Continuity Plan (BCP) in place that covers loss of facilities during things like floods and earthquakes, but it's primarily the really big companies (or those who provide critical services for health care) who’ve done more than download a pandemic plan template off the internet and call it good.

[Only 62% of 500 U.S. companies surveyed](https://www.techrepublic.com/article/business-continuity-plans-and-tech-are-lacking-during-the-coronavirus-pandemic/) by SaaS-based accounts payable vendor _AvidXchange_ at the beginning of March had business continuity plans – nearly half of those said they covered contingencies for only two to three weeks – and 10% have no plan at all. At Auth0, we’ve had a BCP in place for years, but [COVID-19](https://auth0.com/blog/business-continuity-at-auth0-our-response-to-covid-19/) prompted an immediate review. The process proved both necessary and revealing. And because we believe it can help other companies, we’re sharing our approach here.

## Ask Yourselves How Do You ‘Degrade Gracefully’?

The first time I heard of a Pandemic Plan was during the [Bird Flu Outbreak](https://en.wikipedia.org/wiki/Avian_influenza) in 1997, while working for the main security company. A large pharmaceutical company was a major vendor, so they required a plan. Unlike our current situation with COVID-19, the plan remained largely theoretical. That’s not the case now. Even if you have a theoretical pandemic response plan, now is the time to make it real. What are you actually going to do?

In computer science, if hardware or a network has been partially destroyed or rendered inoperative, there’s a limited function necessary to keep it going. That process of how the machine or system shuts down is called “graceful degradation.” So, in a pandemic where your people could be out due to illness or permanently gone, you can apply the same question to your business: How do you degrade gracefully? 

This is not what anyone wants to think about. What if half my staff is sick or permanently gone? But it is much easier to think about it now than when you’re in the middle of it rather than when it’s too late to remediate. Think about it now and you will be doing your future self a big favor. Your future self will be so thankful that your past self documented all these things and you don’t have to think about it while you’re worried about your team. You can just follow the plan that you’ve made.

![Pandemic Plan](https://images.ctfassets.net/23aumh6u8s0i/6eWOAZSW8CT2gSGUHYWjix/af815dc9c1ab6e6e4b4036099e423c9b/plan_sep1)

## How to Create a Pandemic Business Continuity Plan
You’re going to start by assessing the most critical functions that need to continue to happen for you to remain in business. Or the way I’ve been thinking about it: what is the absolutely last thing that gets shut off? Then you’re going to work backward. What are the things that are required to make sure that thing keeps working? What are the dependencies?

In our case, maintaining service for our existing customers is our most critical function. (Yes, it’s going to be important to add new customers, but if we’re just talking about the absolute most critical function, that’s it.)

In order to keep our service running for existing customers, we need to continue to pay AWS and the employees who are directly responsible for keeping it running. So for us, that would be the very last thing to go before the end of the world when we put all the chairs on the table, lock the doors, and head for the hills. 

If you’re a consulting company, you’d end up in a different critical place. You need to keep shipping deliverables to your clients. The ability to email or transfer files would be a critical function. The key is to go to the end of the world, find the most critical business process, and then work back. 

At Auth0, we worked ourselves backward to an absolute worst-case scenario where our staff numbers became more and more constrained, taking us from our global staff of 660 to just 10% remaining and created a plan where we could continue serving our customers. You should review your specific needs to understand your minimum number of employees for critical functions.

### Defining ‘Mission-Critical’ Functions
This process isn’t going to be easy for everyone, but it is an opportunity to think about the bigger picture. This is an opportunity to think about what’s best for the whole company and your customers. Try and set any ego aside. It’s not an insult if your department is not a business-critical function. Just because something isn’t “mission-critical” doesn’t mean it’s something the company will stop doing even in a pandemic. 

As CSO, I know that my team's ability to monitor and respond to security incidents is by definition a mission-critical role even in a pandemic. But, I also know that if we're really down to 10% of staff across the company, I'm going to take whatever resources I have to help keep our core service running for our customers. That's how the BCP helps me, my team, and my peers prioritize. In a sense, even as CSO, I know my place in this chain.

Since creating a BCP plan can bring a lot of different priorities and perspectives into conflict across the company, our entire executive leadership team worked closely to define a set of business-critical priorities for their teams to work from when fleshing out the remainder of the BCP update. 

![Pandemic Plan](https://images.ctfassets.net/23aumh6u8s0i/N21EflGpHem6FVAnIRzNa/9596f571f0021f037ab387287aac831a/plan_sep2)

Because human beings have egos and there may be disagreement about what your most essential business processes are, this is an exercise that the most senior level of leadership should do and agree on. It should not be up to the C-level to put the plan together, but it is their responsibility to have a unified voice because these are business-critical functions. We broke our functions into four categories:

* **Mission-Critical:** Loss of these functions would result in wide-spread loss of reputation, damage to the business, as well as potential damage to the general public.
* **Business Essential:** Loss of these functions would make it difficult, but not impossible to continue the business. Things like generating revenue, customers, following compliance regulations, and maintaining our external help desk fall under this category for Auth0.
* **Business Core:** Loss of these functions would have an indirect revenue impact. In the COVID-era that includes not attending conferences, which impacts both leads and indirectly, customer satisfaction.
* **Business Supporting:** These functions impact employees, not employee productivity. Auth0 examples include employee reviews, our internal help desk, and business support functions.

As things fail, how do we work from the bottom of the list to protect our mission-critical functions? 

If half of your people could be out at any given time and only two people know how to do a given thing that’s critical, that’s not enough.

Here are three questions to ask:

* What are the tools necessary for each business function?
* Who are the people who know-how and are authorized to perform that function?
* Is the process documented with screengrabs so that a smart person could figure out how to make it happen?

### The Hard-Drive Tolerance Approach to Cross-Training
There isn’t great guidance on how many people are needed for cross-training. If all your finance people are in Seattle and everyone in Seattle gets sick, well, that’s not going to work. So I based our approach on hard drive tolerance.

For a hard drive to be considered fault-tolerant, typically the data is backed up in five copies in different places. That’s what we’re doing with people — five people who understand how to perform the process and have access to simple documentation but aren’t all in the same place. As a globally-distributed company, multiple locations are an easily achieved standard for us. If you’re not able to rely on geographic distance, you might want to cross-train additional staff.

![Pandemic Plan](https://images.ctfassets.net/23aumh6u8s0i/6pUwP72d4UnvgotPIDO5YP/954716e2549c226b4994e733066131fe/plan_sep3)

## Update 2x a Year, More in Crisis
We took five working days to review our plan and put this streamlined approach in place. Compared to other pandemic plans I’ve seen, ours is super-actionable — the kind of thing that leaders can actually lean on to help them make decisions.

Essentially it’s:

* A stack rank of priorities by team
* Documented instructions
* A Confluence page with who does what, down to five levels of people and their status
* And the instructions to print it out and store it

We are going to keep an eye on our plan and update it quite regularly through the evolution of this pandemic, likely on a monthly basis. Once we’re through the pandemic, we’ll dial that back to twice a year.

## Your Plan Will Make You Stronger
Your plan doesn’t have to take weeks. As I mentioned, we got our review done in five working days. Even if you’re starting with no plan at all, the effort is worth it for what you’ll gain. You’ll discover things you didn’t realize about your business like:

* Departments you didn’t realize were critical.
* Areas where you are under-staffed.
* Processes that need to be documented.
* People who need to be cross-trained.


Your teams will gain:

* A clearer understanding of how they function AND how they relate to the company’s overall mission.
* Likely every department will have an “aha” moment by going through this process.
* Clear direction on communication AND actions.
* Relief that they won’t have to make it up as they go along.

Like the 40 pounds of pasta I have in my garage, if this all blows over, it will get eaten, it’s not going to go to waste. And going through this process will make you a stronger team even when this situation disappears.

<include src="asides/AboutAuth0" />


How to Create an Actionable Pandemic Plan

df6c864847fba9687d962cb80b482764?size=200 avatar

df6c864847fba9687d962cb80b482764?size=200

Martin Gontovnikas, a.k.a Gonto, is a software engineer at heart who moved to the ‘dark side’ and became VP of Marketing at Auth0. He considers himself lucky to have found a way to combine his two passions and apply his engineering thinking model to marketing.<br/><br/> Gonto’s analytical thinking is a huge driver of his data-driven approach to marketing strategy and experimental design. He is based in the Bay area, and in his spare time, can be found eating gourmet food at the best new restaurants, visiting every local brewery he can find, or traveling the globe in search of new experiences.

Former SVP of Marketing and Growth at Auth0

Martin Gontovnikas

Use public support to your advantage. Roll out privacy features that build your brand's integrity.


In the wake of the EU-centric [_General Data Protection Regulation (GDPR)_](https://auth0.com/blog/get-ready-for-gdpr/), several other nations, as well as states in the U.S., followed suit with similar privacy regulations. One of the landmark follow-on initiatives, the [_California Consumer Privacy Act (CCPA_)](https://leginfo.legislature.ca.gov/faces/billTextClient.xhtml?bill_id=201720180AB375), was approved in June 2018. CCPA will take effect on January 1, 2020.

The Act [builds on existing California law](https://leginfo.legislature.ca.gov/faces/codes_displayText.xhtml?lawCode=BPC&division=8.&title=&part=&chapter=22.&article), which requires businesses to disclose basic information on data collection practices and data breaches.

In January 2020, California residents, who share their state with many of the world’s tech giants, may ask companies handling their data to disclose what personal information has been collected, and how and why they’ve collected it. Residents will also be able to “opt out of” having their data shared with or sold to third parties.

If companies do not or cannot comply — residents have the right to sue. Many companies are already feeling the pressure.

According to Robert L. Wallan, a partner with Los Angeles-based firm Pillsbury Winthrop Shaw Pittman LLP, [as cited in *Insurance Journal*](https://www.insurancejournal.com/news/west/2019/07/01/530904.htm):

> “You’re going to see some class-action litigation, my prediction is, pretty early.”

Despite the threat of hefty fines ([$7,500 per violated record](https://leginfo.legislature.ca.gov/faces/billTextClient.xhtml?bill_id=201720180AB375)) — as well as reputational damages — for noncompliance, many teams are still not prepared. If you’re a chief security officer (CSO) or team lead responsible for safeguarding the data of your users, this article provides an update on major points in the current version of the CCPA — and ways to quickly meet these requirements.

In doing so, you could set yourself apart from [86%](https://fortune.com/2019/03/19/companies-california-privacy-law/) of organizations who are not yet compliant (according to a TrustArc survey reported on in *Fortune*), build greater credibility with your users, and set yourself up for more sustainable growth.

## CCPA: Major Points (the Good and the Bad) to Know

As of the [_July 1, 2020 enforcement date_](https://www.huntonprivacyblog.com/2018/09/01/ccpa-amended-enforcement-delayed-substantive-changes-made/), the Attorney General will support California residents who request the following from companies that collect and use their personal information (PI):

* the particular pieces of personal information they collect,
* the categories of sources that provided their data,
* the categories of third parties with whom they share the data, and
* their commercial reasons for collecting or selling the data.

The CCPA broadly [defines PI](https://leginfo.legislature.ca.gov/faces/billTextClient.xhtml?bill_id=201720180AB375) as information about a California resident that “identifies, relates to, describes, is capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household.” This covers standard items, such as:

* SSN
* driver’s license and passport numbers, purchasing histories,
* internet activities,
* geolocation data, and
* professional or employment-related information.

It also includes “inferences drawn about a California resident” — personal details such as interests, aptitudes, or predispositions that a company uses to [create a customer profile](https://auth0.com/blog/digital-success-through-customer-identity-and-access-management/). For a full list of PI as defined by the CCPA, see [here](https://leginfo.legislature.ca.gov/faces/billTextClient.xhtml?bill_id=201720180AB375).

Under the CCPA, residents may also request that companies delete any personal information (subject to certain exceptions). As mentioned above, they may also opt out having their data sold.

While the Act isn’t set to be enforced until July 1, 2020, it covers personal data twelve months prior to the January 1, 2020 effective date. This means that the CCPA *already* applies to companies’ data collection, storage, and usage practices today—and throughout 2019. If you don’t have a process in place to handle these specific requests, it’s time to create one.

There are more important criteria to note. If an individual does not want their information sold, the CCPA gives them the right to maintain a consistent level of service and steady costs (i.e., not be discriminated against for not consenting). Under the Act, companies are required to clearly display a link that says "do not sell my data" at the bottom of any page that collects personal information. The CCPA also increases fines and penalties for companies that do not take reasonable measures to secure consumer data—again, a civil penalty of up to $7,500 for each violation.

The Act exclusively applies to businesses that:

* have annual gross revenues greater than $25,000,000;
* buy, sell, or otherwise use personal information of 50,000 consumers, households, or devices each year; or
* derive 50% of their annual revenue by selling personal information.

Since being approved in June 2018, the CCPA has already [_been amended_](https://www.dataprivacymonitor.com/ccpa/california-amends-landmark-privacy-law-delaying-enforcement-and-making-revisions/) — and it’s likely to be revised further. Numerous bills could make the CCPA even more stringent. If the CCPA applies to your company, it’s critical that you’re up to speed to avoid penalties. At the same time, this might feel like an overwhelming task when the regulations continue to grow more numerous and complex.

### The Bad News

The practice of collecting consumer data has expanded without regulation for years. Many companies rapidly and successfully built themselves on this information, which underpins their marketing, product development, industry research, and corporate strategy. Now, they must make major operational changes, including the following:

* Tighten and clearly communicate the process whereby customers can request access to their data, have it erased, or transfer it to another data controller.
* Create new systems with better [user management](https://auth0.com/user-management) and/or potentially hire more IT staff.
* Consider outsourcing core services to an [expert managed services provider](https://auth0.com/blog/managed-service-providers-myths/) if the company can’t cover expanded data-privacy needs in-house
* Work with pared-down data sets in the event that consumers withdraw their information.

Figuring out what to do to bring your company into compliance has never been more important — but you don’t have to work through it alone.

### The Good News

Since California is a hotbed of startups, many young and medium-sized teams are flexible by nature. In contrast to industries like insurance, where many teams have processes set in stone over decades, most tech companies and [tech unicorns](https://auth0.com/blog/so-you-want-to-be-a-unicorn/) are more nimble and willing to adapt to changing circumstances. Already, most of these have sent out updated privacy-policy emails to their customers:

![Everlane changes its privacy policy making it easier to understand](https://images.ctfassets.net/23aumh6u8s0i/1E4wAnIObdgK5o5DS08bUP/063ec75b42428fec586862450e9da822/everlane-changes-privacy-policy-making-it-easier-to-understand)

![Houzz updates its policies to make them more transparent](https://images.ctfassets.net/23aumh6u8s0i/iH4yYW88yxsjFttg4ldXO/bdc27ad70562353ce495b040e03698cd/houzz-updates-policies-to-make-them-more-transparent)

In anticipation of CCPA enforcement — as well as the implementation of data privacy policies across [107 nations](https://unctad.org/en/Pages/DTL/STI_and_ICTs/ICT4D-Legislation/eCom-Data-Protection-Laws.aspx) and [nearly 15 other U.S. states](https://www.dataprivacymonitor.com/ccpa/the-california-consumer-privacy-act-frequently-asked-questions/) — other industries are quickly following suit. In addition to email, some best practices are arising across sectors on the back end, including [_identity and access tools_](https://auth0.com/b2e-identity-management-for-employees), specialized managed service providers, [more efficient deletion of user data](https://segment.com/blog/preparing-for-the-ccpa-and-the-future-of-privacy-regulation/), and enhanced anomaly protections for suspicious user behavior.

## Anomaly Detection

[Many companies are taking advantage of](https://twitter.com/intent/tweet?text=%22Auth0+has+anomaly+detection+to+protect+consumer+information.%22%20via%20@auth0%20http://auth0.com/blog/brace-yourself-the-gdpr-ripple-effect-in-california/) [anomaly-detection tools](https://auth0.com/docs/anomaly-detection) to ensure that the users accessing consumer information are (1) who they say they are and (2) behaving appropriately. With large organizations giving access to a wide swath of users both internally (IT staff, marketers, managers) and externally (third-party contractors or consultants), it can be difficult to figure out who is logging in when and from where, and who is using what device(s). Implementing identity access and management tools that incorporate anomaly detection can be essential for avoiding fraudulent practices.

![Auth0 has anomaly detection to protect consumer information](https://images.ctfassets.net/23aumh6u8s0i/4bGZ8v04Sr8DuJR9hXNeYg/583bb6a4ad7a7f7c7e4b02e8a7df8c69/auth0-has-anomaly-detection-to-protect-consumer-information)

With Auth0, anomaly detection is customizable. Once enabled, you can set rules that alert administrators to any suspicious activity and block login attempts by specific users if, say, they are working with data they do not have authorization to use or they fail to enter the system with the correct password.

<include src="TweetQuote" quoteText="Auth0 has anomaly detection to protect consumer information."/>

Teams have been testing and finding early success with these and other new features, like [user dashboard views](https://auth0.com/docs/getting-started/dashboard-overview). Even if you're not a hot tech startup, you still have the advantage of proximity to some of the most cutting-edge technologies and resources in the world.

## Seize the opportunity

The CCPA has strong momentum to become even more robust. As consumers continue to feel the damages from the massive Target and Equifax breaches, Cambridge Analytica’s [_data leaks_](https://auth0.com/blog/cambridge-analytica-and-facebook/), the recent [Marriott breach](https://auth0.com/blog/marriot-starwood-data-breach-5-steps-to-protect-your-data/) and [British Airways incident](https://www.nytimes.com/2019/07/08/business/british-airways-data-breach-fine.html) — they’re pushing their representatives for change. The original ballot initiative that gave rise to the CCPA had [>600,000 signatures](https://www.wired.com/story/california-unanimously-passes-historic-privacy-bill/) when it passed, nearly 2x the 366,000 minimum requirement. Private and public sector coalition backers included the Consumer Federation of California, DuckDuckGo, Consumer Reports, BLUR, DeleteMe, Catalina's List, the Center for Public Interest Law, the Parent Coalition for Student Privacy, and the Academy of Integrative Health & Medicine.

Instead of facing CCPA enforcement with anxiety or opposition, use this swelling public support for the measure to your advantage. Get ahead of the curve in rolling out privacy features to your users on the front end, improve your back-end policies with better identity and access management software to protect your customers, and build a reputable brand in difficult times.

<include src="asides/AboutAuth0" />


Brace Yourself for CCPA Aftershocks (2019 Update)

Use Auth0's Management API to perform administrative tasks on Auth0 clients.



**TL;DR**: In this article, we are going to go over Auth0’s Management API v2. We will cover some of its features and how it can help with client management. We will also dive deeper into the process of updating the client name via the Management API. Each Auth0 application has its own unique client ID which allows us to manipulate each client individually. To see a working example, please take a look at [this GitHub repo](https://github.com/auth0-blog/auth0-management-api).

## Management API v2

When using the Auth0 dashboard, we can see that we can do some of the following items:

1. Create a new client
2. Update the settings for each client
3. Add a new rule for a client
4. And the list goes on and on

Imagine being able to do all of that via the back-end of an application. At [Auth0](https://auth0.com/), we have the Management API that can handle client management, hence the name. Anything the Auth0 Dashboard can do, the Management API can do as well, plus more!

If we were to head over to the Auth0 Docs, we could see more information on the [Auth0 Management API v2](https://auth0.com/docs/api/management/v2).

<include src="TweetQuote" quoteText="Anything the Auth0 Dashboard can do, the Management API can do as well, plus more!"/>

## How Can I Use It?

When using the Management API, we always need to start with a client. Each client belongs to a project or a website. We’ll start with `example.com`. We create an Auth0 client via the "Application" tab, hook it up to `example.com`, and get authentication running for `example.com`. Great!

One great way we could use it would be to update the client information without having to go into the Auth0 Dashboard every time. We could update the client's name, the description, etc.

> The Management API helps with bulk configuration changes and/or automating application changes.

### The solution

While the Management API can be used for administrative tasks like updating client information that’s not the only thing it can do. If we were to take a look at [this list from Auth0 ManagementClient Documentation](https://auth0.github.io/node-auth0/module-management.ManagementClient.html), we could see that there is a large list of items that the Management API can handle.

To name a few:

- [getUsersByEmail](https://auth0.github.io/node-auth0/module-management.ManagementClient.html#getUsersByEmail) - which will get all the users with a particular email address that we input as the first parameter.

```javascript
auth0.getUsersByEmail(email, function(err, users) {
  console.log(users);
});
```

- [updateRule](https://auth0.github.io/node-auth0/module-management.ManagementClient.html#updateRule) - we can update rules that are currently being used.

```javascript
var params = { id: RULE_ID };
var data = { name: "my-rule" };
management.updateRule(params, data, function(err, rule) {
  if (err) {
    // Handle error.
  }

  console.log(rule.name); // 'my-rule'.
});
```

- [getClient](https://auth0.github.io/node-auth0/module-management.ManagementClient.html#getClient) - where we can get the client’s information by using the client id.

```javascript
management.getClient({ client_id: CLIENT_ID }, function(err, client) {
  if (err) {
    // Handle error.
  }

  console.log(client);
});
```

<include src="TweetQuote" quoteText="Use Auth0's Management API to take care of administrative tasks."/>

## Real World Example

In this article, we are going to dive deeper into the functionality that updates the client’s name. This can also be done from the dashboard, but we will be using the Management API to do it instead.

### The project setup

If there is a current project we would like to add the Management API functionality to, we can add this logic to our back-end code. If we are starting with a new project, be sure to create one. We can start a new project by creating a new repository in GitHub and cloning into that repo. Once in that new project, run the following command to get `npm` running on it:

```bash
npm init
```

You will be prompted with questions, like the name of the project, etc. If starting from scratch is not what we want to do, again, pull the code from [this GitHub repo](https://github.com/auth0-blog/auth0-management-api) and follow the instructions in the `README.md`

## Step One - Create the Client and Enable the Management API

First things first, we need to create a client via the Auth0 dashboard. Want to follow along? Now would be the time to [sign up for Auth0 for free](https://auth0.com/signup) or sign in to an existing Auth0 account and head to the [Auth0 Dashboard](https://manage.auth0.com/#).

> Note: Remember that each Auth0 application has a unique Client ID.

Now that we are on the Dashboard view, follow these steps:

1. Click on `+ Create Application`
2. Name the App (For example, "management-api-test")
3. Click on `Machine to Machine Applications`
4. Click on `Create`
5. Select an API - in our case, we want to select `Auth0 Management API`
6. Choose scopes. We will choose `read:clients` and `update:clients`
7. Click on `Authorize`.
8. Go to the `Settings` tab to view `Client ID`, view the `Client Secret`, add in `Allowed Callback URLs`, etc.

There are a few other steps we need to do to make sure our client is ready to communicate with the Management API. If we were to stay in the "Settings" section of our application, scroll down until we see "Token Endpoint Authentication Method". It should say anything but "None", so either "Basic" or "Post". This will allow for the "Client Credentials" to be available.

![Auth0 Dashboard view of Token Endpoint Authentication Method](https://images.ctfassets.net/23aumh6u8s0i/498NEGCrkiQUJex4fw1ma8/5dbb2724f6913915466548d3c491dc31/token-endpoint)

If we continue scrolling down and click on "Show Advanced Settings", we should see in the menu bar, "Grant Types". Click on that. Once clicked, we should then see that "Client Credentials" has been clicked to show the checkmark.

![Auth0 Dashboard view of Client Credentials](https://images.ctfassets.net/23aumh6u8s0i/3UVw4r4Y2Jw0rpo0Dr3ykR/f820e36ca114be4a9690a25ef7e9321d/client-credentials)

Do not forget to hit "Save Changes" at the bottom.

With both of those in, we are ready to build the code in our project.

## Step Two - Create a File to Handle the ManagementClient

Rather than sticking all of our `get` and `update` code into a bunch of little files, let’s create a new file that we’ll use to organize all of our functions.

In the root of the project, create a new file that we will call `Auth0Manager.js`. This file will have all the Management API logic.

We will need to set up a couple of things before we build this file and start our project. We will need `file-system`, `dotenv`, `axios`, and `auth0` installed in our project. We can get these installed by running the following command:

```bash
npm install --save file-system dotenv axios auth0
```

In our `Auth0Manager.js` file we are going to have the following code:

```javascript
// Auth0Manager.js

const axios = require("axios");
const ManagementClient = require("auth0").ManagementClient;

/**
 *
 * How this works:
 *  1. Requests an access token using client_id and client_secret
 *  2. Uses the access token to create a new ManagementClient
 *  3. Use the ManagementClient to interact with the API: https://auth0.github.io/node-auth0/module-management.ManagementClient.html
 *
 */

module.exports = (function() {
  let managementClient;

  return {
    init,
    getClient,
    updateClient
  };

  /**
   * Create a management client
   */
  function init() {
    return getToken()
      .then(data => data.access_token)
      .then(token => {
        const managementClient = new ManagementClient({
          domain: `${process.env.CLIENT_DOMAIN}`,
          token,
          audience: `https://${process.env.CLIENT_DOMAIN}/api/v2/`
        });

        // set it so we can use it in our other methods
        this.managementClient = managementClient;
        return true;
      })
      .catch(err => err);
  }

  /**
   * Get an access token from the Auth0 API
   * We will use this access token to connect to the management API
   * To get a token, we need to provide client_id and client_secret
   * Both of these can be found in the APIs section of Auth0 dashboard
   */
  function getToken() {
    // get the info we need
    const clientId = process.env.CLIENT_ID;
    const clientSecret = process.env.CLIENT_SECRET;
    const url = `https://${process.env.CLIENT_DOMAIN}/oauth/token`;

    // make the call to the API via POST
    return axios
      .post(url, {
        client_id: clientId,
        client_secret: clientSecret,
        grant_type: "client_credentials",
        audience: `https://${process.env.CLIENT_DOMAIN}/api/v2/`
      })
      .then(res => res.data)
      .catch(err => err);
  }

  /**
   * Make a call to the Management API to get all the data for a certain client
   * All the things that are available in the dashboard can be accessed here
   * @param string clientId
   */
  function getClient(clientId = null) {
    if (!clientId) clientId = process.env.CLIENT_ID;

    return this.managementClient
      .getClient({ client_id: clientId })
      .then(client => client)
      .catch(err => err);
  }

  /**
   * Take data and update the Auth0Client
   * This can be used to update the entire client via API instead of in the dashboard
   * Very helpful if moving settings from local to a production environment
   *
   * @param {Object} data     The data that will overwrite anything in our dashboard
   * @param {String} clientId The client that we want to update
   */
  function updateClient(data, clientId = null) {
    if (!clientId) clientId = process.env.CLIENT_ID;

    return this.managementClient
      .updateClient({ client_id: clientId }, data)
      .then(client => client)
      .catch(err => err);
  }
})();
```

As we can see in this file:

1. We have the `init()` function that is creating the management client.
2. We have the `getToken()` function that gets an access token for us.
3. The `getClient()` function grabs the client credentials for us to use.
4. Finally, the `updateClient()` function allows us to update the client.

### .env file

We are going to need a `.env` file that will hold our client credentials. We need to be sure to create one and put in the following credentials:

```bash
CLIENT_DOMAIN="your domain, example: kapehe.auth0.com";
CLIENT_ID="client id from auth0 application";
CLIENT_SECRET="client secret from auth0 application";
```

> **Note:** Do not forget to add the `.env` file to `.gitignore`.

## Step Three - Our `get-client.js` and `update-client.js` files

Now that we have our `Auth0Manager.js` and `.env` files set up, let’s use those functions in two different files, `get-client.js` and `update-client.js`.

### get-client.js

We will start by building out our `get-client.js` file. In the root of the project, create a new file named: `get-client.js`. From there, we are going to want to run the information from the `Auth0Manager.js` file. That file will look like this:

```javascript
// get-client.js

require("dotenv").config();
const Auth0Manager = require("./Auth0Manager");
var fs = require("file-system");

Auth0Manager.init()
  .then(() => Auth0Manager.getClient())
  .then(client => {
    var data = fs.writeFileSync("./client-data.json", JSON.stringify(client), {
      encoding: "utf8"
    });
    console.log(data);
    return client;
  })
  .catch(console.error);
```

Let's go ahead and run this code:

```bash
node get-client.js
```

This will create a new file named `client-data.json`. The file will be automatically created and appear in the root of the project. In this file, we will see exactly the output of what we are requesting in JSON format. We will see things like:

1. Tenant Name
2. Client Name
3. Client ID

By using the `file-system` npm package, it was able to "write" a new file, put the client information in a JSON format, and return that client information to the newly created file.

### Updating client information

Now that we have that newly created file, `client-data.json`, we can go into that file and edit things directly from there. We are _unable_ to update `client_id` but we can, from this file, update the `name`, `description`, or even `allowed_clients`.

In this example, we are going to be updating the `name` field. Currently, we see the name as `management-api-test`. Let's go ahead and type in any new name, for example, `my-management-api`.

Our `client-data.json` file `name` field should look like this now:

```json
"name": "my-management-api",
```

Save that file. Next, we are going to build the file that will read that updated name and send it to the Auth0 Dashboard for us.

### update-client.js

Let's build our `update-client.js` file. In the root of the project, create a new file and name it `update-client.js`. In that file, we are going to have the following code:

```javascript
// update-client.js

require("dotenv").config();
const Auth0Manager = require("./Auth0Manager");
var fs = require("file-system");

// the new data we want to set
let newData = fs.readFileSync("./client-data.json", "utf8", function(
  err,
  data
) {
  if (err) {
    throw err;
  }
  return data;
});
newData = JSON.parse(newData);
const updatedData = { name: `${newData.name}` };

Auth0Manager.init()
  .then(() => {
    return Auth0Manager.updateClient(updatedData);
  })
  .then(updatedClient => {
    console.log(updatedClient);
    return updatedClient;
  })
  .catch(err => ({ message: "There was an error!", ...err }));
```

Once we run the command:

```bash
node update-client.js
```

We will get a returned console of the `updatedClient`. If we look at the `name` property in our console, we will see the new name that we inputted earlier! To test that all the way, go to the Auth0 Dashboard and click on "Applications". We now see the updated name for our application.

To update other properties, like the `description` field, we would need to update the following line in our `update-client.js` file:

```javascript
const updatedData = {
  name: `${newData.name}`,
  description: `${newData.description}`
};
```

And update the `description` field in the `client-data.json` file, like so:

```json
"description": "my new description",
```

We would now be able to see the updated `name` and `description` in our console but also in the Auth0 application dashboard view after we run:

```bash
node update-client.js
```

![Auth0 application view with updated name and description](https://images.ctfassets.net/23aumh6u8s0i/5R4xQMZpWHs7YJEaHAjEUh/42a1127b5d8801fb485d5a2a36e9b9a0/updated-name-description)

## Conclusion

As we saw in this example, the Management API took care of the task of updating the client's name without having to do it via our Auth0 Dashboard. We can use the Management API to do many administrative tasks, so getting familiar with it can be very beneficial in time management but also with ensuring data was updated or transferred correctly.

Go ahead and use the [Management API](https://auth0.com/docs/api/management/v2/) in other available ways. It's amazing what it can do! Again, if you want to see a working example of this project, check out [this GitHub repo](https://github.com/auth0-blog/auth0-management-api).

<include src="asides/AboutAuth0" />


Update Auth0 Applications using the Management API

In this Redis tutorial, learn how to install and setup Redis as well as commands to write, read, update, and delete data from the store using its core data structures.

Introduction to Redis: Installation, CLI Commands, and Data Types

001c9ddc5ceb9829b6aaf24f5d28502a

I am software developer with a keen interest in open-source technologies, Linux, and native development. I've worked on many different platforms Android, iOS, Win32, Linux, FreeRTOS, the Web, and others. I've gone through the whole stack and I enjoy learning and using the latest technologies. I now work as a full-stack developer at Auth0.

Senior Engineer

Sebastian Peyrott

We have released new versions of JWT.io and the JWT Debugger extension, learn what's new.



We have released another round of updates for our [JWT.io](https://jwt.io/) website and the JWT Debugger extensions ([Chrome](https://chrome.google.com/webstore/detail/jwt-debugger/ppmmlchacdbknfphdeafcbmklcghghmd), [Firefox](https://addons.mozilla.org/en-US/firefox/addon/jwtio-debugger)). Among the new features are [HMAC](https://en.wikipedia.org/wiki/HMAC) secret length hints, common claim descriptions, simplified library updates for the website, a share button for the website, support for plain RSA public keys, and more token types can be passed in the URL! In this post, we will go over these new features.

<include src="TweetQuote" quoteText="A new round of updates for JWT.io and the JWT Debugger extensions have been released!"/>

---

## JWT.io and the JWT Debugger extension
[JSON Web Tokens (JWTs)](https://jwt.io/introduction/) are a convenient way to exchange claims between parties. The key features of JWTs are their simple format (Base64-encoded JSON) and the use of signatures and/or encryption. [JWT.io](https://jwt.io/) provides a convenient way to debug and inspect [JSON Web Tokens (JWTs)](https://auth0.com/e-books/jwt-handbook), along with an introduction to some of the key concepts behind them. It also provides a list of libraries and frameworks that can be used with them in many different programming languages.

The JWT Debugger extensions ([Chrome](https://chrome.google.com/webstore/detail/jwt-debugger/ppmmlchacdbknfphdeafcbmklcghghmd), [Firefox](https://addons.mozilla.org/en-US/firefox/addon/jwtio-debugger)) are the [Web Extension](https://browserext.github.io/browserext/) versions of JWT.io. The debugger has the same features as the website but can be used offline. It also provides additional features like automatic inspection of web storage and cookies to easily find and edit JWTs in websites!

Now, let's go over the new features of this release!

## New Features
### HMAC Secret Length Hints
As [we have seen on our blog before](https://auth0.com/blog/brute-forcing-hs256-is-possible-the-importance-of-using-strong-keys-to-sign-jwts/), the length of the HMAC secret is one of the fundamental properties to ensure it cannot be brute forced. For this reason, we have added two hints:

- The default secret for all HMAC token examples now hints at the minimum required length.

![Default secret for HS256 example](https://images.ctfassets.net/23aumh6u8s0i/7bsOiqkha9rbIRXBIaeVhm/ffafe28856d614488a591a39dcdf4cbc/1-hmac-hint-1)

- When typing, a tooltip appears if the secret is too short to be considered safe.

<video src="https://cdn.auth0.com/blog/jwt-io-updates-2/2-hmac-hint-2.mp4" controls autoplay loop></video>

Do note, however, that length is not the only thing that is important for secrets. They must also be hard to guess, or, in other words, completely random.

### Share Button
A `share button` to easily pass tokens in URL form has been requested many times, and indeed, it was already available in the extension. Now it is also available on the website!

<video src="https://cdn.auth0.com/blog/jwt-io-updates-2/3-share-button.mp4" controls autoplay loop></video>

### Easy Library Updates
Since its inception, adding a new library to the library list at JWT.io has been a cumbersome process. Several [Pug](https://pugjs.org/) and CSS files needed to be edited. Furthermore, editing an existing library had its problems too: to change features one had to remember class names, for example. We have finally modernized the process. Now libraries are located in the `views/website/libraries` folder. There, you will find a JSON file for each language or framework. Inside the JSON file you'll see something like this:

```json
{
  "name": "Node.js",
  "uniqueClass": "node",
  "image": "/img/2.svg",
  "bgColor": "rgb(138, 194, 68)",
  "libs": [
    {
      "minimumVersion": "4.2.2",
      "support": {
        "sign": true,
        "verify": true,
        "iss": false,
        "sub": false,
        "aud": true,
        "exp": true,
        "nbf": false,
        "iat": false,
        "jti": false,
        "hs256": true,
        "hs384": true,
        "hs512": true,
        "rs256": true,
        "rs384": true,
        "rs512": true,
        "es256": true,
        "es384": true,
        "es512": true
      },
      "authorUrl": "https://github.com/auth0",
      "authorName": "Auth0",
      "gitHubRepoPath": "auth0/node-jsonwebtoken",
      "repoUrl": "https://github.com/auth0/node-jsonwebtoken",
      "installCommandHtml": "npm install jsonwebtoken"
    }
  ]
}
```

Multiple libraries go in the `libs` array. Most of the JSON file is self-explanatory, but some values are optional. For full details, check out the [README](https://github.com/jsonwebtoken/jsonwebtoken.github.io/blob/master/README.md) file.

To add a language or framework, a new JSON file must be created. The name of the file should start with a number, followed by a name, and end with `.json`. No further changes are required (other than editing the contents of the file).

It really is that simple!

### JWT.io as OpenID Connect Callback
One of the uses that JWT.io originally supported, was to be set as the callback for OpenID Connect operations (you can do this from the Auth0 Dashboard). That way, after a successful login, developers could be sent automatically to JWT.io with the returned token in the editor. This was disabled a long time ago during refactors. But now, that feature is back!

<video src="https://cdn.auth0.com/blog/jwt-io-updates-2/4-jwt-io-callback.mp4" controls autoplay loop></video>

The following URL parameters are recognized: `access_token`, `id_token`, `token`, and `value`.

<a href="https://auth0.com/signup" data-amp-replace="CLIENT_ID" data-amp-addparams="anonId=CLIENT_ID(cid-scope-cookie-fallback-name)">Sign up for a free Auth0 account</a> to try this out!

### Common Claims Tooltips
In our previous update, we had enabled tooltips for dates in claims. This time, we have extended tooltips to also show a short description of what the claim means.

<video src="https://cdn.auth0.com/blog/jwt-io-updates-2/5-claims-tooltips.mp4" controls autoplay loop></video>

Of course, human-readable dates still work.

### Plain RSA Public Keys
Some RSA implementations work using the [old PEM-encoded RSA public key without the X.509 `SubjectPublicKeyInfo` header](https://stackoverflow.com/questions/18039401/how-can-i-transform-between-the-two-styles-of-public-key-format-one-begin-rsa) that is much more common nowadays. Unfortunately, old versions of JWT.io did not support these keys. But that's no longer the case! Plain RSA keys of yore are now supported, try it out!

<include src="TweetQuote" quoteText="The new round of features for JWT.io include: HMAC secret length hints, a share button, easy library updates, JWT.io as OIDC callback, common claim tooltips, and plain RSA pubkeys!"/>

## Other Changes
Of course, not every change in this release is related to new features. In this release, we have also:

- Merged **all PRs**.
- Added **6 new libraries** (thanks to external contributors!).
- Updates **12 libraries** (thanks again to external contributors!).
- Improved the [README file](https://github.com/jsonwebtoken/jsonwebtoken.github.io/blob/master/README.md).
- Implemented some **design changes**.
- Passed the **100 combined tests** mark!
- And fixed a good deal of bugs.

<include src="asides/Jwt" />

## What's Next
After all these changes, we will now let the codebase stabilize for a while. Of course, if you find any bugs, please report them in [the bug tracker](https://github.com/jsonwebtoken/jsonwebtoken.github.io/issues).

But that is not all! We are also thinking of more ways of improving JWT.io. Here are some of the ideas we are considering at the moment:

- Adding a button to clear the last saved token.
- Allowing the selection of different tokens passed in as URL parameters (`access_token` vs `id_token` for example).
- Support more algorithms, such as `ES512` or the [new EdDSA signatures](https://tools.ietf.org/html/rfc8037).
- Undock capability for the extensions (if possible).

What are your thoughts? Don't hesitate to tell us in the comments or by opening an enhancement request in the [bug-tracker](https://github.com/jsonwebtoken/jsonwebtoken.github.io/issues). Hack on!


Another Round of JWT.io and JWT Debugger Extension Updates



We have released a major update to our [JWT.io](https://jwt.io/) website and the [JWT Debugger](https://chrome.google.com/webstore/detail/jwt-debugger/ppmmlchacdbknfphdeafcbmklcghghmd) extension based on it. Among the new features, there are new signing algorithms, improved public-key handling, human-readable timestamps, and even [Firefox support](https://addons.mozilla.org/en-US/firefox/addon/jwtio-debugger) for the extension! In this post, we will go over these new features.

<include src="TweetQuote" quoteText="JWT.io and the JWT Debugger extension have been updated with new features!"/>

---

## JWT.io and the JWT Debugger extension
[JSON Web Tokens (JWTs)](https://jwt.io/introduction/) are a convenient way to exchange claims between parties. The key features of JWTs are their simple format (Base64-encoded JSON) and the use of signatures and/or encryption. [JWT.io](https://jwt.io/) provides a convenient way to debug and inspect [JSON Web Tokens (JWTs)](https://auth0.com/e-books/jwt-handbook), along with an introduction to some of the key concepts behind them. It also provides a list of libraries and frameworks that can be used with them in many different programming languages.

The [JWT Debugger extension](https://chrome.google.com/webstore/detail/jwt-debugger/ppmmlchacdbknfphdeafcbmklcghghmd) is the [Web Extension](https://browserext.github.io/browserext/) version of JWT.io. The debugger has the same features as the website but can be used offline. It also provides additional features like automatic inspection of web storage and cookies to easily find and edit JWTs in websites!

New versions of JWT.io and the JWT Debugger extension have been released. Let's go over the changes.

## New Features
### New Signing Algorithms
For a long time, JWT.io and the JWT Debugger extension only supported the two most popular algorithms: HS256 and RS256. HS256 is an HMAC-based algorithm that relies on a shared secret between parties to produce and verify signatures. On the other hand, RS256 is an RSA-based algorithm, relying on public and private key pairs to sign and verify signatures. The advantages of RS256 are clear: signatures can only be produced by the private-key holder, while verification can be performed by anyone holding the public key. However, the complexity of the implementation for RS256 can make HS256 signatures better for certain use cases (embedded, small devices, etc.).

![New algorithms](https://images.ctfassets.net/23aumh6u8s0i/1NaGCSea11eRFPXlrqP2EO/daed2abf80e328068b91d25647d6f087/1-new-algs)

The new version of JWT.io and the extensions support many more algorithms:

#### HMAC
- HS384
- HS512

These are variants of HS256. HMAC signatures rely on a hash function to produce and verify the signature. In the case of HS256, the hash function is SHA-256. For the other two, the hash functions are SHA-384 and SHA-512. For certain use cases, SHA-512 exhibits better performance than the other two. Security wise, none of these hash functions has been broken.

#### RSA
- RS384
- RS512
- PS256
- PS384

Much like the HMAC counterparts, RSA signatures also rely on a hash function to produce and verify a signature. The same thing changes between RS256, RS384, and RS512.

PS256/384 use a different type of signature (RSA-PSS) that also relies on the RSA algorithm as the baseline. In particular, it uses an encoding method that relies on a random salt value. This produces probabilistic rather than deterministic signatures. It is considered stronger than RS256/384/512 signatures as long as the random salt is truly random. In case the salt is not truly random, it provides the same level of strength as the baseline RSA algorithm

#### ECDSA
- ES256
- ES384

These algorithms rely on the elliptic-curve digital signing algorithm (ECDSA) rather than RSA. The main advantage of ECDSA is that keys can be smaller for a similar level of cryptographic strength. A 256-bit ECDSA key provides a cryptographic strength similar to a 3248-bit RSA key. This makes ECDSA keys better for certain hardware limited devices.

> If you are interested in a detailed rundown of JWT signing algorithms, don't forget to check our [JWT Handbook](https://auth0.com/e-books/jwt-handbook). Chapter 7 goes over all signing algorithms in detail.

#### "none"
JWTs also support setting the `alg` claim to `none`. This means that the JWT is not signed. Unfortunately, this has resulted in [critical vulnerabilities in JSON Web Token libraries](https://auth0.com/blog/critical-vulnerabilities-in-json-web-token-libraries/). For this reason, JWT.io and the JWT Debugger extensions now consider `alg: "none"` tokens always _invalid_.

### Automatic Public-Key Download
Another interesting feature that has been added is automatic public key downloads. Public-key algorithms, such as RSA, RSA-PSS, and ECDSA, rely on public-keys to verify signatures. Public-keys, like their name implies, can be safely shared without compromising the security of the signature. For this reason, it is not uncommon for JWT public-keys to be available either embedded in the token itself, or in a public URL.

JWT.io and the JWT Debugger extensions now attempt to get public keys in different ways according to the claims embedded in the token.

If the token contains both the `iss` and `kid` claims, JWT.io will attempt to download the token from a specially crafted URL. For example:

```javascript
header: {
  kid: 1
},
payload: {
  iss: "https://username.auth0.com/"
}
```

In this case, JWT.io and the extensions will attempt to download the key with `kid = 1` from the special URL `https://username.auth0.com/.well-known/jwks.json`. This is a [common scheme used by Auth0](https://auth0.com/docs/jwks). In other words, all Auth0 JWTs can now be verified in JWT.io and the JWT Debugger extension by simply pasting the token!

<include src="TweetQuote" quoteText="With automatic key downloads, all Auth0 JWTs can now be verified in JWT.io and the JWT Debugger extension by simply pasting the token!"/>

Of course, since the JWK and JWS standards declare other common schemes for specifying keys, these are also supported: the `jwk`, `jku`, `x5c`, and `x5u` claims. These are used to either embed a key within the token (`jwk` and `x5c`) or to declare a URL to get the keys or certificates (`jku` and `x5u`). For example:

```javascript
header: {
  kid: 1,
  jku: "https://username.auth0.com/.well-known/jwks.json"
}
```

In this case, JWT.io and the extensions will attempt to download the key with `kid = 1` from the URL `https://username.auth0.com/.well-known/jwks.json` specified in the `jku` claim.

### Human Readable Timestamps
Several JWT claims are time-based. For instance, the `iat` claim specifies the exact time the JWT was issued at, the `exp` claim specifies the expiration time for the JWT, the `nbf` sets the time when the JWT becomes valid, etc. Unfortunately, these claims are based on the [Unix epoch](https://en.wikipedia.org/wiki/Unix_time): they specify the number of seconds elapsed since January 1st, 1970. Understanding these values by simply looking at them is hard. For this reason, now JWT.io and the JWT Debugger extensions display a tooltip when the mouse hovers over a supported time claim.

![Human readable timestamps](https://images.ctfassets.net/23aumh6u8s0i/KAGGuSxmdUdMO3YeLBJfh/a21a8482154c72bf97bb527ed7b670b0/2-timestamps)

The supported claims are: `exp`, `iat`, `nbf`, `auth_time`, and `updated_at`.

### Firefox Support
Yes! It's finally here. Ever since the first release of the JWT Debugger extension for Chrome we have received requests for a Firefox version. Now it's here and supports all the features of the Chrome extension. [Get it here](https://addons.mozilla.org/en-US/firefox/addon/jwtio-debugger)!

![JWT Debugger on Firefox](https://images.ctfassets.net/23aumh6u8s0i/3oxA0AoIwuIHbRGmi2gcqh/eb843e039c0aa895d02963ecd0eabb51/3-firefox)

## Streamlined Codebase
Although the new features are the cool part of the release, we have also done a ton of internal work on both JWT.io and the extensions. In particular:

- We have closed over 40 issues and merged over 15 pull requests (some with more libraries!).
- We have synchronized the codebases of JWT.io and the JWT Debugger extensions to always get the latest features out to you, regardless of what you use more.
- We have updated all internal dependencies to the latest versions. This has fixed many bugs here and there and also improved the experience on mobile platforms.
- We have performed a major refactor to improve code quality and latencies during page load. JWT.io is now faster than ever!
- We have added more tests to our test suite. Do check that these pass before submitting new PRs!
- Build scripts are now simpler. Want to contribute? Doing so is as simple as:

Steps:

1. [Checkout from Git](https://github.com/jsonwebtoken/jsonwebtoken.github.io/).
2. `npm install`
3. `grunt`

That's it! You will now find JWT.io available on [http://localhost:8000](http://localhost:8000) and ready for your changes. The extension is also built but you'll need to load it manually in your browser, see the Chrome or Firefox docs for help with this. The resulting code can always be found in the `dist` folder. Send your PRs!

<include src="asides/Jwt" />

## What's Next
Although we have just finished with these changes, there's still more in our pipeline!

- **Key-length tips:** we will show you tooltips when your shared secrets are not long enough.
- **Share button:** the extensions already support this, now it's coming to JWT.io!
- **Library submission process:** we get tons of PRs with new libraries, we want to formalize the process and setup tools so that you can easily review any steps that are required to add your library to JWT.io

We hope you enjoy all the new features and changes at [JWT.io](https://jwt.io/) and the JWT Debugger extensions. Please report any bugs at the [GitHub repository](https://github.com/jsonwebtoken/jsonwebtoken.github.io/) and don't forget to leave us your comments or requests here or in the issue tracker at GitHub. Cheers!



JWT.io and JWT Debugger Extension Updates

We have updated our latest benchmark article to use array keys and see what happens!

More Benchmarks: Virtual DOM vs Angular 1 & 2 vs Others

647b1eea820b3fc8a5aee0383930b888

Pablo Terradillos

Good news! We have redesigned the user's profile page in order to make use of the new API v2.

**TL;DR**

  * We have redesigned the user's profile page to use the new [API v2](https://auth0.com/docs/apiv2).
  * API v2 brings an improved way of [handling metadata](https://auth0.com/docs/apiv2Changes#8). In short, metadata will be stored in a separate section (__app\_metadata__ and __user\_metadata__) on the user structure and not merged with root attributes, which had caused confusion before.
  * The data you've modified in our previous dashboard version or using API v1 is now under __app\_metadata__.
  * This is a change on the __Dashboard__, not on the runtime. There are __no breaking changes__ to your apps.



Good news! We have redesigned the user's profile page in order to make use of the new [API v2](https://auth0.com/docs/apiv2).

User's data is now separated in three sections, each one with different meanings according to what it represents.

### User Identity Section

On the main section you will find essential data such as the user's email and login access information.

![](https://images.ctfassets.net/23aumh6u8s0i/6LbA0xu4dya03bD8aExG8T/21358da3d094afc2a08fa652ed1ed4af/new-profile-1)

### Metadata Section

The __Metadata__ section is the part of the user's data that you can modify.

In the previous user's profile, the _metadata_ was merged with the user's root-level attributes which created some confusion. To make everythig more explicit and easier to find, we've decided to keep it separate.

![](https://images.ctfassets.net/23aumh6u8s0i/4V8oIZct9VAUovYhncaUZu/66bc7ba25550102849126c70eb67ae9d/new-profile-2)

If you modified user attributes in the past through the dashboard, you will find the additional attributes under __app\_metadata__  after this change (since the dashboard was using API v1).

> [Learn more](https://auth0.com/docs/apiv2Changes#8) about when to use __app\_metadata__ vs __user\_metadata__.

### Identity Provider Attributes Section

Last but not least, there's the __Identity Provider Attributes__ section. Here you will find all the information retrieved from the authentication provider (e.g. Facebook, Twitter, Google, SAML, your own provider, etc.).

![](https://images.ctfassets.net/23aumh6u8s0i/5bXOtYXCdeKnvzGcrFCY7o/a7b5279bd5595a509804a3b11591045a/new-profile-3)

This data is read-only. Let's say you'd like to modify the picture that is coming from the Facebook profile. You won't be able to change the attribute in the __Identity Provider Attributes__ section. Instead you need to set the `picture` attribute in the `user_metadata` property and then in your application you would do:

```
<img src="<%= user.user_metadata.picture || user.picture %/>">
```

The previous code snippet tries to use the `picture` property from `user_metadata` and if it doesn't exist it uses the default (`user.picture`).

### Raw JSON

Finally, you can easily take a look at the raw JSON format that will be served by our API at the new __Raw JSON__ tab.

![](https://images.ctfassets.net/23aumh6u8s0i/3jXo0J6Xek3EupwcorE8tc/cda8de0de8dad94eca98f1301d9335f4/new-profile-4)

Update of the user's details section

0cd73f2f2f39709bd03646e9225cc3d3?s=200 avatar

0cd73f2f2f39709bd03646e9225cc3d3?s=200

I’m an engineer with a passion for building frictionless products. I’ve built effective teams and have grown them into successful engineering organizations. I like to forge a culture.

CTO and Co-founder

Matias Woloski

For the last few months, we've been working on many new features and improvements to the platform.

For the last few months, we've been working on many new features and improvements to the platform.
We have reached **1700+ subscribers** to our service, and there are now many companies using the private cloud appliance daily. Thanks for your support, feedback and business!

As this first year closes for us, we wanted to share some of the highlights of Auth0, and the functionality we've added in these past months:

<ol style="font-size: 14px;">
  <li><a href="#1">1. Know who is using your apps</a></li>
  <li><a href="#2">2. Richer user profiles</a></li>
  <li><a href="#3">3. Avoid building yet another user/password store</a></li>
  <li><a href="#4">4. Increase your conversion rates</a></li>
  <li><a href="#5">5. Decrease development costs with our SDKs</a></li>
  <li><a href="#6">6. SAML-enable your applications</a></li>
  <li><a href="#7">7. Lighter, better UX and open sourced Login Widget</a></li>
  <li><a href="#8">8. Waste no time remembering passwords</a></li>
  <li><a href="#9">9. Deploy Auth0 Anywhere</a></li>
  <li><a href="#10">10. A Robust online infrastructure</a></li>
</ol>



---

<a name="1"></a>
### 1. Know who is using your apps
You have a more powerful visualization of _when_, _how_ and _how often_ your users access your apps:

[![user analytics](https://images.ctfassets.net/23aumh6u8s0i/3P9yrlvW4Qw8XPuYjMHgyK/356210b0243cab6a7c1bdc96b26e6602/user-details)](https://images.ctfassets.net/23aumh6u8s0i/3P9yrlvW4Qw8XPuYjMHgyK/356210b0243cab6a7c1bdc96b26e6602/user-details)

---

<a name="2"></a>
### 2. Richer user profiles
Many of you wanted to associate additional information to your users' profile in addition to the attributes you get from the authentication source. You can do this through the dashboard or through an API.

[![user metadata](http://dl.dropboxusercontent.com/u/21665105/user-actions.gif)](http://s3.amazonaws.com/blog.auth0.com/newsletter-1/user-actions.gif)

---

<a name="3"></a>
### 3. Avoid building yet another user/password store
Auth0 lets you outsource the authentication by relying on the built-in user/password store. We take care of password hashing, validations, email verification, forgot password flow, single sign on, etc.  And if you want to use your own implementation, then it is as easy as turning a switch.

[![outsource users and password](https://images.ctfassets.net/23aumh6u8s0i/6ctIoMxkLfUWJUePNyKpA3/50fb8c99283feb7e6c19d4b0a1a17f84/database)](https://images.ctfassets.net/23aumh6u8s0i/6ctIoMxkLfUWJUePNyKpA3/50fb8c99283feb7e6c19d4b0a1a17f84/database)

We provide templates to connect with SQL Server Membership, SQL Azure, Mongo, MySQL, Postgress, among many other options.

---

<a name="4"></a>
### 4. Increase your conversion rates
You now have access to 2,000,000,000 potential users out of the box with the addition of new [social and enterprise identity providers](https://docs.auth0.com/identityproviders)

<a href="https://images.ctfassets.net/23aumh6u8s0i/37Q3WcUZA5edS1DBWoqwqI/865e3766383bee8fad2e1744cde66ae2/idps2"><img src="https://images.ctfassets.net/23aumh6u8s0i/37Q3WcUZA5edS1DBWoqwqI/865e3766383bee8fad2e1744cde66ae2/idps2"alt="login widget"/></a>

> Is your favorite IdP not on our list? [Let us know](https://support.auth0.com)!

---

<a name="5"></a>
### 5. Decrease development costs with our SDKs
Every time you start developing on a new platform, you have to solve user and API authentication and access control. Not to mention, the complexity of connecting with legacy identity systems. We’ve been adding support for the most popular development platforms. What used to take days or weeks, will now take just minutes.

[![](https://images.ctfassets.net/23aumh6u8s0i/3ExPVviVDEApcKP87mWK4X/3763aae9818d17612c319514a21ce5c1/te0SB53RLj)](https://images.ctfassets.net/23aumh6u8s0i/3ExPVviVDEApcKP87mWK4X/3763aae9818d17612c319514a21ce5c1/te0SB53RLj)

> Want to a see another platform supported? [Let us know](https://support.auth0.com)!

---

<a name="6"></a>
### 6. SAML-enable your applications
Are you connecting with organizations already using some SAML identity system for SSO? Auth0 removes the complexity of SAML configuration. We can connect easily with all of the most widely used systems.

[![](https://images.ctfassets.net/23aumh6u8s0i/1yDcEYSUAxTQZw9gOFRGDE/83800ee69186b7e6bcc81253aac3d2fa/logos-idps)]( https://images.ctfassets.net/23aumh6u8s0i/1yDcEYSUAxTQZw9gOFRGDE/83800ee69186b7e6bcc81253aac3d2fa/logos-idps)
---

<a name="7"></a>
### 7. Lighter, improved UX and open sourced Login Widget
We've spent quite some time analyzing and improving its user experience. It is now much smaller and lighter weight. It loads faster, it's much more flexible and customizable, and it provides a simpler to use API.

<a href="https://images.ctfassets.net/23aumh6u8s0i/74B6KVzAQgezqVy4VcyUyI/1daf44d3bda2274dbd3cc991ea1d4bd5/testwidg41"><img src="https://images.ctfassets.net/23aumh6u8s0i/74B6KVzAQgezqVy4VcyUyI/1daf44d3bda2274dbd3cc991ea1d4bd5/testwidg41"  alt="login widget"/></a>

<https://github.com/auth0/auth0-widget.js>

Among its many new features: better support for i18n, and keeping track of your login choices. For example: you go to a website, login for the first time and choose Google. You go back to that site a month later and you completely forgot what you used last time to login. We keep track of that and expose it through an API or as a widget option.

In addition to that, you can now [associate multiple accounts](https://docs.auth0.com/link-accounts) into one.

---

<a name="8"></a>
### 8. Waste no time remembering passwords
Your team is using New Relic, Zendesk, CloudBees, Amnazon Web Services, Salesforce, Echosign, Office365, Google Apps and other great apps. However, each of them might require another user and password to remember.

Auth0 easily integrates with __+1000 of apps__ that are SAML, WS-Fed or OAuth capable. You will enter your password once in your identity provider of choice (e.g. GitHub, Google Apps, Windows Azure AD or regular AD) and will be logged in to all these apps seamlessly.

[![new applications](https://images.ctfassets.net/23aumh6u8s0i/1gsQEcro4qzgS113ZI8PKe/5f7e38717dabde51d4cce4c0f60cd605/rGEoPzk40n)](https://images.ctfassets.net/23aumh6u8s0i/1gsQEcro4qzgS113ZI8PKe/5f7e38717dabde51d4cce4c0f60cd605/rGEoPzk40n)

> Need help configuring SAML for an app not listed here? [open a support ticket](https://support.auth0.com)!

<a name="9"></a>
### 9. Deploy Auth0 Anywhere
Need a private deployment of Auth0? Do you have special privacy requirements? Looking at replacing your current ADFS deployment as you expand your use cases?

We ship the same awesome user experience we have with the Auth0 service with the __Auth0 Appliance__. We can run on-premises, or in any of the popular hosting environments: Amazon Web Services, Windows Azure, Rackspace, DigitalOcean, Joyent and others.

[![appliance](https://images.ctfassets.net/23aumh6u8s0i/2FQYk2u26p5zK8qjvMqwBB/cbf3bb8a334529fff5a54b6f6485635a/6qEyXQC65J)](https://images.ctfassets.net/23aumh6u8s0i/2FQYk2u26p5zK8qjvMqwBB/cbf3bb8a334529fff5a54b6f6485635a/6qEyXQC65J)

ASCII art FTW!

---

<a name="10"></a>
### 10. A Robust online infrastructure
We know identity is a critical component of most app. If you can't login, nothing works. Since launching, we invested in higher availability and disaster recovery features. Auth0 is tolerant to failures by running on multiple cloud providers, on different geo-locations. We run on __Windows Azure (US West Coast)__ and __Amazon Web Services (East Coast)__ simultaneously. Within each environment we run multiple instances of the service, minimizing the chances of complete downtime.

[![](https://images.ctfassets.net/23aumh6u8s0i/2sPrhEClV5FwZvhMQOFpIw/0383e82961e3ea26e94aef079a431ac8/auth0-infrastructure)](https://auth0.com/trust)

---

Thanks again for joining us in this first part of our journey. We would love to continue to hear from you. Both about things that you would like us providing, but also about the things you currently love about Auth0. And we wish you all a fantastic 2014!

**Auth0**, The Incredibly Easy, Programmable Identity Platform

PS.: and yes, we love animated GIFs :)

"update"