Calah Vargas

Calah Vargas is the Associate Manager of Product Led Growth, focusing on nonprofits, startups, and partnerships. She works on product marketing and customer marketing initiatives. Outside work, you can find her cooking, trying new restaurants, and traveling with friends and family.

Associate Manager, PLG

Shreya Gupta

Shreya is the Developer Advocate for Auth0 for Startups. She previously founded a non-profit called Bit Project, worked at a YC-backed Startup as a Developer Advocate, and currently hosts The Developer Diaries podcast. Through each experience, she has found her love for building resources and tools that help move the needle for developers. Outside of work, she enjoys traveling, watching K-Dramas, and drinking boba.

Developer Advocate, Startups

emma-gray

Sr. Manager, Product-Led Growth Marketing

Emma Gray

How Auth0 can support your product at any stage in your journey

A secure login experience and access management are at the core of any application with users at any stage of development. At a high level, it’s helpful to bucket product development into one of three stages—**build, launch, and grow**—each with different needs for managing user access. Decisions made at any stage can have long-term benefits and ramifications.

Auth0 is a comprehensive solution built for developers with evolving needs. Let’s walk through how Auth0 solves your needs at each stage – whether your app’s just an idea, in development, or already trusted by millions.

*Which stage does your product fall into?*

![Build, Launch and Grow](https://images.ctfassets.net/23aumh6u8s0i/2JjH4oi3LSWvay1FOri8Tl/9a8dcb4936464f3a54f35fe83815e7e6/2557215_BuildLaunchGrowBlogImages_Img1_022825.png)

## Build

Whether it’s a product that uses generative AI to create the perfect meal plan or a product that helps businesses analyze and act upon their data, your users will need the ability to sign up and log in seamlessly and safely.

You’ve started building your product, and now you’re developing how users interact with it:

* How does a user register for your app?
* How does a user authenticate securely every time?
* For a B2B use case, how do you set up multiple environments for each business/team?

Time is of the essence. The quickest path forward is to integrate a tool that satisfies your basic auth requirements for your MVP while iterating as needed. With Auth0, you can add a login screen, update your logo or brand, and access your user data [within minutes](https://auth0.com/docs/quickstarts). Up to 25,000 monthly active users can log into your application for free. We’re not counting accounts that register but never use the app again; we only count your captive audience.

If you’re depending on internal testing or an early access launch, you’ll be set up with Single Sign-On (SSO), branded forms, a custom domain, and more. You aren’t limited to a specific language or framework. And, if you want to move even faster, we offer [30+ SDKs & Quickstarts](https://auth0.com/docs/libraries) to help. For those building a B2B SaaS app, we released [SaaStart](https://auth0.com/blog/speed-up-your-customer-identity-journey-with-auth0-saastart/) last year, a reference B2B SaaS application built using Next.js and Auth0.

Your tools must integrate seamlessly to capitalize on the work you’ve already done. Auth0 is built to be extensible—you can use Integrations, Actions, and Connections to expand your use case and user experience. Start at the [Marketplace](https://marketplace.auth0.com/) to explore your options, and head to [Docs](https://auth0.com/docs) to start implementing them.

We’re partnering with some of your favorite developer tools to launch integrations within their ecosystems. The [Auth0 integration is now in the Vercel marketplace](https://vercel.com/integrations/auth0), so you can build scalable, secure, and compliant applications with an enhanced user experience by leveraging the strengths of these two best-in-class platforms.

![What can be extended](https://images.ctfassets.net/23aumh6u8s0i/2MzNCdyRT7dta4ua898x1g/1992516d3f5086aa87b943469ecd3c17/2557215_BuildLaunchGrowBlogImages_Img2_022825.png)

## Launch

Congrats on launch day! At this point, you’re eager for users to start interacting with your product so they can enjoy the fruits of your labor. However, you want to ensure that a fragmented or inconsistent login experience doesn’t deter them from exploring or, even worse, choosing an alternative app just because their login experience is better than yours. Features like [Enterprise MFA](https://auth0.com/docs/secure/multi-factor-authentication), so your users can use OTP Apps like Duo and Google or WebAuthn with Security Keys, can help create an accessible and secure experience.

At this stage, it’s also important to be able to handle your growing user base and collect data and insights to enhance your user experience. Our integration with [Datadog](https://marketplace.auth0.com/integrations/datadog-log-streaming) allows you to easily monitor your auth workflow logs, metrics, and request traces. Or, if your customers prefer a [passwordless connection](https://auth0.com/docs/authenticate/passwordless) (let’s face it, we all have too many passwords) or prefer to log in with GitHub over Gmail, our [Social Connections](https://marketplace.auth0.com/features/social-connections?_gl=1*1h59xrj*_gcl_aw*R0NMLjE3MzgwOTY5NTUuQ2p3S0NBaUFuZUs4QmhBVkVpd0FveTJIWVYtdjdFbENLNFVqeFpOT3lOaXN6dU5Va25IYmNWb3ZMWHBQUmlkc0ZlY2ZqNUFIOWxjRjZob0NORmdRQXZEX0J3RQ..*_gcl_au*OTU0MDY3ODU2LjE3MzcxNTg3Nzg.*_ga*MTQ1NzkzOTgwMy4xNzM2OTczNzM0*_ga_QKMSDV5369*MTczODEwNzI0MS4yNi4xLjE3MzgxMDk5NjguNDYuMC4w) have you covered. 

As you analyze the data surrounding your users’ preferences, you may realize that a one-size-fits-all approach doesn’t work. By using [Actions](https://auth0.com/docs/customize/actions), you can customize and extend Auth0’s capabilities with custom logic. If you need some extra support to set your business up for success, we offer programs and discounts for eligible [early-stage startups](https://auth0.com/startups) and [nonprofits](https://auth0.com/nonprofits). 

## Grow

Your app is a success — dare we say viral? You have loyal users, and your goal is to maintain your product's functionality while not spending too many resources on maintenance. However, you still want to invest in features that help you grow so your app stays competitive. As you’re looking to expand your customer base, either to include more countries if you’re building a B2C app or large enterprises if you’re building a B2B app, you may be held to new expectations. 

The good news is that if you built with Auth0 in any of the previous phases, you’ve already enhanced the security of your customer’s journey. If you didn’t, don’t worry; you can always [migrate your users automatically from your database](https://auth0.com/docs/manage-users/user-migration/configure-automatic-migration-from-your-database). You’re not just implementing an auth solution; you’ve enlisted a squad of invested security experts to do the heavy lifting for you. With the option to enable [Bot Detection](https://auth0.com/docs/secure/attack-protection/bot-detection) to mitigate scripted attacks and [Fine Grained Authorization](https://auth0.com/fine-grained-authorization) (FGA) to manage complex authorization scenarios efficiently, your security posture can only get stronger as you scale. 

![Grow](https://images.ctfassets.net/23aumh6u8s0i/5Vvup8eSuFUwpqPK8a6vzh/e9b1d62e2104764b6bce73b61100f359/Screenshot_2025-02-13_at_5.11.18_PM.png)

Another evolving area that requires constant maintenance if you’re not using Auth0 is data privacy and compliance. When expanding to other geographies, especially ones with stricter data privacy regulations, it can seem impossible to maintain compliance when you’re moving quickly. Auth0 maintains and meets the requirements for [multiple compliance frameworks and certifications](https://auth0.com/docs/secure/security-center). 

If you’re looking to test how enterprise-ready your app is, Auth0 can help. The [OpenID Foundation’s Interoperability Profiling for Secure Identity in the Enterprise (IPSIE)](https://openid.net/wg/ipsie/) working group is creating an open industry standard to enhance the end-to-end security of enterprise SaaS products. A few Auth0 capabilities that meet IPSIE’s proposed standards include SSO, SCIM, FGA, and Universal Logout. Read more about the new Identity security standard [here](https://www.okta.com/resources/datasheet-preparing-for-the-new-identity-security-standard/thankyou/).

As you're looking towards the future, Auth0 is right there with you. We just announced [Auth for GenAI](https://auth0.com/blog/auth-for-genai/), an upcoming Auth0 product for developers building applications with Generative AI, like chatbots and AI agents. This capability will enable you to confidently work alongside these chatbots and AI agents to build easily and securely. Head to [demo.auth0.ai](http://demo.auth0.ai/) to try the demo. 

![Auth for GenAI](https://images.ctfassets.net/23aumh6u8s0i/4sG1sozcoE745smr4WSKeB/d27692935da1e2ed836b221bea36ac9e/Screenshot_2025-03-04_at_11.21.22_AM.png)

### Try it for yourself today

If you care about:

- Getting your app to market faster than your competitors by having the ability to turn on core features quickly while also promising 99.99% uptime;
- Enabling a secure experience for your users;
- Having the ability to customize experiences when your app’s needs change or your site goes viral, and you get many more monthly active users.

Auth0 may be just what you’re looking for. [Try it out for yourself today](https://auth0.com/signup?utm_source=blog&utm_medium=auth0&utm_campaign=buildlaunchgrow).

![Auth0](https://images.ctfassets.net/23aumh6u8s0i/4AKQiO1r6bbVsVTYYFDLxV/cb1f61b1c6e10ac17ffcd153fddd1e3f/2557215_BuildLaunchGrowBlogImages_Img3_022425.png)

_These materials and any recommendations within are not legal, privacy, security, compliance, or business advice. These materials are intended for general informational purposes only and may not reflect the most current security, privacy, and legal developments or all relevant issues. You are responsible for obtaining legal, security, privacy, compliance, or business advice from your own lawyer or other professional advisor and should not rely on the recommendations herein. Okta is not liable to you for any loss or damages that may result from your implementation of any recommendations in these materials. Okta makes no representations, warranties, or other assurances regarding the content of these materials. Information regarding Okta's contractual assurances to its customers can be found at [okta.com/agreements](http://okta.com/agreements)._


Build, Launch, and Grow with Auth0

richard-marr

GM, APAC

Richard Marr

A robust CIAM solution helps you find the right balance of security without sacrificing customer experience

A recent PwC study found that [32% of the public will abandon a company](https://www.pwc.com/us/en/advisory-services/publications/consumer-intelligence-series/pwc-consumer-intelligence-series-customer-experience.pdf) after a single bad customer experience. What if that frustrating experience is your login? If you turn up the security measures too high, customers won’t bother navigating the hurdles to create an account or log in to an existing one. The flip side is if you dial the security down too far in favor of an easy login flow, malicious actors will take advantage of the fact that while the majority of people (91%) know reusing passwords is a bad practice, [66% admit to doing it anyway](https://www.logmeininc.com/newsroom/press-release/2020/lastpass-psychology-of-passwords-report-reveals-91-of-people-know-password-reuse-is-insecure-yet-two-thirds-do-it-anyway). Those numbers are courtesy of a study conducted by LogMeIn, makers of the password manager LastPass.

Login pages are often the first point of interaction between customers and the companies they do business with. Of course, that means those login pages are often the first point of contact for malicious actors, as well. For any company doing business online, there’s a line to walk between keeping data secure and providing a low-friction login experience for legitimate customers. [Customer Identity and Access Management (CIAM)](https://auth0.com/blog/what-is-ciam/) is the solution that allows for successful navigation of this line.

From a business standpoint, having too few security measures leaves you open to regulatory penalties should a data breach occur and the high financial costs of recovering from a breach, not to mention the damage to your brand that can extend far beyond the recovery period. Too much security can result in lost conversions when customers abandon the process due to friction. A strong CIAM solution lets you consolidate the onboarding, organizing, and managing of user accounts — all while helping mitigate the chances of a breach with defensive measures like Bot Detection and brute force protection.

![CIAM](https://images.ctfassets.net/23aumh6u8s0i/2opPstgbMTWBqurQhYT22U/fbe55b99b77219db5cee29b29972a62a/CIAM_recorte1.png)

## User Account Flow and How CIAM Manages Each Stage

A robust CIAM platform provides you with an identity Single Source of Truth (SSoT). SSoT is a data organization framework that says it’s easier to protect data in one place rather than data in multiple siloed locations spread across multiple platforms (like on-prem and cloud). Beyond that, strong CIAM provides customers a single login window for all of your properties. Even if you’re expanding your presence and adding new tools and apps, users will only ever have to login once to access them all. CIAM provides similar ease-of-use solutions throughout the user account lifecycle.


### Account creation

When a new customer decides to create an account, they’re telling you that they trust you with their data and that they’re ready to become a customer. Rewarding them with easy, low-friction processes is key to showing them that their trust is well placed. A CIAM solution that offers multiple first-factor sign-on options, such as [passwordless](https://auth0.com/intro-to-iam/what-is-passwordless-authentication/), [biometrics](https://auth0.com/blog/3-critical-trends-in-biometric-authentication-in-2019/), or [single sign-on](https://auth0.com/blog/what-is-single-sign-on-a-non-developer-s-guide/) to create an account means they don’t have to create or reuse an existing password. This streamlines the customer experience while adding security by removing passwords from the login flow.


### Account maintenance

At this stage, automation is CIAM’s biggest benefit. Automated password resets, and the ability to combine accounts in cases where a person accidentally creates a duplicate reduces the backend workload on your team while keeping customer friction low. While such automatic password resets are one of the stronger benefits of a CIAM solution, it’s important to note that malicious attackers often seek to exploit these recovery flows. These attacks can be thwarted by having strong security in place that offers a range of protections, including Bot Detection and the ability to spot suspicious IP throttling.


### Account end-of-life

Should a user abandon their account, you need a process in place that deactivates these accounts and eventually deletes them. This will prevent those credentials from being used in future attack scenarios, as well as keeping your user account database clean and free of dead accounts.


## The Business Impact of Data Security

There are a variety of attack vectors available to malicious actors once account credentials are stolen. We go into more detail in a [whitepaper](https://auth0.com/resources/whitepapers/secure-ciam) on this topic, but what follows is a brief summary of the most prevalent of these vectors.


### Credential stuffing attacks

When an attacker takes a list of breached credentials and runs all of these combinations through a login flow until they find a combination that unlocks the login box, it’s called [credential stuffing](https://auth0.com/blog/what-is-credential-stuffing/). These attacks prove efficient for the attackers due to password reuse. Lists of breached username/password combinations are available on the dark web, making credential stuffing attacks a low-effort way to instigate a breach. 


### Business email compromise (BEC) attacks

Usually beginning with spearphishing emails sent in the guise of a trusted partner account, BEC attacks are targeted at busy executives with the goal of obtaining a money transfer to an account owned by the attacker. Once again, breached credentials often play a key role in these attacks.


### Bot-based brute force attacks

Bot attacks can take several forms. Most often, they are automated credential stuffing or what are called swarm attacks: when a malicious actor uses automation tools to flood a site with traffic either to cause the site to crash in a distributed denial-of-service (DDoS) attack or to buy up available retail stock to inflate the price on the aftermarket.

The business impact of these attacks can be dramatic, ranging from the financial impact of lost business to increased churn due to customers losing trust in the business to long-lasting damage to brand reputation. For these reasons, finding the right balance of[ security and customer experience](https://auth0.com/blog/digital-success-through-customer-identity-and-access-management/) is a business priority. 

![CIAM](https://images.ctfassets.net/23aumh6u8s0i/2cpWz1sTXnXL7Da3rGAWJ0/e96fb924653277fe241211e3e15fa396/CIAM_recorte2.png)

## Data Security Is a Moving Target

According to the 2020 edition of the IBM/Ponemon Institute’s Cost of a Data Breach report, lost business after a data breach averages out to more than [$1.5 million per breach](https://www.ibm.com/security/digital-assets/cost-data-breach-report/#/). That works out to approximately 40% of the total average cost of a data breach, which the same report puts at $3.86 million.

PwC has found that [87% of consumers](https://www.pwc.com/us/en/services/consulting/cybersecurity-privacy-forensics/library/global-digital-trust-insights.html) will take their business elsewhere if they feel a company is not treating their data with due care. The takeaway is to be open and honest with your customers about your data use policies. After collecting their consent to use their information, tell them what you’re using it for, how you’re caring for it, and what your policy is regarding data destruction when you’re done with it. This transparency will go a long way toward mitigating these potential impacts.

Data security needs are in constant flux with changing regulatory requirements, evolving attack vectors, and increasingly data-savvy consumers. Auth0 research has found that [83% of apps in development will require authentication](https://auth0.com/resources/whitepapers/state-app-assembly-2020), yet only 58% of companies are availing themselves of the Identity-as-a-Service (IDaaS) option. Let our experts keep up with those ever-evolving security needs and handle what they do best, identity, while yours do what they do best, creating and enhancing your core product. 

A company’s digital identity is of increasing importance in today’s crowded marketplace, and managing customer experience from the login page is key to creating the trusting relationships needed to thrive. If it’s time for your business to pay more attention to your access management solution, [get in touch with our team of identity specialists](https://auth0.com/contact-us) today to start the conversation.

<include src="asides/AboutAuth0" />

CIAM: Balancing Security with Customer Experience

jenny-obrien

I'm a former business journalist who's fascinated by the intersection of tech and business strategy — in particular how the right solution can transform an idea into reality. I specialize in ROI, data privacy, and identity.

Business Content Manager

Jenny O'Brien

Find out how business leaders are using identity to accelerate their business strategy



In response to COVID-19, 75% of CEOs have accelerated digital transformation, a recent [Zscaler study](https://www.zscaler.com/resources/white-papers/securing-remote-work.pdf) found. 

While the study specifically focused on work from anywhere (WFA) solutions, the need for digital change isn't critical just for employee access. As nearly every customer experience is driven online, your customers' digital experience is the major way they experience your brand.

[Fortune](https://fortune.com/2020/06/26/coronavirus-accenture-ceo-digital-transformation/) noted that the crisis has quickly widened the performance gap between companies investing in digital innovations and those who weren't into a "chasm," saying "digital leaders were performing better through crisis." Companies need new technologies that allow them to activate new business models fully. In this environment, digital transformation initiatives may still be scoped over multiple years, but CIOs need to demonstrate value on a much faster timeframe. 

And the need for rapid digital adaptability is surfacing as an even stronger driver amongst Auth0 customers, especially for those seeking [B2B](https://auth0.com/b2b-enterprise-identity-management) and [Customer and Identity Access Management (CIAM)](https://auth0.com/b2c-customer-identity-management) solutions.

<include src="ebook-ads/DigitalTransformationBook" />

For many business leaders, the question is not just about how to add artificial intelligence and machine learning to new products, but how to keep their companies moving forward, given unpredictable global conditions. Others are wondering if it's too late to catch up &mdash; or even run ahead.

If you're willing to treat Identity Access Management (IAM) as a reusable service as part of your digital transformation strategy, it's not.

## Reusable Services Speed Digital Transformation Success

Many digital transformation projects are executed over the course of several years, while everyone works through "rigid" monolithic I.T. infrastructures and apps created for specific moments in time. Replacing legacy technology with "[componentized](https://auth0.com/resources/whitepapers/state-app-assembly-2020)" digital technologies (think building blocks) that can be more easily reassembled and re-architected allows companies to adapt more rapidly to changing business needs.
 
Reusable services like online payments, communications capabilities, and identity management allow companies to speed their digital transformations and deliver scalable value to customers. Basically, these services give you the power to do what you need to do, when and how you need to do it.

As Pierre Alvear Foxler, Service Manager, IAM, for Northern Europe's leading farming cooperative, [Lantmännen](https://auth0.com/case-studies/lantmannen/), points out, shifting from on-premises to services-based solutions like Auth0 have financial benefits as well as usability benefits. "We went from an on-premise solution that was capable, but complex and costly, to one that saves us money on infrastructure, IAM delivery, and application management," he says.

Strongly designed services can also make it easier to manage the complexity of the fragmented healthcare system, says Chris Carruthers, Principal Technical Program Manager, [Providence](https://auth0.com/case-studies/providence/), a nonprofit healthcare organization based in the U.S. "The healthcare industry is a complex landscape. Many customers have legacy applications and require highly secure vendor systems that meet patient data privacy requirements. Auth0's adherence to top compliance frameworks makes them a valuable identity partner for us."

## Reduce Time to Implementation

The most effective business strategy in the world, expressed through well-planned business models, can easily stall (or die) due during change management. IAM can be a powerful tool for business leaders to speed implementation. Resolving IAM challenges with the help of a vendor focused on not only current, but potential business possibilities means that you can use the IAM discussion as a framework to drive consensus and momentum for their evolving digital transformation strategy.

### Lifen: Contact Tracing in 5 Days

AI-powered [Lifen](https://auth0.com/case-studies/lifen-cs/), a solution that facilitates the secure transfer of medical documents between patients, private practitioners, and hospitals, came to Auth0 early in the pandemic with the goal of replacing their existing identity infrastructure &mdash; and rapidly spinning up a contact tracing solution. We delivered in five days.

You read that right &mdash; five days.

"It was in record time," says Lifen CTO Dali Kilani. "We've put it in the hands of multiple healthcare institutions."

But speed wasn't Lifen's only goal. 

Especially in a global environment with an increasing number of [data breaches](https://auth0.com/blog/the-11-biggest-data-breaches-of-2020-so-far/), fast means nothing if your new solution isn't also more secure. Despite the rapid turnaround, Kilani is more than comfortable. "Auth0 maintains the highest level of security that is possible at this point. Every single doctor and patient that accesses our solution performs their authentication through Auth0. We've put Auth0 at the heart of our service."

### Gymshark: Headless Commerce + Credential Stuffing Protection

For Auth0 customer [Gymshark](https://auth0.com/case-studies/gymshark/), a conditioning brand dedicated to fitness apparel, digital adaptability means making major shifts away from siloed logins that were spoiling their user experience. "We're going down a headless commerce route, doing much of our ops and infrastructure through serverless technologies with cloud partners such as AWS. We're kind of rebuilding the whole back office of the company from the ground up," says Dan Lake, Gymshark Engineering Director.

The complexity of managing a digital transformation alongside a social media following of 10+ million and customers in over 170 countries could have made customer identity and access management (CIAM) changes extremely challenging. 

Instead, Auth0 saved time and effort.

"The ease of implementing Auth0 was brilliant. It saved us months of time, salaries, effort in finding the right engineers, obviously ongoing support, and also probably given us back a few years in our lives as well through stress," says Lake.

Lake also points out that Auth0 has added benefits. "Auth0 protects us against credential stuffing. You don't realize how valuable [credential stuffing](https://auth0.com/blog/what-is-credential-stuffing/) features are until it happens. Those are the kind of features that we relish at the moment, things we see that our customers don't."

### Scale Quickly Across Multiple Applications 

Global technology powerhouse [Siemens AG](https://auth0.com/case-studies/siemens/) plays a pivotal role in everything from digital enterprise to energy to financial services and operates in nearly every country in the world. Performing on a global scale can get extremely expensive when apps are measured across multiple divisions. Creating a uniform login experience for customers and partners allows Siemens to sustain a focus that benefits their business. 

"It was of the utmost importance to have a secured, stable and reliable authentication platform, [so that] our clients and partners can focus on their business instead of focusing on how to log into hundreds of Siemens' applications available in the market," says Hugo Francisco, Service Owner of Siemens ID, Siemens.

## Make Sure Your UX Keeps Pace With Your Business Innovation

With 170 superstores across the U.K., Dunelm prides itself on style and affordability &mdash; and is transforming their digital experience to keep pace with their tangible one.

Moving to a modern, flexible cloud platform is a critical part of that business strategy.

"One of the key things we wanted to do was move over to a cloud platform, AWS, where we could scale up and down and build the best in class for our online customers," says Antony Sohal, Head of Data Platforms for Dunelm.

But instead of building that digital experience in-house, Dunelm created the customer experience using a componentized approach. "One of the key decisions was to focus on what we're good at and single out what we're not good at. We built a product service, a pricing service, we bought authentication, we even bought search as a service. We bought the infrastructure we needed," explains Sohal.

Buying identity-as-a-service means that the effort that would be spent on authentication can instead be spent on core functions and, with the right identity partner, used to customize the user experience. This means there's no need to sacrifice digital innovation for time-to-market. A flexible, extensible identity platform means you can get to market faster and ensure future adaptability.

Treating identity as a reusable service can help your new products get to market faster — and strengthen your ability to adapt once you're there. As Lake explains, "The largest shift and growth at Gymshark is we've become a tech company through our aim to unite the conditioning community. We're building the foundation for where we're headed, and it's just going to get bigger and bigger."

Carruthers says [Providence](https://www.providence.org/en) turned to Auth0 for help creating a seamless, consumer-facing digital experience for patients. "We're years ahead of where we would be if we were to build identity ourselves," says Carruthers.

If you'd like to learn more about how Auth0 could help your company continue to adapt and grow, please reach out to an [Auth0 resource](https://auth0.com/contact-us).

<include src="asides/AboutAuth0" />

How Digital Transformation Enables Business Adaptability

andres

I’ve been at Auth0 since 2017. I’m currently working as a Product Manager for the Auth0 FGA and OpenFGA products. Previously, I worked in the teams that owned the Login and MFA flows. <br>
I spent my entire 20+ year career building tools for developers, wearing different hats. When I'm not doing that, I enjoy spending time with my family, singing in a choir, cooking, or trying new kinds of local cheese.

Product Manager

Andrés Aguiar

Auth0 now supports native login for Facebook, which improves UX and complies with newly-tightened Facebook and Apple policies.



These days, it's common for users accessing websites and applications from a web browser to authenticate with social identity providers such as Google or Facebook. Offering social login as an option goes a long way toward improving user experience. In fact, in a recent survey, [86% of users reported being bothered by having to create new accounts on websites, and 77% said that "social login is a good solution that should be in any site.](https://auth0.com/learn/social-login/)"

On mobile devices, social identity providers usually have their own applications (e.g., Facebook, Twitter), and some of them actually provide the operating system (e.g., Google, Apple). In the latter cases, users can use single sign-on (SSO) with a native UI instead of reauthenticating in the browser. This makes for a cleaner, simpler user experience.

Auth0 already supports native login for Apple ([Sign In with Apple](https://auth0.com/docs/connections/nativesocial/apple)), and we are excited to announce that we now support [native login for Facebook](https://auth0.com/docs/connections/nativesocial/facebook) as well. This allows for authentication using the identity of the user who is logged into the Facebook application installed on the device. Auth0 customers who implemented this flow immediately saw an improvement in how their users were able to authenticate with Facebook:

<include src="BigQuote" quoteText="By enabling native social authentication, our app's Facebook login times have been reduced by 50% compared to web authentication. And successful Facebook logins in our app have increased by 16%." quoteAuthor="Eric Jensen, Principal Engineer, Kiva"/>

> Learn how [Kiva eliminated 22,000 lines of legacy code](https://auth0.com/case-studies/kiva-implements-auth0-rules-mfa/) by implementing Auth0.

## Enhanced User Experience

Compass is a leading national real estate technology company that provides tools and services to help real estate agents grow their businesses and better serve their clients. As one of the largest groups of small business owners in the country, real estate agents utilize the end-to-end Compass platform to improve their productivity and manage their businesses more effectively. Compass currently powers over 18,000 real estate agents across 150+ U.S. cities, who were responsible for over $91 billion in real estate transactions in 2019.

Compass's suite of software tools acts as an operating system for real estate agents, making them more efficient by optimizing their workday, pricing properties more accurately, determining the best time to list, and more. The platform also integrates listings, transactions, and individual client data, giving agents personalized recommendations and insights. This enables agents to tailor their services to the specific needs of each client.

To help agents collaborate with their clients and stay productive even when they're not in front of their laptops, Compass provides iOS and Android apps. They've implemented login with Google, Facebook, and Apple to reduce friction for users. You can see the Facebook login experience in action below:

![Facebook Login 1](https://images.ctfassets.net/23aumh6u8s0i/17jqJUyNCs3a8uIDYVCUzS/df8f1f1d8c7d03fa3f626418dc99f2d6/facebook_login_1)

![Facebook Login 2](https://images.ctfassets.net/23aumh6u8s0i/1gatAU30RSdraoE2tQIrGl/ae58ad5342a3c13e12890ef705d2dbe1/facebook_login_2)

In Android, a popup is displayed where users can confirm their identity and log in. In iOS, the flow is not quite as seamless since the Facebook app is opened, but this gives the end user a clear understanding of what is happening and reassures them that the Facebook app furnished the credentials. 

## Complying With Facebook and Apple Policies

In the past months, several social login providers have been tightening up their requirements to integrate applications with their authentication frameworks. 

* [Facebook's Platform Policy](https://developers.facebook.com/policy#login) states: _"Native iOS and Android apps that implement Facebook Login must use our official SDKs for login."_

* [Apple's application guidelines](https://developer.apple.com/app-store/review/guidelines/#data-collection-and-storage) read: _"An app may not store credentials or tokens to social networks off of the device and may only use such credentials or tokens to directly connect to the social network from the app itself while the app is in use."_

## How Does It Work?

Based on the requirements described above, we collaborated with Facebook to design a solution that will let us authenticate Facebook users in native apps while complying with Apple's rules. The image below shows a high-level description of the flow:

![Facebook Diagram](https://images.ctfassets.net/23aumh6u8s0i/vxr56C8bJdZnGChZqASyV/bcf442508c76064ce8d7ba8974bc5b8d/diagram_facebook)

1. The application logs in with Facebook using the Facebook SDK. This returns a Facebook access token.

2. The native application requests the user profile using the Facebook API or corresponding call in the Facebook SDK.

3. The application exchanges the access token for a [session info access token](https://developers.facebook.com/docs/facebook-login/access-tokens/session-info-access-token). This is a token that can only be used to validate that the user created a session, not to act on behalf of the user or retrieve the user profile.

4. The application calls Auth0's `/oauth/token` endpoint, sending the session info access token and the user profile data.

5. Auth0 calls the [debug_token](https://developers.facebook.com/docs/graph-api/reference/v7.0/debug_token) endpoint to validate that the user initiated a session with Facebook. 

You can read more and see the payload for each API call in our ["Add Facebook Login to Native Apps" docs](https://auth0.com/docs/connections/nativesocial/facebook).

## Get Started

You are only a few steps away from greatly simplifying how users log into your mobile applications. Check out our [Android](https://auth0.com/docs/quickstart/native/android-facebook-login) and [Swift](https://auth0.com/docs/quickstart/native/ios-swift-facebook-login) quickstart guides to learn how to integrate native login with Facebook using our updated [Android SDK](https://github.com/auth0/Auth0.Android) and [Swift SDK](https://github.com/auth0/Auth0.swift).

<include src="asides/AboutAuth0" />


Improving Login With Facebook User Experience With Native Login

df6c864847fba9687d962cb80b482764?size=200 avatar

df6c864847fba9687d962cb80b482764?size=200

Martin Gontovnikas, a.k.a Gonto, is a software engineer at heart who moved to the ‘dark side’ and became VP of Marketing at Auth0. He considers himself lucky to have found a way to combine his two passions and apply his engineering thinking model to marketing.<br/><br/> Gonto’s analytical thinking is a huge driver of his data-driven approach to marketing strategy and experimental design. He is based in the Bay area, and in his spare time, can be found eating gourmet food at the best new restaurants, visiting every local brewery he can find, or traveling the globe in search of new experiences.

Former SVP of Marketing and Growth at Auth0

Martin Gontovnikas

Fintech companies must evolve their identity strategy for the future of banking.



A solid customer identity and access management (CIAM) strategy is a crucial ingredient in successful digital transformation. Over the last several months, many financial services organizations have been forced to recognize that they’re not ready to operate fully online. Features and capabilities that seemed like nice-to-haves in 2019 are being rushed to market in 2020 to meet consumers’ rapidly evolving needs. Delivering a seamless user experience without compromising a strong security posture is the fintech challenge of the moment. 

CIAM is among the best tools for building digital resilience and strengthening online banking security. [Auth0](https://auth0.com/) CEO and co-founder [Eugenio Pace](https://www.linkedin.com/in/eugeniop/) and [IMDWORKS](https://www.idmworks.com/) founder and CEO [Paul Bedi](https://www.linkedin.com/in/paulbedi/) talked with Nick Holland of Information Security Media Group (ISMG) about the role of CIAM in helping banks adapt to our new remote reality and what this means for the future of banking.

## Banks Must Change How They Interact With Customers

Life for most people has changed radically over the last several months, and we’ve reached an inflection point where we’re appraising and challenging established systems and procedures. Put plainly, banks, and fintech companies must change how they interface with their customers. 

**“The way that banks interact with their customers will evolve massively.” &mdash; Paul Bedi, Founder, and CEO of [IMDWORKS](https://www.idmworks.com/).**

For instance, [telehealth](https://auth0.com/blog/how-coronavirus-is-changing-telemedicine-forever/) has gone from an occasional use case to the new default for many types of healthcare. This shift has accelerated the pace of innovation as health systems and technology providers work to redesign their products and procedures for a new system of care.

The COVID pandemic has also created new opportunities for fraud and data theft, raising the security bar even higher. [The Federal Trade Commission](https://www.cnbc.com/2020/04/15/americans-have-lost-13point4-million-to-fraud-linked-to-covid-19.html) reports that Americans have lost more than $13.4 million to COVID-related scams since the beginning of 2020. Meanwhile, [VMWare noted](https://searchsecurity.techtarget.com/news/252481832/Ransomware-attacks-see-148-surge-amid-COVID-19) an alarming 148% surge in ransomware attacks between February and March 2020, along with a 38% increase in the number of cyberattacks in the same period. It’s never been more critical to leverage CIAM to seal up the cracks and ensure your identity strategy is sound. 

### Enable Contactless Transactions

To establish a financial relationship, people used to bring proof of their identity into a brick-and-mortar bank and show it to a bank employee. Before 2020, Millennials’ preference for online banking over in-person transactions was already driving the industry towards developing better remote capabilities, but the pandemic has accelerated this shift. Financial institutions must be able to authenticate customers remotely: not just when they are accessing an established account via ATM or mobile app, but also when they are first launching their financial relationship. The cost of face-to-face interactions, whether measured in terms of public health or time optimization, has risen.

In general, a trend toward contactless transactions has become apparent. When we ordered a takeout dinner in 2019, we met our delivery driver at the door as they handed over our eagerly-anticipated meal. Now food delivery services leave our orders outside the front door and text us because neither party wants to be exposed to unnecessary risk — and because we have the technology to enable us to neutralize that risk.

Other everyday procedures such as notarization, which traditionally involves a face-to-face interaction, analog signatures, and a physical stamp, need to evolve to match the current situation. Because of pandemic-related travel barriers, pace points out, and demand is growing for technology that facilitates international transactions and interactions. It’s no exaggeration to say that we are in the process of reimagining and rearchitecting the entire technological infrastructure upon which we’ve built our lives and livelihoods.

### Earn Customer Trust With User-Centric Security

People have faith in physical banks, Holland suggests because they can see the vault and the teller; there are powerful visual clues that the bank is secure, inviolate. The structures for cultivating and reinforcing this same level of trust in online banking security need to evolve.

A data breach has a devastating impact on customer confidence. [IBM reports](https://www.ibm.com/security/data-breach) that the average data breach costs $3.92 million — of which 36% ($1.42 million) is the direct result of lost business. [A 2019 customer survey from Ping Identity](https://www.pingidentity.com/content/dam/ping-6-2-assets/Assets/Misc/en/3464-consumersurvey-execsummary.pdf) found that 81% of respondents would stop engaging with a brand online if there were a data breach, while 25% would stop engaging with the brand across all channels. 

Bedi advocates for fintech companies embracing public, user-centric security policies and guaranteeing the security of user data across online and mobile apps. “The onus is on you, the company, to protect them, the users,” he says. He urges banks and financial services to consider establishing a contact center staffed with knowledgeable people who can help customers troubleshoot and resolve fraud issues. Now more than ever, Bedi suggests, people want to place complete trust in their financial institutions; they want the reassurance of guaranteed security and genuine accessibility.

## Balancing Security and UX Requires a Fresh Authentication Approach

Maintaining a strong security posture without creating friction that drives users away is a perennial challenge. This is especially true with fintech companies and banks: They operate under heavy regulation, and their top priority is protecting user accounts. Their user bases, meanwhile, often vary wildly in terms of technical sophistication, so the authentication function must be low-friction to avoid confusing, frustrating, and ultimately losing customers. 

### Lose focus on UX and lose 32% of your users

The impact of a cumbersome user experience is easy to dismiss, especially when it’s so important to [protect customer data](https://auth0.com/blog/data-privacy-vs-data-security-why-your-business-needs-both/) (not to mention a legal requirement across 65% of the globe). But bad experiences for users translate directly to lost revenue for you. [PwC found](https://www.pwc.com/us/en/advisory-services/publications/consumer-intelligence-series/pwc-consumer-intelligence-series-customer-experience.pdf) that almost a third of customers will abandon a brand they like after just one negative experience. That’s why it’s crucial to balance high security standards and a smooth customer experience. 

Bedi argues that achieving this balance means making the security paradigm completely invisible to users. In other words, making the systems and processes involved in verifying and managing identity so seamless that the user scarcely registers them. “That’s when you know you’ve succeeded [with CIAM],” he says.

### Put authentication decisions in context

A primary consideration in balancing security and user experience, says pace, is a keen understanding of the context in which interactions are happening. Situations with different levels of risk demand different levels of authentication. For instance, just checking an account balance might require a lower level of authentication than making a transfer. When a user attempts a higher-risk action, they’re prompted with an additional verification step, like multi-factor authentication (MFA) or a [CAPTCHA](https://auth0.com/blog/reducing-the-impact-of-credential-stuffing-attacks/).

Authenticating based on context also involves looking at what time of day a request was made, from what location, and using which device. Historical behavior patterns also come into play. For example, if you always pay your bills on Monday evenings from your laptop at home, a smartphone login in the small hours of Saturday morning from an unexpected location might trigger an additional verification step, because there’s contextual evidence that you are not the one making the login request. On the other hand, a Monday evening request from your living room might not require that additional authentication — and demanding it might create sufficient friction to drive you, the user, to another bank.

Pace explains that the security world has tended to view authentication in binary terms: a user is either authenticated or they’re not. Fortunately for today’s use cases, modern CIAM technology is sophisticated enough to evolve systems to evaluate all of these contextual factors when making decisions. Requesting different levels of authentication depending on context allows fintech companies to maintain high security standards without pestering the user for authentication every time they turn around.

## The Bank of the Future Isn’t Just a Bank

No one has a clear idea of what the future of banking will be, but what is clear is that many features will remain digital. Even once it’s possible to do more banking face-to-face, plenty of customers will still prefer to bank remotely. A hybrid structure is how fintech companies will thrive going forward. 

In a post-pandemic world, real-life interactions will incur a new kind of value, and this certainly applies to financial services companies. One possibility Bedi raises is that banks will transform into offshoots of the community. Like [Capital One Cafés](https://www.capitalone.com/learn-grow/money-management/explore-capital-one-cafes/), banks might leverage their real-estate assets by opening common spaces where people can transact business face-to-face — adding another layer of value to the banking experience. Another possibility is that banking locations could become remote call centers for customers with the kinds of questions that would once have been addressed in person. 

Bedi’s predictions largely align with how pace sees banks evolving in the near future. “The emphasis will be on relationship-building,” he says. In order to keep customers coming through the doors, banks will have an opportunity to deliver value users can’t get online. A bank branch could, for instance, proactively reach out to local customers who qualify for a higher line of credit or a lower interest rate on their mortgage, instead of waiting for customers to seek out their services.

## The Future Calls for CIAM

Ultimately, no matter what new revenue streams financial companies discover in the course of hybridizing their structures, both customers and vendors will be pressuring banks to digitize more fully. A sound CIAM strategy clears the way to next-generation UX without increasing the security risk to customer accounts.

<include src="asides/AboutAuth0" />


How FinTech Benefits From IAM

auziros:jeana-tahnk

Jeana has been in the tech industry for 15+ years, both as a communications professional and writer. As Director of Global Communications at Auth0, she works with her internal team and external agencies to amplify the company's visibility worldwide and establish its leadership in the identity industry. When she is not working, she can most likely be found on a field watching one of her three kids playing sports, or cleaning up after her one-year-old retriever who chews everything.

Senior Director, Global Communications

Jeana Tahnk

New feature blocks majority of malicious requests, saving enterprises critical time and resources



**BELLEVUE, Wash. &mdash; August 18, 2020 &mdash;** The [Auth0](https://auth0.com/) Identity Platform, a product unit within Okta, today launched [Bot Detection](https://auth0.com/blog/reducing-the-impact-of-credential-stuffing-attacks), a new security feature that reduces the effectiveness of a credential stuffing attack by as much as 85%, with minimal impact on user experience. Bot Detection is a powerful addition to the company’s expanding security portfolio, and works in tandem with Auth0 Breached Password Detection, Brute Force Protection, and Multi-factor Authentication, to provide extensive mitigation against a variety of sophisticated threats, including automated attacks, account takeovers, phishing attacks, and more.

Credential stuffing attacks often rely on stolen account credentials (username and password) from a previous data breach, and are used to gain unauthorized access to user accounts on another website. This is executed via large-scale bot-driven attacks against the login flow and is an increasingly pervasive problem for enterprises. Ongoing Auth0 customer analysis revealed the following: 

* Auth0 sees an average of 175,000 unique IP addresses that are deemed suspicious on a daily basis. 
* Threat actors can use as many as 65,000 IP addresses for a single attack.
* During an attack, credential stuffing can account for as much as 65% of the traffic to Auth0’s authentication service.
* During a credential stuffing attack, traffic for a particular website may surge as much as 180x the usual volume, with traffic related to the attack itself accounting for 90% of overall activity. 

Bot Detection correlates numerous data sources to identify and mitigate bot-driven attacks before login, and relies on a collection of risk signals and assessors that identify indicators of suspicious activity. This layered approach — also known as defense in depth — consists of multiple security capabilities, including Bot Detection, that effectively reduce the number of credential stuffing attempts and many other attacks. At a high level, Bot Detection monitors IP addresses for non-suspicious events, such as successful logins; suspicious events, such as numerous failed login attempts across multiple accounts; and IP reputation data, which is used to identify known threat actors. When suspicious traffic is detected, a CAPTCHA step is required to complete a login request — the system is designed to mitigate the majority of bot attacks targeting the login or registration flow. At launch, Auth0 will support customers using its [Universal Login](https://auth0.com/blog/introducing-the-new-auth0-universal-login-experience/) capabilities, with additional support for other experiences in the coming months. 

Automated attacks are growing more sophisticated each day, and these large-scale bots are designed to respond to any and all controls to evade detection. Auth0 found that threat actors can, and do, change their attack strategies in as little as five minutes to bypass a security control. More than [80% of companies](https://auth0.com/resources/whitepapers/credential-stuffing-attacks) state it is difficult to detect, fix, or remediate [credential stuffing attacks](https://auth0.com/blog/what-is-credential-stuffing/), which result in an average of more than $6 million a year in costs per company and can cause a significant impact on IT resources, account takeovers, and brand reputation. 

“We’ve seen an increase in the volume and sophistication of bot attacks over the last few years, and companies are investing more in their defenses,” said Matias Woloski, CTO and cofounder at Auth0. “Being at the front door of applications with a service that secures more than 4.5 billion login transactions per month, we have a unique vantage point for quickly identifying and blocking suspicious activity before any damage is done. This is what makes Bot Detection very effective at preventing account takeover and reducing the load on DevOps and SecOps teams.” 

More detailed information on credential stuffing can be found here: [Credential Stuffing Attacks: What Are They and How to Combat Them](https://auth0.com/resources/whitepapers/credential-stuffing-attacks) (whitepaper), and [Reducing the Impact of Credential Stuffing](https://auth0.com/blog/reducing-the-impact-of-credential-stuffing-attacks) (blog post). 

<include src="asides/AboutAuth0" />

### Media Contacts
Jeana Tahnk <br />
Auth0 Global Communications<br />
[press@auth0.com](mailto:press@auth0.com)<br />

Hannah Carroll<br />
Matter for Auth0<br />
[auth0@matternow.com](mailto:auth0@matternow.com)<br />


New Bot Detection Feature by Auth0 Reduces Effectiveness of Credential Stuffing Attacks by Up to 85%

antoniofuentes

Antonio is a Product Manager in charge of features and functions used by thousands of customers implementing identity systems to keep their users safe and prevent malicious activity.

Product Manager, Continuous Auth

Antonio Fuentes

How Auth0 uses risk signals to detect and help you manage scripted, high-volume attacks on your identity flows



## The Problem

Attacks on an identity infrastructure using stolen credentials are a difficult problem to solve. [Credential stuffing attacks](https://auth0.com/blog/what-is-credential-stuffing/) occur when a bad actor sends scripted, automated login attempts to an application or website in extremely high volumes, with the objective of gaining access to user accounts. This is an increasingly common problem: on any given day, up to 69% of login attempts on the Auth0 infrastructure are suspected to have originated from credential stuffing attacks. 

This type of attack can be quite sophisticated. Sometimes they come in the form of hundreds of thousands of login requests to a site in a short time window, at a very high velocity, and from a relatively small number of IP addresses from unusual locations. They can also come in the form of scripts that send traffic using tactics to dynamically evolve their velocity, location, and number of IP addresses to avoid detection.  

Generally, solving this problem involves a tradeoff between usability and security, in which user experience pays the price. Measures like multi-factor authentication (MFA) are effective in limiting the success rates for a script involved in a credential stuffing attack, but they also add friction for legitimate users. 

To tip the scale in favor of user experience, malicious bots and scripts need to be detected and rejected before a login call is even processed by the authentication server. Doing so enables you to limit the impact of credential stuffing attacks while delivering a better experience for the end user. 

## Bot Detection from Auth0

Auth0 is launching Bot Detection, the first in a series of features to detect credential stuffing attacks on the login flow. Once enabled, this feature will use a variety of signals to assess the likelihood that a login call originates from a scripted attack. If the risk assessment is high, a CAPTCHA step is inserted into the login flow. 

![Bot Detection](https://images.ctfassets.net/23aumh6u8s0i/3Fs7MAvNuLZTFJ20QOSw6m/63bf1b065314dd2bea4a7451782dfb6b/bot-detection-anomaly)

Bot Detection will be supported at launch with Auth0’s Universal Login experience. For customers who have built more customized user experiences using native SDKs such as `lock.js` and mobile SDKs such as a `lock.Android` and `lock.swift`, Auth0 will support an exception scenario so that customers can recognize a risky call and take steps to render a CAPTCHA step on the screen. The feature will also support presenting CAPTCHA using a generic flow or a customer’s own Google reCAPTCHA.

<table>
<tbody>
<tr>
<td><img src="https://images.ctfassets.net/23aumh6u8s0i/1sos7fOgZYGp148983HyH5/809ea54d105104de83c2e922fe22de7f/bot-captcha" alt="Bot Detection-1" width="396" height="602"/></td>
<td><img src="https://images.ctfassets.net/23aumh6u8s0i/1U3FsuEZ0rHL9kDNQv17J5/cb207f20b5eb8b676f1b2549866456dd/bot-captcha-2" alt="Bot Detection-2" width="382" height="735"/></td>
</tr>
</tbody>
</table>

## Mitigating Abuse with Auth0

Bot Detection will be the latest addition to Auth0’s collection of features designed to prevent abuse, including [Breached Password Detection](https://auth0.com/docs/anomaly-detection/breached-password-security), [Brute Force Protection](https://auth0.com/docs/anomaly-detection/brute-force-protection), and [MFA](https://auth0.com/docs/mfa). These features help customers mitigate the tradeoffs between security and usability without unnecessary compromises to user experience. 

## Learn More

* [Credential Stuffing Attacks: What They Are and How to Combat Them](https://auth0.com/resources/whitepapers/credential-stuffing-attacks)
* [The Anatomy of a Credential Stuffing Attack](https://auth0.com/resources/webinars/credential-stuffing-attack-webinar)

Auth0 is the first identity management platform for application builders, and the only identity solution needed for custom-built applications. With a mission to secure the world’s identities so innovators can innovate, Auth0 provides the simplicity, extensibility, and expertise to scale and protect identities in any application, for any audience. Auth0 secures more than 100 million logins each day, giving enterprises the confidence to deliver trusted and elegant digital experiences to their customers around the world.
<include src="asides/AboutAuth0" />


Reducing the Impact of Credential Stuffing Attacks

T025590N6-UA74EV4TB-edf9e73df2fc-512 avatar

T025590N6-UA74EV4TB-edf9e73df2fc-512

I’m a product designer based in Portland, OR. I specialize in breaking down big messy problems and coming up with elegant solutions.

Product Designer

Stacy Taylor

Not only do our customers rely on us to provide secure authentication, they also rely on us to create a positive experience for their users



At Auth0 we provide the tools for application builders to implement authentication and access management so that they can focus on what makes their product unique, rather than on authentication. Our product design team is responsible for both shaping the experience that developers use to implement Auth0 into their product and for informing the design of the authentication experience for our customer’s customers.

That’s a big responsibility. Not only do our customers rely on us to provide secure authentication, they also rely on us to create a positive experience for their users. A well designed and frictionless signup experience can make a huge impact on our customers’ conversion rates and on their users’ level of satisfaction with their product.

As designers, we’re trained to create flows that are intuitive and easy to use, with as little friction as possible. But when it comes to the authentication experience, some degree of friction is required to ensure security. Passwords, multi-factor authentication, CAPTCHA, and session timeouts all introduce friction to the authentication process, but that friction is what stops bad actors from gaining illicit access to accounts.

So how do we balance the need for security with the desire for a frictionless user experience?

## Good Actors vs Bad Actors
One way of balancing security and user experience is by getting better at predicting which transactions are coming from legitimate users and which are not. If we can predict with reasonable accuracy that a user is legitimate we can remove much of the friction from their path. By the same token, if we predict that a user is not acting with good intentions we can introduce more friction to try to stop their attempts at logging in.

At Auth0 we’ve developed several ways of predicting legitimate logins to improve the user experience without sacrificing security.

### Contextual Multi-Factor Authentication
Most security-savvy users are aware that enabling multi-factor authentication (MFA) or two-factor authentication is one of the best ways to protect your accounts online. In May 2019 Google reported that enabling multi-factor authentication can block up to 100% of automated attacks, 99% of bulk phishing attacks, and 66% of targeted attacks.

![Contextual Multi-Factor Authentication](https://images.ctfassets.net/23aumh6u8s0i/1ppxm1wcvVNL65EstifOrV/289400624bb7a80dbba1e485206f72dc/ux-body-01)

But that protection comes at a cost to the user experience. Adding a second factor to the authentication process interrupts the user’s flow. Even a simple factor, like a one time password, requires the user to wait for the SMS or email to arrive, change apps, copy a code, and go back to the original app and paste in the code before returning to the original flow. While mobile operating systems are making it easier to enter a one time password with less context switching, it still disrupts the user flow. Authentication apps, such as Authy and Google Authenticator, provide greater levels of security but are even more disruptive to the user flow.

Wouldn’t it be nice if you had the protection of multi-factor authentication without the inconvenience? That’s the idea behind Auth0’s Contextual MFA feature. Contextual MFA uses certain signals, such as the device you’re using, your geographic location, or your IP to determine how likely it is that a login attempt is legitimate. As the feature learns your login habits it will learn to predict which login attempts are legitimate and only prompt for multi-factor authentication if the confidence score is low.

## CAPTCHA
CAPTCHA, or Completely Automated Public Turing test to tell Computers and Humans Apart, requires users to prove that they’re human, usually by entering a word or words in an image or by identifying objects in a series of images, which helps to reduce automated attacks by bots.

![CAPTCHA](https://images.ctfassets.net/23aumh6u8s0i/7d5ZwC8CYh02nCwsPfr6UC/2f4d12aa2da72dc5f2226728030144b6/ux-body-02)

CAPTCHA can be an effective tool to stop many automated attacks, but again, this protection comes at a cost to the user experience. Like MFA, CAPTCHA interrupts the user flow and requires users to decipher difficult to read text or identify objects in grainy photos. If you get it wrong you frequently have to begin the entire process all over again. CAPTCHA also suffers from many accessibility issues. Users with visual impairments may not be able to solve the CAPTCHA at all. Sometimes an audio CAPTCHA is presented as an alternative, but this may not be a feasible solution for users with hearing difficulties, who are in a noisy environment, or don’t have a sound enabled on their system.

These extra barriers can be significant enough to prevent users from signing up or logging in to an application. According to one study, adding CAPTCHA to a form can reduce conversions by up to 33%!

At Auth0 we work hard to ensure that our customers’ users don’t have to deal with CAPTCHA. Our automated attack protection analyzes traffic patterns in order to determine whether a login is being initiated by a human or a bot and only require CAPTCHA if we’re reasonably certain traffic is coming from a bot. Like with Contextual MFA, a legitimate user’s login experience should never be interrupted.

## Not All Products Are Secured Equally
Helping to secure your application is what Auth0 is all about, but we also understand that certain applications need to be more secure than others. For instance, an online banking app should have more friction in the authentication experience than a product that doesn’t store sensitive personal information.

### Long Lived Sessions
At Auth0, we recognize that while it’s important for applications with access to sensitive data to log users out after they’ve been idle for just a few minutes, many of our customers with lower risk products may not want that for their users.

Media companies, for example, often find that users visit their site once every few weeks. If users are required to authenticate and can’t remember their password they’re likely to just abandon the site. For companies that rely on ad revenue that can be a huge blow to their bottom line.

Other companies, such as insurance or utility companies, might have customers who interact with their site once a month or once a quarter. It’s quite common for users to forget their password after such a long time, which can lead to increased customer service calls and decreased customer satisfaction.

Auth0’s [long lived sessions](https://auth0.com/blog/when-ux-equals-keeping-or-losing-the-customer/) feature addresses these and other similar use cases. Our customers can now customize session limits with up to 100 days of inactivity and up to one year in total depending on the balance of risk and user experience that’s right for them. Customers with a lower risk profile can remove friction for their users by enabling longer session lengths, while customers with higher risk profiles can automatically log users out after a much shorter period of time.

## Obfuscation as a Necessary Evil
Part of designing a good user experience is making sure a user can easily understand what’s happening and what their next course of action should be. Unfortunately, there are times when making things easy for our users also puts them at risk.

### User Enumeration
Have you ever tried to log in to an application only to receive a generic “there was a problem with your username or password” error message? If so, there’s a good chance you cursed the designer who created that error message.

![User Enumeration](https://images.ctfassets.net/23aumh6u8s0i/1WowXTwcIGf90FTqtSJ1oU/49c814a488f089cfe6e71741c845f7c8/ux-body-03)

What kind of subpar UX designer would design such a bad experience? Aren’t they familiar with number nine on Jakob Nielsen’s list of Ten Usability Heuristics, which clearly states “Help users recognize, diagnose, and recover from errors?” A more specific error message like “this username does not exist” or “incorrect password” would be better…right? Maybe not.

While it’s true that a vague error message can be annoying and frustrating, it can also help to protect you. For example, if an application’s error message was “this username does not exist” when the username is invalid, but “incorrect password” when the username is valid it would allow attackers to compile a list of valid usernames for an application. That information could then be used in brute force attacks, such as dictionary attacks or credential stuffing attacks. A dictionary attack is when a hacker uses a known username combined with common passwords like 123456 or passw0rd to try to hack into an account. A credential stuffing attack is when an attacker uses credentials obtained from a data breach on one service to hack into the user’s account on another service.

Using complex and unique passwords help to prevent brute force attacks once a malicious actor has your username, but obfuscated error messages can prevent them from validating your username in the first place.

## Conclusion
Securing the world’s identities while providing a positive authentication experience for end users might seem like a daunting task, but it’s not impossible.

Our engineers work hard behind the scenes to determine whether an attempted login or sign up is legitimate so that we can implement CAPTCHA or multi-factor authentication for suspicious logins while keeping the authentication process frictionless and secure for our customers’ users. We give our customers the power to customize their user experience depending on their risk tolerance and the needs of their users. And while sometimes it is necessary to sacrifice the ideal user experience in order to guarantee the security of our customers and their users, it’s a trade-off that we make consciously and with a great deal of consideration and collaboration.

Designing for both UX and security is a difficult balancing act that the product design team at Auth0 faces every day. If this seems like the kind of challenge you’re interested in tackling be sure to check out our jobs page [here](https://auth0.com/careers/positions?areas=Design).



Balancing UX and Security at Auth0

megan-gleason

Megan is Director of Product at Auth0, focusing primarily on developer experience and service management.  She has a passion for building delightful products for technical audiences and previously led the product team at Chef Software.  Megan is a self-described product geek and enjoys international travel and languages.

Director of Product - DX and Service Mgmt

Megan Gleason

Why your need for rapid integrations drives our modality approach



The identity job you're trying to do at the moment — and the most efficient way to tackle it — is what matters to Auth0.

Making sure our product reflects the simplicity and power you need, when you need it, is why we've embraced a "modalities" model when we work on our developer experience (DX). Because our platform is integrated tightly with our customers' applications, we want to provide developers with a slider on DX that fits the mode of the moment when working with Auth0.

In the Auth0 Product Team, our mission is to make identity simple regardless of the modality you choose to use. The questions that keep us up at night are: Is there a comparable experience across all the modalities? Can you perform a core action of using Auth0 via any of these approaches? Can you really choose your own adventure? 

![Auth0 offers a great pro-code experience](https://images.ctfassets.net/23aumh6u8s0i/2DphcLZYf8BdGfRsZYqekE/805542e2b7bbb6ebfe03bffa5320f25a/no-code-to-pro-code-2)

## Modalities

Products like Auth0 that rely on integration of services with its APIs must meet high standards of utility and simplicity to deliver great DX. The best products in this category "just work" or feel like "magic" to developers who use them. In pursuit of creating those experiences, at Auth0 we look at DX through a particular lens: modalities. (Credit to Ike DeLorenzo of Twilio for introducing me to this idea in 2018.)

Modalities allow us to go beyond traditional UX personas, blending in a bit of jobs theory to get a more nuanced view of how our products need to perform in different situations. A modality effectively summarizes the way in which a user, in this case a developer, is looking to interact with the product right now. A developer likely doesn't stay in one modality forever, but may switch from one to another depending on what they're trying to achieve — and that's where that slider on DX comes into play. 

The following subsections highlight how we talk about modalities at Auth0.

### No Code

A developer in no-code modality is looking for a click-button, out-of-the box experience. For a technical product like Auth0, often we think about developers who might be evaluating the product to understand what it can do without investing a ton of time. Our site [flows.auth0.com](https://flows.auth0.com) is an example of a no-code experience that connects users to the value of Auth0 within seconds. Going one step further, our [Manage Dashboard](https://auth0.com/docs/dashboard) allows developers to quickly change product configuration, like implementing [multi-factor authentication (MFA)](https://auth0.com/docs/multifactor-authentication), with the flip of a button when they are working in this modality.

### Low Code

In this modality, a developer is ready to commit some time, but is looking for reusable patterns to reduce effort wherever possible. Templates, sample apps, and code editors in the Manage Dashboard help low-code developers make quick progress without setting up a full development environment, writing a starter app for prototyping from scratch, and so on. [Auth0's Rules](https://auth0.com/docs/rules) and [Hooks](https://auth0.com/docs/hooks) features, quick customization of the login experience for end users via Universal Login, as well as SDKs with sample code for a broad range of technology platforms, all support developers looking for powerful low-code experiences.

### Pro Code

Once the value of Auth0 is fully realized, developers may switch into the pro-code modality. The same APIs that power the Manage Dashboard can be called directly via custom code in the developer's app. By integrating Auth0 with SCM and even their CI/CD pipelines, developers can fully automate configuration of the system via code. For a great pro-code experience, we embrace API-first development principles ensuring that all of Auth0's capabilities can be exposed and managed this way.

![Auth0 focuses on developer experience.](https://images.ctfassets.net/23aumh6u8s0i/AoR2NphX1ZibBcAmz3rAM/9749691075472a83077f07513af1668d/no-code-to-pro-code)

## Cruising through Modalities

What's powerful about modalities is the recognition that on any given day, a developer may have reason to interact with our product in a different way. We want to provide the same intuitive, predictable, and "magic" experience to developers regardless of where they are on this spectrum. At Auth0 we have an entire product development domain dedicated to DX, and our objective is to surface and eliminate friction across all of these modalities. We want developers to succeed with Auth0 whether they are poking around during their lunch hour or fully automating their use of the product with configuration as code, and our mission is to make the transition between those modalities as smooth as it can be.

If you're interested in sharing your ideas about DX in Auth0, our product development teams would love to talk with you. Visit [auth0.com/feedback](https://auth0.com/feedback) or reach out to us via our [community site](https://community.auth0.com/). Thanks for using Auth0 and for helping us make a great product based on your needs and experiences.

<include src="TweetQuote" quoteText="What's powerful about modalities is the recognition that on any given day, a developer may have reason to interact with Auth0 in a different way."/>

<include src="asides/AboutAuth0" />


Designing for Devs at Auth0

How top teams are updating their legacy systems with more secure and efficient solutions.



You used to pay with cash. Then credit cards. Then EMV cards. Now, we’re moving toward things like [cryptocurrency](https://auth0.com/blog/an-introduction-to-ethereum-and-smart-contracts-part-3/) and [biometric authentication](https://auth0.com/blog/tags/biometric-identity/).

Payments and the technology involved in making them are constantly evolving. For example, payment company Square recently added [_Square Register_](https://techcrunch.com/2017/10/30/square-announces-the-register-a-999-point-of-sale-device-for-larger-businesses/) to its hardware lineup. Unlike most of Square’s other equipment, Square Register targets the needs of larger sellers.

![New Square Register hardware that targets larger sellers](https://images.ctfassets.net/23aumh6u8s0i/3cB517ydiTQ1OrJtW1Xcgp/21b12b0ff377b06d77686c542522fb9f/square-register)

At the same time, Mastercard is [_doing away with signatures_](https://newsroom.mastercard.com/press-releases/signing-off-mastercard-moves-beyond-signatures-worldwide/) on the backs of credit cards, and on receipts themselves, in favor of exploring more advanced technologies for identity verification. 

Even PayPal has jumped on the payment revolution by going beyond ecommerce. PayPal now offers customers the option to use their [_PayPal balances_](https://www.tearsheet.co/payments/how-paypal-is-moving-into-physical-retail) at physical retail shops through Android Pay. 

Needless to say, the [_financial services_](https://auth0.com/financial-services) and payments landscape is ever-changing. And a business that wants to remain competitive within its industry needs to look at [updating its legacy system](https://auth0.com/blog/how-do-i-modernize-my-legacy-system/) (or even ripping and replacing it) in order to be more secure, efficient, and compliant with customers’ financial data.

## What’s Inspiring These Changes?

We live in an age of [seemingly constant innovation and advancement](https://www.teampay.co/insights/how-blockchain-will-change-finance/), so it makes sense that payments are following suit.

But there are a few other factors involved in pushing these advancements in payment technology.

One is the uptick of credit card fraud and, as a result, the increasing consumer concern about their security and protection.

![Advancements and the Future of Payments and Payments Processing in 2019](https://images.ctfassets.net/23aumh6u8s0i/2tbJEM41OF7GvxFNduJbpT/1726b2e1900063ee05eb56c52b9a572f/future-of-payment)

Credit card fraud has steadily been on the rise. In fact, the [_financial industry estimates_](https://www.accenture.com/us-en/insight-banking-future-payments-ten-trends) that we’ll reach $31.3 billion in global credit card losses by the end of 2018. Credit card scammers are getting smarter. Today, these fraudsters are capable of not only [_selling credit card numbers_](https://www.businessinsider.com/credit-card-fraud-scam-what-to-do-2018-8) but also identifying information like zip codes. 

Additionally, new [_payment regulations_](https://home.treasury.gov/sites/default/files/2018-07/A-Financial-System-that-Creates-Economic-Opportunities---Nonbank-Financi....pdf) demand an increasing level of transparency and security. To stay compliant, businesses have no choice but to keep up with the changing technology and rules.

## The Future of Payments: 3 Advancements to Be Aware of in 2019

There’s no shortage of changes happening in the payments space. But trying to stay on top of (or even *ahead* of) all of them is a daunting task.

If you're like most companies, you're primarily focused on what you need to know right now. But to remain competitive, you have to stay ahead of the curve. What will payments look like in the future? Here are three burgeoning areas that you should be aware of as you look at updating your own legacy systems.

### 1. Multi-Factor Authentication Will Gain Even More Importance

As concerns over security continue to grow (for good reason), [multi-factor authentication](https://auth0.com/docs/multifactor-authentication) will be of increasing importance for consumers and businesses. 

Traditionally, you could access various accounts by entering a single identifier (think a username or an email address) and a correct password. 

But multi-factor authentication adds another layer to the identity-verification process by asking you to prove your identity in another way — for example, by entering a code you receive on your cell phone or even scanning a fingerprint.

You can think of it as a second security door. Hackers and thieves who are able to make it through the first will have a much tougher time passing through the second.

Because more and more financial and payment data is linked to our personal accounts (your credit card being stored in your Amazon account is just one example), we’ll see multi-factor authentication become the norm more and more. 

Many regions are actually instituting policies to mandate strong customer authentication—like [_PSD2 in Europe_](https://auth0.com/blog/open-auth-standards-psd2/). 

### 2. Point-of-Sale Analytics Will Become Even More Advanced

While the protection of data is an area of primary focus, so is* leveraging* data.

To make more informed predictions about the future, businesses are hungry for any information about what their customers are purchasing. That means we’ll see [_retail analytics_](https://auth0.com/blog/retail-analytics-past-present-and-future/) continue to expand — with an emphasis on point-of-sale analytics. 

Previously, POS analytics were fairly straightforward — they shared what was purchased, and by whom. But today these analytics are capable of reporting on where the item was stored or where it was shipped from and can provide information about inventory and dead stock and even details about the [_customer's identity_](https://auth0.com/blog/digital-success-through-customer-identity-and-access-management/) and their consumption patterns.

As we move into the future, payments are no longer just a one-time transaction with little to no data attached to them. Instead, this important point of contact will become an informative touchpoint for businesses to learn even more about their consumers. 

### 3. User Experience Will Be Paramount

Convenience and ease of use are main areas of focus for today’s customers. They’re no longer writing out checks or counting out stacks of coins—they want the payment process to be as streamlined as possible.

Just look at something like [_ZAPBuy_](https://www.prnewswire.com/news-releases/omnyway-launches-zapbuy-allowing-shoppers-to-buy-products-from-ads-with-a-snap-300425915.html), which was launched by Omnyway in early 2017. The tool allows users to hold their smartphones over an advertisement on any channel and immediately purchase what’s being promoted to them. 

Consumers have a desire to reduce or eliminate friction in the purchasing process, which is fueling this move toward more [_“invisible” payments_](https://www.tearsheet.co/payments/4-charts-that-show-the-coming-autonomous-payments-wave). Think about Uber as just one of many examples. You don’t think about making a payment when you step foot out of that Toyota Corolla—the transaction happens seamlessly behind the scenes. 

![Uber user interface and simple experience for the future of payments](https://images.ctfassets.net/23aumh6u8s0i/5bRmcm4wRgjkEXsWdYrgJz/24020dd49f3fcabbe8d6c24fcd5b69ab/uber)

When today’s customers see a clunky or cumbersome purchasing process, they immediately head in the other direction. Payments are expected to be fast and easy—and that’s an expectation that will only increase as Generation Z makes up [_40% of consumers_](https://www.accenture.com/t20171012T092426Z__w__/us-en/_acnmedia/PDF-62/Accenture-Driving-the-Future-of-Payments-10-Mega-Trends.pdf#zoom=50) by the year 2020.

## What This Means for You: Updating Legacy Systems in Your Business

Change is here for payments, and it’s going to keep coming.

That means it’s time to start looking at [updating legacy systems](https://auth0.com/blog/how-do-i-modernize-my-legacy-system/) related to payments in your business. While your current systems, tools, and software may work for you right now, they might not have the level of flexibility required to keep up in this ever-evolving industry.

Having the right resources in place will make it much easier to stay on top of—and maybe even ahead of—the constant barrage of changes and advancements in the world of payments. 

Wouldn’t you rather do that than fall behind? We thought so. 

<include src="asides/AboutAuth0" />


The Future of Payments in 2019

bruno-krebs

I am passionate about developing highly scalable, resilient applications. I love everything from the database, to microservices (Kubernetes, Docker, etc), to the frontend. I find amazing to think about how all pieces work together to provide a fast and pleasurable experience to end users, mainly because they have no clue how complex that "simple" app is.

R&D Content Architect

Bruno Krebs

Learn how a B2C Company implemented Single Sign-On to provide seamless integration between different e-commerce portals.

Implementing Single Sign-On in B2C Applications

diegopoza

System Engineer, geek, foodie, technology lover, speaker.

Sr Manager, Developer Advocacy

Diego Poza

Pros, cons, and exceptions to asking users to create an account.



Most of the time on the Auth0 blog, we talk about logging in and signing up as though it's obvious that everyone will do it. However, asking users to sign up for your product isn't always an easy decision to make. Some people are worried about the friction it causes, or if it's necessary for their product. Sometimes, worries about maintaining secure logins make asking for signups seem like more trouble than not asking users to sign up at all. 

As experts on signup and login, we've thought of — and encountered — use case after use case, and find that asking users to log in almost always offers benefits to both the business and the user. From security to enterprise concerns to customer support, the power that login has to better your product is something you should seriously consider as you build and grow your business.

This isn't an exhaustive list of every reason why you should ask users to log in. Rather, it's an overview of why you should have users create accounts, why login is mutually beneficial, and the very few exceptions where this isn't the case. 

## The basics of login

Whether you're using a username and password or a complex multi-factor setup, the core principles of login remain the same:

* **Login requires a signup for your product.** This means that there is only a certain group of users who are allowed access your product, although login doesn't have to mean that your product is 'exclusive.' For example, anyone may be able to sign up for a gaming app, but only paying customers for an analytics software. 
* **Login creates a user account.** This means that users are uniquely identifiable within your product.
    * **For users** this frequently means that they can see their own profile and information, change that information, and keep track of what are the identifiers on their account (profile picture, username, etc.)
    * **For companies** this means that user data can be linked to an individual profile. This profile probably contains all the information the user inputs, and can also be a home for any other data that a company chooses to attach to that profile (type of device, for example).

## Security and accountability

### User Accounts

Enabling a user to create an account and log in, is equipping them with security for and control over their information. 

When a user can see the information they've given you in their user profile, they understand what you're using to connect with them. So when a user gets, for example, a promotional email, they know where it came from. They can simply go into their settings, change their email, check and unsubscribe from promotions. 

Otherwise, users might be wondering what happened to the email address they used to make an in-app purchase.

If they want, they can also change privacy settings, update personal information, and delete their projects and profile, leaving no question about what is hanging around in your product. 

**For your users:** Accounts help put users in the driver's seat for their data. 

**For your company:** Letting users see and control their data builds trust with users, which helps foster transparency about what information is stored by a company (especially when [nobody](https://www.theguardian.com/money/2011/may/11/terms-conditions-small-print-big-problems) reads terms and conditions). 

### Enterprise concerns

Login is also incredibly important for enterprise customers, for a number of reasons. 

* **Security.** Enterprise customers want to have everything within their system secured, which means providing a sign up that works with [enterprise login requirements](https://auth0.com/blog/how-enterprise-federation-helps-shorten-the-sales-cycle/).

![Enterprise Connections](https://images.ctfassets.net/23aumh6u8s0i/5QEgErqXGl2jN1edEZS2Uz/682cd255a8d7d7d0f2610dd323927104/enterprise-connections)

* **Managing roles.** With potentially hundreds of employees all needing to access your product, enterprise customers want to be able to designate and manage roles. The head of marketing might need admin access to an analytics platform, but a sales person definitely doesn't. 
* **Tracking employee data.** When each employee has an account, it's easy to track who is making changes, who is working on what projects, and how teams are working together. Enterprise companies especially are interested in keeping track of who is doing what, so anything that comes up down the line, whether mistake or triumph, can be properly attributed.

**For your users:** Accounts and login helps enterprise customers trust your product and integrate it with their existing tools.

**For your company:** If you are considering working with enterprise customers, you will need to implement a sign on feature. Truthfully, we've only scratched the surface of what enterprise customers expect out of their login — it can be make or break for you if you don't have a login to fit their needs, no matter what your product. 
 
### Customer experience

Login can be a powerful tool for shaping customer experiences. Beyond simply getting someone into a product, login can be a way to manage data on a user and help them get the most out of your product. 

* **Giving better support.** When a customer contacts support with a problem, imagine if they could get welcoming, customized support — like being greeted by name, and not having to answer a long list of questions about their product history or what devices they're using. If you don't have a user account to store data like name and device type, that's simply not possible. Keeping an internal profile of every customer through your login is a great way to personalize your support.
* **Catering to a multi-device world.** When there's no login, there's no easy way for a user to use your product on multiple devices without starting fresh. Even if you're a simple game app, letting people save their progress and access from different devices can keep users habitually engaging with your product.  

![Multi-device world](https://images.ctfassets.net/23aumh6u8s0i/2TtPauGPyLLd8ksJWl5kIB/c53db80c1be8c47fa36b3eb7743faaec/multi-device)

* **Offering a social component**. Whether people want to share their favorite songs, their pictures and videos, their high score or their sales data, any sort of social or sharing component in a product can benefit from a login. By giving people an account and a profile at login, you make it easy for someone to find just the right person to connect with, whether that's for business or friendship. Without login, finding and sharing things to a select group is difficult.

If you're still worried about having the login as a barrier between potential users and your product, consider offering options like passwordless login and social login, that ask less of users than traditional or multifactor authentications. 

## Exceptions to the rule

So, we've been over many reasons why using a login is a good idea. But there's always exceptions to the rule — here are the three biggest. 

* **Product demos:** Although some companies have you create an account to access a product demo, most require only your email or sometimes nothing at all. When you're giving people the chance to try out your product, it doesn't always make sense to have them go through the process of creating an account, especially if it's a short demo and not a free trial. If a user just wants to see what you're about, sometimes it's better to let them get some time to explore without having to sign up.
* **Checkout:** Users shopping online are skittish about signing up in order to check out, especially if they're a new customer and aren't sure if they like your product yet. Removing a requirement to sign up and allowing a guest checkout can benefit your conversions at checkout. Clothing retailer ASOS [halved](https://econsultancy.com/blog/10355-eight-out-of-top-10-us-retailers-offer-guest-checkout/) it's abandonment rate by adding a guest checkout. 

![Checkout experience](https://images.ctfassets.net/23aumh6u8s0i/2gZuegLMzCtwWTguaXRykB/10b3e56cbc728a7e467ef3dba0eb952d/checkout)

* **Mobile**: It seems like almost every mobile app requires a login, save for weather apps and a few games. One reason for this may be that the [download is the real source of friction](https://www.quora.com/Is-it-better-to-force-a-login-signup-to-use-an-app-or-let-users-use-it-freely-until-they-hit-a-feature-that-requires-a-login) to adopting use of a mobile app — once you've gone through the trouble of actually getting the app from the app store, the time it takes to sign up is negligible. Still, if you're offering a simple mobile service without any social features, it might be worth skipping the extra step. 

These exceptions come with deep understanding of your product, and how users are moving through it. When login becomes a big source of friction, it can make sense to remove it. Take the “[$300 million dollar change](https://articles.uie.com/three_hund_million_button/)” that one major e-commerce company made.

They didn't see their request for users to login as a problem — but their users sure did. When interviewed, they expressed that having to login before checkout was a huge nuisance, and when they looked at their analytics they saw 160,000 requests for forgotten password a day — clearly, login was hampering their customers from checking out, not helping them. 

When they dropped their login requirement, they immediately saw a huge sales boost.

So, if you are thinking about ditching your login, do some exploratory work and see what is tripping people up as they're trying to use your product. If it seems to be login, it could be worth a shot to remove it and see how things go.

## Let your login lead the way

If you're trying to decide whether or not to add a login feature to your product, don't fall prey to thinking that all login is is a box for a username and password that only creates friction for your users. When you're actually thinking about what login can do for you, it's clear that there's a host of benefits for both you *and *your users that simply aren't possible if you don't require a login.

Of course, making these benefits a reality means implementing a more sophisticated login than that box for your username and password, and that's where Auth0 is ready to help. When you implement that sophisticated login, you're letting it lead you to better customer experiences, no matter the product.

**Aside: Securing Applications with Auth0**

Are you building a [B2C](https://auth0.com/b2c-customer-identity-management), [B2B](https://auth0.com/b2b-enterprise-identity-management), or [B2E](https://auth0.com/b2e-identity-management-for-employees) tool? Auth0, can help you focus on what matters the most to you, the special features of your product. [Auth0](https://auth0.com/) can improve your product's security with state-of-the-art features like [passwordless](https://auth0.com/passwordless), [breached password surveillance](https://auth0.com/breached-passwords), and [multifactor authentication](https://auth0.com/multifactor-authentication).

[We offer a generous **free tier**](https://auth0.com/pricing) so you can get started with modern authentication.


Should You Make Your Users Log In?

Identity management can be a tool that enhances your onboarding efforts to help you create great user onboarding experiences. Find out how.



User onboarding is not the most straightforward thing to build. You want to get people into the value of your product, and you want to appeal to them from their first interaction with your product. Do you use tooltips? How long is your first onboarding tour? Which features do you point out? 

In all of this, the role that login plays in your onboarding can become an afterthought. Who has time to develop identity management when there's an entire product tour to design and build?! 

If you're falling prey to that thinking, then you're missing out on a great way to upgrade your user onboarding. Identity management can be a tool that enhances your onboarding efforts to help you create great user onboarding — whether you want to create your first flow or your tenth.

## Nail the first step: actually signing customers up

One of the first interactions a customer has with a product is a login screen that asks them to sign up for an account. Since onboarding is about helping a user get to know your product and dig into its value, a signup that drives people away will negate even the best onboarding. 

![Auth0 Lock Widget](https://images.ctfassets.net/23aumh6u8s0i/1Xu90WkRSoZT3zl0xH7daR/3d08d78404a08b99b3b004b55832e9e8/lock)

So you need signup that reduces friction and helps people get straight into your product. That's where social login comes in. Because users don't feel like they're making yet another account with yet another password, they are much more likely to sign up — social login has the ability to boost your conversion by up to [20%](https://www.quora.com/What-impact-does-social-login-have-on-conversion-rates), in fact. 

The benefits of social login don't end there, either. With [Auth0](https://auth0.com/docs/identityproviders), you can pull data from someone's social profile straight into their user profile, eliminating the need for people to fill in questions about their location and birthday. When someone signs up, they can get right into your product, and not get caught in a cumbersome signup that detracts from your product's first impression.

## Use login to customize your onboarding

Let's say you're an e-commerce platform. Single craftspeople with a small inventory are going to need and want different things from your product then that enterprise customer who ships hundreds of items a day. 

Onboarding experts, like the folks at [Chameleon](https://www.trychameleon.com/), suggest that these different personas should receive [custom user onboarding](https://www.trychameleon.com/blog/user-onboarding-more-than-first-user-experience). They say it's best to “identify specific user types within an application and present functionality that’s most relevant to them.” Only one catch — how do you know what type a user is when they sign up?

The answer: profile enrichment.

Profile enrichment is the process of adding publicly available information to a user's profile. With Auth0, you can automate this process at login with snippets of code called [Rules](https://auth0.com/docs/rules). Add a Rule to fetch information from a database like [Clearbit's](https://clearbit.com/), which taps into business information, and you can have profession and job titles as soon as users sign up.

![Clearbit](https://images.ctfassets.net/23aumh6u8s0i/5D9JD85SjvLy39BT0AUz5X/7de99c183866cadfba6fa4745947b05f/clearbit)

([source](https://clearbit.com/enrichment))

If your customer is part of a small business, you can then point them to your SMB flow. If they're enterprise, you might email them letting them know you're available for team onboarding sessions. 

These touches will help get users into your product's value, and show them how they can get exactly what they need out of your product. Between automated profile enrichment and the option to use tools like Chameleon that allow you to quickly build several onboarding flows, there's no reason not to customize at login.

## Ramp things up with login integrations

With a fully developed identity management system, the possibilities for integrations at login extend much further than profile enrichment. 

For example, Auth0 integrates with SalesForce. This means that you can institute a Rule that makes a new lead in SalesForce any time a new user logs in. If you have any personalized onboarding from your sales team, they'll be able to catch everyone that signs up for your product.

Another integration that might be particularly useful for onboarding is setting up a Rule to trigger an email either at first, second or third login. You could open with a welcome message, highlight a useful feature, or point to a help center early in the game to keep users engaged with your product, no matter how much of your onboarding they get through on any given login. 

You can use your preferred email service, or trigger emails at login [right from Auth0](https://auth0.com/docs/email/custom).

![Auth0 Email](https://images.ctfassets.net/23aumh6u8s0i/6KSIpuwtKjUgv0IKS6d1yp/45f6f5f76a0c2777357c1594c8ae02a9/auth0-email)

Whatever tools you want to use with your onboarding, there's a good chance you'll be able to find or write a Rule to get it done. The flexibility of an identity management system to easily interact with other platforms is key to using your onboarding to create great onboarding.

## Improving your onboarding, one step at a time

Obviously, taking advantage of your login isn't going to solve all your onboarding problems or single-handedly build you the best onboarding ever. But it is an easy way to focus your onboarding improvement to be more customized, and more appealing to users. 

Since login is the first thing that new users experience of your company, tackling it as the first step to making better onboarding is pragmatic. Starting with a robust, contemporary identity management platform will help you unlock all the ways identity can help you build great user onboarding.


How Identity Can Help You Create a Great User Onboarding

3 ways you can use Analytics to build your product



# Insight and Execution: Why Analytics Matter

Your goal in building a product is to create something that gives value to your customers. That feeling of delight you experience when a product makes your life easier, that's what customers are paying you for.

You can improve your product forever. There is always a way to deliver more value to your customers. The question is, how do you decide what to improve?

You can use either analytics or intuition to drive your development. If you use analytics, you can be certain you're developing what customers want. If you [use your intuition](https://amplitude.com/blog/2016/05/19/square-built-data-driven-culture/), well, good luck with that.

With this in mind, we've broken down three of the most powerful ways you can use analytics to develop your product.

## 1. Personalize The User Experience

Personalization is one of the most powerful tools you have for driving engagement with your app, but you have to collect data to do it. Rigorous collection and integration with data was the basis of the fastest-growing social network of all time: Facebook.

Many have heard the story of Facebook's [seven friends in ten days](http://andrewchen.co/my-quora-answer-to-how-do-you-find-insights-like-facebooks-7-friends-in-10-days-to-grow-your-product-faster/) metric. Early on, they discovered that if a user added seven friends in their first ten days, they were much more likely to stick around and keep using Facebook. The company united around getting every user to hit that goal, and the rest is history.

All Facebook had to do for this viral growth [was make it easy](https://www.quora.com/What-are-some-decisions-taken-by-the-Growth-team-at-Facebook-that-helped-Facebook-reach-500-million-users) to pull your other contacts into the network. It might seem like some high-tech magic, but it's something you can do very simply in your own app.

Using Auth0's [Single Sign On](https://auth0.com/docs/sso/single-sign-on), or SSO, you can collect such customer data from other social platforms automatically.

Through Auth0's Social Connections dashboard, all you have to do is toggle a switch to enable SSO for any of the 30+ platforms Auth0 supports. This way, if a user authenticates through Facebook, Twitter, LinkedIn, Google, or any other provider, you can immediately pull their contact list and connect them with users in their social network.

![Social Connections](https://images.ctfassets.net/23aumh6u8s0i/20tjBC6sNciJmDOvd46rF6/73e647a6876c576859e6ce6f06432c5f/social-connections)

If you want to make all of your users feel valuable, the first step is to find out who you're dealing with. This means contact lists, but also locations, birthdays, work history, education background, and so much more. With [Auth0's Social Connections](https://auth0.com/blog/2015/12/16/how-to-use-social-login-to-drive-your-apps-growth/), you can easily collect all of these things.

## 2. Build The Right Product/Feature

With analytics, you can build the product your customers want before they know they want it.

<include src="TweetQuote" quoteText="With analytics, you can build the product your customers want before they know they want it."/>

One of the best real-world examples of this is Netflix. The streaming service collects a [giant amount of data](https://pilotfiber.com/blog/how-netflix-know-what-you-want-to-watch/), including:

* Your viewing habits relative to the time of day
* The devices you watch from
* What customers similar to you watch

This data helped Netflix create a show they knew viewers would love before they'd ever shot a single scene, *House of Cards*. While Netflix couldn’t have known the show would go on to be nominated for [32 Emmy](https://en.wikipedia.org/wiki/House_of_Cards_(U.S._TV_series)#Accolades) awards, they knew the show would be successful before they gave it the green light. How? Customer analytics.

![House of Cards - Analytics](https://images.ctfassets.net/23aumh6u8s0i/4kf7K9tHMxTpIweHMA1VAd/daebc761af96f4c5804a507d5a627df9/house-of-cards)

[*source:* [BrainFoodTV](http://brainfoodtv.com/site/wp-content/uploads/2014/03/Screen-Shot-2014-03-12-at-22.14.05.png)]

After studying their user analytics, Netflix noticed there was overlap in three groups of viewers: Kevin Spacey fans, David Fincher fans, and fans of the original British version of *House of Cards*. Putting this knowledge to work, Netflix bought the rights to the US remake of the show, hired David Fincher to direct it, and cast Kevin Spacey as the lead.

Netflix invested millions in *House of Cards*, but the risk was lessened because they were certain an audience existed for the content.

Knowing you have an audience before you build something is always helpful, but it's only one piece of the puzzle. You also have to find a way to retain that audience once they're engaged, and analytics can help with that too.

## 3. Create A Truly Sticky App

Your app might be extremely engaging to a customer when they first open it, and completely lose a customer's interest one day later. In fact, the average Google app loses [90% of its daily active users](http://andrewchen.co/new-data-shows-why-losing-80-of-your-mobile-users-is-normal-and-that-the-best-apps-do-much-better/) within the first 30 days.

The key to creating a sticky app, one which keeps customers engaged, is to use analytics to discover how to engage not just new customers, but old ones as well. One example of this is *behavioral cohorting*.

[Amplitude](https://amplitude.com/), a mobile and web analytics service, [describes behavioral cohorting](https://amplitude.com/blog/2015/12/15/how-to-increase-growth-through-retention-analysis/) as “Looking at all your users *who performed a specific action* (or set of actions) and how that's correlated with their retention, instead of looking at all your new users.”

Heyday, an app that automatically journals your life, used behavioral cohorting to [compare retention rates](https://amplitude.com/resources/Amplitude-Heyday-Behavioral-Cohorts-casestudy.pdf) among customers who used different features. In the following graph, customers who used Heyday to create and edit photo collages are represented in blue. Customers who only viewed photos in Heyday are shown in red.

![House of Cards - Analytics](https://images.ctfassets.net/23aumh6u8s0i/3un549xbFScynLd5YvRQWc/57d4b709c856277beb0f64c011f73b02/heyday-analytics)

[*source:* [Amplitude](https://amplitude.com/resources/Amplitude-Heyday-Behavioral-Cohorts-casestudy.pdf)]

The first day after downloading is labeled “Day 1” on the graph, and it marks the beginning of a sharp decline. For the next 14 days, both groups of customers lessened and lessened. But after the 14th day, the group of customers who used the collaging and editing features stopped hemorrhaging. The other group continued to lose customers.

Realizing that customers who used the photo editing features were more likely to remain engaged, Heyday focused their resources into building out this set of features, instead of wasting energy on features less likely to retain customers.

The customer is always right. The features they use the most are your best features, and are the ones the make your app sticky. Once you know which features to prioritize, you can focus your resources where they matter most.

## Executing On Information

Auth0 isn't an analytics platform, but it makes it easy to execute on the insights your analytics platform provides. For example, with [Auth0 Rules](https://auth0.com/docs/rules) you can take analytic insights and turn them into actionable strategies quickly and easily.

 Auth0 Rules are functions that execute every time a user authenticates to your application. Let's say you built an app where users authenticate through Twitter. If your analytics platform says that email engagement with customers boosts retention, you can use Auth0 Rules to collect customer email addresses and automatically contact them when they authenticate.

The first step here would be to get their email address when they authenticate with Twitter. The rule for this is only two lines of code:

```
user.app_metadata = user.app_metadata || {};
var email = user.email || user.app_metadata.social_email;
```

After storing their email address, you'd use Auth0’s [Segment Rule](https://auth0.com/docs/scenarios/segmentio) to send customer data to Segment, and use Segment’s docs [Customer.io integration](https://segment.com/docs/) to begin the process to automate your emailing. Easy.

The code would look like this:

```
function (user, context, callback) {
  if (context.protocol === 'delegation') {
    return callback(null, user, context);
  }

  const request = require('request');

  if (context.stats.loginsCount > 1) {
    sendEvent('Logged in');
  } else {
    sendEvent('Signed up');
  }

  function sendEvent(e) {
    const sioTrack = {
      userId: user.user_id,
      event: e,
      properties: {
        application: context.clientName
      },
      context: {
        ip: context.request.ip,
        userAgent: context.request.userAgent
      }
    };

    // Segment API returns 200 OK for all its request. For possible errors
    // you must use Segment's Debugger (https://segment.com/docs/libraries/http/#errors)
    request({
      method: 'POST',
      url: 'https://api.segment.io/v1/track',
      headers: {
        'Content-type' : 'application/json',
        'Authorization': 'Basic ' + Buffer.from(configuration.SEGMENTIO_WRITE_KEY + ':').toString('base64')
      },
      body: JSON.stringify(sioTrack),
    });
  }

  callback(null, user, context);
}
```

In less than an hour, you could go from [analysis to execution](https://auth0.com/learn/powering-user-analytics-identity/) and increase your retention rate with Auth0.

## Analytics Keep You In Growth Mode

The key to sustaining rapid growth is to keep experimenting. You should always be trying new things, building onto your product to make it better for your customers.

However, if you want that experimentation to be effective and not just a resource drain, it needs to be informed by the best analytics you can provide. Experimentation is your vehicle for growth, but analytics is the engine.


"user-experience"