alexa-bio

Alexa is a Product Marketing Manager on the Auth0 platform team. With a partner and product marketing background, she is focused on growing our marketplace ecosystem working closely with new and existing partners.

Product Marketing Manager

Alexa Jacky

Stacking integrations from the Auth0 Marketplace enables custom identity use cases with no-code ease

As they compete for attention and conversions in a crowded global marketplace, online retailers and eCommerce companies face a number of challenges. For example:

* **Customers expect personalized omnichannel experiences** at every stage of the buying journey
* **Users want to engage with their apps or services at any time, from any device, in a secure and safe manner** — and they don’t want to spend time with cumbersome account creation
* **The loss of the third-party cookie and tighter app restrictions are threatening marketing strategies** that rely upon cookies and app-based tracking and are forcing a larger dependence on first-party data

The brands that will not only survive but thrive in this dynamic environment will be those that are best able to implement fundamental identity capabilities and extend beyond the identity basics.

But with a developer team that’s busy enough already, it’s important for the business (and for developer sanity) to satisfy identity requirements as quickly — and with as little custom code to write or maintain — as possible.

## Identity Enables Online Retail and eCommerce

Identity may not be top of mind for retailers, but the identity function is essential to helping eCommerce companies:

* **Maximize conversions and revenue** by[ minimizing friction in any and every customer interaction](https://auth0.com/resources/whitepapers/identity-insights-101)
* **Meet user expectations** by[ powering personalized experiences](https://auth0.com/case-studies/coles-group)
* **Manage risk** by addressing regulatory requirements and privacy laws and by addressing[ identity-specific security threats](https://auth0.com/resources/whitepapers/state-of-security-identity-report)

A customer identity and access management (CIAM) solution with the right set of out-of-the-box features can help engineering teams to avoid a whole lot of pain and expense.

For example,[ CIAM has been a core enabler of cosmetic giant Lush’s consumer-oriented initiatives](https://auth0.com/case-studies/lush-cs), powering a range of features including single sign-on (SSO) and guest checkout, as well as the centralization of the point-of-sale (POS) system for the entire business. In particular, extensive out-of-the-box functionality allowed Lush to implement these features with a limited developer team while ensuring the pace of transformation didn’t compromise customer privacy or system security.

While out-of-the-box functionality is important, the real world is a complex and dynamic beast (as anyone who’s ever done a year-over-year roadmap comparison understands). Being able to accommodate change and tailor identity to your unique needs — and doing both without drawing too heavily upon developers — is the difference between CIAM as a necessary component of your application stack and CIAM as an operational and competitive advantage.

![Auth0 Marketplace](https://images.ctfassets.net/23aumh6u8s0i/16QlWAA6ZN2lnMATb3RbMu/3e305e33068ab6a5afb1419500972b4c/Marketplace_Partner_Spotlight_Separator_V01B_3x.png)

## Actions Integrations and the Auth0 Marketplace

A modern CIAM solution can tackle the identity basics (e.g., signups, logins, account updates, password retrievals, etc.), but satisfying advanced use cases often requires transacting with other business systems and third parties to execute complex conditional flows.

Building such advanced logic from scratch is a major undertaking requiring specific skill sets, tools, and knowledge; worse still, it’s inefficient because each use case is a custom coding exercise with little that can be reused.

Alternatively, having a simple but effective (read: powerful, flexible, efficient, etc.) way to make identity work with your other business systems allows developers to quickly implement customized identity solutions without the time, expense, and headaches associated with custom coding projects… and that’s where[ extensibility](https://auth0.com/extensibility) comes into play.

Since launching in late 2020,[ the Auth0 Marketplace](https://marketplace.auth0.com/) has helped developers quickly find and install third-party identity solutions for their applications and APIs.

[Actions Integrations](https://auth0.com/blog/auth0-no-code-actions-integrations-now-available-in-beta/) makes it even easier to extend Auth0 with partner-built innovations, often with no-code, drag-and-drop ease; in fact, you can even ‘stack’ these integrations like building blocks to keep up with new needs and address advanced use cases.

To illustrate, let’s look at some examples…

## Prevent Fraudulent Registrations

One of the major objectives for consumer-facing companies is to convert prospects into first-time customers, and this makes fraudulent registrations (or signup fraud) especially problematic because:

* [Leveraging a customer data platform (CDP)](https://auth0.com/blog/why-you-should-integrate-customer-identity-and-your-customer-data-platform/), customer flows are often optimized based upon data that shows how users interact with a user interface and ultimately ‘convert’ — but fraudulent registrations pollute this data, significantly complicating business analytics activities.
* To maximize conversions, consumer businesses especially must minimize friction during the registration process — but lowering barriers for legitimate users also lowers the barriers for abusers.

While authentication (e.g., logging in with a username and password) shows that a user has the credentials that correspond to a particular account, it doesn’t prove that the user is who they say they are — that’s where[ identity proofing](https://auth0.com/blog/what-is-identity-proofing-and-why-does-it-matter/) comes in, by using additional verifications to create a high degree of confidence that your users are who they claim to be.

Here’s how a sign-up flow works when identity proofing is integrated:

* A new user clicks “sign up” on your website
* The sign-up flow calls upon[ the identity-proofing solution](https://marketplace.auth0.com/categories/identity-proofing)
* The identity proofing solution verifies the user’s identity using phone carrier verification
* Customer identity data is captured and collected by the[ CDP](https://marketplace.auth0.com/integrations/tealium)

By making signup fraud much more challenging to commit, identity proofing meaningfully alters the economics for bad actors and, in doing so, protects your customers, your reputation, and the integrity of the data stored in your CDP.

## Protect and Enrich Existing User Accounts

In addition to protecting against signup fraud, incorporating identity proofing into user workflows can also protect against account takeovers (ATO) and enrich user profiles with ‘golden data’ like age and demographic information.

For example:

* A returning user performs some action, like logging in or attempting to update account details
* Due to the perceived risk associated with the action (and perhaps incorporating other risk signals), the identity stack calls upon the identity-proofing solution as a safeguard
* The identity proofing solution validates the user’s identity, ensuring that the activity is not from a bad actor attempting to take over the account; or, if the user is accessing the service via a mobile app, a[ mobile verification integration](https://marketplace.auth0.com/integrations/incognia-authentication) validates the device ID to confirm the user’s identity
* With the user’s identity validated, the action is permitted, and the data associated with the user’s activity is sent to[ the CDP](https://marketplace.auth0.com/integrations/tealium) to build out the profile

Depending upon the risk signals or significance of the action, the identity-proofing solution may employ document scanning (e.g., passport, driver’s license) and cross-validation as the verification mechanism. When this is the case, the CDP can be enriched with information that may not yet be a part of the user’s profile.

![Auth0 Marketplace](https://images.ctfassets.net/23aumh6u8s0i/6U3nuyVYlbcg9i0C36khkU/61a068d638a5ee2753facbcf5924e55c/Marketplace_Partner_Spotlight_Separator_V01A_3x.png)

## Stop Fraudulent Checkouts

The previous examples involve sending data to the CDP, but the CDP data can also be leveraged within the identity flows. For instance, here’s how data from a CDP can combine with an identity-proofing solution to stop a fraudulent checkout:

* A threat actor masquerading as a user logs in, browses products and adds items to the cart
* The CDP collects and stores behavioral data from this session. The data can then be used to help determine that the risk threshold is exceeded — e.g., the total purchase amount exceeds the real customer’s typical habits, or the IP geo-location is outside the real customer’s region, etc.
* The threat actor fails the identity proofing verification, and the purchase is stopped, protecting the customer and the retail brand from the effects of fraudulent purchases

## Reward Your Loyal Customers

Retail brands can suffer reputational harm when resellers buy premium products (e.g., sneaker drops, limited edition collaborations, small batch cosmetics, etc.) only to mark up the price on a third-party marketplace.

By restricting who is able to purchase these products, retailers can reward loyal customers and protect their brand:

* A user logs in
* The CDP provides customer data that can then be used to indicate whether or not the user exceeds a certain ‘loyalty’ threshold (e.g., based on purchase history)
* If a user exceeds the threshold, then the site/service shows them premium offers
* The user adds a premium product to their cart and initiates the checkout
* Identity proofing validates the user’s identity to guard against an account takeover and ensure that the purchaser is a loyal customer

Additionally, the same building blocks can be used to encourage preferred channel adoption. For example, many retailers reserve limited edition products only for users of their mobile app. Web users could be presented with a message saying, “To see promotional offers, please switch to the app.” If the user’s device has already been verified in a past interaction, then the purchase can proceed; otherwise, the identity stack calls a short verification flow. 

Customer lifetime value is rooted in personalized offers, promotions, and pricing, which depend on rich customer profiles stored in CDPs. To build these profiles, brands collect customer data across various channels and systems, with the mobile app being perhaps the most valuable channel.

## A World of Extensions and Opportunities

Extensibility is a core Auth0 principle.[ Our identity platform](https://auth0.com/resources/videos/platform-introduction-video-2020) is designed to be easy to deploy and even easier to tailor to your unique business needs, so you never have to choose between customizability and ease of deployment.

We’re excited about the potential unlocked by the rich ecosystem of third-party integrations, as they allow our customers to continually add new capabilities as needed.

Whether you prefer the pro-code approach of[ Actions](https://auth0.com/docs/customize/actions) or the no-code convenience of Actions Integrations found within[ the Auth0 Marketplace](https://marketplace.auth0.com/), we encourage you to explore the options to see which of your identity and identity-related use cases already have a ready-built solution just waiting to be integrated!

Why Easy Extensibility is an Online Retail Essential

df6c864847fba9687d962cb80b482764?size=200 avatar

df6c864847fba9687d962cb80b482764?size=200

Martin Gontovnikas, a.k.a Gonto, is a software engineer at heart who moved to the ‘dark side’ and became VP of Marketing at Auth0. He considers himself lucky to have found a way to combine his two passions and apply his engineering thinking model to marketing. Gonto’s analytical thinking is a huge driver of his data-driven approach to marketing strategy and experimental design. He is based in the Bay area, and in his spare time, can be found eating gourmet food at the best new restaurants, visiting every local brewery he can find, or traveling the globe in search of new experiences.

Former SVP of Marketing and Growth at Auth0

Martin Gontovnikas

Retailers are embracing eCommerce but are vulnerable to fraudsters impersonating real users.

Holiday shopping looks a lot different this year. As a result of the pandemic, shoppers are avoiding brick-and-mortar stores and ordering online, with [eCommerce sales up 37%](https://www.digitalcommerce360.com/article/quarterly-online-sales/) over 2019. Unfortunately, the eCommerce boom has created a similar spike in eCommerce fraud. [One study found](https://www.digitalcommerce360.com/2020/07/27/the-cost-of-fraud-is-up-7-for-us-merchants/) that in 2020, mid-sized to large merchants experienced 14% more fraudulent transactions per month than the year before.

These dueling forces put retailers in a difficult position: they need to provide eCommerce options to customers without exposing themselves to attack. Retailers can balance these needs by putting strong fraud-prevention tools in place to maximize their eCommerce trade while locking out fraudsters.

## Bot-Based Fraud Is Rampant in Ecommerce 

Retailers trying to guard against cybersecurity threats must first understand what those threats are. This list is constantly evolving, and in 2020, while there are several types of attacks, most of them use armies of automated bots.

In a [2020 survey](https://kount.com/wp-content/uploads/2020/10/Bot-Landscape-and-Impact-Report-2020-Kount.pdf) from cybersecurity company Kount, 81% of businesses reported that they dealt with malicious bots often or very often, and 25% reported that a malicious bot attack cost their organization over $500,000.

Bot attacks on retailers can take multiple forms. In one variation, armies of bots buy up all the inventory for in-demand items for later resale at a markup. For years, that’s been a popular trick for coveted concert tickets and sneakers, but it’s equally effective for hot-ticket gift items. The risk for retailers is that customers will come to your site looking for a product, and when you don’t have it, they’ll switch to your competitors.

Many bot attacks use identity as their vector, meaning they break in through the login box by impersonating legitimate users. [In credential stuffing](https://auth0.com/blog/what-is-credential-stuffing/) attacks, hackers take user login credentials that were stolen in one data breach and use them to break into other sites. Credential stuffing attacks have become much more widespread in recent years because people tend to reuse passwords, and [billions](https://www.wired.com/story/collection-leak-usernames-passwords-billions/) of these stolen credentials are currently circulating on the dark web.

Ecommerce retailers are at particular risk of these attacks, especially with the booming popularity of “buy online, pick up in store” (BOPIS). In the past, fraudsters had to get stolen merchandise mailed to them, increasing the likelihood that the transaction would be stopped or they would be caught. But with curbside delivery, they can order goods and pick them up before anyone catches on.

Even if bot attacks aren’t successful in conducting fraudulent transactions, they can still crash your website by flooding it with requests. [Auth0’s research](https://auth0.com/blog/auth0-reveals-50000-credential-stuffing-attempts/) has found that in a credential stuffing attack, a site’s traffic can spike by as much as 180-fold.

![Critical Tools in the Fight Against Ecommerce Fraud](https://images.ctfassets.net/23aumh6u8s0i/5CBZ47YCilUVHG1F0gf9om/a5893de32934cc5d60a561a9282d2217/prevent-ecommerce-fraud-separator)

## Critical Tools in the Fight Against Ecommerce Fraud

Fortunately for retailers, there are effective methods to deter bots without creating unnecessary obstacles for legitimate users. Since most eCommerce fraud takes the form of [broken authentication attacks](https://auth0.com/blog/what-is-broken-authentication/) &mdash; meaning that fraudsters impersonate legitimate users&mdash;the fixes all relate to being able to more accurately verify user identities.

### MFA

[Multi-factor authentication (MFA)](https://auth0.com/docs/mfa) demands that users prove they are who they claim to be by providing an additional form of verification beyond the classic username-password combination. Common MFA methods include one-time codes sent to a user’s email address and [biometric scans](https://auth0.com/blog/3-critical-trends-in-biometric-authentication-in-2019/), such as fingerprints. While MFA is the single most reliable defense against identity-/authentication-based attacks, it is not a silver bullet. If retailers want to defend against automated attacks, they have to think about security in layers. 

In 2019, [NIST started recommending](https://auth0.com/blog/why-nist-recommends-mfa-to-fight-ecommerce-fraud/) that retailers implement MFA to fight eCommerce fraud, but adoption has still been slow. That’s partly because retailers worry that MFA will introduce too much friction and will make customers abandon their carts. [But MFA standards are constantly evolving to be more seamless and secure](https://auth0.com/blog/auth0-introduces-adaptive-mfa). For instance, [Microsoft recently told](https://www.zdnet.com/article/microsoft-urges-users-to-stop-using-phone-based-multi-factor-authentication/) its customers not to use SMS as an MFA delivery mechanism because cell phone lines are vulnerable to multiple forms of attack. (They recommend [hardware keys as the least susceptible to attack](https://auth0.com/blog/fido-security-key-support-comes-to-auth0/).)

### Attack Protection

You want to find out about eCommerce fraud before you get a call from a customer’s bank asking you to reverse fraudulent charges. To stop these transactions from ever taking place, you need tools that automatically flag suspicious behavior.

**Brute force protection** is one such tool, which prevents bot armies from overwhelming your site or app with login attempts. Enabling brute force protection locks out IP addresses after a certain number of failed login attempts.

[CAPTCHA](https://auth0.com/blog/captcha-can-ruin-your-ux-here-s-how-to-use-it-right/) (and its assortment of bot-catching descendants) helps to lock out bots at the account creation stage by having human users prove “I’m not a robot” and, occasionally, tricking bots into proving that they are.

**Breached password protection** protects against credential stuffing attacks by monitoring databases of compromised credentials and alerting users if they need to change their passwords.

It’s important to note that none of these technologies are foolproof, and none are designed to work in isolation. Some hackers have learned how to spoof fake IP addresses to mask brute force attacks. CAPTCHA always struggles to stay ahead of sophisticated bots that can mimic human behavior. And while retailers can force users to change their passwords in the event of a breach, they can’t change the underlying problem of password reuse. Even MFA, the bedrock of a sensible security strategy, works only if you convince or compel your customers to sign up for it.

But even though there’s no single silver bullet to prevent eCommerce fraud, implementing these features together offers superior protection. Scammers generally seek out the path of least resistance, and when you have all these tools, you don’t present your business as a soft target. 

![Prevent Fraud by Updating Customer Access Controls](https://images.ctfassets.net/23aumh6u8s0i/1MzswDFUmttHgwNE85rxY2/cc3066d34b3cc682703051845d44b7fc/prevent-ecommerce-fraud-separator-2)

## Prevent Fraud by Updating Customer Access Controls

We’ve talked about the threats to eCommerce retailers and the tools to protect against them, so the question now is, how do you go about putting those tools in place? For many retailers, the solution is to partner with a third-party [customer identity and access management (CIAM)](https://auth0.com/blog/what-is-ciam/) provider. That’s because building fraud-preventing tools in-house is time-consuming for any business, and it’s out of reach for most small to medium-sized retailers. But sticking with the simple login solution you’ve had in place for years is clearly no longer an option.

But as we’ve discussed, all fraud-prevention tools are not created equally. Here’s what retailers should look for when analyzing potential CIAM partners.

### Customizable MFA

There’s no reason to challenge every loyal customer to prove their identity every time they make a purchase, so retailers need [step-up or adaptive MFA](https://auth0.com/blog/what-is-step-up-authentication-when-to-use-it/), which requests additional credentials only in the event of suspicious or high-risk behavior. For example, you may want to verify a customer’s identity if they log in with a new device or place an order above a certain dollar amount.

![Adaptive MFA](https://images.ctfassets.net/23aumh6u8s0i/1NOHOVPjLZsNsuklb3Cw2e/c5ac893b034e2bf9df235deacb04966f/adaptive-mfa-graphic-1)

Auth0’s Adaptive MFA analyzes every login attempt and assesses its risk level. This assessment included a user’s IP reputation, whether the login is coming from a known device, or whether its geographic location indicates so-called “impossible travel.”, Based on these factors, it then determines whether the login can proceed uninterrupted, triggers MFA, or blocks the account altogether.

![Customizable MFA](https://images.ctfassets.net/23aumh6u8s0i/7CKjaRixRDYnypIFL2cTiA/85fd1e38bda162575c1fdd7016738526/use-adaptive-mfa)

### Comprehensive Attack Protection

Likewise, retailers need anomaly detection that lets them combine the strongest tools available to deter scammers. [Auth0’s Attack](https://auth0.com/docs/anomaly-detection) Protection offers an arsenal with which businesses can protect themselves. That includes Bot Detection, which forces suspicious logins to take a CAPTCHA test. Suspicious IP Throttling and Brute Force Protection block IP addresses from trying to break into user accounts. And Breached Password Protection notifies customers if a user’s credentials have been compromised in a known data breach.
Lets customers implement CAPTCHA and enable brute force protection, and notifies them about breached passwords.

![CAPTCHA](https://images.ctfassets.net/23aumh6u8s0i/7KwQQhPVnPr15lr3S73mdz/dc8846b93ba9384500c0bc155928ad84/attack-protection-04)
Here’s a look at Auth0’s Attack Protection tools.

### Developer-friendly documentation and support

Finally, in order to put safeguards in place as quickly and easily as possible, retailers should look for a CIAM solution that provides a high level of documentation and support. While many identity providers have similar suites of tools and services, the time it takes to implement them can vary widely depending on what kind of instructions they give to developers. Having clear documentation and customer support is particularly important to smaller businesses, who don’t have dedicated authentication professionals on their teams.

## An IAM Partner Can Get You Holiday-Ready

It’s been an indisputably challenging year, but retailers have risen to the occasion by embracing eCommerce solutions. And as 2020 comes to a close, it’s increasingly clear that eCommerce isn’t just a stopgap solution for the pandemic &mdash; it’s the new status quo. That means that updating security is a worthwhile investment for the entire coming year, not just the holiday rush. To learn more about how state-of-the-art identity can protect your customers and your business, [reach out to the team at Auth0](https://auth0.com/en/contact-us).

<include src="asides/AboutAuth0" />

How Retailers Can Prevent Ecommerce Fraud This Holiday Season

kapehe-jorgenson

Kapehe is an R&D Content Engineer for Auth0 with a passion for learning and teaching. With her primary focus on ReactJS and JavaScript, she is impressed with what code can create for the web. Technology and web development are constantly evolving and naturally bring that need for continual learning. She enjoys writing tutorials, hosting local meetups, and learning with others to expand coding knowledge.

R&D Content Engineer

Kapehe Jorgenson

Oracle CX Commerce customers can now leverage the Auth0 Platform.

**TL;DR:** In this article, we are going to discuss how Oracle CX Commerce and Auth0 can now be connected! We will walk through that process to see just how we can accomplish that!

## Auth0 + Oracle CX Commerce

Auth0 and Oracle have partnered together to find a great opportunity that brings added value to our users. Oracle and Auth0 now empower customers to leverage the Auth0 platform to add identity and access management capabilities to commerce storefronts that are built and hosted on CX Commerce.

## Oracle CX Commerce 

Okay, but what is Oracle CX Commerce? CX Commerce is a leading enterprise SaaS commerce solution -- scalable, flexible, cloud-native, and built to support both B2B and B2C. Want to build an enterprise, highly customizable, feature-rich digital commerce business? CX Commerce’s solution provides for all of that! 

<include src="TweetQuote" quoteText="Auth0 and Oracle have partnered together to find a great opportunity that brings added value to our users."/>

## Why Use Auth0 and Oracle CX Commerce Together

Auth0 brings a level of identity and authentication that can benefit many Oracle CX Commerce customers, including [social sign-on](https://auth0.com/learn/social-login/)! Auth0 has a large list of social networks to choose from that can easily be plugged into an online store. Merchants can choose from Facebook to LinkedIn, whichever social network makes sense for the audience of the website! Whether B2B or B2C, the integration is easy to use for shoppers and business partners.

Auth0 can add:

* Registering for a new account
* [Single Sign-On](https://auth0.com/single-sign-on) (SSO) for Oracle CX Commerce-powered apps
* Social Sign-On

By adding in Auth0, we can also configure a CX Commerce app and set up SSO for both Social and Enterprise connections!

How will this help improve customer satisfaction? This is a very customizable and global solution that many customers have been waiting for. For example, there are merchants in APAC that want this solution because the current registration requires an email. Many APAC countries have people registering for sites using their mobile phone number. If the shopper wants to use their Facebook or Twitter account to log into the website, this is now possible!

And wherever your shoppers are in the world, being able to log into a storefront via Facebook, Amazon, Google, or other accounts increases conversions. It improves the overall experience by eliminating an additional barrier to browsing or placing an order.

This partnership between Oracle CX Commerce and Auth0 is destined to deliver innovative solutions that help improve business and shopper experience.

<include src="TweetQuote" quoteText="By adding in Auth0, we can also configure a CX Commerce app and set up SSO for both Social and Enterprise connections!"/>

## How to Connect Oracle CX Commerce and Auth0

In this next section, let's go over how to connect Oracle CX Commerce and Auth0.

## Configure Oracle CX Commerce SSO

### Enable Single Sign-On on the Oracle CX Commerce instance

The first thing we need to do is enable SSO on our Oracle CX Commerce instance. We can use a `PUT` request on the `/ccadmin/v1/merchant/samlSettings` endpoint to enable it with some options.

We will want to configure all the security features, such as assertion encryption as well as request and response signatures.

```http
PUT https://ccadmin-{{env}}.oracleoutsourcing.com/ccadmin/v1/merchant/samlSettings
 {
 "enabled": true,
 "nameIdPolicyFormat": "urn:oasis:names:tc:SAML:2.0:nameid-format:persistent",
 "requireEncryptedAssertions": true,
 "requireSignedResponse": true,
 "signAuthnRequest": true,
 "nameIdPolicyAllowCreate": true
 }
```

### Configure Cross-Origin Resource Sharing (CORS) to allow access to resources from Auth0 servers

The following `PUT` request on the `/ccadmin/v1/sites/siteUS` (use your Site ID) will allow access to resources from outside the domain. This will return two URLs: the Auth0 URL and a URL for Facebook Social Login.

```http
PUT https://ccadmin-{{env}}.oracleoutsourcing.com/ccadmin/v1/sites/siteUS
  {
    "properties": {
    "allowedOriginMethods": {
      "https://login.eu.auth0.com" : "POST",
      "https://dev-e3psebdq.eu.auth0.com": "POST"
    }
  }
}
```

### Retrieve Service Request Entity Descriptor for the Storefront instance

We can retrieve the whole Service Request Entity Descriptor for our Storefront instance using a `GET` request on the `/ccstore/v1/merchant/samlSettings` endpoint.

The Entity Descriptor is returned in the `spEntityDescriptor` field.

```http
GET https://ccstore-{{env}}.oracleoutsourcing.com/ccstore/v1/merchant/samlSettings
 {
 "spEntityDescriptor": "<?xml version=\"1.0\" encoding=\"UTF-8\"standalone=\"no\"?>
 <md:EntityDescriptor xmlns:md=\"urn:oasis:names:tc:SAML:2.0:metadata\" 
 entityID=\"https://ccstore-z7ta.oracleoutsourcing.com[…Binding=\"urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST\" 
 Location=\"https://ccstore-z7ta.oracleoutsourcing.com/SAMLpost\" 
 index=\"1\" isDefault=\"true\"/>
 </md:SPSSODescriptor>
 </md:EntityDescriptor>",
 "links": [
 {
 "rel": "self",
 "href": "https://ccstore-z7ta.oracleoutsourcing.com/ccstore/v1/merchant/samlSettings"
 }
 ]
}
```

Above is a formatted version of the `spEntityDescriptor` field. We will find the application SAML callback URL in the `Location` attribute of the `md:AssertionConsumerService` tag.

```xml
<?xml version="1.0" encoding="UTF-8"?>
<md:EntityDescriptor xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata" entityID="https://ccstore-
z7ta.oracleoutsourcing.com">
 <md:SPSSODescriptor protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol">
 <md:KeyDescriptor xmlns="urn:oasis:names:tc:SAML:2.0:metadata" use="encryption">
 <dsig:KeyInfo xmlns:dsig="http://www.w3.org/2000/09/xmldsig#">
 <dsig:X509Data>
 <dsig:X509Certificate>MIIDUjCCAjqgAwIBAgIEFV[…]xFQQXQ\nWt8ObeT8vQdOLn9t4ZnXevMY3MV EsjMbFQUu99mngLR1h9mG7C4=\n</dsig:X509Certificate>
 <dsig:X509IssuerSerial>
 <dsig:X509IssuerName>CN=ops</dsig:X509IssuerName>
 <dsig:X509SerialNumber>358591734</dsig:X509SerialNumber>
 </dsig:X509IssuerSerial>
 <dsig:X509SubjectName>C=US, ST=California, L=Redwood City, O=Oracle Corporation, OU=tz7ta0c0, CN=tenant_tz7ta0c0</dsig:X509SubjectName>
 <dsig:X509SKI>wwGRZXxfpezbTIFzTqCB+gFO+hU=\n</dsig:X509SKI>
 </dsig:X509Data>
 </dsig:KeyInfo>
 </md:KeyDescriptor>
 <md:KeyDescriptor xmlns="urn:oasis:names:tc:SAML:2.0:metadata" use="signing">
 <dsig:KeyInfo xmlns:dsig="http://www.w3.org/2000/09/xmldsig#">
 <dsig:X509Data>
 <dsig:X509Certificate>
MIIDUjCCAjqgAwIBAgIEFV[…]xFQQXQ\nWt8ObeT8vQdOLn9t4ZnXevMY3MVEsjMbFQUu99mngLR1h9mG7C4=\n
 </dsig:X509Certificate>

 <dsig:X509IssuerSerial>
 <dsig:X509IssuerName>CN=ops</dsig:X509IssuerName>
 <dsig:X509SerialNumber>358591734</dsig:X509SerialNumber>
 </dsig:X509IssuerSerial>
 <dsig:X509SubjectName>C=US, ST=California, L=Redwood City, O=Oracle Corporation,OU=tz7ta0c0, CN=tenant_tz7ta0c0
 </dsig:X509SubjectName>
 <dsig:X509SKI>wwGRZXxfpezbTIFzTqCB+gFO+hU=\n</dsig:X509SKI>
 </dsig:X509Data>
 </dsig:KeyInfo>
 </md:KeyDescriptor>
 <md:NameIDFormat xmlns="urn:oasis:names:tc:SAML:2.0:metadata">urn:oasis:names:tc:SAML:2.0:nameid-
format:persistent</md:NameIDFormat>
 <md:AssertionConsumerService xmlns="urn:oasis:names:tc:SAML:2.0:metadata" Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="https://ccstore-z7ta.oracleoutsourcing.com/SAML/post" index="1" isDefault="true" />
 </md:SPSSODescriptor>
</md:EntityDescriptor>
```

### Add the SAML Login/Registration Widget to the Header Widget

Now that CX Commerce is configured, we can replace the standard Login/Registration Widget. We can find that in the Header Widget along with the SAML Login/Registration Widget. This will redirect users to our Auth0 login screen when they click the Login link.

![Oracle Header Widget](https://images.ctfassets.net/23aumh6u8s0i/3ZByTVdLqC0uxKKzp3V7L6/ed8ff99e3e41ae3b0130d4191a3729e9/header-widget)

## Configure Auth0 Application and SAML2 Add-On

### Create and configure an application in Auth0

If we visit [Auth0.com](https://auth0.com/), we can start the application process. If we do not already have an account, we can <a href="https://auth0.com/signup" data-amp-replace="CLIENT_ID" data-amp-addparams="anonId=CLIENT_ID(cid-scope-cookie-fallback-name)">sign up for a free Auth0 account here</a>.

1. Go to our [**Auth0 Dashboard**](https://manage.auth0.com/#/) and click the "[Create Application](https://manage.auth0.com/#/applications/create)" button.
2. Name our new app (Oracle CX Commerce), select "Single Page Web Applications", and click the "Create" button.
3. In the **Settings** for our new Auth0 app, add `https://ccstore-xxx.oracleoutsourcing.com/SAML/post` to the **Allowed Callback URLs**.
4. Add `http://localhost:[PORT]` to the **Allowed Logout URLs**. This will be the link we want the user directed to when they hit log out.
5. Click the "Save Changes" button.

### Configure the SAML 2 Web App add-on in Auth0

Once the application is configured, we can enable the SAML 2 add-on. If we were to click on "Addons", right next to the "Settings" tab for our application, we will see the option for "SAML 2 Web App". Click on the button that toggles, and a modal will appear.

Within that modal, we will want to add in our "Allowed Callback URL" into the spot for "Application Callback URL": `https://ccstore-xxx.oracleoutsourcing.com/SAML/post`

We can then configure additional security features in the settings, such as signing responses and importing CX Commerce certificates for handling signed requests.

The certificate is the one found in the storefront entity descriptor extracted earlier.

```json
{
 "signatureAlgorithm": "rsa-sha1",
 "digestAlgorithm": "sha1",
 "signResponse": true,
 "signingCert": "-----BEGIN CERTIFICATE-----\nMIIDUjCCAjqgAwIBAgIEFV[…]xFQQXQ\nWt8ObeT8vQdOLn9t4ZnXevMY3MVEsjMbFQUu99mngLR1h9mG7C4=\n-----END CERTIFICATE-----\n"
}
```

Next, click on "Usage" at the top of the modal and we will find all the information we need to finalize the configuration in Oracle CX Commerce.

Here we can download the "Identity Provider Metadata" that will be uploaded to CX Commerce.

Our Auth0 Entity Descriptor will look like:

```xml
<EntityDescriptor entityID="urn:dev-e3psebdq.eu.auth0.com" 
 xmlns="urn:oasis:names:tc:SAML:2.0:metadata">
 <IDPSSODescriptor protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol">
 <KeyDescriptor use="signing">
 <KeyInfo xmlns="http://www.w3.org/2000/09/xmldsig#">
 <X509Data>
 <X509Certificate> MIIDDTCCAfWgAwIBAgIJGkJ2[…]8hn9WIe2Uj6rqrINzyhHclXVdRzy1F8EQ5q/+Z1ECF9Bc1I8sqFQk=
 </X509Certificate>
 </X509Data>
 </KeyInfo>
 </KeyDescriptor>
 <SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" Location="https://dev-e3psebdq.eu.auth0.com/samlp/8kVhBa7Sn84ejet98w634wAGlNi9N5AW/logout" />
 <SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="https://dev-e3psebdq.eu.auth0.com/samlp/8kVhBa7Sn84ejet98w634wAGlNi9N5AW/logout"/>
 <NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress</NameIDFormat>
 <NameIDFormat>urn:oasis:names:tc:SAML:2.0:nameid-format:persistent</NameIDFormat>
 <NameIDFormat>urn:oasis:names:tc:SAML:2.0:nameid-format:transient</NameIDFormat>
 <SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" Location="https://dev-e3psebdq.eu.auth0.com/samlp/8kVhBa7Sn84ejet98w634wAGlNi9N5AW"/>
 <SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="https://dev-e3psebdq.eu.auth0.com/samlp/8kVhBa7Sn84ejet98w634wAGlNi9N5AW"/>
 <Attribute Name="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="E-Mail Address" 
 xmlns="urn:oasis:names:tc:SAML:2.0:assertion"/>
 <Attribute Name="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="Given Name" 
 xmlns="urn:oasis:names:tc:SAML:2.0:assertion"/>
 <Attribute Name="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="Name" 
 xmlns="urn:oasis:names:tc:SAML:2.0:assertion"/>
 <Attribute Name="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="Surname" 
 xmlns="urn:oasis:names:tc:SAML:2.0:assertion"/>
 <Attribute Name="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="Name ID" 
 xmlns="urn:oasis:names:tc:SAML:2.0:assertion"/>
 </IDPSSODescriptor>
</EntityDescriptor>
```

### Configure SAML Mapping Rule in Auth0

To be able to match the existing user in Oracle CX Commerce, we need to change the SAML mapping to map the "nameidentifier" field with the email address. We can do this by creating a rule in Auth0.

If we click on "Rules" in the menu on the left in the Dashboard, we will then see a "+Create Rule" button. Hit that button. We will then see a list of rules we can use.

Scroll down to find the rule titled: _SAML Attributes mapping_

Here is the code for the final rule:

```javascript
function (user, context, callback) {
  context.samlConfiguration.mappings = {
    "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier": "email",
    "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress": "email",
    "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name": "name",
    "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/food": "user_metadata.favorite_food",
    "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/address":
    "app_metadata.shipping_address"
  };

  callback(null, user, context);
}
```

Hit "Save Changes" when done.

![Rules Dashboard with SAML Attributes mapping active](https://images.ctfassets.net/23aumh6u8s0i/6HzBsBIFoUNmmalCMin5C8/026768a8e4a1a1305bdf7628114ef97d/saml-attributes-mapping)

### Force Email Verification in Auth0

We may want to add in email verification to our application. That's also an Auth0 Rule!

If we return to our Rules Dashboard, we can add another rule by clicking the "+Create Rule" button again. Find the "Force email verification" and click on it.

Here is the code for the final rule in Auth0:

```javascript
function (user, context, callback) {
  if (!user.email_verified) {
    return callback(new UnauthorizedError('Please verify your email before logging in.'));
  } else {
    return callback(null, user, context);
  }
}
```

So now, when the user registers to Auth0 using a username/password method instead of the social media route, they will receive an email that will allow them to verify their email address via a link.

## Configure Social Connections in Auth0

### Enable a new social connection in Auth0

Now that we have SAML 2 configured in Auth0 let's add in Social Connections!

If we were to click on "Connections" and then "Social", we would be at the Social Connections page within our Auth0 Dashboard.

Here, we can turn on Facebook social connections for one or many of our Auth0 apps. We will be directed to a modal that will show us our list of applications. Be sure to turn it on for this application!

We will need to add in our App ID and App Secret. To learn more about this, please [visit this document](https://auth0.com/docs/connections/social/facebook).

## Conclusion

With Oracle CX Commerce and Auth0 connected, developers and customers can see huge benefits. Having Social Login capabilities makes shopping easier for customers and improves conversion rates for merchants. Auth0 helps enable social sign-on, plus other rules and benefits, to be added easily to Oracle CX Commerce digital experiences. 

<include src="asides/AboutAuth0" />

---

How to Integrate Auth0 with Oracle CX Commerce

jenny-obrien

I'm a former business journalist who's fascinated by the intersection of tech and business strategy — in particular how the right solution can transform an idea into reality. I specialize in ROI, data privacy, and identity.

Business Content Manager

Jenny O'Brien

We’re sending an expert team to Shoptalk this year. Schedule a meeting to learn how Auth0 can help you increase conversions.

<div class="alert alert-info alert-icon">
 
 Forrester Consulting analysis determines that using Auth0 can yield a 548% ROI and $3.7M in identity-related savings. Read the full report: <a href="https://resources.auth0.com/forrester-tei-research-case-study/">Total Economic Impact of Auth0</a>.
</div>

---
Just a few years ago, some retailers were hesitant about letting shoppers access online stores through social logins like Facebook or Google. Leading up to [Shoptalk 2018](https://shoptalk.com/), people headed to this year’s global retail innovation convention in Vegas are telling us that’s no longer the case — [one-click login](https://auth0.com/retail) has gone mainstream.

## Increased Conversions
At Auth0, we’ve helped customers like Polaris, Nando’s, Wayfair, The Iconic, Western Digital, Talbot’s, and more streamline their customer logins. Our customers find that social login increases conversions, removing unnecessary barriers to a pleasurable shopping experience.

Rather than losing a customer during login hesitation, social login also gives retailers opportunities for personalization while enabling them to deliver a consistent brand experience at each touchpoint. According to a [Web Hosting Buzz survey](http://www.webhostingbuzz.com/blog/2013/03/21/whos-sharing-what/): 86% of users report being bothered by having to create new accounts on websites.

## Phase I Replatforming - Identity

Another trend we’re hearing is the desire to replatform ecommerce experiences as a way to become more responsive to ever-changing customer needs. Shoptalk attendees are telling us that addressing identity is phase I in their multi-phase approach to becoming more agile.

Auth0 identity offers an opportunity to create a true omnichannel experience across brands with single-sign on, while also simplifying partner collaborations.

## Schedule Your Shoptalk Meeting with Auth0

We are sending an expert team, including a software architect, to Shoptalk this year. If you’d like to schedule a meeting to discuss how Auth0 can help increase your conversions, personalize engagement, streamline partnerships, and build brand loyalty, please reach out to [sales@auth0.com](mailto:sales@auth0.com).

---

<include src="asides/AboutAuth0" />

Meet with Auth0 at Shoptalk 2018

Auth0 explores the Data-Driven approach to eCommerce and how retail analytics can help you optimize procurement, merchandising, and marketing

Retailers are always fighting for better predictions of what their customers want. From setting price points to predicting next season's trends, [retail](https://auth0.com/retail) has been working to move faster and be more efficient since its inception.

<include src="TweetQuote" quoteText="Retailers are always fighting for better predictions of what their customers want."/>

That's why every retail company has some form of *retail analytics* in place. Retail analytics is data in and around the creation, distribution, and purchase of products. Keeping track of what percentage of your inventory is still in stock would fall under *retail analytics*, but so would data about the efficacy of your new marketing campaign. 

As consumers have adopted device after device and service after service, eCommerce worked hard to create robust methods of tracking and analyzing a flood of new retail data. Retail analytics today is more powerful and more flexible than ever before. For marketers, salespeople, and product people, it is the way forward for eCommerce.

Here's everything you need to know to keep up with *retail analytics* for today and tomorrow. 

## What can you expect from retail analytics?

When something encompasses production through sales, its possibilities seem almost endless. Right now, though, the big uses for *retail analytics* center on optimizing procurement, optimizing merchandising, and optimizing marketing.

### Optimizing procurement

One of the key places that *retail analytics* helps businesses is **optimizing procurement**. By better predicting sales numbers, procurement and stocking gets more efficient. Retailers can also better see the cost balance for a given materials vendor, with more visibility into how the different purchases from a single vendor add up. 

### Optimizing Merchandising

When it comes to merchandising, **product appeal** has always been a huge consideration for retailers. With digital marketing and eCommerce, it's only gotten more important. The color of landing pages, the music in product videos, the packaging that an item comes in when someone receives it in the mail — these things are all important factors that replicate the “in-store experience” for digital consumers. And they're things that marketers are testing to optimize for the most appeal to online shoppers, who have their attention going in 700 different directions.

![Retail Analytics - Optimizing Merchandising](https://images.ctfassets.net/23aumh6u8s0i/1uK9nzv2IQrcWwjlaikcIm/dc37cf9f813f1ed99553591ba78570b3/optimizing-merchandising)

> _"The best packaging [...creates] memorable marketing," [writes](https://www.forbes.com/sites/onmarketing/2014/07/23/the-five-things-product-packaging-must-do/#7cfd6433ac4f) Simon Preece for Forbes._

Another big place that companies are constantly tweaking with the help of *retail analytics* is **pricing**. Companies like [Price Intelligently](http://www.priceintelligently.com/) have made whole businesses off of analyzing how to optimize pricing by digging into data about customers, price points, and pricing strategies. Even companies that aren't outsourcing their pricing strategy are still paying close attention to what their consumer data tells them about how much a customer is willing to pay for their product.

### Optimizing Marketing

The digital age birthed more sales channels than ever before, and now it's rushing to catch up to them. Consumers find their way to products across social media, shopping websites, word of mouth, meatspace ad campaigns, emails, and magazines. To track all of these channels is difficult, but *retail analytics* is getting better at tracking across devices and digital channels to give a better idea of **which ads are working online**. 

<include src="TweetQuote" quoteText="The digital age birthed more sales channels than ever before, and now it's rushing to catch up to them."/>

**Ad targeting** is another area that can be positively influenced by *retail analytics*. As users login with their social accounts for eCommerce sites, see targeted ads on social media, and are retargeted after purchase, more information about their demographics, habits, likes, and dislikes are gathered. This means that *retail analytics* can streamline ad targeting for happier customers and happier marketers. 

![Retail Analytics - Interest Targeting](https://images.ctfassets.net/23aumh6u8s0i/5MDdOkV4JJyYEAzc0bJlRK/a8f4da62b0481e368ed5e11749132960/but-no-one-else-would-trick)

> _[Digitalmarketer](http://www.digitalmarketer.com/facebook-advertising-targeting-options-social/)'s literal ad target shows one way to determine ad interest and reach by using the “but no one else would” trick._

## Trends in retail analytics

Digital retailing has both given a boost to traditional *retail analytics* and allowed companies to create new ways to follow their digital commerce. While companies are going to continue to refine *retail analytics*, the *retail analytics* trends of today are strongly tied to our ideas about multichannel commerce and will likely continue in this vein. 

### Oldies but goodies

Let's start out with some of the “traditional” *retail analytics* that have stood the test of time. These are some baseline heavy-hitters. Where before, people might have tracked these manually, they have now been supercharged by contemporary analytics platforms. 

* **POS analytics.** Point of Sale analytics, or POS analytics, is a broad field that uses the information that relates to the final sale of an item. This started as simply a log of payments and has progressed as sales technology picked up, gaining steam from the mid-1980s onward. Now, POS analytics will cover not just what was purchased and by whom, but also where that item was stored or shipped from, and information about the customer (rewards points, address, email, etc.). Almost every eCommerce system comes equipped with basic POS analytics — [Shopify](https://www.shopify.com/retail/improved-retail-analytics-help-merchants-dive-deeper-into-data-to-bolster-sales) is a great example. 

* **“Traditional” marketing analytics.** Marketing has been around forever, and old-school analytics have made their way over to digital. Tracking the basics of marketing campaigns is easier with marketing tools, and many of them put bells and whistles on basic marketing stats, like ROI on mailing campaigns. Google Analytics or built-in analytics on platforms like Facebook Business often serve as an easy way into this type of data.

### New kids on the block

What's happening in *retail analytics* today isn't just refreshed POS analytics. More data is being collected, which means there's more to dive into. The *retail analytics* trends of today are focused on looking at more micro-level actions or strings of actions that are predictive, rather than simply using analytics to form assessments of marketing schemes or to find macro trends. 

* **Micro marketing analytics.** Digital analytics platforms have allowed businesses a greater window of insight into their marketing analytics. Now, it's easier than ever to look at more micro-level marketing data (like how many impressions a customer needs before they purchase), what items are likely to be purchased together or in subsequent orders, and live updates of A/B testing on campaigns. 

* **Sentiment analysis.** Sentiment analysis is a new way of determining how customers and potential buyers feel about your product. It uses text analysis to determine how your customers are talking about your products on channels from on-site product reviews to comments on your social pages. [Sentiment analysis](https://auth0.com/blog/4-ways-to-calculate-your-customers-happiness) helps predict trends, gauge customer reactions to products and marketing materials, and can be the missing link that explains sales fluctuations.

![Retail Analytics - Social media real time sentiment analysis](https://images.ctfassets.net/23aumh6u8s0i/5rw5l3OakrHAJCvIYKDzZa/ca074dc53bd1d85a277d2ded7e9ad1b7/social-media-realtime-sentiments)

[[Source](https://www.linkedin.com/pulse/introducing-social-media-real-time-sentiment-analysis-debajani)]

* **Omnichannel analytics.** With all of the different platforms available to customers, and all of the paths customers take to purchase, getting a robust view of how your customers are purchasing across platforms and devices is crucial. While some software, like [Sellbrite](https://www.sellbrite.com/ecommerce-reporting/), include multi-channel eCommerce reporting, companies also turn to their IAM to help them stitch together [customer identities](https://auth0.com/blog/the-three-best-ways-to-create-the-single-vision-of-a-customer/) across channels. This can help eCommerce companies build and track brand experiences.

### The future 

Moving commerce online was the first in a series of chain reactions that have opened an entirely new world for retail and marketing. Even though technology and techniques seem to move at lightening speed, the truth is that eCommerce, shopping and marketing analysis, and behavioral analysis of customers has been slow to perfect. While getting targeting capabilities, cart abandonment numbers, and CTR stats has been quick, true customization for retailers, shoppers, and marketers is just beginning. 

* **Better predictions and forecasting.** While companies like [SAS](https://www.sas.com/en_us/solutions/analytics.html#forecasting) are investing a lot of energy into building forecasting capabilities, [predictive analytics](https://auth0.com/blog/predictive-analytics-why-is-it-important/) for retail will get better as more customer data is collected and software is better able to track and integrate that data across channels. Because predictions and forecasting are holistic efforts, as each part of data-rich eCommerce improves, so will these capabilities.

* **More IoT data.** It's no secret that the IoT has more and more [use cases](https://www.interana.com/blog/the-top-iot-analytics-use-cases-today/) as each year passes. More connected devices will mean a better picture of your eCommerce customer and their behaviors. eCommerce is also likely to build its own integrations with IoT devices — think [Farmstead](https://www.farmsteadapp.com/) integrated with your smart fridge — and this will bring a whole new set of data to process. 

![Retail Analytics - The Internet of Things and the mythical smart fridge](https://images.ctfassets.net/23aumh6u8s0i/52FGQ6wdqOVIBaR1GA6569/10ec870dbfa0fec766f9451db849e7cc/mythical-smart-fridge)

[[Source](https://uxmag.com/articles/the-internet-of-things-and-the-mythical-smart-fridge)]

## Getting your data together

The more that eCommerce progresses, the better *retail analytics* is going to get. Right now, companies and platforms have the capability to collect a huge amount of data, but we're still in the process of refining [how to use it](https://auth0.com/blog/all-you-need-to-know-about-data-management-and-integration/). Marketing is getting smarter and optimizations are being made all the time. From startups to the enterprise, eCommerce software is trying hard to figure out the best ways to help companies use customer data.

<include src="TweetQuote" quoteText="The more that eCommerce progresses, the better retail analytics is going to get."/>

For now, you should be looking at a combination of tried-and-tested *retail analytics* and newer approaches to retail data, like putting together cross-channel analytics and predictive metrics. The good news is that things aren't changing quite as fast as we think they are, and there's plenty of time to ramp up your analytics to get ready for the next step in eCommerce business.

## Aside: Securing Applications with Auth0

Are you building a [B2C](https://auth0.com/b2c-customer-identity-management), [B2B](https://auth0.com/b2b-enterprise-identity-management), or [B2E](https://auth0.com/b2e-identity-management-for-employees) tool? Auth0, can help you focus on what matters the most to you, the special features of your product. [Auth0](https://auth0.com/) can improve your product's security with state-of-the-art features like [passwordless](https://auth0.com/passwordless), [breached password surveillance](https://auth0.com/breached-passwords), and [multifactor authentication](https://auth0.com/multifactor-authentication).

[We offer a generous **free tier**](https://auth0.com/pricing) so you can get started with modern authentication.

"ecommerce"