andrea-chiarelli

I have over 20 years of experience as a software engineer and technical author. Throughout my career, I've used several programming languages and technologies for the projects I was involved in, ranging from C# to JavaScript, ASP.NET to Node.js, Angular to React, SOAP to REST APIs, etc.

In the last few years, I've been focusing on simplifying the developer experience with Identity and related topics, especially in the .NET ecosystem.

Principal Developer Advocate

Andrea Chiarelli

We released a new version of the .NET SDK for desktop and mobile applications. Learn what’s new.

We're thrilled to announce the newest release of the [Auth0 OIDC Client for .NET](https://github.com/auth0/auth0-oidc-client-net), bringing enhanced support and improvements to your desktop and mobile applications. This update focuses on future-proofing your applications by adding support for **.NET 9**, ensuring you're ready for the latest advancements in the .NET ecosystem.

## Key Highlights

Here are the main improvements provided by this release:

* **.NET 9 Support:** This release officially adds support for .NET 9 across WPF, WinForms, iOS, Android, and MAUI platforms.
* **MAUI issue fix**. With this release, we work around a [well-known issue with WebAuthenticator support in Windows](https://github.com/microsoft/WindowsAppSDK/issues/441).
* **Latest Dependencies:** Under the hood, this release includes the latest version of [Auth0.OidcClient.Core (version 4.1.0)](https://www.nuget.org/packages/Auth0.OidcClient.Core/4.1.0), which includes various underlying improvements and fixes.

What this means for you:

* **Future-Proofing:** By adopting this version, you're ensuring your authentication logic remains compatible as you migrate to .NET 9.
* **Continued Compatibility:** This release maintains compatibility with previous .NET versions, allowing for a smooth transition.
* **Enhanced Stability:** Leveraging the updated core library contributes to a more stable and reliable authentication process within your applications.

## Get Started Today!

Updating your Auth0 OIDC Client for .NET is straightforward. You can find the latest packages on NuGet, based on your UI framework:

* [Auth0.OidcClient.WPF - ver. 4.3.0](https://www.nuget.org/packages/Auth0.OidcClient.WPF/4.3.0)
* [Auth0.OidcClient.WinForms - ver. 4.3.0](https://www.nuget.org/packages/Auth0.OidcClient.WinForms/4.3.0)
* [Auth0.OidcClient.iOS - ver. 4.3.0](https://www.nuget.org/packages/Auth0.OidcClient.iOS/4.3.0)
* [Auth0.OidcClient.Android - ver. 4.1.0](https://www.nuget.org/packages/Auth0.OidcClient.Android/4.1.0)
* [Auth0.OidcClient.AndroidX - ver. 4.3.0](https://www.nuget.org/packages/Auth0.OidcClient.AndroidX/4.3.0)
* [Auth0.OidcClient.MAUI - ver. 1.3.0](https://www.nuget.org/packages/Auth0.OidcClient.MAUI/1.3.0)
* [Auth0.OidcClient.UWP - ver. 4.2.0](https://www.nuget.org/packages/Auth0.OidcClient.UWP/4.2.0)

Simply update your project dependencies to the latest version to take advantage of these improvements.

We're committed to providing you with the best possible authentication experience. This release is a step towards ensuring your .NET applications are ready for the future. Stay tuned for more updates and features!

Learn More:

* [Auth0 OIDC Client for .NET Documentation](https://auth0.github.io/auth0-oidc-client-net/)
* [GitHub Repository](https://github.com/auth0/auth0-oidc-client-net)

Thank you for being a part of the Auth0 community!

Announcing a New Release of the Auth0 OIDC Client for .NET

ana-cidre

Ana Cidre is a passionate advocate for the developer community and leads the Developer Advocacy team at Auth0. She's committed to fostering a more inclusive and diverse tech world, drawing on her technical background and strategic vision to improve developer experiences and build meaningful connections.

<br>

As the founder of GalsTech, an initiative supporting women in tech in Galicia, and through her active efforts to create welcoming spaces for underrepresented groups, Ana's dedication to diversity and inclusion extends beyond her daily work.

<br>

Ana has a proven track record of building global Developer Relations teams, cultivating active developer communities, and crafting impactful educational content. She maintains a strong connection to the community through speaking engagements and direct interaction with developers.

Sr Manager, Developer Advocacy

Ana Cidre

Discover the latest releases, updates, events, and all things developer-related from Auth0!

Identity is foundational, but building and scaling it well is hard. That’s where we come in. Each month, we surface the updates most relevant to you, things you can actually use, build with, and ship. Here’s what shipped in March 2025 and why it matters.

## Updates You Don’t Want to Miss

### Event Streams for User Lifecycle - Public Beta

Tracking changes to user profiles, like when a user is created, updated, or deleted, hasn’t always been straightforward. Until now, most teams had to rely on workarounds like Actions or digging through logs.

With Event Streams, you can now subscribe to real-time user lifecycle events and route them to a **Webhook, Event-Stream** or **AWS EventBridge**, making it easier to build automations, sync data, or trigger downstream systems whenever user data changes regardless of the connection used.

**Highlights:**

* Get notified when users are created, updated, or deleted
* Route events to webhooks or EventBridge with minimal setup
* No need to poll the Management API or monitor logs manually

> Event Streams is currently in **Public Beta**, and we’re looking for developers to test and share feedback. Check out the [Auth0 Docs](https://auth0.com/docs/deploy-monitor/events/create-an-event-stream) to get started.

### Advanced Customizations for Universal Login (Early Access) - Organizations, MFA TOTP, and Password Reset Challenge!

Back in February, we introduced Advanced Customizations for Universal Login (ACUL), giving you full control over login and signup screens. Now we’re extending that flexibility even further.

As of March, ACUL now supports building custom, client-rendered versions of additional key screens—including organization flows, MFA TOTP (Time-based one-time password) screens, and related reset password challenges.

**Highlights:**

* Customize Organization screens like Accept Invitation and Organization Picker
* Fully brand MFA TOTP enrollment and challenge screens
* Tailor Reset Password challenges across OTP, email, push, and SMS flows

This release also includes updates to the ACUL SDK, Auth0 CLI, Deploy CLI, and Terraform Provider—all with support for these new screens. (Note: the TypeScript SDK includes a breaking change—check the changelog for details.)

> We’re continuing to expand support across the full Universal Login experience. Check out the [docs](https://auth0.com/docs/customize/login-pages/advanced-customizations) to get started today.

### 🇯🇵 Japanese Language Support Added to Auth0 Dashboard and Docs

To support our developer community in Japan (and global teams building for Japanese users), the **Auth0 Dashboard and Documentation are now available in Japanese**.

**How it works:**

* Browser language preference set to Japanese? The dashboard and docs will load in Japanese automatically.
* Prefer manual control? Use the language switcher in the top-right corner.

This makes it easier for devs in Japan and beyond to build secure identity solutions with less friction.

### Breached Password Detection for Password Reset Flows is Now Available!

Breached Password Detection is getting a major upgrade. Until now, it only applied during sign-up and login and now, it also protects the **password reset flow**.

That means users can no longer reset their password to something that’s already known to be compromised, reducing both security risks and unnecessary password changes down the line.

**Highlights:**

- Prevent password resets to known breached credentials
- Expanded coverage now includes sign-ups via the Management API
- Improves account protection across the entire password lifecycle

> This update brings stronger security and a better user experience with minimal configuration. Check the [docs](https://auth0.com/docs/secure/attack-protection/breached-password-detection) to get started.

### Custom Phone Providers and Unified Phone Experience Now Generally Available

Custom Phone Providers and the Unified Phone Experience are now GA, giving you more control and simplicity when building phone-based authentication flows.

With **Custom Phone Providers**, you can use your own SMS provider and customize messages across Phones as ID, MFA, and Passwordless. It’s fully supported in Auth0 CLI, Deploy CLI, and Terraform for seamless integration with your CI/CD workflows.

The **Unified Phone Experience** simplifies configuration by consolidating phone settings and templates in one place. New tenants will use this by default, and existing tenants can opt-in anytime.

>  [Learn how to get started in the docs](https://auth0.com/docs/customize/phone-messages/unified-phone/use-auth0s-unified-phone-experience-for-multi-factor-authentication)

### More cool features we have shipped to improve your experience: 

**Swift Package Manager Support for Guardian SDK**

Integrating Auth0 Guardian into your iOS projects is now easier than ever. With support for Swift Package Manager (SPM), you can add Guardian directly in Xcode without manual setup or external dependency management. This update simplifies mobile integration and streamlines authentication setup in your Apple ecosystem.

**Credential Guard Now Available for Private Cloud on Azure**

Credential Guard is now supported for customers running Auth0 in Private Cloud on Azure. This enhancement offers faster breach detection, up to 250% quicker than traditional automated tools, along with global password protection coverage in 200+ regions and real-time threat intelligence powered by a dedicated security team.

**Actions – Execution Error Logs Now Available**

We’ve introduced better observability for unhandled execution errors in Actions. A new event type is now available in the Auth0 Dashboard under Monitoring > Logs and can also be streamed to your existing Log Stream platforms. You’ll also find a dedicated filter for Actions-related errors, helping you monitor and debug custom logic more efficiently.

## Community and Events

At Auth0, we’re all about showing up for developers, whether it's at a major conference or a local meetup. March was packed with great conversations around identity, security, and the future of application development.

### Where We Were in March

Here’s a quick look at where we’ve been and the awesome developer communities we connected with:

* **All Things Open AI** – March 17–18
* **NAVIGATE Kongress 2025**
* **Gartner IAM Summit London**
* **Tech.eu Summit** – March 25–26

![Community and Events](https://images.ctfassets.net/23aumh6u8s0i/65ZQfEpouwgVrXBqsDIEa8/243d53c9255ae9e5ffcb8b71f74a2773/Community_and_Events_-_March.jpg)

Thanks to everyone who dropped by to talk shop with us. We loved chatting about secure AI integrations, passwordless strategies, and how developers are solving identity challenges at scale.

### Where We’ll Be in April

We’re keeping the momentum going in April! If you're attending any of these, come say hi; we'd love to meet you and hear what you're building.

* **VoxxedDays Amsterdam (April 3rd)** – Don’t miss **Deepu’s talk** on *Securing the Future of AI: Authorization Strategies for RAG Systems with LangChain4J and OpenFGA*
* **Apidays Singapore 2025 (April 15–16th) – Daizen Ikehara **will discuss "Is your SaaS scalable? 4 things to consider to support large organizations."
* **AWS Summit Amsterdam (April 16th) **
* **React Miami (April 17–18th)**
* **PyCon DE (April 23–25th) – Juan Cruz Martinez **will present on "Secure 'Human in the Loop' Interactions for AI Agents."​
* **CityJS London (April 23rd–25th) **
* **Vue.js Global Summit '25 – AI Edition (April 29–30th) – Ramona Schwering** will deliver "Developer's Guide to Not Summoning Skynet."​
* **AWS Summit London (April 30th)**

Stop by our booth, catch a talk, or just grab some Auth0 swag; we’re excited to connect!

That’s all for March! <br>
We’ll be back next month with even more updates to help you build secure, scalable, and modern identity solutions. In the meantime, build something great and let us know how we can support your journey.

Stay secure. <br>
Keep shipping. <br>
We’re here if you need us.

March 2025 Updates: What’s New in Auth0 (Developer Edition)

Calah Vargas

Calah Vargas is the Associate Manager of Product Led Growth, focusing on nonprofits, startups, and partnerships. She works on product marketing and customer marketing initiatives. Outside work, you can find her cooking, trying new restaurants, and traveling with friends and family.

Associate Manager, PLG

Get started and ship fast with Auth0 and Netlify

**TL;DR:** [New Auth0 Extension](https://www.netlify.com/integrations/auth0/) for Netlify: Available Now. We’ll go over why we partnered with Netlify and share resources to help you build and deploy an app.

## Why Should I Choose Auth0?

A secure login experience and access management are at the core of any application with users. Auth0 is a comprehensive auth solution built for developers with evolving needs. With Auth0, you can get your app to market fast by quickly turning on core features, enabling a secure experience for your users, and customizing experiences when your app’s needs change. 

## What is Netlify, and Why Did We Choose to Partner Together? 

[Netlify’s](https://www.netlify.com/) platform allows you to build highly performant and dynamic websites, e-commerce stores, and web applications. It also unites an extensive ecosystem of technologies, services, and APIs into one workflow to unlock team productivity. Integrating with a third-party platform like Auth0 allows Netlify users to deploy any modern frontend stack safely and securely. 

We both share a commitment to an excellent developer experience, so this partnership is a great fit. This extension allows you to leverage Netlify to innovate, scale, and ship while relying on Auth0 to enhance security and a great user experience. 

## Let’s Start Building with Auth0 and Netlify

Challenge: You’re looking to add authentication to your Netlify site easily.

Solution: Use this new extension to add authentication to your Netlify site and connect your Auth0 tenants to your Netlify account dashboard. 

This [guide](https://developers.netlify.com/guides/getting-started-with-the-new-auth0-extension-on-netlify/) will include instructions on how to set up the following while using the web framework Astro:

* Authentication flows for login/logout
* An Auth0-protected serverless function for serving user information

> [Let’s dive in here](https://developers.netlify.com/guides/getting-started-with-the-new-auth0-extension-on-netlify/).

Once complete, you will have built a static site and enabled the Auth0 extension. Congrats on successfully authenticating your new website! 🎉

## Have Questions?

If you want to learn more, check out the new [Netlify documentation](https://docs.netlify.com/integrations/auth0/). Share your thoughts on the guide [here](https://developers.netlify.com/guides/getting-started-with-the-new-auth0-extension-on-netlify/#guide-feedback-form).


Happy building!

_This blog may contain hyperlinks to non-Okta websites that are created and maintained by third parties who are solely responsible for the content on such websites._

New Auth0 Extension for Netlify: Available Now

In the ever-evolving world of application development, managing identity is no small feat. But with the right tools, you can streamline your security and user management like never before. In this recap, we’ll dive into the latest updates from Auth0, showcasing how we’re enhancing your development experience with new features, integrations, and updates that bring both simplicity and power to the forefront.

Let’s explore the key updates you’ll want to know about and see how they can help you streamline your identity management, bolster security, and deliver more powerful, user-centric applications.

## Updates You Don’t Want to Miss

![Auth0 Next.js SDK](https://images.ctfassets.net/23aumh6u8s0i/40qRm7ybg04Di2kdebAuQc/745efea8a558a7c7e8c51a6b9bb03326/auth0_nextjs_sdk.png)

### Next.js SDK v4 (GA) Released

If you’re a **Next.js** developer, this update will significantly enhance your workflow. With **Next.js SDK v4**, now fully compatible with **Next.js 15** and **React 19**, you can take advantage of cutting-edge features like:

* **Middleware-Based Authentication**: A streamlined approach that makes authentication management easier and reduces maintenance.
* **Improved Security**: Encrypted cookies replace outdated logic, bringing your app's security up to date.
* **Better Session Management**: Features like rolling sessions and custom database support ensure a smoother user experience.

> This update is designed to help you take full advantage of the latest web development advancements without sacrificing security or performance.

### Advanced Customizations for Universal Login (Early Access)

For customers who want to take their Universal Login experience to the next level, we’ve launched Advanced Customizations for Universal Login (ACUL) in Early Access. ACUL enables you to create fully custom, client-rendered versions of each Universal Login screen. With ACUL, you get full control over every pixel of the login and signup screens.

Supported flows include Single Step Signup/Login, ID First Signup/Login with various authentication methods (password, passwordless, passkeys, etc.), and more.

This is just the beginning, with more features and a new configuration UI coming in the months ahead. [Check out the online documentation](https://auth0.com/docs/customize/login-pages/advanced-customizations) for all the details, and start building today!

### Okta Universal Logout Integration Now Supported in Auth0

For teams using **Okta** to manage their workforce identity, we’re rolling out [Universal Logout](https://auth0.com/blog/okta-universal-logout-integration-now-supported-in-auth0/) integration with Auth0. This update means you no longer need to build a global token revocation endpoint. Instead, when Okta detects a change in risk, it will automatically revoke sessions and refresh tokens.

> It’s a simple **integration** with minimal configuration, but the **security** benefits are huge, making it easier for you to ensure your applications are always up-to-date and protected.

### Custom Token Exchange – Early Access

We’re thrilled to announce[ Custom Token Exchange](https://auth0.com/docs/custom-token-exchange-early-access) in Early Access. This OAuth grant-type feature allows you to exchange security tokens for other tokens, such as access tokens and offers flexibility using Actions for custom logic.

This new feature enables advanced use cases like:

* Migrating users to Auth0
* Integrating external IDPs
* Exchanging Auth0 tokens for different audiences

> **Custom Token Exchange** provides the flexibility you need to handle sophisticated integrations where regular federation and OIDC flows aren’t feasible.

### More cool features we have shipped to improve your experience: 

- **Optimised TOTP Enrollment for Mobile Devices:** We’ve made the process of enrolling in TOTP (Time-Based One-Time Password) on mobile devices more intuitive. Check out [**Auth0 Temporary OTP**](https://auth0.com/docs/secure/multi-factor-authentication/auth0-guardian#temporary-one-time-passwords) for more details!

- **Email OTP Verification – Email OTP(One Time Password) Verification:** is now Generally Available (GA), providing an additional layer of security during signup and password reset. This feature requires **Universal Login** and can be enabled by changing the **Verification Method** from Verification Link to OTP in your connection settings.

- **Usage Metrics Dashboard for Auth0 FGA:** We’re introducing the **Usage Metrics Dashboard** for **Auth0 Fine-Grained Authorization (FGA)**. This new tool gives teams deep visibility into their authorization usage, enabling more efficient monitoring and management of monthly active users, total number of tuples, and monthly average requests per second.

- **New Private Cloud Region in India:** We’ve expanded our Private Cloud availability by adding a new region in Hyderabad. This follows the Mumbai AWS region in India, providing additional flexibility, reduced latency, and improved data residency options for Auth0 customers in the region.

### Deprecations

**Node.js 12 and 16 Extensibility Runtimes Deprecation:** We’re phasing out the Node.js 12 and 16 runtimes for extensibility integrations, such as Actions, Rules, Hooks, Custom Database Connections, and Custom Social Connections. If you’re using these runtimes, we strongly recommend migrating to Node.js 22, which is our recommended runtime for all new and existing extensibility integrations.

**Unwarranted Session Removal After User Updates (Deprecated):** In a bid to improve the user experience, we’ve deprecated the automatic invalidation of user sessions when performing database connection user updates with unchanged email or `email_verified` attributes. This change will ensure that the session invalidation behavior aligns more closely with the email verification flows. 

## Community and Events

### Partnering with LangChain and LlamaIndex

As Generative AI (GenAI) applications become more powerful, securing these systems becomes essential. The "[Auth for GenAI](https://auth0.com/blog/auth-for-genai/)" initiative is here to help developers integrate strong authentication and authorization into their GenAI applications, ensuring sensitive data is protected when interacting with external APIs and data sources.

We’re thrilled to announce our partnerships with [LangChain](https://auth0.com/blog/building-a-secure-rag-with-python-langchain-and-openfga/) and [LlamaIndex](https://auth0.com/blog/genai-llamaindex-js-fga/)—two leading frameworks in the GenAI space. Together, we’re demonstrating how Auth0 can seamlessly integrate with these tools to secure your AI applications.

Key aspects of our collaboration include:

* **Framework-Specific SDKs** to simplify the integration of Auth0’s authentication and authorization solutions.
* **Informative Developer Content** that offers best practices, guides, and examples for secure GenAI app development.
* **Fine-Grained Access Control** using **Auth0 FGA (Fine-Grained Authorization)**, which ensures that AI applications can securely access external data sources and APIs.

This partnership is a great step toward building secure, scalable, and compliant AI applications. We’re excited to collaborate with **LangChain** and **LlamaIndex**, and provide developers with the tools and resources they need to build the next generation of secure AI-powered systems.

> Together, we’re building the future of secure **Generative AI**. Let’s innovate and secure the AI applications of tomorrow!

* [Building a Secure RAG with Python, LangChain, and OpenFGA](https://auth0.com/blog/building-a-secure-rag-with-python-langchain-and-openfga/)
* [Build a Secure RAG Agent Using LlamaIndex and Okta FGA on Node.js](https://auth0.com/blog/genai-llamaindex-js-fga/)

### Events

At Auth0, we’re passionate about engaging with the developer community and sharing insights at events worldwide. Whether we’re speaking at conferences, hosting workshops, or simply connecting with like-minded developers, we’re excited to be part of the conversations shaping the future of identity and security. Here’s a look at where we’ve been recently and where you can catch us next!

#### Where Were We?

In the past few weeks, we’ve had the privilege of attending some amazing events and meeting incredible developers:

* [JFokus](https://www.jfokus.se/talks/1839) – February 3-6
* [Developer Week](https://www.developerweek.com/) – February 11-13
* [DevWorld Amsterdam](https://devworldconference.com/) – February 27-28

![Events](https://images.ctfassets.net/23aumh6u8s0i/4t1GBeVZ6OXdhXZ2CFbTHs/d1ef9abcb6f96fdaa98143c6890623e0/events2025.jpg)

It’s been a blast connecting with the community, and if you joined us at any of these events, we hope you had a chance to chat with the team and explore what’s new with Auth0.

Looking ahead, we’ve got a busy schedule and can’t wait to meet more of you at these upcoming events:

* [All Things Open AI](https://allthingsopen.ai/) – March 17-18
* [Tech.eu Summit](https://tech.eu/event/2025/summit-london/) – March 25-26

Make sure to swing by our booth if you’ll be at any of these events, we’d love to talk all things identity, security, and the future of AI-powered applications!

That’s all for this month! We’re committed to keeping you updated with the latest and greatest features to help you build secure, scalable applications. Stay tuned for more in March!


February 2025 Updates: What's New in Auth0

sara-kazemi

As a former computer science educator and software engineer, I joined Okta in 2021 to combine these skills to create engaging, accessible learning experiences for devs.

Senior Technical Curriculum Developer - Expert Acceleration

Sara Kazemi

We're excited to introduce [Okta Learning](https://learning.okta.com/), our new learning experience designed to help you level up your identity and access management (IAM) superpowers. With Okta Learning, you can develop new skills and earn valuable certifications that can help advance your career. Whether you're a seasoned developer or just getting started, Okta Learning offers self-paced, tailored learning paths and plans to help you master the tools and technologies you need to succeed in the world of digital identity.

## Personalized Learning Paths for Every Developer

We know that every developer has unique learning needs. That’s why we’ve built custom [learning paths](https://learning.okta.com/page/courses-all#swimlane-learningpaths) based on the specific skills you want to learn. Whether you're interested in leveraging Auth0 APIs and SDKs, integrating authentication protocols, or learning how to implement security best practices, you can choose the path that aligns with your personal learning goals.

![Learning Paths](https://images.ctfassets.net/23aumh6u8s0i/6QLFAt7aVC12TsgwhULpNC/a797cab358757cac93d4cc1d0453d04b/01_okta-learning-learning-path.png)

## Goal-Oriented Learning Plans

If you're working toward a specific objective—like earning your [Okta Developer - Customer Identity Cloud Certification](https://certification.okta.com/okta-developer-cic-certification-exam)—our [learning plans](https://learning.okta.com/page/development) are designed to guide you through a curated set of activities to support you through your learning journey. These plans provide a clear, structured roadmap so you can stay on track and feel confident in your preparation.

![Goal-Oriented Learning Plans](https://images.ctfassets.net/23aumh6u8s0i/6R0mLRtkwJBecA4e1tdkUt/e03a4607a399e738a9855088243a3b7f/02_okta-learning-learning-plan.png)

## Hands-On Coding Labs and Interactive Learning

We believe in learning by doing. That's why we’ve included interactive activities and [hands-on coding labs](https://learning.okta.com/page/courses-all#delivery-method_hands-on-lab) that allow you to apply what you've learned in a real-world context. From working with Auth0 SDKs to creating custom identity flows you'll gain practical experience to help you build better, more secure applications that fit your requirements.

![Hands-On Coding Labs and Interactive Learning](https://images.ctfassets.net/23aumh6u8s0i/6i3fdO4ksJ2CZNtfsvHCag/2c0f13d7a8d0d0c3b87d1b5932366a79/03_okta-learning-hands-on.png)

## Earn Badges to Showcase Your Skills

To recognize your progress and achievements, we’ve introduced skills-based badging assessments. Successfully pass an assessment, and you'll earn a badge that showcases the skill you've gained—whether it's a foundational understanding of digital identity or an advanced feature of Auth0. [These badges](https://learning.okta.com/page/skill-badges) serve as both a personal accomplishment and a tangible way to demonstrate your expertise to peers, employers, and the broader tech community.

![Earn Badges to Showcase Your Skills](https://images.ctfassets.net/23aumh6u8s0i/EyzFcVcI3qw0tWnhp3ECm/f18010f6fbab2bb40c792eebbe5fdc93/04_okta-learning-skill-badges.png)

## Start Your Learning Journey Today

With Okta Learning, you can take ownership of your own learning journey at your own pace. Whether you’re just starting out in the digital identity space or working towards career advancement, Okta Learning has a path for you.

Get started today and unlock your potential with [Okta Learning](https://learning.okta.com/)!

Knowledge Belongs to You: Introducing the New Okta Learning Experience

deepu-sasidharan

Deepu is a polyglot developer, Java Champion, and OSS aficionado. He mainly works with Java, JS, Rust, and Golang. He co-leads JHipster and created the JDL Studio and KDash. He's a Staff Developer Advocate at Okta. He is also an international speaker and a published author.

Staff Developer Advocate

Deepu K Sasidharan

arpit-jain

Arpit is a skilled engineering manager and software developer who specializes in Java, JS, and cloud-native technologies. He actively contributes to the developer community and focuses on enhancing the developer experience. Arpit also mentors aspiring developers.

Senior Engineering Manager

Arpit Jain

The Auth0 Terraform provider has many new features and updates. Learn all about what's new.

The [Auth0 Terraform Provider](https://registry.terraform.io/providers/auth0/auth0/latest/docs) allows you to automate the configuration of Auth0 resources like applications, connections, actions, and more. You can also use it to manage users and groups. With the Auth0 Terraform provider, you can automate almost everything you can do via the management UI.

**Check out our blog post to get started with Auth0 and Terraform.**

<include 
    src="LinkCard" 
    title="Get Started with the Auth0 Terraform Provider" 
    link="https://auth0.com/blog/get-started-with-auth0-terraform-provider/" 
    description="Learn how to get started with the Auth0 Terraform Provider to automate your identity infrastructure." 
    img="https://images.ctfassets.net/23aumh6u8s0i/315vJcTNAjaIgQZWxlovOf/a1839ed3bff28c3da8969642252c86a6/terraform-auth0-logo"
/>

## What's New in the Auth0 Terraform Provider

The latest versions (1.4 to 1.7) of the Auth0 Terraform provider have many new features and updates. Here are the top **six** features to look out for.

### Auth0 Forms

[Auth0 Forms](https://auth0.com/features/forms) is a robust visual editor that enables you to create custom, dynamic forms seamlessly integrating with your authentication workflows.

> [Available from v1.7.3](https://registry.terraform.io/providers/auth0/auth0/latest/docs/resources/form)

<AmpContent>
  <amp-youtube
      data-videoid="jkzwN2xwO5w"
      layout="responsive"
      width="480" height="270">
  </amp-youtube>
</AmpContent>
<NonAmpContent>
  <div class='embed-container' style="position: relative; padding-bottom: 56.25%; height: 0; overflow: hidden; max-width: 100%;margin-bottom:40px;"><iframe style="position: absolute; top: 0; left: 0; width: 100%; height: 100%;" src='https://www.youtube.com/embed/jkzwN2xwO5w' frameborder='0' allowfullscreen></iframe></div>
</NonAmpContent>

Forms offer a secure and controlled experience within your tenant's domain, eliminating the need for external site redirects. You can manage Auth0 Forms and [Flows](https://auth0.com/docs/customize/forms/flows) via Terraform, enabling you to automate the creation and management of forms and flows.

```hcl
# Create an Auth0 Form
resource "auth0_form" "sample_form" {
  name = "KYC Form"

  start = jsonencode({
    coordinates = { x = 0, y = 0 }
    next_node = "username_step"
  })

  nodes = jsonencode([{
    id   = "username_step"
    type = "STEP"
    config = {
      components = [{
        category = "FIELD"
        config = {
          max_length = 50
          min_length = 1
          multiline  = false
        }
        id        = "full_name"
        label     = "Your Name"
        required  = true
        sensitive = false
        type      = "TEXT"
        },
        {
          category = "BLOCK"
          config = { text = "Continue" }
          id   = "next_button_3FbA"
          type = "NEXT_BUTTON"
      }]
      next_node = "$ending"
    }
    coordinates = { x = 500, y = 0 }
  }])

  ending = jsonencode({
    after_submit = {
      flow_id = auth0_flow.sample_flow.id
    }
    coordinates = { x = 1250, y = 0 }
    resume_flow = true
  })

  style = jsonencode({ css = "h1 { color: white; text-align: center; }" })
}

# Create an Auth0 Flow to use the Form
resource "auth0_flow" "sample_flow" {
  actions = jsonencode([{
    action = "UPDATE_USER"
    allow_failure = false
    id            = "update_user_metadata"
    mask_output   = false
    params = {
      changes = {
        user_metadata = { full_name = "{{fields.full_name}}" }
      }
      connection_id = auth0_flow_vault_connection.sample_connection.id
      user_id       = "{{context.user.user_id}}"
    }
    type = "AUTH0"
  }])
  name = "Flow KYC update data"
}

# Create a Flow Vault Connection to use in a Flow
resource "auth0_flow_vault_connection" "sample_connection" {
  app_id = "AUTH0"
  name   = "Auth0 M2M Connection"
  setup = {
    client_id     = var.auth0_client_id # The M2M app must be authorized to use the Auth0 Management API
    client_secret = var.auth0_client_secret
    domain        = var.auth0_domain # without https:// in the domain
    type          = "OAUTH_APP"
  }
}
```

### Machine-to-Machine Access for Organizations

[Machine-to-Machine (M2M) Access for Organizations](https://auth0.com/docs/manage-users/organizations/organizations-for-m2m-applications) enables you to define the organizations that a given application can access for each API using the Client Credentials Flow. This enables customers to sell and operate their services in M2M environments properly, cover scenarios with consumption devices with limited user experience capabilities, and simplify configuration and usage.

This is being implemented so that M2M Apps can be associated with a given organization, as currently done for Connections. This will enable that application to request an access token for that specific Organization.

> Note: This feature is available from B2B Professional, Enterprise, and Enterprise premium plans.

> [Available from v1.7.0](https://registry.terraform.io/providers/auth0/auth0/latest/docs/resources/organization_client_grant)

```hcl
# Create an Auth0 Organization
resource "auth0_organization" "my_organization" {
  name         = "auth0-inc"
  display_name = "Auth0 Inc."

  branding {
    logo_url = "https://example.com/assets/icons/icon.png"
    colors = {
      primary         = "#f2f2f2"
      page_background = "#e1e1e1"
    }
  }
}

# Create a new Auth0 M2M application
resource "auth0_client" "sample_client" {
  name                = "MyCoolApp"
  description         = "My Cool App Client Created Through Terraform"
  app_type            = "non_interactive"
}

# Create a Client Grant for the Client
resource "auth0_client_grant" "my_client_grant" {
  client_id = auth0_client.sample_client.id
  audience  = "https://passkeys-demo.eu.auth0.com/api/v2/"
  scopes    = ["create:foo", "create:bar"]
}

# Create a Client Grant for the Organization
resource "auth0_organization_client_grant" "sample_organization_client_grant" {
  organization_id = auth0_organization.my_organization.id
  grant_id       = auth0_client_grant.my_client_grant.id
}
```

## Bring Your Own Key (BYOK)

[Bring Your Own Key](https://auth0.com/docs/secure/highly-regulated-identity/customer-managed-keys/customer-managed-keys-management-api) allows you to securely replace your tenant’s top-level encryption key with a key of your own, hence gaining control of your key material in Auth0’s hardware security module (HSM). It allows compliance with specific secret custody and key provenance requirements. Once you have uploaded your key, data encryption and decryption operations use that key to encrypt your tenant's secrets and data.

> Note: This feature is available as Early Access on Enterprise plans with the Highly Regulated Identity add-on.

> [Available from v1.7.0](https://registry.terraform.io/providers/auth0/auth0/latest/docs/resources/encryption_key_manager)

```hcl
# Modifying the key_rotation_id causes the keys to be rotated/rekeyed.
resource "auth0_encryption_key_manager" "sample_key_manager_initial" {
  key_rotation_id = "da9f2f3b-1c7e-4245-8982-9a25da8407c4"
}

resource "auth0_encryption_key_manager" "sample_key_manager_rekey" {
  key_rotation_id = "68feba2c-7768-40f3-9d71-4b91e0233abf"
}

# To initialize the process of providing the root key by the customer, create a
# `customer_provided_root_key` block.
resource "auth0_encryption_key_manager" "sample_key_manager" {
  customer_provided_root_key {
  }
}

# The public_wrapping_key and wrapping_algorithm should be available to
# be used to wrap the new key by the customer
output "key_manager" {
  depends_on = [auth0_encryption_key_manager.sample_key_manager]
  value = {
    public_wrapping_key = auth0_encryption_key_manager.sample_key_manager.customer_provided_root_key.*.public_wrapping_key
    wrapping_algorithm  = auth0_encryption_key_manager.sample_key_manager.customer_provided_root_key.*.wrapping_algorithm
  }
}

# The root key should be wrapped using the specified algorithm by the customer and Base64 encoded.
resource "auth0_encryption_key_manager" "sample_key_manager" {
  customer_provided_root_key {
    wrapped_key = "your_base64_encoded_wrapped_root_key"
  }
}
```

## Customize Signup and Login Prompts

[Customize Signup and Login Prompts](https://auth0.com/docs/customize/login-pages/universal-login/customize-signup-and-login-prompts) is a feature that allows customers with a Custom Domain and Custom Page Template enabled to add custom fields and content to their app’s signup and login prompts.

> [Available from v1.7.0](https://registry.terraform.io/providers/auth0/auth0/latest/docs/resources/prompt_screen_partial)

Customize Signup and Login Prompts supports two use cases.

- **Custom content**: Custom content is static content like text, links, or images placed directly on the signup and login prompts.
- **Data capture**: Data capture uses form elements dynamically added to the signup and login prompts, which is useful for collecting and validating user consent or user-produced data like a surname.

```hcl
# For managing a single prompt screen
resource "auth0_prompt_screen_partial" "login" {
  prompt_type = "login"
  screen_name = "login"
  insertion_points {
    form_content_start = "<div>Form Content Start</div>"
    form_content_end   = "<div>Form Content End</div>"
  }
}

# For managing multiple prompt screens
resource "auth0_prompt_screen_partials" "prompt_screen_partials" {
  prompt_type = "login-passwordless"

  screen_partials {
    screen_name = "login-passwordless-email-code"
    insertion_points {
      form_content_start = "<div>Form Content Start</div>"
      form_content_end   = "<div>Form Content End</div>"
    }
  }

  screen_partials {
    screen_name = "login-passwordless-sms-otp"
    insertion_points {
      form_content_start = "<div>Form Content Start</div>"
      form_content_end   = "<div>Form Content End</div>"
    }
  }
}
```

## Self-Service Single Sign-On

[Self-Service Single-Sign On (SSO)](https://auth0.com/docs/authenticate/enterprise-connections/self-service-SSO) provides business-to-business (B2B) customers with the tools needed to delegate SSO setup to their enterprise customers. This enables your B2B customers to configure and manage their own ways of logging in to your SaaS application.

Self-Service SSO provides a packaged experience that Auth0 customers can offer to their business customers so that they can set up their own SSO access. Customers can take advantage of this time-saving feature to reduce support costs and time-to-value for their business customers.

> Note: This feature is available as limited Early Access on Enterprise plans.

> [Available from v1.5.0](https://registry.terraform.io/providers/auth0/auth0/latest/docs/resources/self_service_profile)

```hcl
resource "auth0_self_service_profile" "my_self_service_profile" {
  user_attributes {
    name        = "sample-name"
    description = "sample-description"
    is_optional = true
  }
  branding {
    logo_url = "https://mycompany.org/v2/logo.png"
    colors {
      primary = "#0059d6"
    }
  }
}
```

## SCIM Configuration

[System for Cross-domain Identity Management (SCIM)](http://www.simplecloud.info/), is a [protocol](https://tools.ietf.org/html/rfc7644) and [schema](https://tools.ietf.org/html/rfc7643) used by enterprise organizations for provisioning, de-provisioning, and managing user identity-related information across systems in a standardized way. SaaS developers selling their SaaS apps and services to large enterprises may be asked, or even required, by those customers to implement a SCIM-based API to integrate with the user provisioning tooling they use.

With support for [inbound SCIM](https://auth0.com/docs/authenticate/protocols/scim/configure-inbound-scim), SaaS application builders will be able to:

- Use the Auth0 Dashboard or APIs to quickly and easily enable support inbound SCIM user provisioning and de-provisioning workflows to their Auth0 user identity stores
- Get out-of-box support for top Workforce IDPs that implement outbound SCIM (including Okta Workforce Identity Cloud and Azure AD) without needing to build or self-host any custom endpoints

> Note: This feature is available on Enterprise plans.

> [Available from v1.4.0](https://registry.terraform.io/providers/auth0/auth0/latest/docs/resources/connection_scim_configuration)

```hcl
resource "auth0_connection" "my_enterprise_connection" {
  name         = "my-enterprise-connection"
  display_name = "My Enterprise Connection"
  strategy     = "okta"

  options {
    client_id              = "1234567"
    client_secret          = "1234567"
    issuer                 = "https://example.okta.com"
    jwks_uri               = "https://example.okta.com/oauth2/v1/keys"
    token_endpoint         = "https://example.okta.com/oauth2/v1/token"
    authorization_endpoint = "https://example.okta.com/oauth2/v1/authorize"
  }
}

# A resource for configuring an Auth0 Connection SCIM Configuration, specifying `user_id_attribute` and `mapping`.
# Only one can be specified for a connection.
resource "auth0_connection_scim_configuration" "my_conn_scim_configuration" {
  connection_id     = auth0_connection.my_enterprise_connection.id
  user_id_attribute = "attribute1"
  mapping {
    auth0 = "auth0_attribute1"
    scim  = "sacim_attribute1"
  }
  mapping {
    auth0 = "auth0_attribute2"
    scim  = "sacim_attribute2"
  }
}
```

## Learn More

I hope that you found this article helpful. Here are some additional resources to learn more about Auth0 and DevOps.

- [Get Started with the Auth0 Terraform Provider](https://auth0.com/blog/get-started-with-auth0-terraform-provider/)
- Be a DevOps Hero\! Automate Your Identity Infrastructure with Auth0 CLI and Ansible
- [Deploy Secure Spring Boot Microservices on Amazon EKS Using Terraform and Kubernetes](https://auth0.com/blog/terraform-eks-java-microservices/)
- [Shhhh... Kubernetes Secrets Are Not Really Secret\!](https://auth0.com/blog/kubernetes-secrets-management/)
- [Auth0 CLI Basics \- Lab](https://developer.auth0.com/resources/labs/tools/auth0-cli-basics#introduction)

You can also sign up for our [newsletter](https://a0.to/nl-signup/java) to stay updated on everything about identity and security.

If you liked this tutorial, chances are you'll enjoy the others we publish. Please follow [@auth0 on Twitter](https://twitter.com/auth0) and [subscribe to our YouTube channel](https://youtube.com/oktadev) to get notified when we publish new developer tutorials.


What's New in the Auth0 Terraform Provider?

Abbie Carlson

As a Product Marketing Manager, I'm responsible for communicating the value of Identity for consumer apps as well as focusing on the developer experience. I'm forever curious about how Identity plays a role in our everyday lives as consumers and how a great Customer Identity solution can make or break a business through patron loyalty and retention. 

Outside of work can catch me watching Seattle sports, going to as many concerts as I can or listening to true crime podcasts.

Senior Product Marketing Manager - Developer Experience & Analytics

Keep scrolling to learn more about our newest releases, updates, and all things developer.

As builders and developers, you know how quickly the Identity landscape can change and pivot. And here at Auth0, we’re right there with you. To be in the loop, you gotta always be two steps ahead.

You’re shaping the future of Identity as you build and scale your app. You’re adding to open-source projects to support the wider good. And you’re learning as you go and adopting new standards to stay on top of it all.

With that, we want to share some new and updated releases that can help you continue to grow, support, and learn in this ever-changing Identity world.

[**Auth0 Plans Just Got an Upgrade**](https://auth0.com/blog/auth0-plans-got-an-upgrade/) 🎉 Auth0’s vision is to free any consumer or SaaS application user to safely use any technology. This means giving developers the products that help make building, deploying, and scaling applications easy. In the last few years, we’ve added more capabilities that allow developers to battle malicious attacks and attackers.

We’re happy to bring you more on our Free, Essential, Professional, and Enterprise Plans. A few highlights to mention- the Free Plan now includes 25,000 MAUs and a Custom Domain. 10 Organizations are now available on our B2C Plans and Unlimited[^1] Organizations on our B2B Plans as well as increased MFA offerings so you can mitigate the growing threat of AI-based attacks.

![Free plan](https://images.ctfassets.net/23aumh6u8s0i/sFytL92hG7PJErfIvOoJc/c6facc7de0415a1b8db32b206809b457/Uploaded_from_Staying_up_to_date_in_Identity__Auth0_s_Q3_Developer_Releases)

_These are just our Free Plan updates. Take a look at our [blog](https://auth0.com/blog/auth0-plans-got-an-upgrade/) to learn more about the plan changes._

[**Forms**](https://auth0.com/docs/customize/forms) ✨ Frictionless sign-up and login experiences are crucial for winning over customers and staying competitive. Today's businesses need tools that support efficient and secure operations but also help drive customer retention and growth, adapt to unique security needs, and unify and activate data across multiple apps and systems.

Forms enables developers and UX teams to streamline orchestration and create custom Identity flows tailored to their company's needs. This flexibility helps you build a more seamless user experience.

![Dashboard > Actions > Forms](https://images.ctfassets.net/23aumh6u8s0i/58pMHDbyfqe0thBPLzu4ij/5a4ac70a7a9be3d280b9dc4945158061/Uploaded_from_Staying_up_to_date_in_Identity__Auth0_s_Q3_Developer_Releases)

**What’s Next? Auth for GenAI** 🤖 Auth for GenAI is a series of features that allows you to confirm that your AI agents have the right and least privileged access to sensitive information. In addition, Auth for GenAI can call APIs securely on behalf of users to integrate with other apps and is capable of securely implementing on-demand user authentication when background or async AI agents need user confirmation for actions.

![auth0.ai](https://images.ctfassets.net/23aumh6u8s0i/FumWILM0KMtXGUdXuZxYw/0cc2ccf921997f0f0d3802f3dfdd8dd0/Uploaded_from_Staying_up_to_date_in_Identity__Auth0_s_Q3_Developer_Releases)

Interested? Join our waitlist [here](http://auth0.ai/) to be the first to find out when these features become available.

We hope that these product updates and releases support you in this ever-changing world of Identity and security. If you’d like to learn more about our other updates and releases (we’ve got a lot more to tell you about), take a look at our [Developer Releases Guide](https://www.okta.com/resources/datasheet-developer-releases-auth0-by-okta-q3-2024/). And if you’d like to dive even deeper, please check out our combined [Customer Identity and Workforce Identity Release Guide](https://www.okta.com/resources/product-release-overview-q3-2024-wic-cic/).

Outside of all these release updates, take a look at our developer resources at [www.developer.auth0.com](http://www.developer.auth0.com/).

[^1] : _subject to system limitations_

Staying up to date in Identity… Auth0’s Q3 Developer Releases

carla_urrea

I've been working as a software engineer since 2014, particularly as a backend engineer and doing system design. I consider myself a language-agnostic developer but if I had to choose, I like to work with Ruby, Python, and Elixir.  

After realizing how fun it was to create content and share experiences with the developer community I made the switch to Developer Advocacy. I like to learn and work with new technologies. 

When I'm not coding or creating content you could probably find me going on a bike ride, hiking, or just hanging out with my dog, Dasha. 

Senior Developer Advocate

Carla Urrea Stabile

Developer Day 2024 is a wrap and Auth0 announced some cool stuff! Let's recap some of them in this blog post.

Yup, Developer Day 2024 is a wrap! 

We hosted a 24-hour virtual event with unique content regardless of your timezone! But do not despair— if you want to go back, you can check out the announcements, [all sessions](https://a0.to/devday24/sessions) and [labs](https://a0.to/devday24/labs). In the meantime, let's take a look at some of the cool stuff Auth0 announced and what is new with the product!


## 🤑 Improvements in Pricing & Plans

Let's start with (what I think) is one of the best announcements 😏. We heard the feedback from developers, and we want to make application security accessible to everyone, so we're adjusting pricing and what's included in plans in response. So, let's take a look at some of the changes in our plans:

### Expanding Free Tier

What's included in the new plan?: 
- Increase in the number of Monthly Active Users (MAUs) **from 7,500 to 25,000 MAUs.**
- Now you have **unlimited social connections and Okta connections**.
- You can have **up to 5 Organizations** and use **Passwordless**.
- You can set **up to 5 Actions.**
- You can configure your **own custom domain.**


### Expanding Paid Plans

- **Organizations are included in every plan**, with sign-up and login customization starting from the B2C Essentials plan.
You have **unlimited Okta connections**, which allow you to integrate your applications easily with Okta Workforce Identity Cloud.
- **MFA** included in all Enterprise plans!

## 🚀 Login Experience & Extensibility

Every company has its own authentication requirements, and Auth0 wants to make sure most of them, if not all, are available, so let's take a look at some improvements: 

### Add Custom Prompts to Sign-Up and Login

You can now [add custom prompts to your sign-up and login boxes](https://auth0.com/docs/customize/login-pages/universal-login/customize-signup-and-login-prompts). Now you could, for example, add extra user information like their full name, phone-number, without leaving the authentication process. You could also show them a prompt with your Terms and Conditions so they can consent before registration. Most importantly, you can validate all the data you gather using Auth0 Actions!

![Custom Prompts from Docs](https://images.ctfassets.net/23aumh6u8s0i/4LCBduxiYIaC2UWU87FAct/044c25887847927b56d6975b0d1d29ac/Screenshot_2024-07-22_at_13.37.03.png)

<div class="alert alert-info alert-icon">
  <i class="icon-budicon-487"></i>
  <strong>Friendly Reminder!</strong><br> 
 Be prepared for End-of-Life: Don't forget to <a href="https://auth0.com/blog/preparing-for-rules-and-hooks-end-of-life/">migrate your Rules & Hooks to Auth0 Actions before November 18th!</a>
  <br> 
</div>

### Auth0 Forms

Auth0 Forms allows you to create custom forms and extend your identity flow using a visual editor. You no longer need to redirect your users outside of Auth0 to achieve this. [Check out the docs here to learn how to do it.](https://auth0.com/docs/customize/forms)

![Auth0 Forms from Docs](https://images.ctfassets.net/cdy7uua7fh8z/3QLVE6XsMRwhL17SUSMw8H/c679b99a8930d463a30352e1d11ee755/2024-05-09_14-20-42.png)

## 🚦 MFA Customization with Actions

Now, you can enroll your users in specific factors using the post-login flow in Actions. You can also prompt users to enroll in SMS for one application while encouraging them to enroll in push notifications or WebAuthn for a different application. [Learn more on how to customize MFA here.](https://auth0.com/docs/secure/multi-factor-authentication/customize-mfa/customize-mfa-enrollments-universal-login)

## 🤩 New APIs: Sessions & Refresh Tokens Management APIs

We've released new APIs! Here's everything you need to know: 

### Session Management API 

The [Sessions Management API](https://auth0.com/docs/manage-users/sessions/manage-user-sessions-with-auth0-management-api) provides you a set of endpoints of the Management API that allows you to manage active authenticated sessions, enabling you to close those deemed redundant or a security risk. 

### Refresh Tokens Management API 

The [Refresh Tokens Management API](https://auth0.com/docs/secure/tokens/manage-refresh-tokens-with-auth0-management-api) allows you to list and revoke refresh tokens and make your applications more secure and consistent.

## 🔐 New Features in Okta FGA 

Earlier this year, we released [Okta FGA](https://docs.fga.dev/), a highly scalable authorization service powered by [OpenFGA](https://openfga.dev/); apart from that, the team has been working hard to add more features: 

- Create multiple credentials for a single Okta FGA store with different permissions depending on how you want to use it. You can [learn more about how to do this by reading the docs](https://docs.fga.dev/integration/getting-your-api-keys). 
- [Modular Models](https://docs.fga.dev/modeling/modular-models) so you can compose an authorization model from multiple modules; this feature comes in handy in scenarios where your authorization model grows too large, and it isn't easy to understand or when your team grows, and ownership boundaries are not clear enough. 

## 🏢 Highly Regulated Identity (HRI)

[Highly Regulated Identity](https://auth0.com/docs/secure/highly-regulated-identity) is Auth0’s feature set that enables the development of secure applications that comply with critical international regulations such as Open Banking, Financial Data Exchange, and Consumer Data Rights. It is now available as an optional security add-on for Enterprise plan customers.

Among other things, Highly Regulated Identity provides you with the following:
- Advanced security with OpenID Connect.
- Strong Customer Authentication, which supports compliance with Europe’s Payment Services Directive (PSD2)
- Strong Application Authentication allows you to implement the FAPI 1 Advanced Security profile using Private Key JWT or mTLS for OAuth.
- Token Binding adds the ability to bind an access token to your application, preventing unauthorized access even when a token is compromised.

## 🤖 Bot Detection Improvements

We are introducing Auth Challenge, a new and improved bot response available in Bot Detection. 

Auth Challenge is the default bot detection response, which provides a CAPTCHA-free user verification. It leverages a series of non-intrusive browser challenges to set the difficulty of the challenge, making it tougher on bots and easy for humans. You can [learn more about it in the Bot Detection docs.](https://auth0.com/docs/secure/attack-protection/bot-detection)

## 👥 Introducing Auth0 Teams

Auth0 Teams provides a single point of visibility and control over your Auth0 resources by providing centralized governance, compliance, and secure collaboration at scale.

Teams consolidate managing tenants, tenant members, and subscriptions in one central place, offering visibility from a higher level perspective instead of the tenant by the tenant. Auth0 Teams is designed to improve the work efficiency and experience of dashboard admins responsible
for managing the Auth0 resources.

[Learn more of Auth0 Teams in our docs!](https://auth0.com/docs/get-started/auth0-teams)

## 👩‍💻 JWT Access Token Profiles

JSON Web Token (JWT) Profile for OAuth 2.0 Access Tokens - [RFC 9068](https://datatracker.ietf.org/doc/rfc9068/) is now available. RFC 9068 provides a standard JWT format to represent Access Tokens. The main goal here is to provide interoperability to issue and consume Access Tokens between authorization servers and resource/API servers of different vendors and reduce friction to use Auth0 when onboarding from other solutions. [Read more about it in the docs.](https://auth0.com/docs/secure/tokens/access-tokens/access-token-profiles)

Our Auth0 profile for JWT Access Tokens will remain the default option, as we need and want to maintain backward compatibility. However, customers can now opt-in to use the new profile for Access Tokens on a per-API basis. This standard was authored by [Vittorio Bertocci](https://auth0.com/blog/in-celebration-of-vittorio-bertocci/). 

## Summary 

This blog post was already a summary of everything announced during Developer Day 2024, so go back and check the section names! 😜

If you missed Developer Day and watch to [catch the recording, you can do so by clicking here.](https://developerday.com/) 


DevDay 2024 Recap: What's New In Auth0?

Ruchita Shah

Ruchita is a Product Marketer for Okta’s Customer Identity products. With an engineering and product marketing background, she is focused on showcasing how organizations can create secure and seamless digital experiences for their end users using Okta’s identity products. She spends her spare time hiking, reading and watching Formula1

Senior Product Marketing Manager, Customer Identity

Michelle Agroskin

Michelle Agroskin is a Product Marketing Manager for Okta. She leads the Customer Identity AI, Authorization, and Consumer portfolios, driving go-to-market strategy, messaging, launches, and strategic growth initiatives.

She lives in NYC and in her free time, loves to travel the world and try new restaurants!

Product Marketing Manager, Customer Identity Cloud

Discover a new way to unlock your developer potential and elevate your SaaS projects

<div class="alert alert-info alert-icon">
  <i class="icon-budicon-487"></i>
  <strong>Important:</strong><br> 
  We recently launched SaaStart - our newest B2B SaaS reference app built using Next.js and Auth0. If you're working on a B2B SaaS app or need to build a proof-of-concept, SaaStart offers a fast, safe, and accessible way to bootstrap advanced customer identity. <a href="https://auth0.com/blog/speed-up-your-customer-identity-journey-with-auth0-saastart/">Check out our blog to learn more</a>.<br> 
</div>

As a developer, the prospect of building a multi-tenant SaaS application can be both exciting and intimidating. The possibilities are endless, but so are the questions about where to begin, what technologies to use, and how to ensure a smooth user experience. Okta is launching the [Developer SaaS Starter Kit](https://developer.auth0.com/resources/guides/web-app/nextjs/saas-basic-authentication) to kickstart this journey. 

The Developer SaaS Starter Kit is an all-inclusive package designed to make the process of building a multi-tenant SaaS application an enjoyable and hassle-free experience. With this kit, developers can take their first steps with confidence.

What you get from the starter kit: 

1. Getting started made easy: The kit is curated to cater to developers of all levels, from beginners to seasoned experts. The Starter Kit is crafted to provide an introduction and guide you through each step effortlessly.
2. Powered by [Auth0 Next.js SDK](https://github.com/auth0/nextjs-auth0#documentation) and [Auth0 Management API SDK](https://auth0.com/docs/libraries#mgmt): The Starter Kit is built upon the foundation of Next.js, a powerful framework for server-rendered React applications. Its simplicity makes it ideal for building high-performance web applications. Alongside Next.js, the Auth0 management API SDK streamlines the development process and provides essential tools to complete administrative tasks that can be done through the Auth0 Dashboard programmatically. 
3. Seamless Implementation in 15 minutes: Developers can get through the setup process in no more than 15 minutes. This allows them to focus on innovation rather than getting stuck in debugging.

Auth0 powered by Okta supports this starter kit with purpose-built features and capabilities that ensure faster time to market while balancing unique branding, security, and availability requirements. It provides:

* First-class representation of your business customers
* Supports your multi-tenant product out-of-the-box, conveniently serving from a single Customer Identity Cloud tenant
* Provides flexible and fully customizable signup and invitation flows to your business customers that mix and match your brand with theirs
* Connects with external Identity Providers using industry standards like SAML and OIDC.

By providing simplified, user-friendly, step-by-step guidance, the starter kit, alongside Auth0, paves the way for successful application development. Developing a SaaS application requires a lot of knowledge and willingness to dive deep into underlying technologies and architectures. The Starter Kit develops this curiosity and encourages developers to explore further. So go ahead, take those first confident steps with the Developer SaaS Starter Kit, and watch your journey unfold with confidence and clarity.

Stay tuned for more!

<include 
    src="LinkCard" 
    title="A B2B SaaS Application Primer Using Auth0" 
    link="https://auth0.com/blog/b2b-saas-application-primer-using-auth0/" 
    description="Are you building a B2B SaaS application using Auth0? Then check out our primer on delivering IAM functionality using the Auth0 Organizations feature."
img="https://images.ctfassets.net/23aumh6u8s0i/44Jbuzdh6CvHDaCJ6LJNLh/2a8d0114b1bd7b03a92a386cced73e6b/square-hero.jpg"
/>

Empower Developers with the Developer SaaS Starter Kit

Shreya Gupta

Shreya is the Developer Advocate for Auth0 for Startups. She previously founded a non-profit called Bit Project, worked at a YC-backed Startup as a Developer Advocate, and currently hosts The Developer Diaries podcast. Through each experience, she has found her love for building resources and tools that help move the needle for developers. Outside of work, she enjoys traveling, watching K-Dramas, and drinking boba.

Developer Advocate, Startups

emma-gray

Sr. Manager, Product-Led Growth Marketing

Emma Gray

Get started fast with two best-in-class developer platforms: Auth0 and Vercel

**TL;DR:** [New Auth0 Integration](https://vercel.com/integrations/auth0) for Vercel: Available Now. We’ll share why we partnered with Vercel, help guide you through deploying an application, and explain how you can take full advantage of this integration.

<AmpContent>
<amp-youtube
    data-videoid="YqGClksfZKE"
    layout="responsive"
    width="480" height="270">
</amp-youtube>
</AmpContent>
<NonAmpContent>
<div class='embed-container' style="position: relative; padding-bottom: 56.25%; height: 0; overflow: hidden; max-width: 100%;margin-bottom:40px;"><iframe style="position: absolute; top: 0; left: 0; width: 100%; height: 100%;" src='https://www.youtube.com/embed/YqGClksfZKE' frameborder='0' allowfullscreen></iframe></div>
</NonAmpContent>

## Why Should I Choose Auth0?

Auth0 provides an extensible and scalable authentication experience, allowing you to focus on your core product. We’ll ensure your users have the best possible experience and help you maintain a strategic advantage for years to come.

We offer comprehensive out-of-the-box functionalities with cutting-edge technologies and architecture. Our rich features include customizable actions, connections to over 60+ social and Identity providers, broad support for open standards (OIDC, SAML, FIDO, OAuth, and more), multi-cloud encryption architecture, extensive compliance and regulatory requirements, and easily customizable sign-up and login interfaces and flows, to name a few. 
    
## What Is Vercel and Why Did We Choose to Partner with Them?

[Vercel](http://vercel.com/) is a cloud platform designed to simplify the deployment process for web applications, making it easy to deploy and manage your frontend. In the world of web development, efficiency and speed are crucial, as are the safety and security of production environments. Integrating with a third-party platform like Auth0 allows Vercel users hosting their new or existing projects to seamlessly extend Vercel’s capabilities.

Prioritizing who we partner with comes down to selecting organizations who align with our mission and values, including key pillars of cutting-edge developer experiences and a foundation of security. With this in mind, investing in a partnership with Vercel was an obvious choice for our team. This integration allows you to build scalable, secure, and compliant applications with an enhanced user experience by leveraging the strengths of these two best-in-class platforms. 

## Let’s Start Building with Auth0 and Vercel

**Challenge**: You’re looking for the most efficient way to integrate Auth0 into your Vercel-powered app.

**Solution**: Use the new integration to build and customize the Identity flow for your Vercel project. To get your app up and running quickly and securely, this integration will:

* Set up a production environment in Vercel that integrates with your Auth0 tenant in just a few clicks,
* Automatically create an [Application](https://auth0.com/docs/get-started/auth0-overview/create-applications) in your Auth0 tenant that is connected to your Vercel project, and 
* Pre-load your [Auth0 application credentials](https://auth0.com/docs/secure/application-credentials) into Vercel, allowing you to skip some of the manual steps in this credentials setup.

To get started, you will need a [project in Vercel](https://vercel.com/docs/projects/overview). You can either import your own project into Vercel or use a Vercel template so you don’t have to start from scratch. For this demo, we’re going to use a simple [B2B SaaS app template](https://vercel.com/templates/next.js/auth0-nextjs-saas-starter) (learn more [here](https://auth0.com/blog/speed-up-your-customer-identity-journey-with-auth0-saastart/)). Before starting, you'll want to make sure to deploy the template in Vercel.

### Add the integration to your project

_The following steps are based on an example flow. Refer to [docs](https://a0.to/auth0-vercel-docs) for more information._

1.  Open the [Auth0 integration](https://vercel.com/integrations/auth0) in Vercel.
2.  Select a Vercel team and the Vercel project that this integration will have access to. _Note: At this time, the integration is limited to one project per Vercel team._
3.  Click Install.

![integration](https://images.ctfassets.net/23aumh6u8s0i/14eBngE6fGo3LLYmsazyej/fef2739f60c10d8e4621820cd1c6d53e/Uploaded_from_New_Auth0_Integration_for_Vercel__Available_Now)

4. Log into Auth0 and select the Auth0 tenant you would like to use.

![integration](https://images.ctfassets.net/23aumh6u8s0i/2NeRwaR38HOAJp0CMRSULh/05375ed30bcb3404effd26bfd07a3b16/Uploaded_from_New_Auth0_Integration_for_Vercel__Available_Now)

5.  Click Accept.
6.  Select and confirm the Vercel project that you would like to integrate with Auth0. This will create an Application in your Auth0 tenant with the same name, which you can find at [Auth0 Dashboard > Applications](https://manage.auth0.com/#/applications).

![Vercel](https://images.ctfassets.net/23aumh6u8s0i/6fBKpsGXChFuoVC03SDnmH/5727eea8b7d271548da59c1f35f834a1/Uploaded_from_New_Auth0_Integration_for_Vercel__Available_Now)

It’s that simple! You can confirm by navigating to your project’s “Environment Variables” within Vercel (Select project > Settings > Environment Variables), where you will find your [Auth0 application credentials](https://auth0.com/docs/secure/application-credentials).

> If you have any technical questions, refer to [our documentation](https://a0.to/auth0-vercel-docs).

<div class="alert alert-info alert-icon">
  <i class="icon-budicon-487"></i>
  <strong>NOTE:</strong><br><br>
  As of 7/18/2024, this integration only works with production environment Vercel projects and only supports <b>Next.js apps using the latest version of the Auth0 SDK</b>.</b><br> 
</div>

### It’s time to start leveraging all of Auth0’s capabilities

Any changes we make to our Application within Auth0 will be reflected in the identity flow of our Vercel project and vice versa. For example, let’s create an [Organization](https://auth0.com/docs/manage-users/organizations) in the B2B app we deployed earlier.

![Auth0](https://images.ctfassets.net/23aumh6u8s0i/5LENP3xOgPvQeLxcSNT4Qv/0584f5239dfb2247764a60f27a35bfff/Uploaded_from_New_Auth0_Integration_for_Vercel__Available_Now)

This Organization automatically appears in our Auth0 tenant, and we can customize its settings and branding within Auth0. Let’s add a logo!

![Auth0](https://images.ctfassets.net/23aumh6u8s0i/1gdO1eHhlfdkYEK51Kzmzn/08dc06a7e809f9501939ee22252f7b24/Uploaded_from_New_Auth0_Integration_for_Vercel__Available_Now)

## Have Questions? 

**We want to hear from you! Join our AMA on Aug 8, 2024**

Deploying your app quickly and securely with Auth0 and Vercel just became easier and faster. This is the first version of this integration, and we’re always looking for ways to improve. Join us for an online Ask Me Anything event in the Auth0 Community on August 8. This is your chance to share your questions, feedback, and ideas of what you’d like to see in the future. Engage with our product experts [here](https://community.auth0.com/t/auth0-community-ask-me-anything-integrating-auth0-within-the-vercel-marketplace/136388).

Happy authenticating!


New Auth0 Integration for Vercel: Available Now

Being creative, finding solutions, and always looking to evolve. To me, that’s what encompasses a true developer. And maybe I’m living in Camelot, but honestly- what would apps be without the dev? (literally, we wouldn’t have any).

**Auth0 by Okta** understands that you, the developer, are here to, well, develop. 

And all that we can do is support you in your journey. Whether that’s at your 9-5  (more likely your 4-midnight) or on the weekends building your hobby app.

So with that, we want to share some new and updated products that can help solve your problems around all things Identity. 

## Highly Regulated Identity General Availability

**[Highly Regulated Identity General Availability](https://auth0.com/docs/secure/highly-regulated-identity)**. This Financial Grade Identity ™ solution suite delivers elevated security, privacy, and UX controls for sensitive customer operations beyond login— such as updating account information, accessing sensitive data, sending money, or making an open banking payment. Enable financial grade API protections, step-up security and consent. 

![Highly Regulated Identity General Availability](https://images.ctfassets.net/23aumh6u8s0i/7eRSbWJjEVlxClg7D8DdTM/8d675fdef576d67efbd56f6a9493e785/Uploaded_from_Coming_in_Hot__Auth0_s_Q2_Developer_Releases)
_Highly Regulated Identity Phase 1_

## Forms for Actions EA

**[Forms for Actions EA](https://auth0.com/docs/customize/forms)**. This feature provides a new visual editor for customers to build custom forms to extend login and signup flows within their tenant’s domain. This gives our customers better control over user experience and additional flexible building blocks. 

![Dashboard > Actions > Forms](https://images.ctfassets.net/23aumh6u8s0i/3DTIQSawDVsEGJhHIRJ4Gg/55df24a93d55e784fa0f01ee1e7ae14b/Uploaded_from_Coming_in_Hot__Auth0_s_Q2_Developer_Releases)

## Flexible Identifiers

**[Flexible Identifiers](https://auth0.com/docs/authenticate/database-connections/flexible-identifiers-and-attributes)**. Now, in EA... keep an eye out for GA (coming soon) This feature allows the use of multiple attributes such as email, phone number, and username as unique identifiers, either individually or in combination, to authenticate users. Including the option to configure Phone Number as a Sole Identifier.

![Flexible Identifiers](https://images.ctfassets.net/23aumh6u8s0i/SsqfcCZArhGlfn4vGMVul/39cc10bfa6e3e0cd6914d8c5ba0fea0a/Uploaded_from_Coming_in_Hot__Auth0_s_Q2_Developer_Releases)

We truly hope that these product updates and releases can help you continue to create, build, and solve problems- whether it’s a work or personal project. If you’d like to learn more about our other updates and releases (we’ve got a whole lot more to tell you about), take a look at our [Developer Release Guide](https://www.okta.com/resources/datasheet-developer-releases-auth0-by-okta-q2-2024/). And if you’d like to dive even deeper, please check out our combined [Customer Identity and Workforce Identity Release pdf](https://www.okta.com/resources/product-release-overview-q2-2024-wic-cic/). 

Outside of all these release updates, take a look at our developer resources at [**developer.auth0.com**](http://www.developer.auth0.com/).

Coming in Hot… Auth0’s Q2 Developer Releases

I stream, blog, and make youtube videos about tech stuff. I love coding, I love AI, and I love building stuff!

Juan Cruz Martinez

Learn how to seamlessly integrate Auth0 into your newsletter sign-up process, ensuring compliance with GDPR regulations. This simple guide walks you through different methods to collect user consent for newsletter signups.

Engaging your users and keeping them informed about the latest features you deploy is crucial for any successful online business. However, it's equally important to ensure your communication efforts comply with users’ right to privacy and regulations like GDPR.

Thankfully, if you're already using Auth0 for user authentication, you have a powerful tool at your disposal to streamline the process of obtaining consent for email communications.

In this article, we'll delve into how you can leverage Auth0's capabilities to seamlessly integrate GDPR-friendly newsletter sign-ups directly into your existing user registration or onboarding flows. We'll cover best practices for obtaining explicit consent using two different approaches. By the end, you'll have a streamlined system that not only grows your email list but also fosters trust and transparency with your users.

## Method 1: Customize Signup and Login Prompts

Auth0's Universal Login feature provides a convenient way to add a newsletter sign-up option directly into your existing login or registration process. You can easily customize the Universal Login sign-up form to include an input checkbox for newsletter subscriptions.

When designing this checkbox, it's crucial to use clear and concise language that leaves no room for ambiguity. The checkbox should be unchecked by default, and the wording should explicitly state that the user is agreeing to receive marketing emails from your company.

Here's an example using Auth0 signup prompts for gathering consent:

![Example of Auth0 signup prompts for gathering consent for marketing purposes](https://images.ctfassets.net/23aumh6u8s0i/4n1CUQRKeGZDfnh4WaPoH/310a9792c14981c94634e94498d98b72/checkbox-consent-example.png)

Once the user submits the form, Auth0 can store their consent status as a custom field in their user profile. This allows you to easily track who has opted in to receive your newsletter and segment your audience accordingly.

The documentation provides great detail on [how to customize signup and login prompts](https://auth0.com/docs/customize/login-pages/universal-login/customize-signup-and-login-prompts), so I won't be covering the steps here, but I'll share some of the code I used to set up the example above.

To add the new field to the signup form, I made the following call to the management api:

```shell
curl -L -X PUT 'https://{auth0-domain}/api/v2/prompts/signup/partials' \
-H 'Content-Type: application/json' \
-H 'Authorization: Bearer {access-token}' \
-d '{"signup":{"form-content-end":"<div class=\"ulp-field\"><input type=\"checkbox\" name=\"ulp-newsletter-consent\" id=\"newsletter-consent\"><label for=\"newsletter-consent\">I agree to receive information and commercial offers to my e-mail.</label></div>"}}'
```

Which will inject the following HTML after the login form.

```html
<div class="ulp-field">
    <input type="checkbox" name="ulp-newsletter-consent" id="newsletter-consent" />
    <label for="newsletter-consent">I agree to receive information and commercial offers in my e-mail.</label>
</div>
```

Then, I'm using Auth0 Actions to automatically sign up the user to my newsletter service. Here's the code for the action:

```javascript
exports.onExecutePreUserRegistration = async (event, api) => {
  const consent = event.request.body['ulp-newsletter-consent'];

  if(consent) {
    api.user.setUserMetadata("newsletter_consent", consent);
    api.user.setUserMetadata("newsletter_consent_date", Date.now());

    // Call the newsletter service API to subscribe the user
    await fetch(`https://newsletter-api.example.com/u/${event.user.email}`, {
      method: "POST"
    })
  }
};
```

You'll have to adapt the HTTP call to match your newsletter service API, or, what I prefer to do, is to add the email to a processing queue, which then triggers the newsletter subscription.

<include 
    src="LinkCard" 
    title="There's a lot more you can do with prompts" 
    link="https://auth0.com/docs/customize/login-pages/universal-login/customize-signup-and-login-prompts" 
    description="Explore the documentation to find out other use cases and examples for prompts." 
/>

### Key considerations for this approach:

- **Integrated with Sign-Up Form**: This method seamlessly blends the newsletter sign-up with the user's initial interaction.
- **Social Login & Passkeys**: Keep in mind that this approach won't work if your primary login methods are social logins (e.g., Google, Facebook) or passkeys.
- **Custom Domain and Custom Page Template Required**: To leverage this functionality, you'll need to have a custom domain set up for your Auth0 tenant.

## Method 2: Using Auth0 Forms for Dedicated Consent Collection Step

If you need a more comprehensive consent collection solution or want to gather additional information beyond a simple yes/no for the newsletter, [Auth0 Forms](https://auth0.com/docs/customize/forms) is the solution for you. This approach involves presenting users with a dedicated form during the authentication process, allowing for more detailed data collection and tailored consent options.

Auth0 Forms is a powerful visual editor that empowers you to create custom, dynamic forms that integrate seamlessly with your authentication flows. These forms can be, for example, used for:

- **Progressive profiling**: Collect user preferences, demographics, or any other data relevant to your business.
- **Enforce Policies**: Require users to accept updated terms and conditions or privacy policies before accessing your application.
- **Customize Authentication Flows**: Add steps to your login or sign-up processes, such as email or phone number verification, OTP, account linking, or consent collection.
- **Trigger Custom Actions**: Initiate backend processes or workflows based on user input.

### How Can Auth0 Forms Be Used for Consent?

Auth0 Forms provide a flexible framework for obtaining and managing user consent in various scenarios:

- **Newsletter Sign-Ups**:  Create a dedicated form with clear and concise language to request explicit consent for email communications.
- **Terms and Conditions Acceptance**:  Present updated terms or policies to users and require their acceptance before continuing.
- **Data Usage Consent**:  Seek permission for specific data processing activities, such as personalized advertising or data analytics.
- **Granular Permissions**:  Offer users fine-grained control over their data by allowing them to choose which types of communication they want to receive.

Here's an example of a form that collects information about the user and asks for marketing consent the second time the user logs into the application.

![Example of Auth0 Forms to collect user information and marketing consent](https://images.ctfassets.net/23aumh6u8s0i/74OX4QmLN20UuPpyIbglk4/acfcc586f1f472584b3aacea98974da3/auth0-forms-consent.png)

<include 
    src="LinkCard" 
    title="Auth0 Forms is a great resource to further customize your authentication flow." 
    link="https://auth0.com/docs/customize/forms" 
    description="Explore the documentation to find out how to build your own forms or use pre-defined templates for common use cases." 
/>

### Key considerations for this approach:

- **Universal Compatibility**: Auth0 Forms works seamlessly with all authentication methods, including social logins and passkeys, providing flexibility for your user base.
- **Additional Step**: Be aware that this method adds an extra step to the authentication flow, which, only for the purposes of asking consent, can potentially affect user experience. Consider balancing the need for comprehensive consent with the desire for a streamlined login process.
- **Versatile Usage**: Auth0 Forms aren't limited to just newsletter sign-ups. They can be used for a variety of scenarios, such as accepting terms and conditions, requesting permission for specific data usage, or collecting user preferences. This versatility makes Auth0 Forms a valuable tool for managing ongoing compliance and user engagement.

## Best Practices for Obtaining Explicit Consent

To ensure your newsletter sign-up process is fully GDPR-compliant, there are several best practices you should follow. First and foremost, use clear and concise language on your sign-up forms. Avoid legalese or confusing terminology, and be upfront about what the user is signing up for.

Additionally, consider offering granular consent options. Instead of just one checkbox for all types of communication, you could provide separate checkboxes for newsletters, product updates, or other types of emails. This gives users more control over the emails they receive and can improve engagement rates.

Another effective strategy is implementing a double opt-in process. This means that after a user submits their email address, they receive a confirmation email with a link they must click to verify their subscription. This extra step helps ensure that the email address is valid and that the user genuinely wants to receive your newsletter.

Finally, it makes it easy for users to manage their communication preferences. Provide a clear link in your emails where users can update their subscriptions or unsubscribe altogether. This demonstrates respect for their privacy and can help prevent spam complaints.

## Conclusion

By following the steps outlined in this article, you can seamlessly integrate GDPR-friendly newsletter sign-ups into your Auth0-powered website or application. This not only ensures compliance with data protection regulations but also builds trust with your users, leading to higher engagement and a more successful email marketing program.

Thanks for reading!

Using Auth0 to Collect Consent for Newsletter Signups

A new release of the package Auth0 Templates for .NET is out with new project templates and other improvements.

A new awesome version of the [Auth0 Templates for .NET package](https://www.nuget.org/packages/Auth0.Templates/) has been released! It brings you new templates and other improvements, which we will discover in a moment. Install now the latest release of the templates by running the following command in a terminal window:

```bash
dotnet new install Auth0.Templates
```

> ⚠️ Make sure you have uninstalled any previous version of the package from your machine before installing the new one.

Ready to learn what's new in the latest release? Let's go!

## New Project Templates

The first big news is that two new templates are now available: the Blazor Web App and the MAUI templates.

### The Blazor Web App template

The Blazor Web App template allows you to create a web application using the .NET 8 Blazor application model. As you may know, this new type of Blazor application has some complexities in properly supporting authentication. Take a look at [this article](https://auth0.com/blog/auth0-authentication-blazor-web-apps/) to learn more about it. Now you can have a starting point for your new Blazor application with Auth0 embedded in a snap by simply running the following command:

```bash
dotnet new auth0blazor -o MyNewBlazorApp
```

As usual, if you also have the [Auth0 CLI](https://github.com/auth0/auth0-cli) installed on your machine and logged in, you can automatically register your app with Auth0. Of course, you can still use the templates with Visual Studio:

![Auth0 Blazor Web App template in Visual Studio](https://images.ctfassets.net/23aumh6u8s0i/1fmXTCgaPVzvKGGiW0QPon/edd5f2a979472be788c9c6d448dc1ed0/auth0-blazor-web-app-vs.png)

Read [more about the Blazor Web App template here](https://github.com/auth0/auth0-dotnet-templates/blob/main/docs/auth0blazor.md).

### The MAUI template

With the MAUI template, you can build desktop and mobile applications with Auth0 authentication for Windows, macOS, iOS, and Android using a single code base. In this case, the command to use is as follows:

```bash
dotnet new auth0maui -o MyNewMauiApp
```

Building your new MAUI app using this template will save you a lot of time, as you can see from reading [this article](https://auth0.com/blog/add-authentication-to-dotnet-maui-apps-with-auth0/).

Check out [this document to learn more about the MAUI template](https://github.com/auth0/auth0-dotnet-templates/blob/main/docs/auth0maui.md).

## Other Improvements

In addition to the new templates, the new package brings you other internal and external improvements. To mention just a few of them:

- The Blazor WebAssembly template now supports .NET 8.
- The program that registers your application with Auth0 is no longer tied to .NET 7.0.
- A few issues with the auto-registration script have been fixed.

These improvements help provide a better experience when scaffolding and registering your application with Auth0.

<include src="ebook-ads/dotnetIdentity" />

## JetBrains Rider Support

Now you can use the Auth0 Templates with JetBrains Rider! Starting with [version 2024.1](https://www.jetbrains.com/rider/whatsnew/), Rider fully supports custom templates, so now you can choose your preferred IDE to build your .NET applications with Auth0 integrated, regardless of your operating system. This is especially important now that [Visual Studio for Mac is close to its retirement](https://learn.microsoft.com/en-us/visualstudio/mac/what-happened-to-vs-for-mac?view=vsmac-2022).

Previously, Rider [didn't support parameters for custom templates](https://youtrack.jetbrains.com/issue/RIDER-16759), which was a clear barrier to using the Auth0 Templates. Now you can use them just like in Visual Studio!

![Auth0 Blazor Web App Template in JetBrains Rider](https://images.ctfassets.net/23aumh6u8s0i/2wWfc13e4He4h6Ob3H7Eyu/d4fcd35aab3ae5a1ed41f6ec25fc486b/auth0-blazor-web-app-rider.png)

## A Look Back and a Glimpse Forward

The first version of the package was released one year ago. Since then, the project has grown with new templates and integration with the Auth0 CLI for automatic registration of your applications. During this year, the package has been downloaded over 8,000 times, and we have received suggestions and contributions.

We want to continue improving the current templates by adding features and improving the developer experience. Your feedback is very important. Share your thoughts by leaving a message below, or by opening a [new issue](https://github.com/auth0/auth0-dotnet-templates/issues/new/choose) to report problems and request new features.
If you like the project, don't forget [to star it on GitHub](https://github.com/auth0/auth0-dotnet-templates).

New Templates for Building .NET Apps with Auth0 Authentication

Let’s take an overview of the new Session Management API, which allows you to manage your user sessions.

User session management allows developers to implement features ranging from controlling session concurrency to monitoring and terminating sessions. In this article, we will discuss the Session Management API, which allows you to manage user sessions in applications that integrate with Auth0.

## The Need for Managing User Sessions

When a user logs in to your application using Auth0, at least two sessions are initiated:

- The *Local Session* (*Application Session*). This session exists on your application's side. It typically uses cookies or similar mechanisms to store information like the user's login status, preferences, or any other data relevant to your application's functionality. Its primary role is to indicate to your application whether the user is currently logged in and authorized to access specific resources or features.
- The *Authorization Server Session* (*Auth0 Session*). This session is managed by Auth0's servers. It's typically stored in a cookie within the *auth0.com* domain or a custom domain associated with your Auth0 tenant. It's primarily used by Auth0 to facilitate features like Single Sign-On (SSO) and to determine if a user needs to re-authenticate when accessing other applications within the same Auth0 tenant.

> In case the user authenticates using a third-party Identity provider, such as Google, Facebook, GitHub, or others, you have a third session, the *3d party IdP session*, which tracks the interactions between the user and that Identity provider. See [this document](https://auth0.com/docs/manage-users/sessions/session-layers) for more info.

Your application's sessions are entirely in your hands, although Auth0 SDKs can help you with session creation. Auth0's session management is under Auth0's control. However, thanks to the new [Session Management API](https://auth0.com/docs/manage-users/sessions/manage-user-sessions-with-auth0-management-api), you can now manage Auth0 sessions from your application as well. The ability to manage authenticated user sessions in Auth0 can meet a few needs, such as:

- You can allow users to list their active sessions and close them by remotely logging out.
- You can allow an administrator to list all the user sessions and possibly force any of them to log out for security reasons.
- You can limit the number of concurrent user sessions.

Let's explore how you can use this new API.

## Set Up Access to the Session Management API

To use the Session Management API, you need the [Enterprise plan](https://auth0.com/pricing). If you don't have this plan but want to test the API, you can create a new tenant and get a free trial period.

You can use the Session Management API as you do with all the [Management API](https://auth0.com/docs/api/management/v2): basically, you need to enable your client application, [get an access token](https://auth0.com/docs/secure/tokens/access-tokens/management-api-access-tokens), and call the API endpoints.

### Enable your client

As a first step, you need to enable your client application to use the required scopes to use the Session Management API. In particular:

- The scope `read:sessions` enables your client to list sessions and get details about them.
- The scope `delete:sessions` allows your client to close a session, i.e., logging a user out.

To enable a client to these scopes, go to your [Auth0 dashboard](https://manage.auth0.com/) and select the application you want to enable. Make sure this is a [Machine to Machine application](https://auth0.com/docs/get-started/auth0-overview/create-applications/machine-to-machine-apps). Select the APIs tab on the application page and then toggle the *Authorized* switch button corresponding to the Auth0 Management API, as shown in the following picture:

![Auth0 Management API authorization](https://images.ctfassets.net/23aumh6u8s0i/2Lo0IwblYRUHaYSZumG0KV/5ba4a67cf84835252167fac11102c2c4/auth0-management-api-authorization.png)

Then, expand the Auth0 Management API section and filter the permissions list using the `session` keyword. You should get the `read:sessions` and `delete:sessions` items. Check them as shown in the following picture:

![Auth0 Management API session scopes](https://images.ctfassets.net/23aumh6u8s0i/6hTwgUYPtXviFLa5BlZtph/7167f08b695580ac2aac827a9e0a809f/auth0-management-api-session-scopes.png)

Don't forget to click the *Update* button to save your changes.

### Get an access token

Now, your application must request an access token to call the Management API. Depending on your specific scenario, you can get an access token in different ways. For example, in a test scenario you can [get it manually](https://auth0.com/docs/secure/tokens/access-tokens/management-api-access-tokens/get-management-api-access-tokens-for-testing#get-access-tokens-manually) from the Auth0 dashboard or you can use cURL, while in a production scenario, your application must request an access code programmatically.

For demonstration purposes, let's see how you can request an access token via cURL:

```bash
curl --request POST \
  --url https://YOUR_AUTH0_DOMAIN/oauth/token \
  --header 'content-type: application/json' \
  --data '{"client_id":"YOUR_CLIENT_ID","client_secret":"YOUR_CLIENT_SECRET","audience":"https://YOUR_AUTH0_DOMAIN/api/v2/","grant_type":"client_credentials"}'
```

Replace the placeholders `YOUR_AUTH0_DOMAIN`, `YOUR_CLIENT_ID`, and `YOUR_CLIENT_SECRET` with the respective values from your client configuration.

This request generates a response as the following:

```bash
{ "access_token":"eyJhbGci...",
  "scope":"read:sessions delete:sessions",
  "expires_in":86400,
  "token_type":"Bearer"
}
```

You will use the value of the `access_token` property to demonstrate that you are authorized to call the Management API.

### Call the API

Now that you have the access token, you can call the API endpoints by passing it in the `Authorization` header, as shown in the following cURL request:

```bash
curl --request GET \
  --url 'https://YOUR_AUTH0_DOMAIN/api/v2/AUTH0_API_ENDPOINT' \
  --header 'Authorization: Bearer YOUR_ACCESS_TOKEN' \
  --header 'content-type: application/json'
```

Replace the placeholders `YOUR_AUTH0_DOMAIN`, `YOUR_ACCESS_TOKEN`, and `AUTH0_API_ENDPOINT` with the respective values.

## Managing the User Sessions

Once we have enabled the client and obtained the access token, let's see how to actually use the Session Management API.

Let's start by listing the active sessions of a specific user. You can use the `/api/v2/users/{userId}/sessions` endpoint as shown in the following example:

```bash
curl --request GET \
  --url 'https://YOUR_AUTH0_DOMAIN/api/v2/users/auth0%7C8374f7459j7493u84335/sessions' \
  --header 'Accept: application/json' \
  --header 'Authorization: Bearer YOUR_ACCESS_TOKEN'
```

In this example, you send a GET request to the endpoint by specifying your Auth0 domain, the user ID, and the access token. As a response, you will get a JSON object like the following:

```bash
{
  "sessions": [{
    "id": "2Lw8dT76wJpOl924",
    "user_id": "auth0|8374f7459j7493u84335",
    "created_at": "2024-05-10T12:04:22.3452",
    "updated_at": "2024-05-10T12:04:22.3452",
    "authenticated_at": "2024-05-21T11:29:12.4251",
    "authentication": { "methods":[
      {
        "name": "pwd",
        "timestamp": "2024-05-21T11:29:12.4251"
      }
    ]},
    "idle_expires_at": "2024-05-21T12:29:12.4251",
    "expires_at": "2024-05-21T18:29:12.4251",
    "device": {
      "initial_ip": "142.250.184.206",
      "last_ip": "142.250.184.206",
      "user_agent": "Mozilla/5.0...",
      "initial_asn": "8612",
      "last_asn": "8612"
    },
    "clients":[ {"client_id": "Hwo482a51heU632d34"} ]
    }
  ]
}
```

This is an object with the `sessions` array that lists the user's active sessions. Each session is represented by an object with some properties: the session ID (`id`), the user ID (`user_id`), the time stamp of their authentication (`authenticated_at`), the authentication method (`authentication`), the device on which the session is active (`device`), the application client used by the user (`clients`), etc.

In the example above, only one session is returned for that user.

If you have a session ID, you can access the data about that session by using the `/api/v2/sessions/{id}` endpoint. You can get a session ID from the `sid` claim of the ID or [Logout token](https://auth0.com/docs/authenticate/login/logout/back-channel-logout#tokens-in-oidc-back-channel-logout-communications). The following example shows how to get the session details given its ID:

```bash
curl --request GET \
  --url 'https://YOUR_AUTH0_DOMAIN/api/v2/sessions/2Lw8dT76wJpOl924' \
  --header 'Accept: application/json' \
  --header 'Authorization: Bearer YOUR_ACCESS_TOKEN'
```

You will receive a JSON object representing that single session, as shown in the following:

```bash
{
  "id": "2Lw8dT76wJpOl924",
  "user_id": "auth0|8374f7459j7493u84335",
  "created_at": "2024-05-10T12:04:22.3452",
  "updated_at": "2024-05-10T12:04:22.3452",
  "authenticated_at": "2024-05-21T11:29:12.4251",
  "authentication": { "methods":[
    {
      "name": "pwd",
      "timestamp": "2024-05-21T11:29:12.4251"
    }
  ]},
  "idle_expires_at": "2024-05-21T12:29:12.4251",
  "expires_at": "2024-05-21T18:29:12.4251",
  "device": {
    "initial_ip": "142.250.184.206",
    "last_ip": "142.250.184.206",
    "user_agent": "Mozilla/5.0...",
    "initial_asn": "8612",
    "last_asn": "8612"
  },
  "clients":[ {"client_id": "Hwo482a51heU632d34"} ]
}
```

## Forcing Session Termination

In addition to getting information about the user sessions, you can also terminate them if your application has the `delete:sessions` scope enabled. You can call both endpoints `/api/v2/users/{userId}/sessions` and  `/api/v2/sessions/{id}` using the `DELETE` method. For example, the following cURL command terminates a specific user session:

```bash
curl --request DELETE \
  --url 'https://YOUR_AUTH0_DOMAIN/api/v2/sessions/2Lw8dT76wJpOl924' \
  --header 'Authorization: Bearer YOUR_ACCESS_TOKEN'
```

The following command deletes all the sessions of a specific user:

```bash
curl --request DELETE \
  --url 'https://YOUR_AUTH0_DOMAIN/api/v2/users/auth0%7C8374f7459j7493u84335/sessions' \
  --header 'Authorization: Bearer YOUR_ACCESS_TOKEN'
```

Session termination does not automatically log a user out of the application. As mentioned earlier, multiple sessions are involved in an application, and logout must be handled properly. Read [this article to get an idea of logout complexity](https://auth0.com/blog/the-not-so-easy-art-of-logging-out/).

In particular, session termination events are connected to the [OpenID Connect Back-Channel Logout](https://auth0.com/docs/authenticate/login/logout/back-channel-logout) mechanism. Therefore, to trigger application logout through the Session Management API, your application must be configured to use the `session-revoked` initiator. Read [this document](https://auth0.com/docs/authenticate/login/logout/back-channel-logout/oidc-back-channel-logout-initiators#configure-oidc-back-channel-logout-initiators) to learn how to configure your application to use the `session-revoked` initiator.

## Sessions and Refresh Tokens

Session termination forces the user logout. However, if an application requests a refresh token at login time, this refresh token is still available to the application even after the user session terminates.

This may be an intended or unintended situation, depending on the application's specific requirements. For example, consider an application that needs to call an API on a scheduled basis. It needs a refresh token to ensure an access token even if the user does not have an active session. On the other hand, your application can use a refresh token only to renew an access token with a limited lifetime, but you do not want the refresh token to survive the user session.

In the first case, terminating a user session will work as shown so far. You don't need to take an extra step to revoke the refresh token.

In the second case, the session termination is not enough. You also need a way to invalidate the current refresh token. For this purpose, you can use a few endpoints to help you manage refresh tokens.

> To enable your client application to manage refresh tokens, you have to add the `read:refresh_tokens` and `delete:refresh_tokens` scopes to the Management API configuration in the Auth0 dashboard.

The following command shows how to list all the refresh tokens associated with a given user:

```bash
curl --request GET \
  --url 'https://YOUR_AUTH0_DOMAIN/api/v2/users/auth0%7C8374f7459j7493u84335/refresh-tokens' \
  --header 'Accept: application/json' \
  --header 'Authorization: Bearer YOUR_ACCESS_TOKEN'
```

You get a JSON object containing the list of the refresh tokens with all the details, as in the following example:

```bash
{
  "refresh_tokens": [{
    "id": "6srfsU4dh510",
    "user_id": "auth0|8374f7459j7493u84335",
    "client_id": "Hwo482a51heU632d34",
    "created_at": "2024-05-10T12:04:22.3452",
    "updated_at": "2024-05-10T12:04:22.3452",
    "idle_expires_at": "2024-05-21T12:29:12.4251",
    "expires_at": "2024-06-21T18:29:12.4251",
    "session_id": "2Lw8dT76wJpOl924",
    "rotating": true,
    "resource_servers": [{ audience: "http://myapi.com", scopes:"read:users"}] 
  }]
}
```

To delete this specific refresh token, you can call the `/api/v2/refresh-tokens/{tokenId}` endpoint as in the following example:

```bash
curl --request DELETE \
  --url 'https://YOUR_AUTH0_DOMAIN/api/v2/refresh-tokens/6srfsU4dh510' \
  --header 'Accept: application/json' \
  --header 'Authorization: Bearer YOUR_ACCESS_TOKEN'
```

Notice how you specify the ID of the refresh token to delete.

If you want to delete all the refresh tokens associated to a user, you can use the following command:

```bash
curl --request DELETE \
  --url 'https://YOUR_AUTH0_DOMAIN/api/v2/users/auth0%7C8374f7459j7493u84335/refresh-tokens' \
  --header 'Accept: application/json' \
  --header 'Authorization: Bearer YOUR_ACCESS_TOKEN'
```

> Consider that refresh token revocation through the `DELETE` command on the endpoints shown above runs asynchronously. This means that refresh tokens are not immediately revoked when the command finishes running.

## Summary

This article has given you an overview of Auth0's Session Management API with some examples of endpoint invocation via cURL. We started with activating the client application and getting the access token, then moved on to getting a user's session list and terminating a specific session.

You then learned about the relationship between sessions and refresh tokens and how to revoke refresh tokens associated with a user.

Now that you have a basic understanding of how to use the Session Management API, you can build a better security experience for your users.


Introducing the Auth0 Session Management API

This guide shows you how to permit or deny login requests by utilizing deny or allow lists. With step-by-step instructions, you'll create a new Auth0 Action, work with lists, and delegate list management to an external API.

Auth0 provides a robust set of tools and features to enhance authentication and authorization in applications. One such feature is Auth0 Actions, which allows you to customize and extend the behavior of the Auth0 platform. This article will explore using Auth0 Actions to permit or deny login requests based on specific criteria, such as a denied and allowed list.

## Prerequisites

Before diving into the implementation, there are a few prerequisites to ensure you have in place. 

- **Auth0 account.** If you don’t have one already, you can <a href="https://a0.to/blog_signup" data-amp-replace="CLIENT_ID" data-amp-addparams="anonId=CLIENT_ID(cid-scope-cookie-fallback-name)">sign up for a free Auth0 account</a>.
- **Basic JavaScript knowledge**: Auth0 Actions are functions you can program using JavaScript. In this tutorial, I’ll provide you with the examples. However, to further customize them for your use case, it is important to have basic JavaScript knowledge.

## Create a New Action

To begin, let's create a new [Auth0 Action](https://auth0.com/docs/customize/actions/actions-overview). Actions are serverless functions that run in a secure Auth0 environment.

To create an Action, log into your [Auth0 Dashboard](https://manage.auth0.com/#/actions/flows), select Actions from the left sidebar menu, then select Flows. This page shows the different flows you can customize. For our use case, we’ll choose the “Login” flow.

![The “Actions” page of the Auth0 dashboard.](https://images.ctfassets.net/23aumh6u8s0i/6Urd7xOI45T2kfVRnSYVfg/2deba4f6affc4cf234e5874d99999ba2/select_the_login_flow.png)

This will take you to the “Login” flow page, where you can install, create, and add Actions to the flow.

![The “Login” flow page of the Auth0 dashboard.](https://images.ctfassets.net/23aumh6u8s0i/7lgp4OyGh5EigXd8W6yZ8n/6c9dd5f1b3a162d8654fd97dcb629369/login_flow_page.png)

The screen has two main sections, the diagram in the center of the page shows the login flow and the Actions panel.

On the diagram, we can see the default login flow, which contains two states.

- **Start:** The user completed the login form and is ready to log in.
- **Complete:** The system issues the user’s credentials (an ID token and, if required, an access token).

You can drag and drop Actions in between these states to add custom logic to the login flow or to even deny the login request before the tokens are issued.

On the right panel, we have the Actions panel with two tabs.

- **Installed**: Pre-installed Actions from the [Auth0 Actions Marketplace](https://marketplace.auth0.com/features/actions)
- **Custom:** Actions created for this tenant

To create an Action, click the plus icon on the Actions panel and select "Build Custom".

![Create a custom Action using the Actions panel](https://images.ctfassets.net/23aumh6u8s0i/4AlGcWH9I7XWxYaG9BGpgt/7bc82776e321c1fe97b3e91a06667439/add_action.png)

After that, a modal window will appear to enter the information for our Action: you’ll have to provide a name, and you can leave the trigger and runtime as the default values. For my Action, I’ll name it “Validate User Login”.

![Enter the Action name and click create](https://images.ctfassets.net/23aumh6u8s0i/54faDAu75f8xpX1WjMnblt/717dd9e1d20658fedcc03e8271f64143/create-auth0-action-modal.png)

After clicking on "Create", you’ll be taken to the Action’s code editor, where you can write the code for your Action, install packages, test it, and more:

![Auth0 Actions code editor page](https://images.ctfassets.net/23aumh6u8s0i/5qe9QL6Iefmin0HFmRyQ5A/376010f5d460bbc7c034ad644f0543e7/auth0-actions-code-editor.png)

An Action can make use of two JavaScript functions to alter the Login flow:

- `onExecutePostLogin`: defines what should happen immediately after the user provides login credentials that Auth0 verified. This method receives two parameters, `event` and `api`.
    - `event`: contains details about the login request, such as the user and the context.
    - `api`: contains methods to manipulate the login’s behavior.
- `onContinuePostLogin`: defines what should happen when control returns to the Login Action after a redirect to another web page. It’s used only when the user returns after being redirected, which is why it’s commented out by default.

For this tutorial, we’ll focus on the `onExecutePostLogin` method.

## Working with a Deny List

A deny list is a common way to block specific users or IP addresses from logging in. To implement a deny list using Auth0 Actions, you can leverage the context available to the Action's code through the `event` parameter. The `event` object contains information about the incoming authentication request, such as user details and IP address. By accessing this object, you can compare the values against your deny list and take appropriate action just as denying the authentication request.

Before we start writing the code for our deny list, we need to know how to cancel the user’s login request. For that, we make use of the `api` parameter as follows:

```javascript
api.access.deny('reason');
```

With a single line of code, we can deny the login request. The `deny` method expects a single parameter `reason`, which is a human-readable explanation for the rejection.

Now, let’s start updating our function to support a deny list:

```javascript
// Array containing the email addresses that are blocked from logging on.
const denyList = ['myemail@example.com']

exports.onExecutePostLogin = async (event, api) => {
  if (denyList.find(email => email === event.user.email)) {
    api.access.deny("Your email address is blocked from logging in to our systems.");
  }
};
```

In this simple function, we have a hardcoded list of email addresses that are forbidden from logging in to our system, and the `onExecutePostLogin` simply looks if the user’s email address on the login event is in the list. If so, it denies the user’s access.

Once you add the code to the Action’s editor, it’s time for testing, and the best way to do it while in development mode is with the test panel.

You can access the test panel by clicking the play button on the editor’s sidebar, as shown below:

![Access the Auth0 Actions test panel by clicking the play button on the left sidebar](https://images.ctfassets.net/23aumh6u8s0i/5aZkR41jz9C6UjtuZizGCm/26ec7df5b28c78639e4701a1624a2dad/actions-test-panel.png)

Once you expand the panel, you can customize a test event object to your needs; for example, you can look for the `user` object, which contains all user properties such as `given_name`, but more importantly for our use case, `email`.

By clicking the "Run" button at the bottom of the test panel, Auth0 will execute the Action on the given data and output the test results on the test result window. If the given user is not part of our denied list, you’ll see the following test output:

![Auth0 Action’s test result for a successful execution](https://images.ctfassets.net/23aumh6u8s0i/2pX163YMm8dq9OPvbMIXz9/37f82cec86640e560a4bb2fd3543074d/auth0-action-ok-test-result.png)

On the contrary, if you update the event JSON to include one of the denied user email addresses, you’ll receive the following test output:

![Auth0 Action’s test result for a denied request](https://images.ctfassets.net/23aumh6u8s0i/7xGybOaomBF6ghtsP6l0i8/485440622fc08629927fae8eb3b820e8/auth0-action-denied-test-result.png)

Finally, once you complete your testing, you can deploy the function so it is available to add to the login flow.

## Working with an Allow List

On the other hand, an allow list specifies the users or IP addresses that are explicitly permitted to log in. Like working with a deny list, you can access the necessary information using the `event` object. Compare the values against your allow list and proceed with the login flow only if the user or IP address is found on the list. Otherwise, you can deny access by rejecting the authentication request.

Similarly to the deny list, the allow list will use the `deny` method to reject all requests except those from users in the allow list.

Here is the new code:

```javascript
// Array containing the email addresses that are allowed to log in.
const allowList = ['myemail@example.com', 'j+smith@example.com']

exports.onExecutePostLogin = async (event, api) => {
  if (!allowList.find(email => email === event.user.email)) {
    api.access.deny("Your email address is not authorized to log into our systems.");
  }
};```

Running the tests, as previously explained, should give similar results following the corresponding logic.

## Delegate List to an API

If you have many entries in your denied or allowed list, storing and managing the list in an external system, such as a database or an API, might be more practical. With Auth0 Actions, you can delegate the list retrieval and verification to an external API. Within your Action's code, make the necessary API calls to verify the user's status and subsequently reject or allow the authentication request.

For this exercise, we'll assume that you already have an API endpoint that, given a user's email address, will return if the user is authorized to access. Here is an example of what such an API could look like:

```bash
curl https://myaccessapi.com/users/is_authorized?email=myemail@example.com
{
  is_authorized: false
}
```

Given this simple example, let’s update our code:

```javascript
const axios = require('axios');

exports.onExecutePostLogin = async (event, api) => {
  const auth_result = await axios.get(`https://myaccessapi.com/users/is_authorized?email=${event.user.email}`)
  if (!auth_result.is_authorized) {
    api.access.deny("Your email address is blocked from logging in to our systems.");
  }
};
```

Note that for calling an API, we are using the `axios` library, which is already available in your Actions environment. If you need access to other dependencies, you can simply add npm dependencies as part of your Actions bundle. You can learn more about dependencies on Actions on the [official documentation](https://auth0.com/docs/customize/actions/manage-dependencies).

## Attach an Auth0 Action to the Login Flow

After coding and testing your Actions, it’s time to deploy and use them as part of the login flow. Once you are ok with your testing results, you can hit the `Deploy` button on the top right corner of the screen. This will take the existing code and settings and generate a function snapshot you can use in your login flow.

If you ever need to change the code on the function, all changes will automatically be saved as a new draft, and if you want the changes to become effective, you’ll have to deploy your latest version once again.

Once your code is deployed, it doesn’t mean it is actively used as part of your login flow. To check for that, please refer back to the [login flow screen](https://manage.auth0.com/#/actions/flows/login/), where the login diagram is shown. If you don’t see your Action as part of the diagram, it means that, even if your Action is deployed, it has not yet been activated. To activate the Action as part of the flow, click on the “Custom” tab on the Actions panel, locate your Action by name, and simply drag and drop the box over the login diagram between the "Start" and "Complete" steps. After that, you can apply changes using the “Apply” button on the top right corner of the screen.

![Apply an Auth0 Action to the Login Flow](https://images.ctfassets.net/23aumh6u8s0i/eHb4lOXaXYvG3EdaVt6xM/aed46e987226df5b8ff5d41b03fd882c/apply-action-to-flow.gif)

## Summary

This article explored how to leverage Auth0 Actions to permit or deny login requests. By using a deny list or an allow list, you can enhance the security of your application and control access based on specific criteria. We also discussed delegating the list management to an external API, providing scalability and flexibility. With Auth0 Actions, you have the power to customize the login flow and add an additional layer of security to your application.

The examples I provided throughout the article are a good starting point. However, you can further customize them to meet your needs. For instance, you could use allow/deny lists by domains instead of emails or by IP addresses, country, day and time, etc.

Always thoroughly test your implementation and consider any potential edge cases specific to your application's requirements. By using Auth0 Actions effectively, you can ensure a robust and secure authentication experience for your users.

Thanks for reading!

Permit or Deny Login Requests Using Auth0 Actions

Let’s find out how to add Auth0 authentication to the new Blazor application model introduced in .NET 8.

Add Auth0 Authentication to Blazor Web Apps

A new version of the Auth0 Templates for .NET package has been released: discover the new powerful features.

In May, we [announced the release of Auth0 Templates for .NET](https://auth0.com/blog/introducing-auth0-templates-for-dotnet/), a NuGet package that allows .NET developers to scaffold a new project with Auth0 embedded. Today, we are announcing the release of a new powerful version of the package: [Auth0 Templates for .NET 2.1](https://www.nuget.org/packages/Auth0.Templates). 🎉

Go to your terminal window and install the new package by running the following command:

```bash
dotnet new install Auth0.Templates
```

> ⚠️ If you already have a previous version of the package installed on your machine, please uninstall it using the following command before installing the new package:
>
> ```bash
> dotnet new uninstall Auth0.Templates
> ```
>
> 

Let's explore what's new and how you can now create **a working application with Auth0 authentication in less than a minute!**

## Auth0 CLI integration

The most prominent feature introduced in this new release is the integration with the [Auth0 CLI](https://github.com/auth0/auth0-cli), the command line tool that allows you to manage your Auth0 tenants and your application registration from your terminal window.

> 📖 If you are new to the Auth0 CLI, take a look at [the Auth0 CLI Basics Lab](https://developer.auth0.com/resources/labs/tools/auth0-cli-basics) to learn how to use it.

If you have the Auth0 CLI installed on your machine and are already logged in to your Auth0 tenant, you can have your new application automatically registered. Let's do an example to better explain.

### Self-Registration in .NET CLI

Suppose you want to create a Blazor Server application with Auth0 authentication embedded. You can start by running the following command in a terminal window:

```bash
dotnet new auth0blazorserver -o MyBlazorServerApp
```

This command uses the `auth0blazorserver` template to create a Blazor Server application in the `MyBlazorServerApp` folder.

After launching the command, you will see a message similar to the following:

```bash
The template "Auth0 Blazor Server App" was created successfully.

Processing post-creation actions...

Template is configured to run the following action:
Actual command: register-with-auth0.cmd 
Do you want to run this action [Y(yes)|N(no)]?
```

With this message, the template engine asks if you want to register the newly created application with Auth0.

Once you confirm, the new Blazor application will be registered on your current Auth0 tenant. You will see the registration data onscreen for documentation purposes only, as you don't need to configure it manually. In fact, your new application will be automatically configured. All you need to do is run your Blazor application with `dotnet run`!

As you can see, using the integration with the Auth0 CLI allows you to have **an application up and running in less than a minute!**

Of course, you can still pass the configuration options on the command line in case you don't have the Auth0 CLI installed or if you have already registered the application with Auth0. See the [specific options for each template](https://github.com/auth0/auth0-dotnet-templates#usage) for more details.

### Auth0 registration in Visual Studio

If you are using the templates with Visual Studio, you can't leverage the self-registering feature. This is not a limitation of the template, but a restriction imposed by Visual Studio (see [this issue](https://github.com/dotnet/templating/issues/4575) for context).

However, you can run the registration action manually. So, assuming you want to create your Blazor Server application with Visual Studio, select the Auth0 Blazor Server App template as shown in the following picture:

![Auth0 Blazor Server template in Visual Studio](https://images.ctfassets.net/23aumh6u8s0i/4vIKOhrrozhmSDMkYPsEUr/5bd66766af25db726fb3aca5c4d731ab/auth0-blazorserver-app-vs.png)

Then, accept the default values proposed by the template configuration window and create the project.

After the project is created, go to the newly created application and run the following command:

```bash
./register-with-auth0.cmd
```

This command will automatically register your Blazor Server application with Auth0 and configure your application.

> Note: On MacOS you must enable the script to execute. Run the following command before launching the automatic registration:
>
> ```bash
> chmod +x register-with-auth0.cmd
> ```

## .NET 8 Support

The new release of Auth0 Templates for .NET supports .NET 8 by default for most templates. When you use the `dotnet new` command without specifying a framework version, you will get a .NET project with .NET 8 as the target framework. This is also the default .NET version when you are using Visual Studio, as shown below:

![Auth0 Template for ASP.NET Core MVC targeting .NET 8](https://images.ctfassets.net/23aumh6u8s0i/1mnYGKi2t006MED0sC2raQ/902bd9cb7b94be9e4b0d4c6c14b9d3ea/auth0-mvc-app-vs-options.png)

Blazor templates do not currently support .NET 8, but they still target .NET 7. The reason for this choice depends on the new .NET 8 Blazor model, which provides a more fluid approach between the Server and the WebAssembly hosting models. Currently, there are no official guidelines on how to integrate OpenID Connect with the new Blazor model. If you are interested in this topic, you can follow [this thread in the Auth0 Community forum](https://community.auth0.com/t/net-8-0-blazor/119691) to stay updated.

<include src="ebook-ads/dotnetIdentity" />

## Minimal API Template

The [Auth0 Templates for .NET package](https://www.nuget.org/packages/Auth0.Templates/) contains four templates since its first release:

- ASP.NET Core MVC
- ASP.NET Core Web API
- Blazor Server
- Blazor WebAssembly (ASP.NET Core hosted)

This new release adds a new template for [ASP.NET Core minimal API](https://learn.microsoft.com/en-us/aspnet/core/fundamentals/minimal-apis). To use this template, add the `--minimal` option to the `dotnet new auth0webapi` command, as shown in the following example:

```bash
dotnet new auth0webapi -o MyWebAPI --minimal
```

This command creates a minimal API project in the `MyWebAPI` folder, and if you have the .NET CLI installed on your machine, it also registers it with Auth0.

In Visual Studio, you can simply select the *Use minimal API* checkbox as shown in the following picture:

![Options for the Auth0 ASP.NET Core Web API template in Visual Studio](https://images.ctfassets.net/23aumh6u8s0i/30Wl7yaOdnuWBhmdbRZa3v/259aa7ca9bb215da9fba8e62bfee8d87/auth0-webapi-app-vs-options.png)

## Looking Ahead

We hope that these new features will help .NET developers set up their new applications with Auth0 more easily than before. Our goal for the next release is to include a template for the missing Blazor model and add templates for other .NET application types.

Your feedback is valuable. If you experience a problem or have a request, please [open an issue](https://github.com/auth0/auth0-dotnet-templates/issues/new/choose) on the project's GitHub repository.

Remember that [Auth0 Templates for .NET](https://github.com/auth0/auth0-dotnet-templates) is an open source project, so your contribution is welcome! If you think you can help, check out [our contribution policy](https://github.com/auth0/auth0-dotnet-templates/tree/main#contributing) and get involved.



Auth0 Templates for .NET: A New Powerful Version Released

Let’s explore the new features brought by .NET 8 to support authentication and authorization in your applications.

The release of **.NET 8** is just around the corner. Among the amazing features it brings to developers, it offers a minor revolution in support for authentication and authorization: moving ASP.NET Core Identity from a page-oriented approach to an API-oriented approach.

Let's explore what's going on.

## ASP.NET Core Identity and Token-based Authentication

ASP.NET Core developers have the built-in [ASP.NET Core Identity](https://learn.microsoft.com/en-us/aspnet/core/security/authentication/identity) framework to add support for local authentication and authorization. The identity framework includes everything that developers typically need to authenticate and authorize users against a local user store. By default, a SQL Server database is created on Windows and a SQLite database is created on macOS, but you can change it to the DBMS of your choice.

The ASP.NET Core Identity framework is designed for server-rendered web applications, such as ASP.NET Core MVC or Razor Pages applications, and has challenges with SPAs, where token-based authentication seems more appropriate. To address this problem, Microsoft has provided built-in project templates for SPAs based on Angular and React with Identity Server support since .NET Core 3.1. However, the .NET community [has not been totally happy with this approach](https://github.com/dotnet/aspnetcore/issues/42158). To [meet the community's demands](https://github.com/dotnet/aspnetcore/issues/42158#issuecomment-1481742187), Microsoft removed the default support for Identity Server in .NET 8 and redesigned the internal architecture of ASP.NET Core Identity to be more suitable for SPAs and native apps. .NET 8 introduces a new set of Identity API endpoints and support for token-based authentication. But let's go in order.

## Bearer Token Authentication Handler

The first building block of this new infrastructure is the new [bearer token authentication handler](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.bearertokenextensions.addbearertoken). This handler is similar to the classic [cookie authentication handler](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.cookieextensions.addcookie) that ASP.NET Core Identity uses by default. The cookie authentication handler is responsible for two things:

- Creating a new session cookie after the user authenticates.
- Building a `ClaimsPrincipal` user object based on a valid session cookie received in the incoming HTTP request.

Similarly, the bearer token authentication handler is responsible for:

- Creating a new token after the user authenticates.
- Building a `ClaimsPrincipal` user object based on a valid token received in the incoming HTTP request.

In other words, the bearer token handler mimics the behavior of the cookie handler to manage authenticated sessions based on a token instead of a cookie.

> Note that the tokens generated by the bearer token handler are not in JWT format. Also, they don't follow any specific standard. While the documentation mentions [access tokens](https://learn.microsoft.com/en-us/dotnet/api/microsoft.aspnetcore.authentication.bearertoken.accesstokenresponse.accesstoken?view=aspnetcore-8.0) and [refresh tokens](https://learn.microsoft.com/en-us/dotnet/api/microsoft.aspnetcore.authentication.bearertoken.accesstokenresponse.refreshtoken?view=aspnetcore-8.0), they do not implement the [OAuth 2.0 authorization framework](https://oauth.net/2/).

How can this bearer token handler be used in practice?

Consider the following code:

```csharp
// Program.cs

using Microsoft.AspNetCore.Authentication.BearerToken; //👈
using System.Security.Claims;
 
var builder = WebApplication.CreateBuilder(args);
 
builder.Services
    .AddAuthentication()
    .AddBearerToken();  //👈
builder.Services.AddAuthorization();
 
var app = builder.Build();
 
app.MapGet("/login", (string username) =>
    {
        var claimsPrincipal = new ClaimsPrincipal(
          new ClaimsIdentity(
            new[] { new Claim(ClaimTypes.Name, username)},
            BearerTokenDefaults.AuthenticationScheme  //👈
          )
        );

        return Results.SignIn(claimsPrincipal);
    });
 
app.MapGet("/user", (ClaimsPrincipal user) =>
    {
        return Results.Ok($"Welcome {user.Identity.Name}!");
    })
    .RequireAuthorization();
 
app.Run();
```

This application defines two API endpoints:

- The `/login` endpoint creates a `ClaimsPrincipal` user object based on the username sent in the HTTP request and returns the result of signing in.
- The `/user` endpoint returns the username of the authenticated user.

Note the highlighted lines in the code. You have a reference to the new `Microsoft.AspNetCore.Authentication.BearerToken` namespace, which gives you access to the `BearerTokenDefaults.AuthenticationScheme` value. You also configure the bearer token middleware by using the `AddBearerToken()` extension method.

Now, assume you call the `login` endpoint with curl, as shown below:

```bash
curl 'https://<YOUR_HOST>/login?username=joe'
```

You will see a result like the following:

```json
{
  "token_type": "Bearer",
  "access_token": "CfDJ8Ha5YkqG...omitted content...",
  "expires_in": 3600,
  "refresh_token": "CfDJ8Ha5YkqG...omitted content..."
}
```

This JSON contains an access token and a refresh token that you can use to make your calls to the protected APIs exposed by your application. For example, you can now call the protected `/user` endpoint as follows:

```bash
curl -i https://<YOUR_HOST>/user \
-H 'Authorization: Bearer CfDJ8Ha5YkqG...omitted content...'
```

And you will get the following response:

```json
Welcome joe!
```

In summary, the bearer token authentication handler makes it very easy to set up token-based authentication. This is the building block of the whole ASP.NET Core Identity transition to token-based authentication.

## Identity API Endpoints

The second step in adding token-based authentication to ASP.NET Core Identity is to introduce the Identity API endpoints. Basically, this is an API version of the actions that you can perform with ASP.NET Core Identity through the classic web UI. Once you enable the [Identity API endpoints](https://github.com/dotnet/aspnetcore/blob/main/src/Identity/Core/src/IdentityApiEndpointRouteBuilderExtensions.cs), you will get endpoints like `/register`, `/login`, `/forgotPassword`, `confirmEmail`, etc.

The Identity API endpoints solve two of the most complained problems:

- You can build your own UI for user authentication and account management while maintaining the overall UI style of your application.
- After authentication, your app can get access tokens instead of cookies, so it's a more suitable approach for SPAs and native applications.

> Keep in mind that the Identity API endpoints do not implement [OpenID Connect (OIDC)](https://auth0.com/docs/authenticate/protocols/openid-connect-protocol). They simply expose the standard functionality provided by the ASP.NET Core Identity UI through a custom API. They are intended for first-party authentication.

Adding the Identity API endpoints to an ASP.NET Core application relies on two new methods:

- `AddIdentityApiEndpoints()`, which configures the token-based authentication using the bearer token handler in addition to the cookie authentication, and adds a set of identity services.
- `MapIdentityApi()`, which actually adds the Identity endpoints to your application.

The code in your `Program.cs` file will look like the following:

```csharp
// Program.cs

using System.Security.Claims;
using Microsoft.AspNetCore.Identity;
using Microsoft.AspNetCore.Identity.EntityFrameworkCore;
using Microsoft.EntityFrameworkCore;

var builder = WebApplication.CreateBuilder(args);

builder.Services.AddAuthorization();

builder.Services.AddDbContext<ApplicationDbContext>(
    options => options.UseSqlite(builder.Configuration["ConnectionString"]));

builder.Services.AddIdentityApiEndpoints<IdentityUser>()
    .AddEntityFrameworkStores<ApplicationDbContext>();

var app = builder.Build();

app.MapIdentityApi<IdentityUser>();

app.MapGet("/user", (ClaimsPrincipal user) =>
    {
        return Results.Ok($"Welcome {user.Identity.Name}!");
    })
    .RequireAuthorization();

app.Run();
```

Your client will be able to register a user by calling the `/register` endpoint, authenticate the user through the `/login` endpoint, and so on.

While the Identity API endpoints seem to solve the two main complaints about the classic ASP.NET Core Identity, there are [some concerns about using them in a production context](https://andrewlock.net/should-you-use-the-dotnet-8-identity-api-endpoints/), mainly on the security and scalability side.

## Blazor Identity UI

In addition to the changes to ASP.NET Core Identity, .NET 8 integrates the authentication framework into the Blazor project template. You can create a new .NET 8 Blazor application with identity support by running the following command:

```bash
dotnet new blazor -au Individual
```

You will get a Blazor application with everything you need to manage users and authentication locally. You will get a SQLite database to store the user accounts. You will get a SQL Server database if you use Visual Studio to scaffold the application instead of the .NET CLI. You also will get all the pages that allow users to register, authenticate, and manage their account.

The following image shows the built-in login page of a Blazor app:

![Blazor login page](https://images.ctfassets.net/23aumh6u8s0i/3J8DlVMk9qsHw9tLIAwpue/cd94d62d51ce5dc6627bda3c75d14a42/blazor-identity-ui-login.png)

The user authentication and management pages that implement the Blazor Identity UI are not Razor pages as it happens with the classic ASP.NET Core Identity, but [Razor components](https://learn.microsoft.com/en-us/aspnet/core/blazor/components). The template provides you with the source code for all of the UI components in the `Pages/Account` folder of the project. This allows you to customize them according to your application design.

<include src="ebook-ads/dotnetIdentity" />

## Custom Authorization Policies Simplification

Apart from the new features related to ASP.NET Core Identity, .NET 8 introduces a simplification to the definition of custom authorization policies. Previously, you had to write a lot of code to define a parameterized authorization policy to apply to an API endpoint.

For example, suppose you want to define a policy for an endpoint that only authorizes users over the age of 18 and that can be used as shown below:

```csharp
[ApiController]
[Route("api/[controller]")]
public class DrinkController : Controller
{
    [MinimumAgeAuthorize(18)]
    [HttpGet("beer")]
    public string BeerDispenser(ClaimsPrincipal user) => $"Here is your beer, {user.Identity?.Name}!";
}
```

With previous .NET versions, to implement your custom authorization policy, you must write the code outlined in the following code snippet:

```csharp
class MinimumAgeAuthorizeAttribute : AuthorizeAttribute
{
  ...
}

class MinimumAgePolicyProvider : IAuthorizationPolicyProvider
{
  ...
}

class MinimumAgeRequirement : IAuthorizationRequirement
{
  ...
}

class MinimumAgeAuthorizationHandler : AuthorizationHandler<MinimumAgeRequirement>
{
  ...
}
```

You must define an `AuthorizeAttribute`. Then you need to implement an `IAuthorizationPolicyProvider` to handle your custom policy and an `IAuthorizationRequirement` to define the requirement. Finally, you have to implement the `AuthorizationHandler`.

The code snippet shown above outlines the classes you need to implement. To see an example of the actual implementation, take a look at this [code sample](https://gist.github.com/captainsafia/309e408cb5e2c2e5acd44d2e19f7f88e).

Using the new `IAuthorizationRequirementData` interface, your implementation code becomes as follows:

```csharp
class MinimumAgeAuthorizeAttribute : AuthorizeAttribute, IAuthorizationRequirement, IAuthorizationRequirementData
{
  public MinimumAgeAuthorizeAttribute(int age) => Age =age;
  public int Age { get; }

  public IEnumerable<IAuthorizationRequirement> GetRequirements()
  {
    yield return this;
  }
}

class MinimumAgeAuthorizationHandler : AuthorizationHandler<MinimumAgeAuthorizeAttribute>
{
  protected override Task HandleRequirementAsync(AuthorizationHandlerContext context, MinimumAgeAuthorizeAttribute requirement) 
  {
    ...
  }
}
```

You only need to implement two classes instead of four as in the previous example. See [here](https://gist.github.com/captainsafia/7c54e92d12df695ff0908e989fb8531f) for the complete code.

## Summary

Throughout this article, you have learned about the new features that .NET 8 brings to support authentication and authorization. Most of these features are related to the extension of the ASP.NET Core Identity framework to support token-based authentication, which paves the way for authentication in SPAs and native applications.

As a side effect, you get access to the bearer token authentication handler, which allows you to issue access tokens, and to the Identity API endpoints, which allow you to embed authentication support in your Web API.

In addition, the Blazor project template now supports authentication through the Identity API endpoints and a rich set of Razor components designed for user authentication and management.

Finally, the new `IAuthorizationRequirementData` interface allows you to create custom authorization policies with less code.


.NET 8: What's New for Authentication and Authorization

michael-swanson

I live in Austin, TX with my wife, Anneke, and our two kiddos, Ilya (5) and Everett (2). I am a native Texan but lived in multiple places across the southern US as a kid. I have family in Houston TX and Midland TX that we visit on a regular basis. Prior to joining Okta, I worked with early stage startups as a hands-on Product Manager, team lead, and product designer, while also writing (mostly frontend) code. 
<br>

When I am not working you can usually find me chasing my kids around, reading sci-fi or fantasy novels, or playing needlessly complex strategy board games with friends. I am also a huge Star Wars fan and am always down to talk about the latest Star Wars movies, TV, and/or books. Additionally, Anneke and I love to travel and have been all over the world together. Much of our travel focuses on getting out of the Texas heat, tasting and learning about wine, and sampling the amazing food we find along the way!


Senior Product Manager

Michael Swanson

Tailor registration flows to maximize conversion while meeting business requirements.

Sign-up and login are two critical entity points for your business. They not only provide a means for your company to collect customer data, present and collect consent, and authenticate and verify users and their data, but they also serve as moments to establish brand image and trust. Because of that, these experiences need to be localized, branded, and consistent for your customers and would-be customers.  

For each company, this will be different. This means that companies require the flexibility to modify sign-up and login forms with additional fields and elements to address their unique use cases, business needs, evolving regulatory requirements, and customer demands for transparent, convenient, and personalized experiences.  

And with that, **we’re excited to announce that new sign-up customization capabilities are now available in early access within our Universal Login experience!** This flexibility will ensure that our customers can tailor their sign-up flows to meet their specific use cases.

## How Does It Work?

Customers can customize existing signup prompts by adding custom content and form elements to meet diverse customer preferences, business, localization, and internationalization requirements. No need to host your own pages, which introduce different URLs and separate code bases that slow time to market and create an inconsistent customer experience. 

This includes client and server-side validation, leveraging the Pre User Registration trigger, to ensure that required data, such as Terms of Service acceptance, are completed and validated before completing the signup process.

![How Does It Work](https://images.ctfassets.net/23aumh6u8s0i/1ka3a5mkTZz8NLSNjO7HPW/acb847f03bc1854ddfe55b83f40be34b/New_Sign_Up_Customizations_Now_in_Early_Access.png)

## What Use Cases Are Supported?

The initial early access release will provide support for various use cases, including: 

* Collect necessary customer data (name, phone number, email, preferences, consent, etc.) 
* Present Terms of Service/Privacy policy and opt-in before signing up
* Display marketing information and trust signals with URLs and/or images
* Add custom text, links, images, URLs, etc. 
* Localize or customize custom text in different languages (Note: EA release may not include a full scope of localization capabilities)
* Experiment with different designs, copies, and elements 

## How Can You Apply?

If you are interested in joining the early access program, please reach out to your account manager.  

_Any products, features, or functionality referenced in this material that are not currently generally available may not be delivered on time or at all. Product roadmaps do not represent a commitment, obligation, or promise to deliver any product, feature, or functionality, and you should not rely on them to make your purchase decisions._


New Sign-Up Customizations Now in Early Access

Let's explore the main features of the new Auth0 SDK for NextJS release.

For almost a year now, the team at Next.js has been building the foundations for the future of Next.js, a future based on the React architecture, which includes Server Components, Server Actions, and much more.

With the introduction of Next.js 13.4 a few months ago, the new [App router](https://nextjs.org/blog/next-13-4#nextjs-app-router) architecture with support for React Server Components, nested routes, layouts, and new data fetching design, was promoted to stable and is the recommended option for newly built Next.js applications.

These new fundamental changes in architecture and APIs on Next.js meant that many libraries with support for Next.js had to undergo changes to fully utilize and benefit from the latest release.

<AmpContent>
<amp-youtube
    data-videoid="9ubpQ_VW158"
    layout="responsive"
    width="480" height="270">
</amp-youtube>
</AmpContent>
<NonAmpContent>
<div class='embed-container' style="position: relative; padding-bottom: 56.25%; height: 0; overflow: hidden; max-width: 100%;margin-bottom:40px;"><iframe style="position: absolute; top: 0; left: 0; width: 100%; height: 100%;" src='https://www.youtube.com/embed/9ubpQ_VW158' frameborder='0' allowfullscreen></iframe></div>
</NonAmpContent>

Auth0's first SDK for Next.js dates back to 2021. Since then, we have been committed to the Next.js community by providing a robust, scalable, and developer-friendly SDK for implementing user authentication. We are **very happy to announce the stable release of the [Auth0 Next.js SDK v3](https://github.com/auth0/nextjs-auth0/releases/tag/v3.0.0)** with support for App Router, Edge Runtime, and Responses in Middleware.  We’ve created this [quickstart guide](https://auth0.com/docs/quickstart/webapp/nextjs/01-login) that demonstrates how to integrate Auth0 with any new or existing Next.js application using the Auth0 Next.js SDK.

## What Do I Need to Do With Existing Applications Using Pages Router?

Not much. Like Next.js, the Auth0 Next.js SDK `v3` continues to support the Pages Router and the new App Router. When updating to the new SDK, there are three considerations to keep in mind:

- As is the case for Next.js `v13.4`, the new SDK requires [Node `v16` LTS or newer releases](https://nodejs.org/en/download).
- For TypeScript applications, differences in function signatures that support both the Pages and App Router may require you to use explicit declarations for the `request` and `response` objects to help TypeScript infer their type correctly. For example:
    - Before:
    
    ```typescript
    import { withApiAuthRequired } from '@auth0/nextjs-auth0'
    
    export default withApiAuthRequired(async function handler(req, res) {
      res.status(200).json({});
    });
    ```
    
    - After:
    
    ```typescript
    import { NextApiRequest, NextApiResponse } from 'next';
    import { withApiAuthRequired } from '@auth0/nextjs-auth0'
    
    export default withApiAuthRequired(async function handler(req: NextApiRequest, res: NextApiResponse) {
      res.status(200).json({});
    });
    ```
    
- The `/401` handler has been removed: As of Next.js `v13.1`, you can now return responses from middleware. As such, the unauthorized handler has been removed in favor of an unauthorized response.

If you need to migrate your application from the Auth0 Next.js SDK `v2` to the latest version, please follow our official [`v3` migration guide](https://github.com/auth0/nextjs-auth0/blob/main/V3_MIGRATION_GUIDE.md).

## Working with the New App Router

Working with the new App Router requires a shift in the architecture and project structure of your Next.js application, and as a result of this new architecture, there are a [few limitations](https://github.com/auth0/nextjs-auth0/tree/main#important-limitations-of-the-app-directory) that you need to understand before implementing authentication for your application or working with cookies and sessions in general.

These are the steps to add authentication to your Next.js application using the latest version of the Auth0 Next.js SDK:

### Install the Auth0 SDK for Next.js

First and foremost, install the Auth0  Next.js SDK using the following command:

```bash
npm install @auth0/nextjs-auth0
```

### Add the dynamic API route

As was the case for Pages Router, the Auth0 SDK automatically creates a series of API routes or endpoints to handle essential authentication features such as login, logout, and getting user information.

For the Auth0 Next.js SDK to create such routes, it is necessary to create a [catch-all, dynamic API route handler](https://nextjs.org/docs/app/building-your-application/routing/dynamic-routes) under the `/app/api` directory. Technically speaking, you don’t need to use the `api` directory anymore to specify API routes. However, our SDK follows that convention for simplicity and clarity.

Then, create a `route.js` or `route.ts` file under the `/app/api/auth/[auth0]/` directory and populate it with the following code:

```javascript
import { handleAuth } from '@auth0/nextjs-auth0';

export const GET = handleAuth();
```

### Make the Auth0 hooks accessible throughout your application

When working on the client side of your Next.js application, you can use the `useUser()` hook from the Auth0 Next.js SDK to retrieve information about the current user and session. Since this hook leverages the React Context API to manage and communicate the authentication state of the user, you’ll have to wrap your components with a `UserProvider`. 

When using the Next.js App Router, you should wrap your [root layout](https://nextjs.org/docs/app/building-your-application/routing/pages-and-layouts#layouts) with `UserProvider` as follows:

```javascript
// app/layout.js
import React from 'react';
import { UserProvider } from '@auth0/nextjs-auth0/client';

export default function App({ children }) {
  return (
    <UserProvider>
      <body>{children}</body>
    </UserProvider>
  );
}
```

### Access user and session information

You can check if a user is authenticated by verifying that the `user` object returned by the `useUser()` hook is defined. Additionally, you can log in or log out of your users from the client layer of your Next.js application by redirecting them to the corresponding automatically-generated route.

Here is an example of a client component accessing and using user information to build a basic login, logout user flow.

```javascript
// pages/index.js
'use client';
import { useUser } from '@auth0/nextjs-auth0/client';

export default function Index() {
  const { user, error, isLoading } = useUser();

  if (isLoading) return <div>Loading...</div>;
  if (error) return <div>{error.message}</div>;

  if (user) {
    return (
      <div>
        Welcome {user.name}! <a href="/api/auth/logout">Logout</a>
      </div>
    );
  }

  return <a href="/api/auth/login">Login</a>;
}
```

## What’s Next

With the release of the Auth0 Next.js SDK v3, we are excited to continue supporting the Next.js community with a comprehensive solution for user authentication and route protection.

<div class="alert alert-info alert-icon">
  <i class="icon-budicon-487"></i>
  <b>To get started, create a free account at <a href="https://auth0.com/signup?utm_source=partner&utm_medium=vercel-okta&utm_campaign=2023-03%7CINB-ORG%7CVercel-Auth0-SignupUserCreationForm-SU&ocid=7014z000000zJItAAM-aPA4z0000008OZeGAM&utm_id=aNK4z000000blT4GAI">Auth0.com</a>.</b><br> 
</div>

In this article, we only covered the basics, and if you want to learn more about how to secure your application, please check the official [GitHub repository for the SDK](https://github.com/auth0/nextjs-auth0) as well as some [examples of practical use cases](https://github.com/auth0/nextjs-auth0/blob/main/EXAMPLES.md), or check out our [Next.js code samples](https://developer.auth0.com/resources/code-samples/web-app/nextjs/basic-authentication). To get started on Next.js Authentication with Auth0 check out this [blog post](https://auth0.com/blog/ultimate-guide-nextjs-authentication-auth0/).

Auth0 by Okta is committed to providing our community and customers with a smooth yet robust developer experience to secure their applications. We continue to look for ways to improve our products and shape the future of authentication. We'd love to hear about your experience using our latest iteration of the Auth0 Next.js SDK.

Thanks for reading!

Auth0 Stable Support For Next.js App Router!

shiven_ramji

Shiv is an experienced product executive and builder obsessed with creating beautiful products. He is the President of Customer Identity at Okta, managing a $1B ARR business and overseeing the company’s product, data, security, and technology strategy and execution. Before Auth0 and Okta, Shiv was the SVP of Product at DigitalOcean, leading DigitalOcean’s products, pricing, and partnerships. Additionally, Shiv has held product leadership positions at global brands, including Amazon, NBCUniversal, LiveIntent, and The Nielsen Company. Shiv was the recipient of the 2023 Top Global CPO Award by the Products That Count community. 

Beyond his current corporate focus, Shiv is deeply committed to fostering entrepreneurship and innovation, particularly in Africa. He is an active angel investor and startup advisor and also serves on the boards of [Products That Count](https://productsthatcount.com/) and [Aiven.io](http://Aiven.io).

President, Auth0

Shiven Ramji

Over the last 6 months, Okta has delivered capabilities designed with security, scalability, and resiliency in mind. Read about what we delivered and our future roadmap.

Our teams have been heads down and focused on delivering capabilities that empower our customers to continue to provide seamless customer experiences and power their SaaS ambitions. As we are now halfway through the calendar year, I wanted to reflect on the capabilities we have delivered and give you a glimpse of what's to come next. 

## Unveiling New and Improved Product Features

We strive for innovation and resiliency in our work since we know it translates into direct value for our customers. Over the past six months, our teams have worked across domains to deliver capabilities meticulously designed with security, scalability, and resiliency in mind.

### Flexibility Focus

We continue to double down on improving our customers' ability to build great user experiences within consumer apps. The team has persistently strived to provide a flexible way to build identity flows. In the past few months, we've launched a few enhancements to support this goal further.

* [Passwordless support on New Universal Login](https://auth0.com/docs/authenticate/passwordless/passwordless-with-new-universal-login) allows users to provide an email address or phone number and receive a one-time password (OTP) to complete authentication.
* [Additional email provider support](https://auth0.com/changelog#3yVUYwYINRo7edOw8tP7kG) (Azure Communication Service & Microsoft Modern Auth) enables customers to use Outlook on Microsoft 365 or the recently released Azure Communication Services as preferred authentication methods.

### SaaS Excellence

With a keen eye for enhancing user experiences and elevating customer satisfaction, we continue to make strides that redefine and advance SaaS excellence. To that end, the teams have released several new features:

* [PKCE and attribute mapping are available on OIDC and Okta Workforce Connections](https://auth0.com/docs/authenticate/identity-providers/enterprise-identity-providers/configure-pkce-claim-mapping-for-oidc), allowing customers to build more secure connections between Auth0 and your connected identity provider. With attribute mapping, you can sync more attributes from your IDP into your Auth0 tenant.
* [Improved Login Flow for SaaS Users](https://auth0.com/docs/manage-users/organizations/login-flows-for-organizations) includes options for tying identifier first Home Realm Discovery to Connections with IdP domains associated with Organizations and a New Universal Login Prompt that displays when configured for end users with multiple organization memberships. 
* [Organization Name support for launching Login flows](https://auth0.com/docs/manage-users/organizations/configure-organizations/use-org-name-authentication-api), making Organizations easier to use by enabling the Organization Name to launch login flows via the Authentication API.

### Making Security Easy

At the core of everything we do is the desire to make security seamless and straightforward. Safeguarding data should be uncomplicated yet foolproof. Our latest releases offer protection and make it intuitive, empowering our customers and their users to navigate the digital world without compromise.

* [Security Center is now available on Converged Platform](https://auth0.com/docs/secure/security-center), a new security feature that provides real-time monitoring of potential security events.
* [Bot Detection Slider for Bot Detection](https://auth0.com/docs/secure/attack-protection/bot-detection#use-bot-detection-slider) provides the ability to adjust the level of friction of the "When Risky" setting on our Bot Detection model.
* [Bot Detection is Now Integrated with Friendly Captcha and hCaptcha](https://auth0.com/docs/secure/attack-protection/bot-detection#configure-bot-detection), supporting additional Captcha Providers and their capabilities. 
* [Teams: Security Policies - SSO Enforcement Early Access](https://auth0.com/docs/get-started/tenant-settings/auth0-teams#configure-security-policies), providing the option to mandate login to Teams and Manage Dashboard through the organization's enterprise IdP.

### Developer Experience

Our Developer Experience teams built the following enhancements with intention, care, and a complete developer experience in mind. With streamlined workflows and a suite of tools, developers quickly translate their application experience vision into reality.

* [Node 18 is now available for Actions, Rules, and Hooks](https://auth0.com/changelog#2xzzvhZDXiRbThfc7XsfO). You can start using Node 18 in your tenants' settings and/or when creating new Actions in the Auth0 Manage Dashboard.
* [Auth0 Terraform Provider V1 - BETA](https://auth0.com/changelog#515sGCwZW2u6bD06rzS1uC), with the v1 release, managing your Auth0 resources using Terraform has never been easier. 
* [Auth0 Management API](https://auth0.com/docs/api/management/v2) launched, which includes numerous new features and enhancements for the UI experience.
* [Teams: Security Policies - SSO Enforcement](https://auth0.com/docs/get-started/tenant-settings/auth0-teams#configure-security-policies), allowing you to mandate login to Teams and Manage Dashboard through the organization's enterprise IdP.

### Customer Delight

We obsess over giving customers the complete capabilities to deliver a delightful customer experience. Every interaction and every touchpoint is an opportunity to elevate the customer journey. Our latest achievements stand as a testament to our dedication to not only meeting but exceeding the expectations that define customer delight.

* [Guardian App Localization](https://auth0.com/docs/secure/multi-factor-authentication/auth0-guardian): The Guardian app is available as an authenticator to deliver push notifications to a user's pre-registered device (mobile phone or tablet) and supports English - US (en-us), French - Canada (fr-ca), French - France (fr), Portuguese - Brazil (pt-br), and Spanish - Argentina (es-ar).
* [Universal Login: New Language Support](https://auth0.com/docs/customize/internationalization-and-localization/universal-login-internationalization): Six new languages are now available as supported translations for Universal Login: Basque: eu-ES; Catalan: ca-ES; Galician: gl-ES; Norwegian: no; Norwegian Nynorsk: nn; and Welsh: cy.
* [Custom Domains in Guardian SDKs](https://auth0.com/changelog#7brExNHNLtHshVHvayBm6L), building your users' confidence that they are providing their credentials to the proper party. Custom Domains allow authentication to happen within the context of your brand.

The [Auth0 Changelog](https://auth0.com/changelog) has the full details and documentation on these updates and serves as the real-time release center. 

## Looking Forward to the Next Half

We've made good progress on delivering our roadmap and have steadily released capabilities that help our customers deliver seamless and secure experiences for their customers. 

A big thank you to all of our teams, and looking forward to penning another post full of releases in the next six months. 

[Oktane](https://www.okta.com/oktane/) is just around the corner, where we'll pull back the curtain on what's still to come! Registration is now open, and we hope to see you there.

Unveiling New and Improved Product Features — 6 Month Lookback

KonradProfilePicture

Konrad is a Community and Online Support Content Manager at Auth0 by Okta with more than 10 years of experience building, fostering and managing various technical developer communities. Outside of work he enjoys caravanning with his family, doing long distance bikepacking trips and spending time with positively crazy people.

Community and Online Support Content Manager

Konrad Sopala

Help grow the Auth0 Community and get recognized for your contributions. Learn more about our new Community Catalysts Program.

Auth0 is happy to announce an exciting new addition to the Auth0 Community: the Community Catalysts program! This private, invitation-only group provides a space for our elite members to share their expertise.

## What Is Auth0 Community?

[Auth0 Community](https://community.auth0.com/) is a place for Auth0 developers, customers, and employees to learn, unlock new skills, and connect with fellow Auth0 users. 

Here, you can ask and answer questions, share expertise, collaborate with fellow developers, submit product feedback, and learn more about implementing and using Auth0 products and solutions.

## What Is the Community Catalysts Program?

The Auth0 Community Catalysts program encourages elite contributors to lead the way by lending their expertise, knowledge, and best practices to our growing online Community. And in doing so, Community Catalysts will be recognized and rewarded for their time and effort. This is a handpicked group of community members selected by the Auth0 Community team.

## Who Qualifies as an Auth0 Community Catalyst?

Key criteria for qualifying as a Community Catalyst include:

- **Being an expert.**
  They have a good understanding of Auth0 and its products.

- **Being an advocate leader.**
  They represent the spirit of the Community, leaving a path for others to follow by sharing knowledge and best practices.

- **Being helpful.**
  They contribute to various topics in the Auth0 Community by answering/asking questions and contributing to Auth0’s product roadmap by submitting feedback or feature requests.

- **Being empathetic.**
  They exemplify a supportive style to help others succeed in maximizing the use of Auth0 products.

## What Benefits Do I Get Being a Community Catalyst?

Member benefits enable you to:

- Elevate your personal brand and reputation with a special community badge and Okta swag.

- Enhance your expertise with exclusive access to Okta Learning and certification programs, and discounts to Okta events.

- Stay connected with Auth0 experts and your peers with private chat discussions, AMAs, virtual meetups, member spotlights, and more.

- Influence Auth0 product roadmap and Community direction by participating in beta testing.



## How Do I Become an Auth0 Community Catalyst?

Here are a few steps to become a Community Catalysts:

- Start by updating your community forum profile. Share a photo of yourself (or an avatar) and information about yourself.
- Ask and answer questions in our forum to learn, share knowledge, and grow your experience with Auth0.
- Engage in the forum by providing solutions, commenting, liking posts, or upvoting feedback cards.

Auth0 Community Catalyst status is awarded for a one-year period. New and renewed Community Catalysts will be handpicked by the Auth0 Community team based on their contributions in the last 12 months.

Want to learn more about our Auth0 Community Catalysts program? Check out the[ Auth0 Community Catalysts community topic](https://community.auth0.com/t/auth0-by-okta-community-catalysts-program/112576), join the conversation, and get engaged in our questions forum. 


Introducing Auth0 Community Catalysts Program

Oliver Wang

A product manager at Auth0 focuses on  Ecosystem and Extensibility.  With an engineering background, Oliver always puts developers' experience first.  He has mixed industrial experience as a Product Manager, Software Engineer and Data Analyst. This diverse profile unites different team members to deliver value to our customers. Besides work, you can catch him up on a ski hill in the Canadian Rockies.

Product Manager, Ecosystem

Three new capabilities are all now available in Auth0 Actions.

## Do More with Actions

You can now unlock deeper identity customization with Auth0 by Okta. Starting today, you can use advanced features in Auth0 Actions, which include SAML Mapping, Root-Level User Attributes, and Access Token Scope. These new capabilities enable you to seamlessly upgrade from Rules to Actions - our flagship extensibility product.


## Allow Deep Customization with Three New Capabilities in Actions

Our new functionalities bring unique benefits to developers and their customers alike. We dive deeper into these below.

### SAML mapping and configuration

The Security Assertion Markup Language (SAML) is essential for sharing authentication and authorization data between various identity and service providers. Our latest update integrates SAML mapping and configuration into Actions, streamlining the handling of user data and facilitating integration with SAML-based identity providers.

Developers can now map user attributes and claims from SAML assertions directly to user profiles using Actions. This integration simplifies the management of user attributes, ensuring a seamless flow of data between different identity providers and their applications. As a result, you can create context-aware, personalized experiences, bolstering your identity pipeline. Learn more about SAML in our [Docs](https://auth0.com/docs/customize/actions/flows-and-triggers/login-flow/api-object).

### Access Token scope

Access tokens are crucial for token-based authentication, allowing an application to access an API. With our upgrade, developers can freely add or remove claim scopes with custom APIs, enhancing their ability to meet their overall security needs. Learn more about Access Token in our [Docs](https://auth0.com/docs/customize/actions/flows-and-triggers/login-flow/api-object).

### Root-Level user attributes

The normalized Auth0 user profile includes both root attributes and profile attributes from various identity providers. Our latest update provides a comprehensive exposure to these attributes, enabling developers to better customize their identity solutions. This means you can make more use of standard properties such as `user.roles`, `user.groups`, and `user.permissions` to understand customer profiles and protect user interests better. Learn more about User Attributes in our [Docs](https://auth0.com/docs/customize/actions/flows-and-triggers/login-flow/event-object).

## Migrating to Actions: It’s All about out-of-Box Customization

In today's shifting digital landscape, off-the-shelf identity solutions are often insufficient. Given unique organizational needs and ever-changing regulations, customization and flexibility are critical. Auth0 Actions offers an opportunity for deep customization, benefiting customers, partners, and developers alike.

We encourage you to move from Rules and Hooks to Actions for improved developer experiences and ongoing feature enhancements. By using Actions, you can directly integrate third-party solutions, bypassing the need for custom code and benefiting from improved caching performance. Embrace simplicity and flexibility in identity management— transition to Auth0 Actions today.

We are here to help. Visit our [Move to Actions](https://auth0.com/extensibility/movetoactions) page for more migration information and learn more about SAML, Access Token, and User Attributes in our [Docs](https://auth0.com/docs/).


Unlock Deeper Customization in Actions with Three New Capabilities

evan-sims

Evan is a software engineer on the DX-SDKs team at Auth0, and his pronouns are He/Him. He's passionate about helping developers build great (and secure!) software, a big fan of PHP, Laravel, Symfony, and WordPress, and an avid FOSS contributor. Before joining Auth0, he created free and open-source software supporting humanitarian aid and citizen journalism efforts. Once upon a time, he worked as a technical designer in the video games industry; he's more focused on playing them these days. He loves reading, traveling, spending time outdoors with his partner, and writing his blog autobiographies in the third person.

SDK Engineer

Evan Sims

Integrate Auth0 in your Laravel applications with no code by using the new Laravel SDK.

[Laravel](https://laravel.com/) is a tremendously popular web application framework — with good reason! Now in its 10th generation, the framework has built up a robust and mature foundation that’s not just battle-tested but genuinely delightful to build applications with. Laravel has elevated the entire PHP experience to a new level thanks to its incredibly passionate developer community. These days it’s nearly become as synonymous with PHP as Rails has with Ruby. And with PHP running on [at least 80% of web servers](https://kinsta.com/blog/is-php-dead/), that’s a big deal. For a good reason, companies like Disney, Warner Brothers, Twitch, and The New York Times have embraced Laravel.

Auth0 has offered a Laravel SDK for many years — our first release dates back to 2014! A lot has changed since then, and like all our SDKs, we’ve evolved to fit the times and the community’s needs. Every new release is an opportunity to iterate, improve, and create a better developer experience.

Early last year, [we released v7 of our Laravel SDK](https://github.com/auth0/laravel-auth0/), which was a big one. We rewrote the SDK from the ground up to take advantage of [PHP 8](https://stitcher.io/blog/new-in-php-8) and [Laravel 9](https://kinsta.com/blog/laravel-9/) and restructured everything on top of our massively upgraded core [PHP SDK v8](https://github.com/auth0/auth0-php). For the first time, developers could integrate authentication with Auth0 in their Laravel apps in less than ten lines of code, and it was great!

But we wondered — what if you could do it with zero lines of code?

Over the last few months, we’ve been striving to create that experience for our Laravel developers, and as of [v7.8 release](https://github.com/auth0/laravel-auth0/releases/tag/7.8.0), we’ve reached that milestone (and so much more).


## With Great Power...

Laravel is a robust framework created to support practically any kind of application developers might want to build. It’s one of those rare frameworks that has managed to strike a harmonious balance between powerfully customizable and highly opinionated. And when it comes to something as critical to an application as authentication, if you’re going to tackle the subject, you better be sure you’re striking that same balance successfully. It should “just work” while also being flexible enough to mold to the most niche scenarios.

Admittedly in the past, our Laravel SDK has not always hit that mark on addressing those niches, particularly in supporting monolithic apps; that is, apps that serve JSON APIs with token-based authorization as well as modern frontends with session-based authentication, in the same codebase. The community asked us to create a better solution, but there were some technical hurdles to work through first.

Traditionally, our SDK exposed authentication through a single API, which made integration super simple but meant that, on occasion, developers had to figure out how to support some exotic use cases using just a single SDK configuration. It simply didn’t always work as elegantly as one would hope.

With v7.8, we went back to the drawing board to address this. We took a deep dive into the core of Laravel’s Authentication APIs, drilling into the framework’s source code, and began laying the groundwork for a whole new approach that let us support every type of application (yes, even those tricky monolithic apps!) in exciting new ways. We even learned some new tricks along the way!


## Real Artists Ship

Efforts toward these ends [began with 7.2](https://github.com/auth0/laravel-auth0/releases/tag/7.2.0), where we started working on the foundation of our new approach. We started by building the support we needed to do this right. We began by releasing support for native Laravel sessions, persistent session storage, and support for Laravel’s native caching APIs. We built experimental [Octane](https://laravel-news.com/laravel-octane-for-scale) support for supercharged applications. We improved reliability by achieving 100% code coverage and implemented mutation testing and triple-filtered static analysis to ensure we caught as many edge cases as possible. We cut a new release each month, bringing us closer to our new goal: a no-code solution that addresses all our customers' requests.

And today, finally, with 7.8, we’ve reached our goal. There’s so much to share, but we’ll distill it down to the headline features:


### Changing of the Guard(s)

With 7.8, we released two completely new Guards that leverage every aspect of Laravel’s powerful Authentication API. These new Guards — one for session-based authentication and the other for token-based endpoint authorization — enable support for applications of all types and use cases, finally addressing the demands of those monolithic app developers.

Previously, you had to write the following code:

```php
Route::middleware(['guard:auth0', 'auth0.authenticate'])->get('/messages', function () { 
    // ...
});
```

Today you just write as follows:

```php
Route::get('/messages', function () {
    //...
} })->middleware('auth'); 
```

We created a suite of new middleware and services that support using these Guards without any integration work within the application. There are no editing files, defining middleware, or Kernel changes; it just works. Authentication is immediately available, and any routes configured to use Laravel’s native `‘auth’` middleware for limiting access to authenticated sessions instantly work with Auth0. **Zero lines of code!**

Previously, you had to define your guards and provider...

```
// config/auth.config: 
return [ 
    'guards' => [ 
        'auth0' => [ 
            'driver' => 'auth0.guard', 
            'provider' => 'auth0-provider', 
        ]
    ],
    'providers' => [ 
        'auth0-provider' => [ 
            'driver' => 'auth0.provider', 
            'repository' => \Auth0\Laravel\Auth\User\Repository::class, 
        ]
    ],
];
```
...and modify the Kernel:

```php
// app/Http/Kernel.php: 
use Illuminate\Foundation\Http\Kernel as HttpKernel; 

class Kernel extends HttpKernel 
{
protected $middlewareGroups = [ 
    'web' => [ 
        \App\Http\Middleware\EncryptCookies::class, 
        \Illuminate\Cookie\Middleware\AddQueuedCookiesToResponse::class, 
        \Illuminate\Session\Middleware\StartSession::class, 
        \Illuminate\View\Middleware\ShareErrorsFromSession::class, 
        \App\Http\Middleware\VerifyCsrfToken::Class, 
        \Illuminate\Routing\Middleware\SubstituteBindings::Class, 
        \Auth0\Laravel\Auth\Guard::class, 
    ]; 
} 
// routes/web.php: 
use Auth0\Laravel\Http\Controllers\{Callback, Login, Logoutl}; 
Route::group(['middleware' => ['web', 'guard:auth0'], static function (): void {
    Route::get('/login', Login::class)->name('login'); 
    Route::get('/logout', Logout::class)->name('logout'); 
    Route::get('/callback', Callback::class)->name('callback');
    }); 
```

Today, this is all you need to do:

```php
// Nothing! 🎉
```

And for the first time, we now support Laravel’s powerful native Authorization API, which enables developers to write permissions-based gates and policies that can use Auth0’s RBAC with APIs for fine-grained access control.

This is what you had to write previously:

```php
Route::middleware(['guard:auth0', 'auth0.authenticate'])->group(function () { 
    Route::get('/messages', function () { 
        return response("You're authorized to read messages."); 
    })->can('auth0.authorize:read:messages'); 
}); 
```
Here is what you have to write today:

```php
Route::get('/messages', function () { 
    return response("You're authorized to read messages."); 
})->middleware('auth')->can('read:messages'); 
```

### Auth0 CLI: First-Class Configuration

To support these new guards, we completely reinvented our SDK configuration API — and ended up building something profoundly flexible and capable. Our new configuration API enables us to support an infinite number of Guard instances in memory at any given time, supporting every conceivable need a developer might have for their application’s authentication needs — which is particularly important for Octane applications.

Our goal with the new configuration API was to simplify the integration experience dramatically, taking a sometimes lengthy explanation process involving application configuration instructions and `.env` file editing down to just a few error-proof steps.

What we arrived at was a whole new configuration experience powered by the Auth0 CLI. The CLI is an exciting tool that guides developers in managing their tenants through an elegant command-line interface. It was a perfect fit for simplifying one of the biggest challenges of getting started with the SDK, so we baked in native support for the CLI. Now, the JSON expressed by the CLI can be used to directly configure an application’s Auth0 SDK integration. **For the first time, you can configure your tenant and SDK in a single command.** It’s pretty awesome!


### The Quickest of Quickstarts

We’re always looking for ways to improve a developer’s first experiences with our SDKs, and that all begins with the quickstart. These starter applications demonstrate how a developer can integrate base applications with fully functional authentication as efficiently as possible — ideally resulting in a working app in 5 minutes or less.

Now that we’ve achieved no-code and integrated the Auth0 CLI, developers can do this with their Laravel application in **less than a minute**.

We re-wrote our Laravel quickstarts from the ground up to showcase this new configuration approach and demonstrate these new features, which cut the length of our quickstart in half. We also reworked the GitHub repository so developers can use it as a starting template for new Laravel applications with a single command.

Want a fully functional Laravel 9 application with Auth0 authentication out of the box? You got it!

```
composer create-project auth0-samples/laravel
```

Ready to configure it? Done!

```
./auth0 apps create \ 
--name "My Laravel Application" \ 
--type "regular" \ 
--auth-method "post" \ 
--callbacks "http://localhost:8000/callback" \ 
--logout-urls "http://localhost:8000" \ 
--reveal-secrets \ 
--no-input \ 
--json > .auth0.app.json 
```

You have a ready-to-ship app with completely functional authentication and access control.

## Integration Comparison

Let's compare how you would have integrated Auth0 previously with how you do it today.

### The old-days integration

Previously, you should have started with the installation:

```
$ composer global require laravel/installer 
$ laravel new example-app 
$ cd example-app 
$ composer install 
$ composer require auth0/laravel 
```

Then, you should have created an application in the [Auth0 dashboard](https://manage.auth0.com/)...

![Setup — Auth0 Application Creation](https://images.ctfassets.net/23aumh6u8s0i/4QoFmUwS0wdwyaHrQe5Ynr/444d87da9a8fabb23ad449dbc83de48b/09_-_Setup___Auth0_Application_Creation.png)

...and configured it:

![Setup (Continued) — Auth0 Application Configuration](https://images.ctfassets.net/23aumh6u8s0i/S2eVoxkVBulc96Ei8KrOn/1f2c5d6eedcbea27533337c60ccfd644/10_-_Setup__Continued____Auth0_Application_Configuration.png)

Back to your application, you should have configured it with the Auth0 registration data:

```
AUTH0_DOMAIN="..." 
AUTH0_CLIENT_ID="..." 
AUTH0_CLIENT_SECRET="..." 
AUTH0_COOKIE_SECRET="..." 
AUTH0_AUDIENCE="..." 
```

You should have defined your Guards and provider:

```php
// conflg/auth.config: 
return [ 
    'guards' => [ 
        'auth0' => [ 
            'driver' => 'auth0.guard', 
            'provider' => 'auth0-provider', 
        ]
    ], 
    'providers' => [ 
        'auth0-provider' => [ 
            'driver' => 'auth0.provider', 
            'repository' => \Auth0\Laravel\Auth\User\Repository::class,
        ]
    ], 
];
```

You should have defined your middleware in the Kernel:

```php
// app/Http/Kernel.php: 
use Illuminate\Foundation\Http\Kernel as HttpKernel; 

class Kernel extends HttpKernel 
{
    protected $middlewareGroups = [ 
        'web' => [ 
            \App\Http\Middleware\EncryptCookies::class, 
            \Illuminate\Cookie\Middleware\AddQueuedCookiesToResponse::class, 
            \Illuminate\Session\Middleware\StartSession::class, 
            \Illuminate\View\Middleware\ShareErrorsFromSession::class, 
            \App\Http\Middleware\VerifyCsrfToken::Class, 
            \Illuminate\Routing\Middleware\SubstituteBindings::class, 
            \Auth0\Laravel\Auth\Guard::class,
        ];
} 
```

You should have added support for authentication...

```php
// routes/web.php: 
use Auth0\Laravel\Http\Controllers\fCallback, Login, Logout}; 

Route::group(['middleware' => ['web', 'guard:auth0'], static function (): void {
    Route::get('/login', Login::class)->name('login'); 
    Route::get('/logout', Logout::class)->name('logout'); 
    Route::get('/callback', Callback::class)->name('callback');
    }); 
```

...and optionally configure the application's routing:

```php
Route:middleware('guard:auth0', 'auth0.authenticatel)->group(function () { 
    Route::getr('/messages', function () { 
        return response("You're authorized to read messages."); 
    })->can('auth0.authorize:read:messages'); 
});
```

### Today's integration

With the new SDK, you integrate Auth0 in your Laravel application in two easy steps.

First step, create a new application:

```
$ composer create-project auth0-samples/laravel
```

Second step, configure your application through the Auth0 CLI:

```
./auth0 apps create \
--name "My Laravel Application" \
--type "regular" \
--auth-method "post" \
--callbacks "http://localhost:8000/callback" \
--logout-urls"http://localhost:8000"\
--reveal-secrets \
--no-input
--json > .auth0.app.json
```

Optionally, configure its routing this way:

```php
Route::get('/messages', function () { 
    return response("You're authorized to read messages."); 
})->middleware('auth')->can('readmessages'); 

```

## Conclusion

At Auth0, we never stop innovating, and our SDKs are absolutely no exception. With v7.8, we’ve achieved a powerful no-code integration, an incredibly streamlined configuration scheme powered by the Auth0 CLI, and we now offer our quickest quickstarts ever. We’re proud of our latest Laravel release, but more importantly, we’re excited to see what developers build with it. We wouldn’t have gotten here without the valuable feedback of our developer community, and we’re excited to continue building the future of authentication in Laravel together.


Authentication with Laravel: Raising the Bar with a No Code Future

Nabeel-Saeed

Nabeel is a product marketer focused on all things security and identity. He has contributed to publications like Wirecutter, Information Age, and Professional Security. He has also been a guest speaker at the Bay Area Cybersecurity Meetup, and delivered talks on IAM across the US, Canada, Israel, and Singapore. He is passionate about helping build secure auth experiences that amaze users and delight businesses.

Product Marketing

Nabeel Saeed

New feature provides real-time monitoring of potential identity security events and threat response efficacy

Okta Customer Identity Cloud (powered by Auth0) today announced the general availability of Security Center, a new feature that helps enterprise customers optimize their identity security posture by leveraging insights from Okta Customer Identity Cloud to provide a single view of authentication events, potential security incidents, and threat response efficacy. It includes real-time data on companies’ current state of attack protection, out-of-the-box threat monitoring on major identity attack vectors, and application-level visibility into authentication traffic.

Determining whether an organization’s identity security posture is too restrictive or too lax is not trivial. Customers currently need to parse through logs 3rd party tools or build their own, which requires expert-level experience to effectively identify attacks and be ready to respond to them. Security Center provides an improved way to visualize this type of data directly from the Okta Customer Identity Cloud. 

Security Center leverages Okta Customer Identity Cloud security insights to provide CISOs, Security Operations Professionals, and Identity teams a faster way to detect and respond to identity threats. It provides a streamlined view of authentication events, potential incidents, and threat response efficacy, allowing them to optimize their security posture without having to risk their bottom line after going through the learning curve themselves.

![Attack Protection](https://images.ctfassets.net/cdy7uua7fh8z/2hyZMfdrGwVZxKtuV4ZOR3/f1795066d12eb02550da8f4eb0f00fd5/Threat_Behavior.png)

“Accurate detection alone doesn’t ensure threat response is appropriate to the level of risk, given other business objectives like customer acquisition, retention, and growth,” said Jameeka Aaron, Chief Information Security Officer, Customer Identity at Okta. “As attacks against identity flows get more sophisticated and evolve to bypass detection, security teams often have to go through a learning curve on their own production environments, which can mean delayed detection of attacks and consequent business losses. Security Center leverages our focused expertise in identity security and packages it in a way that security operations professionals can understand and take action.”

Account takeover attacks targeting everything from sensitive healthcare data to loyalty points are one of the most common and costly cyber threats. Verizon’s 2022 Data Breach Investigations Report (DBIR) found that 80% of corporate breaches involve compromised identity solutions*. Security Center takes the work out of building your own tooling to identify and be able to respond to identity threats in a timely manner. Customers can understand their identity security landscape with summary visualization of major attack types, authentication events, and threat monitoring.

Security Center also allows companies to measure user experience impacts of Attack Protection features. Consumer-facing apps must balance security with user experience by minimizing friction while maintaining appropriate protection against identity attacks. Security Center shows app owners in near-real time UX effects of defense tactics, allowing them to adjust security and friction as appropriate to their situation. Companies can fine-tune their attack protection strategy by seeing in near real-time how defense tactics like MFA, rate limiting, and CAPTCHA affect their applications.

Security Center is available for all Enterprise customers. Learn more about implementing Security Center [here](https://auth0.com/docs/secure/security-center).

### About Okta

Okta is the World’s Identity Company. As the leading independent Identity partner, we free everyone to safely use any technology—anywhere, on any device or app. The most trusted brands trust Okta to enable secure access, authentication, and automation. With flexibility and neutrality at the core of our Okta Workforce Identity and Customer Identity Clouds, business leaders and developers can focus on innovation and accelerate digital transformation thanks to customizable solutions and more than 7,000 pre-built integrations. We’re building a world where Identity belongs to you. Learn more at [okta.com](https://www.okta.com/).


Okta Customer Identity Cloud Adds Security Center to Enterprise Plan

Kevin Lillybridge

I’ve been at Auth0 since 2020. I am the Group Product Manager for our SDK and developer tooling products. I have a passion for developer experience and love working with developers like yourself and learning about all the amazing products you’re building! When I’m not doing that, I enjoy spending time with my family, biking, skiing, and experimenting with the latest cookbook.

Group Product Manager

We’re thrilled to announce the launch of Auth0 CLI v1, which includes support for improved authentication processes, the new 'api' command, and much more.

For developers unfamiliar with the Auth0 CLI, it is a powerful tool designed to streamline and enhance your Auth0 development experience. The CLI empowers you to manage your Auth0 tenants effortlessly from the command line and automate tasks such as creating users, assigning roles, updating applications, and accessing unique features tailored to streamline your Auth0 integration process.

This article will highlight some of the most significant changes, but for a comprehensive overview and guidance on how to transition your current project to the new Auth0 CLI, we recommend following the official [v1 Migration Guide](https://github.com/auth0/auth0-cli/blob/v1.0.0/MIGRATION_GUIDE.md) and [Release Notes](https://github.com/auth0/auth0-cli/releases/tag/v1.0.0) on GitHub.

## The Journey to Auth0 CLI v1

The Auth0 CLI has come a long way since its humble beginnings during a hackathon over two years ago. Initially labeled as an experimental build, Auth0 CLI has received modest updates and feature enhancements along the way. Thanks to the continuous feedback and contributions from our developer community, we have been able to refine and expand its feature set, making the CLI a valuable tool for Auth0 developers.

The decision to transition from an experimental build to an officially supported General Availability (GA) build is a testament to our commitment to the Auth0 CLI and its continued development. This significant milestone reflects our confidence in the CLI's stability, reliability, and ability to cater to a diverse range of developer needs. By moving to GA, we're signaling our full support for Auth0 CLI and ensuring that devs can trust and rely on it as a core part of their workflow.

## What's New in Auth0 CLI v1

Let's look at some of the new updates in Auth0 CLI v1! This latest version is packed with new features and improvements to streamline your Auth0 development experience and boost efficiency. In this section, we'll dive into some of the most noteworthy additions and enhancements you can expect in Auth0 CLI v1.

### Improved authentication process

With Auth0 CLI v1, we've redesigned the interactive prompts at login to offer a seamless experience for authenticating as a user or as a machine for automating your backend services. This flexibility accommodates different types of developer workflows and situations, such as automating tasks or integrating with third-party services, making it simpler and more convenient for a wide range of users to get started with Auth0 CLI. Take a look at the improved authentication flow below to see just how fast it is to start using Auth0 CLI:

![Auth0 CLI authentication process](https://images.ctfassets.net/23aumh6u8s0i/3hwMPj6ZTc45CNUQkxY24L/5d5edb2e1b1f2bb913ea097adfa2e4e7/auth0-cli-authentication.gif)

### API command for authenticated Management API requests

The new `api` command enables you to make authenticated HTTP requests to the Management API directly, ensuring feature parity with our other development tools. This powerful addition provides a convenient and efficient way to access the Management API and further bridges the gap between the Auth0 CLI and any available Management API endpoint, making your workflow even more streamlined and cohesive. The animation below shows you just how easy it is to extend any Management API endpoint with Auth0 CLI:

![Auth0 CLI Management API](https://images.ctfassets.net/23aumh6u8s0i/7zEwdFMaA0XIzVwsuDKPLq/493f7a454494280599401a9066aa57da/auth0-cli-management-api.gif)

### Streamlined and expanded feature set

Auth0 CLI v1 is packed with numerous enhancements and bug fixes, offering developers a dependable and adaptable solution. These refinements increase the CLI's reliability, reflecting our unwavering dedication to continuously improve the tool in response to feedback from our growing developer community.

Boasting more than seventy new features, enhancements, and bug fixes, Auth0 CLI equips developers with unique features designed to optimize the Auth0 development experience, such as:

- Live tailing tenant logs
- Visualizing Universal Login modifications with Storybook and hot reloading
- Generating access tokens on demand
- Downloading, bootstrapping quickstarts

For a full list of changes, please refer to our [Release Notes](https://github.com/auth0/auth0-cli/releases/tag/v1.0.0) on GitHub.

![Register a new app with Auth0 CLI](https://images.ctfassets.net/23aumh6u8s0i/5gT494hRmVVE8bp42JdOjZ/097f8f915179e33924ff502a7ab6bd84/auth0-cli-app-registration.gif)

## Getting Started with Auth0 CLI v1

To get started with Auth0 CLI v1, follow these steps:

1. Install the CLI by following the instructions specific to your operating system on [GitHub](https://github.com/auth0/auth0-cli#installation).
2. Authenticate using `auth0 login` and follow the interactive prompt.

Thats it! Once you're authenticated, explore the available commands and features with `auth0 --help` or refer to the [documentation](https://github.com/auth0/auth0-cli) for a complete guide.

Note, if you are coming from a previous version of Auth0 CLI, please refer to the [v1 migration guide](https://github.com/auth0/auth0-cli/blob/v1.0.0-beta.3/MIGRATION_GUIDE.md), as this release includes breaking changes.

## Your Feedback Matters

Your feedback plays a crucial role in the ongoing improvement of Auth0 CLI. We encourage you to report bugs, suggest features, and share your thoughts through [GitHub issues](https://github.com/auth0/auth0-cli/issues). While v1 is a significant step forward, we have more plans for Auth0 CLI and we invite you to join us in this exciting journey and contribute to its future.

## Summary

Auth0 CLI v1 marks a new chapter in the Auth0 development experience. With its enhanced feature set and stability, it can become a useful tool in your Auth0 toolkit. We invite you to try it out and share your feedback to help us make the Auth0 CLI even better. Be sure to visit the [Auth0 CLI GitHub repository](https://github.com/auth0/auth0-cli) to stay informed on the latest developments and join the growing community of Auth0 CLI users.

Auth0 CLI v1: A New Milestone for Auth0 Developers

andres

I’ve been at Auth0 since 2017. I’m currently working as a Product Manager for the Auth0 FGA and OpenFGA products. Previously, I worked in the teams that owned the Login and MFA flows. <br>
I spent my entire 20+ year career building tools for developers, wearing different hats. When I'm not doing that, I enjoy spending time with my family, singing in a choir, cooking, or trying new kinds of local cheese.

Product Manager

Andrés Aguiar

Join us at KubeCon + CloudNativeCon Europe on April 17th, 2023, for the official launch of OpenFGA v1.0

We’ve been talking to hundreds of developers who consistently tell us that they want to change how authorization is implemented in their applications. Authorization logic is embedded in the code and implemented differently in each service. It’s not flexible enough to define complex policies or finer-grained authorization. They struggle with load at scale. The existing RBAC/ABAC solutions can’t handle this complexity. That’s why we built OpenFGA.

We are thrilled to announce the release of [OpenFGA](https://openfga.dev) v1.0, a modern, flexible authorization system inspired by [Google's Zanzibar](https://zanzibar.academy). OpenFGA, designed for reliability and low latency at scale, has been embraced by the developer community since its open-sourcing in June 2022. As a Cloud Native Computing Foundation (CNCF) Sandbox Project, OpenFGA is having a significant impact in the world of authorization.

## OpenFGA v1.0: A Host of Enhancements

OpenFGA v1.0 brings a wealth of improvements since it was open sourced, raising the bar for authorization systems and providing developers with the tools they need to create secure, scalable applications. Here's a rundown of the new features:

1. Enhanced Authorization Model Language: OpenFGA v1.0 offers a [significantly improved](https://openfga.dev/docs/modeling/migrating/migrating-schema-1-1) language for defining authorization models, making them easier to read and author.
2. ListObjects API: This [new API](https://openfga.dev/docs/interacting/relationship-queries#listobjects) lets you retrieve all resources that a user can access based on the defined authorization policies, greatly simplifying auditing and access controls.
3. Elevated Observability: OpenFGA v1.0 takes [observability to new heights](https://openfga.dev/docs/getting-started/setup-openfga/docker#telemetry) with Open Telemetry tracing, Prometheus metrics, and prof profiles, providing insights into your authorization system's performance.
4. Effortless Deployment: Deploying OpenFGA to Kubernetes has never been easier, thanks to [official Helm chart](https://artifacthub.io/packages/helm/openfga/openfga) support. Get your Kubernetes cluster provisioned with just one command.
5. Postgres Storage Adapter Performance Boost: OpenFGA v1.0's Postgres storage adapter is supercharged, ensuring rapid performance and seamless scalability.
6. New Python SDK: A brand-new [Python SDK](https://pypi.org/project/openfga-sdk/) makes it even more convenient for Python developers to integrate OpenFGA into their projects.
7. Batching support in SDKs: OpenFGA v1.0's enhanced SDKs support batching queries, providing greater efficiency when making authorization requests, available for [JavaScript](https://github.com/openfga/js-sdk#batch-check) and [.NET](https://github.com/openfga/dotnet-sdk), [Go](https://github.com/openfga/go-sdk) coming pretty soon!

## Experience OpenFGA v1.0 at KubeCon + CloudNativeCon Europe, April 17, 2023

Mark your calendars and join us at KubeCon + CloudNativeCon Europe for the official launch of OpenFGA v1.0. Be among the first to discover the future of authorization systems and learn how OpenFGA can transform your cloud deployments and bolster your application security.

You’ll be able to connect with the OpenFGA team in different ways:

* Find us at Kiosk #27 in the Project Pavilion in the afternoons.
* Join the [OpenFGA project meeting](https://kccnceu2023.sched.com/event/1JWSb) on April 18, 9:30 AM CST in Room D406, Congress Center
* Participate in the Cloud Native Authorization Birds of a Feather meeting on April 21st from 11 AM - 12:30 PM CST. You can register [here](https://kccnceu2023.sched.com/event/1KW9e).

## Join us!

An open-source project is only as good as its community, so we are extending a warm welcome to everyone who wants to get involved. 

The project already has more than 30 contributors from multiple companies, and it’s being deployed in production by many of them.

The community has contributed a [MySQL Storage Adapter](https://github.com/openfga/openfga/pull/210), SDKs for [ASP.NET Core](https://github.com/Hawxy/Fga.Net), [Elixir](https://github.com/msutkowski/fga-elixir-sdk),  [Kotlin](https://github.com/Ozee-io/fga-kotlin-sdk) and integrations with [Quarkus](https://github.com/quarkiverse/quarkus-zanzibar), [Open Policy Agent](https://github.com/thomasdarimont/custom-opa-openfga), [Keycloak](https://github.com/embesozzi/keycloak-openfga-workshop), [Kratos](https://github.com/tx7do/kratos-authz) and [SCIM](https://github.com/SUSE-Skyscraper/openfga-scim-bridge).

You can help by simply trying the product, providing feedback, and engaging with other OpenFGA users in [Discord](https://discord.gg/6xzMMuU8YR) / [Github Discussions](https://github.com/orgs/openfga/discussions), attending our [monthly meetings](https://github.com/openfga/community/blob/main/community-meetings.md), or [contributing](https://github.com/openfga/.github/blob/main/CONTRIBUTING.md) to the project.

Find out more by checking out the Github repository [https://github.com/openfga/openfga](https://github.com/openfga/openfga), and learn how to use it in our [documentation](http://openfga.dev). Keep up to date with the latest news by following us on [Twitter](https://twitter.com/openfga).


Announcing OpenFGA v1.0: A New Milestone in Cloud Native Authorization Systems

johnathan-campos

Johnathan Campos is a Senior Product Marketing Manager at Okta focused on platform infrastructure and scalability. Johnathan is responsible for helping customers and partners understand the value of the Okta platform. Prior to joining Okta, Johnathan was a Senior Product Marketing Manager of the Observability Practitioner team at Splunk. During his time at Splunk, he helped practitioners understand the details of why Observability is the new necessary for native cloud deployments. When not focused on platform infrastructure and scalability, John enjoys tinkering in his garage, learning new things, spending time with family, and is an avid motorcycle fan.

Senior Product Marketing Manager, Global Platform Service

Johnathan Campos

With our new UK Region, we can enable local subscribers to achieve compliance and benefit from the quickest login response times available.

**TL DR;** The UK joins our available public cloud regions across EMEA to help with compliance requirements, data residency, and performance for our subscribers based in the UK.

We are thrilled to announce the launch of our newest region across our Customer Identity Cloud (Powered by Auth0) service in the UK. This new offering will provide a high-performance and secure way to manage customer identities while helping subscribers comply with UK data privacy regulations. As our first public cloud region on our converged platform architecture, this brings the latest cloud-native design and employs cutting-edge tools and fully automated operations to enhance business agility, developer productivity, scalability, reliability, and security for both our subscribers and platform teams. We encourage you to check out our blog series [here](https://auth0.com/blog/a-technical-primer-of-auth0-s-new-private-cloud-platform/) to learn more about our converged platform, and if you want to double-click even further on architecture, check out this blog [here](https://auth0.com/blog/the-architect-s-view-of-auth0-s-new-private-cloud-platform/) by my colleague, Leonardo Zanivan.

This public cloud region is also a major milestone in supporting UK customers with data residency needs. UK-based data centers will enable subscribers to store their data within the UK, helping ensure compliance with UK regulations for those that need it. This is particularly important for businesses that operate in heavily regulated industries, such as finance or healthcare, where data residency requirements can often be strict. To choose their preferred location, subscribers can easily select from a menu when creating their new tenant where the UK is now available. 

![UK](https://images.ctfassets.net/23aumh6u8s0i/7oWDzK3Dj7HVHwHlQ8XuoV/4f01fd4cb8bdaa926b07ab83c9009419/UK.png)

In today's constantly connected environment, where numerous users - from staff to customers - need access to mobile applications, websites, APIs, and portals from any location and device, we are proud to provide our subscribers with an IDaaS solution that delivers the essential scalability, reliability, and accessibility organizations require. Our goal has always been to simplify identity management for developers and IT professionals worldwide. 

With the new launch, users in and around the UK can experience reduced latency while logging in and solve many challenges faced with data privacy regulations. Don't hesitate to contact us for any questions or help regarding the newly launched UK Region. We are always here to help!

The UK Joins Existing EMEA Regions for Public Cloud Deployments!

Damian Schenkelman

Damian was one of Auth0's earliest employees. He loves building products for developers and taking things from 0 to 1.
<br><br>
He played key roles in implementing product features and growing the engineering organization in the early stages, and later on defining Auth0's architecture for scale and creating new products. Today he helps shape Auth0's long term strategy and leads Auth0Lab, a small and amazing team doing research and development of forward-looking products.
<br><br>
He spends his spare time with family, and friends, exercising, and catching up on all things NBA.

VP R&D (Auth0Lab)

We’re bridging the Web2 and Web3 worlds with new integrations from our partners

Over the past few months, the [Auth0 Lab](https://lab.auth0.com/) team has researched the [Web3 space](https://auth0.com/blog/identity-and-web3/) and its relation to identity, with a main focus on developer building blocks. From that research, we realized we could play a role in **bridging the Web2 and Web3 worlds.**

What do we mean by bridging? In short, making it easy for developers to create applications that take advantage of constructs from each world as necessary through the help of [Web3 partners and their integrations](https://auth0.com/developers/lab/web3). We think we are well positioned to do this, as "software identity" can serve as that bridge.** **

We took a step toward that goal with the introduction of the [Web3 category in the Marketplace](https://marketplace.auth0.com/categories/web3). This new category will help you seamlessly leverage Web3 constructs when building your applications. In this post, we’ll explore the tools we’ve made available and give you a brief overview of our analysis of Web3 and decentralized technologies at large.

## Why Web3?

Let’s start by defining what we mean by Web3. We don't mean cryptocurrencies and decentralized finance. Those are specific _applications_ of Web3.

To us, Web3 includes the philosophies, concepts, and technologies that prioritize user [choice](https://www.notboring.co/p/the-web3-debate?s=r) and [ownership](https://future.a16z.com/why-web3-matters/) and that one can use to build decentralized services. [Blockchains](https://en.wikipedia.org/wiki/Blockchain), tokens (fungible or non-fungible), protocols, services, [dApps](https://ethereum.org/en/developers/docs/dapps/), and [users' keys](https://ethereum.org/en/developers/docs/accounts/#externally-owned-accounts-and-key-pairs) are some (but not all) of the elements that make up Web3.

At its core, Web3 is about user choice. As Packy McCormick, founder of NotBoring,[ put it](https://www.notboring.co/p/the-web3-debate):

_“Some people will want centralized services, some will want fully decentralized ones, and many will choose points on the spectrum in between that work for them at different times and for different things. And we're arguing that Web3 gives them that choice.”_

From our research, we believe Web3 can help application builders provide personalized user experiences and satisfy privacy and compliance use cases. But for the space to really take off, it needs to deliver a strong user experience and protect customer data and assets. 

Countless companies rely on the Okta Customer Identity Cloud to help them meet their UX and security goals. We are excited to bring our capabilities to developers and companies looking to leverage Web3 constructs in the identity space, and the Web3 Marketplace category is our first step toward that goal.

## A New Set of Building Blocks for Identity

Web3 constructs introduce a set of new "decentralized identity" building blocks. With them, users can own their credentials and choose what data they share and what remains private.

Let's go over those building blocks in detail.

**Private keys as credentials.** Users’ private keys can act as credentials to authenticate with services, providing passwordless login user experiences. 

For example, [Sign-in with Ethereum](https://eips.ethereum.org/EIPS/eip-4361) (SIWE) provides sign-in functionality for Ethereum accounts. More generally, [Decentralized Identifiers](https://www.w3.org/TR/did-core/) (DIDs), a recently approved w3c (World Wide Web Consortium) open web standard, propose identifiers based on asymmetric cryptography and owned by users. Methods like [did:pkh](https://github.com/w3c-ccg/did-pkh) or [did:ethr](https://github.com/uport-project/ethr-did) implement DIDs using addresses/keys from decentralized networks like Bitcoin, Ethereum, Solana, etc. You can watch [this video](https://twitter.com/Auth0Lab/status/1501984414267490311?s=20&t=7ig8XYs2PR9gPBCfr8fUMg) on how we used SIWE in a sample app.

**Public, human-friendly usernames.** These can be implemented by associating friendly names, like jane.eth or gary.wallet, to blockchain addresses via smart contracts. These usernames would act both as a user-friendly way to refer to blockchain addresses and as a single username across all applications that rely on the account's private key for authentication.

**Public User Profiles.** These can be implemented using the aforementioned smart contracts to map attributes (besides usernames) to a blockchain address. Some users might publicly share an avatar/profile picture, email address, or other personal details. 

Applications can then use these profiles to provide personalized experiences to users without requiring the creation of application-specific profiles. Watch [this video](https://twitter.com/Auth0Lab/status/1501984444500033542?s=20&t=7ig8XYs2PR9gPBCfr8fUMg) on how we used public user profiles and usernames in a sample app.

**Public Attestations.** These can be implemented using either non-fungible tokens (NFTs) for "ownership attestations" or "soulbound tokens" (SBTs) for non-transferable attestations. 

[Token gating](https://medium.com/@jshanks21/nft-meaning-token-gating-ad83aef7cccd), where access to specific features is allowed only if a user owns a token on a blockchain, is an example of how these could be used. Shopify is working on [tokengated commerce](https://help.shopify.com/en/manual/products/digital-service-product/nfts#tokengated-commerce). You can watch [this video](https://twitter.com/Auth0Lab/status/1501984507481792519?s=20&t=7ig8XYs2PR9gPBCfr8fUMg) on how we used NFTs for token gating in a sample app.

**Private User Data**. This data is associated with a user's identifier (this works with and without DIDs), and **Privacy-Preserving Attestations** can be implemented using [Verifiable Credentials](https://www.w3.org/TR/vc-data-model/) (VCs) and Zero-Knowledge Proofs (ZKPs). 

**Verifiable Credentials**, cryptographically verifiable digital credentials, can be obtained and stored on a user's phone app (called "wallet", adding to the confusion around the term). 

Later, users can present them (the entire credential or some of its attributes) wherever they want. A benefit of these Verifiable Credentials is that issuers don't need to know where credentials are presented. You can watch [this video](https://twitter.com/Auth0Lab/status/1501984570136272900?s=20&t=7ig8XYs2PR9gPBCfr8fUMg) on how we used Verifiable Credentials to help prove a user's age in a sample app.

## Introducing the Web3 Category in Our Marketplace

The Marketplace allows developers to explore and install integrations for various use cases into their identity infrastructure. With a single click, you can add support for Identity Proofing, implement risk-based MFA, or send application activity to your logging infrastructure, among other things. 

Web3 is built on open standards and composable building blocks, giving developers flexibility in how they design and architect their applications. We want to provide that same composability and extensibility. That's why we’ve partnered with leading Web3 organizations that are building developer tooling to launch the Web3 category on the Marketplace.

![web3 and blockain](https://images.ctfassets.net/23aumh6u8s0i/5hBxjlnYRZDGmNqTnLrfBm/a3ea21e3252993f9dbe0a5cbf6cfa8db/01_web3_and_blockain.png)

### Use Cases

As we started working with Web3 organizations to build integrations for Okta, we discovered integrations typically fit into one of three use cases:

* **Logging in with a Web3 account/private key**: Authenticating to an application as the owner of a particular blockchain address or private key. This provides a passwordless login experience to users that allows them to own their identity without involving third parties like social login providers.
* **Creating a Web3 wallet for a user:** Allows creating and associating a wallet (custodial or non-custodial) to an Okta user that logged in with any Okta connection (social, enterprise, database, etc.). This is a model similar to that of centralized exchanges and some gaming platforms. They use it because it does not require users to have a wallet before signing up, so users don't drop out because of that requirement during the signup process.
* **Use Web3 public constructs for app logic:** Once a user's blockchain accounts are identified, developers can use it within their applications. Potential scenarios include: displaying profile information, listing a user's NFTs, and gating access to content based on NFT ownership.

_We expect that as we learn more and Web3 constructs evolve, the previous three categories/use cases might change. For example, a new use case for reading and writing private data might be available in the future once we have integrations supporting those features in our Marketplace._

### Available Integrations

#### Use case: Logging in with a Web3 account/private key

**[Sign-in with Ethereum](https://marketplace.auth0.com/integrations/siwe) (by [Spruce](https://www.spruceid.com/)):** Sign-in with Ethereum enables users to log in with their Ethereum account instead of relying on a traditional intermediary (e.g., social login). 

Spruce builds decentralized identity developer tooling. They are also developing a self-sovereign user data storage solution for Web3 users and organizations. Self-sovereign user data storage means that it relies on open standards and the user’s keys for security, allowing users to control where they store their personal data and who they share it with.

**[Sign-in with Unstoppable Domains](https://marketplace.auth0.com/integrations/unstoppable-domains) (by [Unstoppable Domains](https://unstoppabledomains.com/)):** Unstoppable Domains allows Web3 users to access apps using their portable digital identity. This integration will allow your users to sign in by proving they own a specific domain from Unstoppable Domains. 

That proof is performed by having the user sign a message with the private key that is associated with the address on which the domain is registered and verifying the message's signature. Your app will be able to access profile information associated with the user's domain, such as wallet address, email, profile picture, social profile, and more.

**[Dock Web3 ID](https://marketplace.auth0.com/integrations/dock-web-3-id) (by [Dock](https://www.dock.io/)):** Decentralized Identifiers are identifiers defined in a w3c recommendation. They allow a party (for example, a user) to prove control over them without requiring permission from any other party (for example, a company). For example, to authenticate using a specific DID, a user can sign a payload with a private key that the DID expresses should be used for authentication. 

Then, another party can verify that the signature corresponds to the specific DID. This integration allows your users to sign in by proving ownership of the authentication key of a Decentralized Identifier (DIDs).

#### Use case: Creating a Web3 wallet for a user

**[Non-custodial Web3 Wallets](https://marketplace.auth0.com/integrations/web3auth) (by [Web3Auth](https://web3auth.io/)):** The Web3Auth integration allows you to create and associate a non-custodial wallet to any Okta user, regardless of how they logged in.

#### Use case: Use Web3 public constructs for app logic

**[ENS Profile](https://marketplace.auth0.com/integrations/ens-profile) (by Auth0 Lab):** The Ethereum Name Service (ENS) integration lets you integrate ENS profile data into your application. You can leverage and display user-picked usernames, avatars, and other pieces of their public profile without requiring users to create them for your specific application.

**[NFT Retrieval](https://marketplace.auth0.com/integrations/auth-0-inc-fetch-nfts) (by Auth0 Lab):** The NFT Retrieval integration allows you to retrieve NFTs from a set of contract addresses and add them to ID Tokens as claims. With this, you can use the user's NFTs in your application's logic. 

> _Today, the NFT extensions assume you also use the [Sign-in with Ethereum](https://marketplace.auth0.com/integrations/siwe) integration to get the user's Ethereum address. In the future, we hope to work with partners to standardize claim names. Standardization should allow integrations to read/write users' blockchain accounts from/to a single claim, improving interoperability between integrations._


## What's Next

Launching the Web3 category is our first step to making it easy for developers to build applications using constructs from the Web3 world.

If you are a developer or company exploring integrations with Web3 technologies, we encourage you to [explore these integrations](https://auth0.com/developers/lab/web3) and take them for a spin. It should take minutes to enable Web3 capabilities for new or existing Web2 apps. 

If you are a Web3 organization creating products for other developers, consider building an Okta Customer Identity Cloud integration. Countless developers and businesses use Okta Customer Identity Cloud to manage identity at scale. By building an integration, you can reach hundreds of potential new customers and users. We explain how the integration development process works at [https://auth0.com/integrate](https://auth0.com/integrate).

![integration](https://images.ctfassets.net/23aumh6u8s0i/2cwAfgp4KrMdWMlMtwfjcm/a640a78e8d55498d46bdb873d135f2c5/02_integration.png)

Okta is excited about the prospect of a decentralized future and looks forward to working closely with the Web3 community. Join our [Discord](https://discord.com/invite/QGHxwDsbQQ) to share your thoughts and tell us about the integrations you want to see in the future. We look forward to working with you. 

Let’s keep building!

Introducing the Web3 Category in Marketplace

MichaelW

Michael has worked in the security space for over 10 years, developing integrations for different vulnerability scanning, SIEM, and SOAR tools. He is passionate about discovering the exponential value that can be had by combining together multiple security datasets rather than using them on their own. As the lead on partner integrations for Pangea, Michael is working on bringing together a group of best-in-market security services for developers to use via API.

Senior Manager - Partner Integrations Pangea

Michael Weinberger

Pangea offers integrations to enhance security for new account registrations and logins

Do developers who are not security experts want to spend their valuable time developing security features? But _should they_, given the considerable room for error? 

Pangea helps remove this margin for error. Pangea is a comprehensive set of API-based security services that can quickly and easily be added to any cloud application, embedded as functions directly into the application source code. Pangea emerged from the idea that key security features should not be repeatedly reinvented by companies every time they build new products. 

Instead, with Pangea, application developers can access a wide selection of out-of-the-box security services to embed security easily in all of their applications. Comparable to AWS for compute APIs, Twilio for communications APIs, and Stripe for billing APIs, Pangea has created a single platform for security — [Security Platform-as-a-Service](https://www.prnewswire.com/news-releases/pangea-cyber-closes-26m-series-b-from-gv-decibel-and-okta-ventures-for-developer-first-security-framework-to-deliver-secure-apps-faster-301689531.html) (SPaaS).

## Keeping Security Simple with Pangea Integrations

As we like to say, Pangea makes it “dead simple to integrate security with just a few lines of code”. With a clear developer focus, Pangea simplifies the varied aspects of security that are required for virtually every application. 

Without Pangea’s SPaaS for developer-first security services, the security puzzle is made up of scattered commercial and open-source pieces. Usually, these pieces are not even API-first, which makes integrations difficult. Pangea specializes in bringing these pieces together in an API-first form, with consistent documentation and guaranteed services compatibility — making it easy for developers to embed security in their applications.

## Pangea Integrations for Marketplace

Three Pangea Integrations have been released for the Auth0 Marketplace — [Pangea - Domain Check](https://marketplace.auth0.com/integrations/pangea-domain-check), [Pangea - Embargo Check](https://marketplace.auth0.com/integrations/pangea-embargo-check), and the [Pangea - Validate Registration](https://marketplace.auth0.com/integrations/pangea-validate-registration). The Pangea - Validate Registration integration uses Pangea security APIs to validate new user registrations. This includes embargo checks using Pangea’s Embargo Check and domain score checks using Pangea’s domain intel service, which contains intelligence on over 390 million domain addresses. The results are all logged to the Pangea secure audit log service.

Configuration can then be done on the Pangea console to view and manage audit logs (redaction and retention), manage embargo lists, and select providers for domain scoring — with no additional code changes. 

## How the Pangea Integration Works

To use the Pangea Marketplace integration, you will need an Auth0 account and tenant as well as a Pangea account.

Pangea setup requires some light integration configuration before adding the Auth0 Action. Note that once the Action is successfully deployed, all new user registrations for a tenant will be processed by this integration. Before activating the integration in production, install and verify the Action on a test tenant.

Once the Action is added, new user registrations will be defended by Pangea APIs. Each new user registration will be checked against Pangea Embargo and Pangea Domain Intel. The user will either be accepted or rejected, and the results will be written to Pangea Secure Audit Log.

## Shifting “Left-of-Left”: Pangea Benefits 

Implementing Pangea provides a number of benefits, including: 

* **Prioritizing security from the get-go of app development**, i.e., shifting responsibility “left-of-left”. Pangea's library of APIs security and compliance requirements are addressed from the beginning, giving developers the ability to drop security into their app runtime code prior to publishing. This can reduce developer cognitive load while covering security from the outset. 
* **Leveraging security intel from leading providers**, such as Crowdstrike, DomainTools, and ReversingLabs, among others, in Pangea APIs.
* **Securing registration decisions with cryptographically secure audit logs**. Pangea audit logs provide built-in redaction and can be used to help meet compliance and regulatory requirements under GDPR, SOC2, HIPAA, and more.

## Simplify Application Security with Pangea 

It’s never been easier for developers to add security to their applications right out of the box. Check out the [Pangea - Validate Registration](https://marketplace.auth0.com/integrations/pangea-validate-registration) integration in the Marketplace to get started.

Pangea — Security with Ease, Now on Marketplace

The Auth0 team released a new major version of the [Auth0 NextJS SDK](https://github.com/auth0/nextjs-auth0) which incorporates much of the received feedback from our v1, including support for NextJS middleware, changes in the API, first-class testing support, optimizations on the Front End package, and lots more.

This article will cover some of the most significant changes, but for a complete set, plus indications on how to migrate your current project to the new SDK, I recommend following the official [migration guide](https://github.com/auth0/nextjs-auth0/blob/v2.0.0/V2_MIGRATION_GUIDE.md).


## NextJS Middleware Support

The introduction of NextJS middleware in v12 was a big step for the framework that allows you to run code before a request is completed.

This support has been highly requested by the community, and the benefits can be summarized in two aspects: simplification and performance improvement.

### It's a lot easier to add authentication code

Prior to middleware support, each page that required authentication would need to add a snippet of code to tell NextJS only to allow access to authenticated users.

In v2, all that spread-out code can be rewritten at a single location by using middleware like the following:

```javascript
// middleware.js
import { withMiddlewareAuthRequired } from '@auth0/nextjs-auth0/middleware';

export default withMiddlewareAuthRequired();

export const config = {
  matcher: '/user/:path*',
}
```

With that simple configuration, NextJS will run the middleware `withMiddlewareAuthRequired` when the URL matches the given `matcher` expression. The matcher expressions are a feature of NextJS, they are very customizable, and you can read more information about them on [NextJS's middleware docs](https://nextjs.org/docs/advanced-features/middleware#matcher).

### Performance

Since middleware in NodeJS runs on the [NextJS Edge Runtime](https://nextjs.org/docs/api-reference/edge-runtime), validating user sessions at that level gives an immediate performance boost by simply reducing the latency for users. It is no longer required for the request to be sent to the origin server and back if the user is not authenticated.

In the image below, you can see how the NextJS Middleware Architecture plays a role in performance by being closer to the user's location.

![NextJS Middleware Architecture](https://images.ctfassets.net/23aumh6u8s0i/6jmWEwH1yBEc8Mb9lchAUk/313ee1de712bc6bd0cbe8e106154c5be/nextjs-middleware.png)

## A Delightful New Declarative Routing API

From v1, the SDK has been deeply customizable, but users often have to write full request handlers to access some of the lower-level features of the SDK. With the new declarative API for creating request handlers, this can be done simply and beautifully through the API.

Take a look at the following snippets of code.

### Using SDK v1

```javascript
export default handleAuth({
  signup: async function signup(req, res) {
    try {
      await handleLogin(req, res, {
        authorizationParams: {
          screen_hint: 'signup'
        }
      });
    } catch (error) {
      res.status(error.status || 400).end(error.message);
    }
  },
  invite: async function invite(req, res) {
    try {
      await handleLogin(req, res, {
        authorizationParams: {
          invitation: req.query.invitation
        }
      });
    } catch (error) {
      res.status(error.status || 400).end(error.message);
    }
  },
  'login-with-google': async function loginWithGoogle(req, res) {
    try {
      await handleLogin(req, res, {
        authorizationParams: {
          connection: 'google'
        }
      });
    } catch (error) {
      res.status(error.status || 400).end(error.message);
    }
  },
  'refresh-profile': async function refreshProfile(req, res) {
    try {
      await handleProfile(req, res, {
        refetch: true
      });
    } catch (error) {
      res.status(error.status || 400).end(error.message);
    }
  },
}
```

### Using SDK v2

```javascript
export default handleAuth({
  signup: loginHandler({ authorizationParams: { login_hint: 'signup' } }),
  invite: loginHandler({ authorizationParams: (req) => { invitation: req.query.invitation } }),
  'login-with-google': loginHandler({ authorizationParams: { connection: 'google' } }),
  'refresh-profile': profileHandler({ refetch: true }),
}
```

Isn't that much nicer?

## First Class Testing Support

Testing routes that require login has always been a complex problem for developers. The new SDK release includes built-in support for seeding the session cookie on your tests to make testing authenticated pages a breeze. 

Instead of having to manage secrets in tests, visit third-party websites or mock complex internals of authentication libraries, users can use the new testing functionality built right into the SDK.

Consider the following code:

```javascript
import { generateSessionCookie } from '@auth0/nextjs-auth0/testing';

test('should visit profile page', async () => {
  const cookie = await generateSessionCookie(session, config);
  const res = visit('/profile', { headers: { cookies: `appSession=${cookie}` } });
  expect(res.status).toBe(200);
})
```

The code above uses Auth0 NextJS SDK to generate a session cookie which is later sent as part of the `visit` request.

If the session is not provided, the request would respond with a `403 Forbidden` as the URL is protected against unauthenticated requests.

## And LOTS more…
But that is not all. The new SDK offers you:

- New session lifecycle and `updateUser` method.
- New package export profile to support React Server Components. 
- Improved API Docs.
- Improved Error Handling.
- Lighter Front-End binary.
- Support for custom Logout Options.
- Easier options for managing cookie size.

## Summary

The [Auth0 NextJS SDK](https://github.com/auth0/nextjs-auth0) v2 introduced some pretty neat changes that will ultimately provide a better developer and end-user experience.

For those projects migrating from the SDK v1, I recommend reading the official [migration guide](https://github.com/auth0/nextjs-auth0/blob/v2.0.0/V2_MIGRATION_GUIDE.md).

Thanks for reading!

Auth0 SDK for NextJS v2.0 released!

Cyril David

Cyril is a Platform System Architect at Auth0. He is a seasoned engineer with over a decade of experience in building distributed systems.

Platform System Architect

Designing for quality, reproducibility, and determinism.

**TL;DR**: Releasing individual services today is largely a solved problem. The complexity arises when we need to factor in the combinations of services, the configs and secrets necessary for a given service version, and the underlying infrastructure supporting those services while ensuring quality, reproducibility, and determinism.

## What’s in a Service?

When we talk about services, we largely focus on the code — but other things we might need to account for are:

* Config and Secrets
* Database related migrations
* Related infrastructure dependencies for a particular service version
* Implicit dependencies with other services

## Introducing the Concept of a Release Manifest

Given these problem constraints, we introduced a **release manifest** concept, which we define as a versioned JSON file describing a point-in-time representation of the entire Auth0 product stack, which includes: all service versions and the infrastructure version it was deployed on.

Configs and secrets are also versioned for every release manifest, which are snapshotted in our config/secrets storage.

Just to make it more concrete, here’s a hypothetical snippet:

```json
{
	"version": "v202221.99.0",
	"services": {
		"productpage": {
			"entity": {
				"name": "productpage",
				"default_vcs_branch": "main",
				"stacks": ["STACK_AUTH0"]
			},
			"artifact": {
				"version": "1.464.0",
				"vcs_revision": "dc62808d3a75a814a0748827d74e0936669dfec9",
				"vcs_url": "https://github.com/auth0/productpage",
				"reference": "sample.jfrog.io/docker/productpage:1.464.0",
				"metadata": {
					"build_number": "464",
					"build_started": "2022-05-24T18:52:34.753+0000",
					"build_url": "https://samplebuilds.auth0.net/job/productpage/job/main/464/"
				}
			}
		},
		"reviews": {
			"entity": {
				"name": "reviews",
				"default_vcs_branch": "main",
				"stacks": ["STACK_AUTH0"]
			},
			"artifact": {
				"version": "1.31.0",
				"vcs_revision": "dc62808d3a75a814a0748827d74e0936669dfec9",
				"vcs_url": "https://github.com/auth0/reviews",
				"reference": "sample.jfrog.io/docker/reviews:1.31.0",
				"metadata": {
					"build_number": "31",
					"build_started": "2022-05-24T18:52:34.753+0000",
					"build_url": "https://samplebuilds.auth0.net/job/reviews/job/main/31/"
				}
			}
		}
	}
}
```

A couple of notes:

* The version `v202221.99.0` is based on a year/week scheme (e.g., year`2022`, week `21`) and just a monotonic minor version which represents an atomic change.
* In this example, we only have two services called `productpage` (versioned `1.464.0`) and `reviews` (versioned `1.31.0`).
* This file is committed within our central git ops repository, with a matching tag `v202221.99.0` where the underlying infrastructure as code is also versioned for that specific point in time.
* Config/secrets aren’t versioned in git — but instead are stored separately in our config/secrets storage where we have the ability to snapshot them based on a specific version (in this case, all secrets/config have the same version `v202221.99.0`attached as metadata).

With this construct defined, we now have a baseline primitive for ensuring the properties we set out to solve initially:

* **Quality** — we can easily run our suites of system tests against a given version to ensure that our features work as expected.
* **Reproducibility** — we can create as many different spaces for testing or for onboarding new customers.
* **Determinism** — we’re guaranteed we have the same combination of service versions, config/secrets, database migrations, and infrastructure.

## A Note about Database Migrations

Database migrations themselves are a vast topic that is beyond the scope of this blog post, but the core properties we need to ensure are:

* **Forwards and backwards compatibility** – that a new version can be read by old code, and new code can work with the old schema.
* **Idempotency** – that any transient failures are wrapped in a transaction so we can retry the entire job if it fails. In addition, being able to run the same job once completed should be a no-op.

We utilize kubernetes jobs as the underlying primitive to run these database migrations and write them in such a way that retries during transient failures are ok — and that if we have to roll back, the previous service version will work with the new database migration.

Rollback is only within a reasonable constraint – in our case, the constraint is one major version away, which means a weekly version. So we only need to ensure backward/forward compatibility one major version away.

## Deploying a Release Manifest-Version

Given that we have all the necessary information codified in a release manifest version, the next step is to deploy older versions to a new version. Taking our hypothetical example:

* We have the current version `v202221.99.0`
* We need to deploy to a new version `v202222.105.0`

### Maintenance windows

Our private cloud customers can define a maintenance window where their space gets deployed every week. This means that these versions can only go out during that maintenance window — and that if anything potentially goes wrong, we have the ability to stop the release and Rollback to the prior version.

### Promotion pipeline

Like any release pipeline, we define a hierarchical set of channels; let’s imagine the following hypothetical example:

```
stage
+- internal
   +- free
      +- enterprise
         +- private cloud dev
            +- private cloud prod
```

So, in this case, if the stage had the version `v202221.99.0`, it means we need to deploy it _first_ to `v202222.105.0` before we can deploy `internal` to `v202222.105.0` and so forth.

### Rolling back

If, for any reason, a deployment encounters an error, we can roll back by shifting traffic back to the previous stable cluster.

## What’s Next?

The new release pipeline we’ve developed is only the beginning – and we’re planning to build more innovative tools for our platform in order to consistently deliver excellent service and reliability to our customers.

We are publishing a series of technical posts on how and why we replatformed. They’ll be linked at the bottom of this post as they publish and are also findable on our blog. If you have technical questions or ideas for future posts, please reach out to us via the [Auth0 Community](https://community.auth0.com/). (Our marketing team also tells us we would be remiss if we didn’t include a link to talk to Sales, so that is [here](https://auth0.com/contact-us), too.)

How We Do Releases in Auth0’s New Private Platform

How to use the new user-jwts tool to test a protected ASP.NET Core Web API without involving an authorization server.

Test Authorization in ASP.NET Core Web APIs With the user-jwts Tool

swale-nunez

Swalé Nunez is a polymath with a deep fascination for creativity and an uncontrollable desire to innovate. A creative whose creativity takes shape in the form of technology manifested through human-centered design. Through his disruptively unorthodox approach and advocacy for technology that is user-centric, he is helping to pioneer decentralized identity through user-controlled identity provisioning. <br>
He has architected robust identity and access management solutions across industries, including finance and government sectors, and continuously works to bring that level of security to consumer identity. Ushering in a hybrid architecture implementation, which offers enterprise-grade authentication with intuitive consumer-like ease of use. An implementation that introduces a more transparent profile data sharing model that gives users more control over the access and sharing of their profile data while streamlining onboarding and checkout for seamless digital interactions.

Founder - Iuncta, Inc

Swalé Nunez

Iuncta has a new integration on Auth0 Marketplace

Social logins have given developers an effortless way to address several of their onboarding challenges. With a simple integration that lets users sign up and sign in to applications using social accounts, developers remove considerable friction from the process. Auth0 eased the integration process further, letting developers choose which social login provider to use. The [most prevalent](https://www.okta.com/blog/2020/08/social-login/), Facebook, was generally the default. That integration alone not only helped eliminate password management but also showed increases in conversion rates and overall user engagement. But removing friction and easing a developer’s job is just the first part of this journey. It’s also about user trust.

## A Question of Trust

There has always been an element of trust involved in the social login relationship. But it’s changing. As the relationship between users and the applications they interact with has evolved, user expectations of that relationship have shifted as well. And trust is at the core of these expectations. A study by [MalwareBytes Labs](https://blog.malwarebytes.com/security-world/2019/03/labs-survey-finds-privacy-concerns-distrust-of-social-media-rampant-with-all-age-groups/) found that 95% of internet users don’t trust social media companies with their personal data. Those who responded to the survey showed distrust across all social media platforms. The same research found that 87% of respondents didn’t feel confident sharing their personal data online. The lack of user confidence and distrust is becoming evident in how often they make use of social logins today. 

With users becoming more informed about data privacy and the need to become more active in protecting their online identity, they expect a privacy-first login that will give them more control over and transparency in their data. A report from [PEW Research Center on Americans and their online privacy](https://www.pewresearch.org/internet/2019/11/15/americans-and-privacy-concerned-confused-and-feeling-lack-of-control-over-their-personal-information/) found that 84% of users stated they have little to no control over the data companies collect about them. As technology evolves and with the advent of blockchain technology, users are embracing the idea of having more control over their online identities, data, and transactions, and technology is evolving to help make this possible. Decentralized identity is one such approach.

## A User-First Approach to Online Identity

[Iuncta](https://iuncta.io/)’s user-first approach to identity and access management is built on a model emphasizing transparency that leads to trust. It prioritizes user privacy and enables user control, all consistent with its user-centered design approach. Iuncta is a social login with transparent data sharing and access to zero-party data, so users are always aware of what data is being shared, when, and with whom. A social login that gives users the control they deserve, ensuring trust, offering privacy, and establishing peace of mind.

Iuncta’s decentralized identity implementation allows users to act as their own identity provider online, introducing a more transparent profile-data-sharing model. With its hybrid architecture, developers can quickly and easily offer enterprise-grade passwordless authentication with an intuitive consumer-ready experience that is supported by Iuncta’s [mobile app](https://youtu.be/GN5VMTN_fm8). The Iuncta platform enables user identity on demand, streamlining onboarding and facilitating secure and effortless digital interactions between users and developers.

![Mobile App](https://images.ctfassets.net/23aumh6u8s0i/1yV0zNgYxkdaBNrtSWznCd/ac139374809ea4f043d22ed1db6dda18/01_mobile-app.jpeg)

### End-to-end authentication

The Iuncta solution manages the relationship between the developers and the users of their applications and is supported by a feature-rich cloud offering at the core of an end-to-end solution to consumer online identity management and licensing. 

The key elements in Iuncta’s layered implementation include:

* Developers (Client) – A minimalist module requires only a username for passwordless access.
* Web API/Mobile SDK – A comprehensive list of tools for seamless integration into the Iuncta cloud service offering.
* Cloud services – A feature-rich collection of core Iuncta ecosystem services. It is the control center for the extensive functionality list.
* Mobile app – A clean and intuitive user interface designed to make user interaction with the Iuncta platform natural and effortless. 

![Iuncta](https://images.ctfassets.net/23aumh6u8s0i/1uGGyQ3FBjMBIO34dhAawX/149ba6599cc169cd3c9f0232ba209ea1/02_end-to-end_authentication.png)

Iuncta’s hybrid approach combines a consumer-friendly user experience with enterprise-grade security without lengthy development time. As an official Auth0 partner in its [Marketplace](https://marketplace.auth0.com/integrations/iuncta), the integration only takes a button click and a few simple steps for developers. With an Iuncta partner account, developers get access to the complete list of web APIs and downloadable mobile SDKs, as well as a reference guide with documentation and code samples to enable customization.

## Transparency That Leads to Trust

Social logins don’t all operate by the same set of principles. This means that, despite the importance of transparency, as cited by users, privacy, control over data, and trust aren’t priorities for all social login providers. The most important factor to consumers when choosing to share personal data in its secure collection and storage, control over what data is being shared, and trust in the company, according to the [Agility PR report](https://www.agilitypr.com/pr-news/public-relations/covid-has-made-consumers-more-willing-to-share-data-what-do-they-expect-in-return/). Iuncta believes in these principles and puts them to work.

Through its transparent practices, Iuncta’s social login helps to facilitate this trust through privacy, security, and control. Iuncta meets current and future expectations through:

* Ethical, fair, and transparent data practices without massive data collection or secrecy 
* Passwordless, user-controlled authentication and access to personal data
* Multifactor authentication for additional layers of security
* Creating a channel for users to profit from managing access to their identity, an innovative value exchange model.

Putting transparency into practice, it becomes clear that the more users trust, the more willing they are to share their data; the more data they share, the better the experience. The better the experience, the more likely they are to return as paying customers. A little trust goes a long way. 

Let’s work together to re-establish trust. Check out our [integration in the Auth0 Marketplace](https://marketplace.auth0.com/integrations/iuncta).

A Better Social Login: Transparency That Leads To Trust

Let's explore the main features of the new Auth0 SDK for SPA release.

> The Auth0 team released the new Auth0 Single Page App SDK v2.0, and it's now available in the [npm registry](https://www.npmjs.com/package/@auth0/auth0-spa-js). It is a major new release with a focus on development and user experience.

The new release makes an important step towards improving usability and reducing the footprint (size) of the SDK.

## Quick Start with the New SDK

You can follow the [quick start guide](https://auth0.com/docs/quickstart/spa/vanillajs) if you build a new application or connect your SPA with Auth0 using the SDK for the first time.

If you use frameworks such as React, Angular, or Vue, you can use framework-specific libraries instead. You can learn more about specific frameworks in our [SPA guides section](https://auth0.com/docs/quickstart/spa).

> All of the mentioned improvements will be available in the next beta versions of our framework-specific SDKs. Be sure to keep an eye on them to be notified when their beta versions are available.

## Migrating from v1.x

With the improvements from v1.x, it was necessary to introduce some breaking changes. We will cover the most impactful changes in this post, but we recommend reviewing the [migration guide](https://github.com/auth0/auth0-spa-js/blob/master/MIGRATION_GUIDE.md) for the details of all breaking changes and their corresponding migration path.

## Reduced Bundle Size by 60%

Auth0 SPA SDK V1.x shipped with built-in polyfills to compensate for the lack of native support on some browsers for features such as:

- [AbortController](https://caniuse.com/mdn-api_abortcontroller_abortcontroller)
- [Promise](https://caniuse.com/promises)
- [TextEncoder & TextDecoder](https://caniuse.com/textencoder)
- [Fetch](https://caniuse.com/fetch)

As the above APIs are now available for most browsers, we believe there's no more need to include those polyfills. Primarily users of IE11 would require them, and with [Microsoft dropping support for IE11](https://blogs.windows.com/windowsexperience/2022/06/15/internet-explorer-11-has-retired-and-is-officially-out-of-support-what-you-need-to-know/), we believe it makes sense to capitalize on the gains and **drop support for IE11 as of V2**.

By removing these polyfills, and with some small improvements on our side, we **reduced the bundle size by an outstanding 60%**.

Such a reduction will allow for faster download and processing times for application users.

## API Consistency

Our SDK offers a variety of settings that can be divided into two categories:

- Properties used to configure our SDK
- Properties used solely to pass through to Auth0

In v1.x, passing both types of properties to the SDK was possible when instantiating a new `Auth0Client`. Because the different types of arguments were differentiated only by the case (camel vs. snake case), with no additional separation in the object argument, it wasn't very evident what arguments were SDK properties and which ones were authorization parameters.

Here is an example of what setting such options on v1.x looks like:

```javascript
const client = new Auth0Client({
  client_id: '...',
  useRefreshTokens: true,
  useRefreshTokensFallback: false,
  redirect_uri: '...',
  custom_param: '...',
  screen_hint: 'signup'
});
```

With v2, we are ensuring the distinction between the two categories is clear by putting any property solely used to pass through to Auth0 in a property bag named `authorizationParams`. On top of that, any property outside of `authorizationParams` will now be using camel casing.

Here is what the configuration looks like in v2:

```javascript
const client = new Auth0Client({
  clientId: '...', // <= camelCasing
  useRefreshTokens: true,
  useRefreshTokensFallback: false,
  authorizationParams: { // <= new property bag
    redirect_uri: '...', // <= moved into authorizationParams
    custom_param: '...', // <= moved into authorizationParams
    screen_hint: 'signup' // <= moved into authorizationParams
  }
});
```

## `localOnly` Logout

In v1.x of the SDK, it was possible to pass a `localOnly` when calling `logout`. In the current release, we dropped the `localOnly` argument in favor of a new `onRedirect` event that allows for more control, including the possibility of not redirecting, and thus produces the same effect the `localOnly` property intended.

To replicate the `localOnly` behavior, you can implement the following:

```javascript
await client.logout({
  onRedirect: async (url) => {
    // Do not do anything
    // Or do something else but redirecting
  }
})
```

## Removed `buildAuthorizeUrl` and `buildLogoutUrl`

In v1.x, it was possible to use the methods `buildAuthorizeUrl` and `buildLogoutUrl` for applications that couldn't rely on `window.location.assign` to redirect to Auth0 when calling `loginWithRedirect` or `logout` respectively. A typical example of this was when developers needed to set a specific URL in the context of a mobile application using frameworks such as Ionic.

In v2, developers would rely on `onRedirect` to specify such behavior.

For example:

```javascript
await client.loginWithRedirect({
  async onRedirect(url) {
    // Redirect using Capacitor's Browser plugin
    await Browser.open({ url });
  }
});
```

## `getUser` and `getIdTokenClaims`

As part of our optimization efforts, we reworked the SDK's internal cache to store tokens. Consequently, it was possible to simplify the methods `getUser` and `getIdTokenClaims`.

In v1.x, developers could pass a specific scope and audience when calling either of those functions.

Here are some examples of how these functions were used in v1:

```javascript
const user = await getUser();
const user = await getUser({ audience, scope });

const claims = await getIdTokenClaims();
const claims = await getIdTokenClaims({ audience, scope });
```

However, as an application should only have one user, such parameters wouldn't be required. So from v2, we dropped those parameters and simplified the methods to:

```javascript
const user = await getUser();
const claims = await getIdTokenClaims();
```

## Retrieve a Token from the Cache

With v2, we are introducing the possibility of retrieving a token from the cache without contacting Auth0 if no entry is found. To achieve that, we reworked the already existing `ignoreCache` argument for `getTokenSilently`, which takes a boolean, to `cacheMode`, which can accept three values:

- **on** (default value): Use the cache, but call the `oauth/token` endpoint when no entry is found. This is the equivalent of when `ignoreCache` was omitted or its value was set to false in v1.
- **off**: Do not use the cache, always call the `oauth/token` endpoint. This is the equivalent of `ignoreCache: true` in v1.
- **cache-only**: Use the cache, do not call the `oauth/token` endpoint when no entry is found.

To use our SDK and see if we have a token in the cache without contacting Auth0, you must set `cacheMode` to `cache-only` when calling `getTokenSilently`.

```javascript
const token = await client.getTokenSilently({
  cacheMode: 'cache-only'
});
```

## URL Encoded Form Data

V1 of SPA-JS defaults to sending payloads using JSON when calling Auth0's `oauth/token` endpoint, but users can opt-in to send the data as `x-www-form-urlencoded` instead.

With the release of v2, we will default to sending the requests to the `oauth/token` endpoint using `x-www-form-urlencoded`, while users can opt-in to using JSON as needed. Using `x-www-form-urlencoded` has shown to have a small performance optimization and aligns more with what the [spec describes](https://datatracker.ietf.org/doc/html/rfc6749#section-3.2).

## Summary

The Auth0 Single Page App SDK v2 improves both the developer and the user experience. On the one hand, it simplifies and makes working with the SDK API easier. On the other hand, it reduces the bundle size, which translates into faster downloads and processing times.

Thanks for reading!

Auth0 SDK for Single Page Applications v2.0 released!

New partnerships aim to bring secure customer identity to the platforms developers use every day in one click, or less

Almost a decade ago, _The New Kingmakers_ made reference to the rise of a developer class that would fundamentally reshape technology decision-making. Today, two-thirds of professional developers have a voice when their organizations are purchasing new technologies, according to [Stack Overflow](https://survey.stackoverflow.co/2022/#technology-most-loved-dreaded-and-wanted). Product-led growth is official “a thing,” and companies that make life easier for developers have been crowned with success again and again.

The acquisition of Auth0 accelerated Okta’s own journey with developers. Over 2.8 million unique developers look to [Auth0, now the Okta Customer Identity Cloud](https://www.okta.com/press-room/press-releases/okta-introduces-okta-customer-identity-cloud-to-help-businesses-grow-user/) each month for expertise on how to implement customer identity, across in-person events, the Auth0 Ambassador program, and digital channels like docs, technical blogs, and JWT.io.

Today, at [Oktane22](https://www.okta.com/oktane22/), we announced the next giant leap in our journey toward making identity easier for developers: New partnerships with three of the leading developer platforms: DigitalOcean, Netlify, and Vercel. These are like-minded platforms that put developers at the heart of their missions. Together, we intend to bring expert advice and easy integrations to where developers already spend their time–with the ultimate vision of providing secure customer identity in one click or less within each platform environment.

“Creating compelling experiences is hard enough without having to be an identity expert, too. And the stakes are too high to get it wrong,” said Shiven Ramji, Chief Product Officer, Customer Identity at Okta. “Okta Customer Identity Cloud powered by Auth0 can be called by your app and hosted in your cloud of choice, but we don’t want to stop there. This is the first step in a multi-year journey to fully integrate secure identity capabilities where developers are building the future. We are honored to have DigitalOcean, Netlify, and Vercel join us on this quest.”

## Abstracting Away Complexity

Developers are facing all kinds of application complexity and maintenance work that takes them away from innovation. The Covid-19 pandemic only amplified the need to be hyper-focused on shipping differentiated, user-centric products. Security has become a cat-and-mouse game as attackers shift their tactics and new privacy laws are established. Developers need to balance all of these priorities while dealing with resourcing and talent pressures.

Customer identity stands at the intersection of these forces: security, privacy, and user experience. Getting it right enables everyone to safely access any technology and developers to integrate customer identities across the stack. But according to a [Gartner](https://www.gartner.com/en/documents/4009255)® report, “The cost of maintaining a homegrown CIAM toolset has grown, compared with commercial offerings. There is a growing preference for buying versus building, which is enabling the business to refocus development resources.”

## Empowering Developers for a Safer Internet

Together, we believe Okta, DigitalOcean, Netlify, and Vercel can streamline the education, implementation, and activation of customer identity for developers across the globe. Today, we’re starting with improving education and awareness around the complexity of identity, followed by improving discoverability for our integrations along the developer journey, with the ultimate vision of one-click integrations.

Democratizing access to enterprise-grade customer identity for developers will have a massive impact on the security of end-consumers and empower developers to focus on innovation. As part of Okta Customer Identity Cloud, we can put adaptive multi-factor authentication (MFA), bot detection, passkeys, and more in the hands of developers with the literal flip of a switch. Meeting developers where they are is a key part of our strategy, and we couldn’t be more excited to welcome DigitalOcean, Netlify, and Vercel to our network.

“We’re very excited to be working with Okta to better equip developers and small businesses to add customer identity into their Apps built on DigitalOcean,” said Tyler Healy, Vice President of Security at [DigitalOcean](https://www.digitalocean.com/). “When it comes to developers and digital entrepreneurs, simplicity is vital. This partnership will only further DigitalOcean’s ability to simplify innovation on our platform and enable builders to spend more time creating software that changes the world.”

“Developers are moving to a decoupled, composable web architecture because they want more flexibility to use any tool or framework to build faster, better-performing web experiences. At the same time, they need a great developer experience in a simple workflow. That’s where Netlify plays a key role as the platform connecting all developer’s tools, including Auth0 by Okta, and APIs in one place to build and run web apps. Working with Okta, we look forward to making identity and authentication as easy and simple as possible for millions of developers,” said Matt Biilmann, CEO and co-founder [Netlify](https://www.netlify.com/)

“As a leading cloud platform for frontend developers, Vercel provides innovators with the speed and reliability they need to create at the moment of inspiration. Security and identity are at the core of building delightful digital experiences,” said Malte Ubl, CTO at [Vercel](https://vercel.com/). “By joining forces with Okta, we’re not only simplifying the role that identity plays on the web but also making a commitment to enhancing the speed and breadth of developer-friendly cybersecurity in an increasingly digital world.” 

## Neutrality to Build Your App, Your Way

Developers want the freedom and power to choose the best solutions for their digital ecosystem. Okta’s commitment to neutrality means not being restricted to a specific technology stack and having the ability to control and customize identity now and in the future. We are designing easy-to-integrate solutions that free developers to use any technology, regardless of platform, device, or infrastructure. We are 100% focused on identity, so developers can focus on innovation.

## Availability and Signup

Developers can learn more about Okta’s new developer platform partnerships and get started with Okta Customer Identity Cloud [on our Developer Center](https://developer.auth0.com/resources/get-started/cloud?utm_source=blog&utm_medium=website&utm_campaign=partnerships). We will release more information about the DigitalOcean, Netlify, and Vercel integrations as they become available.

If you’re a developer platform interested in joining our quest to make identity easier for developers, [please reach out to our tech partnerships team](https://docs.google.com/forms/d/e/1FAIpQLSfGzaE5a6-OSy1D1N8PMeSE8pXCfsr4UkzDqUpW-vUGq2rYHg/viewform).

## About Okta

Okta is the World’s Identity Company. As the leading independent Identity partner, we free everyone to safely use any technology—anywhere, on any device or app. The most trusted brands trust Okta to enable secure access, authentication, and automation. With flexibility and neutrality at the core of our Okta Workforce Identity and Customer Identity Clouds, business leaders and developers can focus on innovation and accelerate digital transformation thanks to customizable solutions and more than 7,000 pre-built integrations. We’re building a world where Identity belongs to you. Learn more at [okta.com](http://okta.com/).

Okta Partners with DigitalOcean, Netlify, and Vercel to Simplify Identity for Developer

Let’s explore the new .NET 7 features for improving and simplifying authentication and authorization support in .NET applications.

The release of .NET 7 continues the simplification effort that began with .NET 5. Following this line, the new release provides .NET developers with a few features related to authentication and authorization that make .NET developers' lives a bit easier. Let's take a quick look at those features, which range from simplifications in authentication configuration to the addition of new authorization test tools, to improvements to Blazor's authentication support.

## Default Authentication Scheme

When you configure authentication for your application, you need to register the authentication service through `AddAuthentication()`. For example, the following is the code needed to configure `JwtBearer` as the authentication scheme in an ASP.NET Core Web API:

```csharp
builder.Services.AddAuthentication(JwtBearerDefaults.AuthenticationScheme)
     .AddJwtBearer(JwtBearerDefaults.AuthenticationScheme, options =>
     {
         options.Authority = $"https://{builder.Configuration["Auth0:Domain"]}";
         options.TokenValidationParameters = 
           new Microsoft.IdentityModel.Tokens.TokenValidationParameters
         {
             ValidAudience = builder.Configuration["Auth0:Audience"],
             ValidIssuer = $"{builder.Configuration["Auth0:Domain"]}"
         };
     });
```

Although you are defining just one authentication scheme (`JwtBearerDefaults.AuthenticationScheme`), the  `AddAuthentication()` method requires that you specify the default scheme to use when it is not specified in your API endpoints (see [this document for more details on multiple authentication schemes in ASP.NET Core](https://learn.microsoft.com/en-us/aspnet/core/security/authorization/limitingidentitybyscheme?view=aspnetcore-6.0#use-multiple-authentication-schemes)).

Starting with .NET 7, the default scheme is no longer required when you define just one authentication scheme. It is automatically inferred by the framework. In practice, you can write the previous code as follows:

```csharp
builder.Services.AddAuthentication() //👈 no default scheme specified
     .AddJwtBearer(JwtBearerDefaults.AuthenticationScheme, options =>
     {
         options.Authority = $"https://{builder.Configuration["Auth0:Domain"]}";
         options.TokenValidationParameters = 
           new Microsoft.IdentityModel.Tokens.TokenValidationParameters
         {
             ValidAudience = builder.Configuration["Auth0:Audience"],
             ValidIssuer = $"{builder.Configuration["Auth0:Domain"]}"
         };
     });
```

In case you need to restore the old behavior for any reason, you can disable the new feature using the following statement:

```csharp
AppContext.SetSwitch("Microsoft.AspNetCore.Authentication.SuppressAutoDefaultScheme", true);
```

## Simplified Configuration

One of the recurrent critiques of .NET authentication and authorization is its complexity (see [this thread](https://www.reddit.com/r/dotnet/comments/vttrib/is_auth_way_too_hard_in_net/) and [this one](https://social.msdn.microsoft.com/Forums/en-US/4d3844d5-9175-49ba-8c2f-8257f2c67639/authentication-and-authorization-is-too-complicated-too-abstract?forum=aspdotnetcore), for example). Actually, .NET provides developers with an articulate system for managing authentication and authorization. This system is great for the flexibility it offers, but it may be hard for a beginner to digest all the details. It may be hard even for a more experienced developer who is not used to dealing with the identity features every day.

To overcome this issue, the .NET team started an initiative aiming at simplifying the authentication and authorization configuration. The .NET 7 release introduces the first step in this direction, bringing you a simplified approach to configure ASP.NET Core Web APIs authorization based on access tokens in JWT format.

> Check out [this article to learn how to protect your ASP.NET Core Web API](https://auth0.com/blog/aspnet-web-api-authorization/).

If you ever had secured an ASP.NET Core Web API with Auth0, the following code should look familiar to you:

```csharp
using Microsoft.AspNetCore.Authentication.JwtBearer;

var builder = WebApplication.CreateBuilder(args);

builder.Services.AddAuthentication(JwtBearerDefaults.AuthenticationScheme)
     .AddJwtBearer(JwtBearerDefaults.AuthenticationScheme, options =>
     {
         options.Authority = $"https://{builder.Configuration["Auth0:Domain"]}";
         options.TokenValidationParameters = 
           new Microsoft.IdentityModel.Tokens.TokenValidationParameters
         {
             ValidAudience = builder.Configuration["Auth0:Audience"],
             ValidIssuer = $"{builder.Configuration["Auth0:Domain"]}"
         };
     });

builder.Services.AddAuthorization();

var app = builder.Build();

app.UseAuthentication();
app.UseAuthorization();
```

Now, you can directly rely on the built-in configuration system to define your Web API's authorization options. In fact, in addition to default authentication schemes, .NET 7 automatically loads the options to configure the authentication service from the new  `Authentication` section of the `appsettings.json` configuration file. With this new feature, the code shown earlier becomes as follows:

```csharp
using Microsoft.AspNetCore.Authentication.JwtBearer;

var builder = WebApplication.CreateBuilder(args);

builder.Services.AddAuthentication().AddJwtBearer(); //👈 new feature

builder.Services.AddAuthorization();

var app = builder.Build();
```

All the configuration settings are moved to the `appsetting.json` file as follows:

```json
{
  "Logging": {
    "LogLevel": {
      "Default": "Information",
      "Microsoft.AspNetCore": "Warning"
    }
  },
  "AllowedHosts": "*",
  //👇 new section
  "Authentication": {
    "Schemes": {
      "Bearer": {
        "Authority": "https://YOUR_AUTH0_DOMAIN",
        "ValidAudiences": [ "YOUR_AUDIENCE" ],
        "ValidIssuer": "YOUR_AUTH0_DOMAIN"
      }
    }
  }
  //👆 new section
}
```

The new `Authentication` section keeps the configuration settings for any authentication scheme supported by your application, although currently only the `JwtBearer` scheme is supported.

Notice that now you don't need anymore to call `UseAuthentication()` and `UseAuthorization()`. The framework takes care of automatically adding the required middleware to the request pipeline.

## Authorization Policies for Specific Endpoints

ASP.NET Core allows you to specify policies to make more accurate authorization decisions based on the access token content or other advanced criteria. Usually, these policies are defined globally at the application level and attached to the endpoint definitions the policy applies to.

> Take a look at [this article to learn how to use policies to protect ASP.NET Core Web APIs](https://auth0.com/blog/permission-based-security-aspnet-webapi/), for example.

Defining policies globally is pretty good for reuse. However, sometimes you may need just a specific policy for one endpoint. In this case, you can specify your policy directly on the endpoint definition.

The following is an example of how you can use this new feature:

```csharp
app.MapGet("/api/special-endpoint", () => "A special endpoint!")
    .RequireAuthorization(p => p.RequireClaim("scope", "api:special"));
```

## The `user-jwts` Tool

Testing a token-protected Web API could be complex. You can easily use tools like curl or Postman, but you need to pass a valid access token along with your HTTP request. To get a valid access token, you usually need a working identity and access management system at your disposal, such as [Auth0](https://auth0.com/). You need to configure your API with this system and log in by providing valid credentials.

Auth0 allows you to test your registered API using a token issued directly in the [Auth0 dashboard](https://manage.auth0.com/), but you still need to register your application with Auth0.

.NET 7 brings a new CLI tool that helps simplify protected Web API testing: `user-jwts`. This tool is integrated with the .NET CLI and allows you to generate access tokens in JWT format. The tool is based on the same infrastructure as the [secret manager](https://auth0.com/blog/secret-management-in-dotnet-applications/) and enables your application to validate the generated access token. Basically, the following command allows you to generate a new access token:

```bash
dotnet user-jwts create
```

You can use this token with curl, Postman, or any other HTTP client to make your call to the protected endpoints of your Web API without the need to register your application with an actual identity and access management system.

Beyond the basic usage, the `user-jwts` tool allows you to customize your access token by specifying the scopes, custom claims, and other properties so that you can also test endpoints with access policies. See the [official documentation](https://learn.microsoft.com/en-us/aspnet/core/security/authentication/jwt-authn) to learn more.

<include src="ebook-ads/dotnetIdentity" />

## Dynamic Authentication Requests in Blazor WASM

Blazor WebAssembly uses the `Microsoft.AspNetCore.Components.WebAssembly.Authentication` package to handle OpenID Connect authentication. This package allows you to statically define at the startup time how authentication will occur. However, there are scenarios where you may need to authenticate users at runtime with a different configuration. For example, you may need to perform [step-up authentication](https://auth0.com/docs/secure/multi-factor-authentication/step-up-authentication) or may want the user to change their account.

In .NET 7, Blazor WebAssembly supports the creation of dynamic authentication requests using the new `InteractiveRequestOptions` class and the `NavigateToLogin()` method of the `NavigationManager` object.

The following example shows the basic use of these new features:

```csharp
InteractiveRequestOptions requestOptions = new()
{
    Interaction = InteractionType.SignIn,
    ReturnUrl = NavigationManager.Uri,
};
NavigationManager.NavigateToLogin("authentication/login", requestOptions);
```

The `InteractiveRequestOptions` class also provides a way to add custom parameters to the authentication request. For example, consider [Auth0's `screen_hint` parameter](https://auth0.com/docs/authenticate/login/auth0-universal-login/new-experience#signup) that allows you to show the signup form instead of the default login form. You can send this parameter to Auth0 as shown below:

```csharp
InteractiveRequestOptions requestOptions = new()
{
    Interaction = InteractionType.SignIn,
    ReturnUrl = NavigationManager.Uri,
};
requestOptions.TryAddAdditionalParameter("screen_hint", "signup");
NavigationManager.NavigateToLogin("authentication/login", requestOptions);
```

## Blazor WASM Authentication Diagnostics

Detecting authentication issues is not easy, especially if you are running a WebAssembly code, as it happens with Blazor WebAssembly applications. The .NET 7 release tries to improve its support for authentication diagnostics by introducing the debug level for the `Microsoft.AspNetCore.Components.WebAssembly.Authentication` library. After [enabling logging for Blazor WebAssembly](https://learn.microsoft.com/en-us/aspnet/core/blazor/fundamentals/configuration?view=aspnetcore-7.0#logging-configuration), you can add the following setting in the `wwwroot/appsettings.json` configuration file to get detailed information about the authentication process:

```json
"Logging": {
    "LogLevel": {
        "Microsoft.AspNetCore.Components.WebAssembly.Authentication": "Debug"
    }
}
```

<include src="SignupCTA" text="Try out Auth0 authentication for free." linkText="Get started →" />

## Conclusion

Probably the new features introduced by .NET 7 to mitigate the complexity of authentication and authorization support will not drastically change your life as a developer. However, they confirm the effort Microsoft is making to simplify the use of its development platform. In the area of authentication and authorization, the commitment to reduce configuration complexity with an [initiative](https://github.com/dotnet/aspnetcore/issues/34545) that will continue in subsequent .NET releases looks pretty promising.

I hope that the combination of these and future simplifications will go in the right direction of making authentication and authorization integration into .NET applications less and less challenging.


What's New in .NET 7 for Authentication and Authorization

pablo-cibraro

Pablo is an internationally recognized expert and entrepreneur with more than 22 years of experience in designing and implementing large distributed systems with Microsoft technologies and a Connected System MVP. <br>
For the last few years, Pablo has helped numerous Microsoft teams develop tools and frameworks for building service-oriented and web applications with .NET. <br>
Pablo now focuses on technologies that enable developers to build large-scale systems and web applications on the cloud, such as HTML5, Node.js, ASP.NET, Windows Azure and Amazon AWS.

Agilesight Cofounder

Pablo Cibraro

Learn about the new ASP.NET minimal Web APIs introduced in .NET 6.0 and how to secure them with Auth0.

"new"