jess-author

Jessica Temporal is a Senior Developer Advocate at Auth0 and co-founder of the first Brazilian data science podcast called <a target='_blank' href='https://pizzadedados.com'><strong>Pizza de Dados</strong></a>. She’s the author of <a target='_blank' href='https://www.amazon.com/dp/B0CDNX6NS7/ref=sr_1_1?&_encoding=UTF8&tag=jesstempora0e-20&linkCode=ur2&linkId=efc4229f6b816609dfce4f185781d99a&camp=1789&creative=9325' ><strong>The Big Git Microbook</strong></a>, creator of <a target='_blank' href='https://gitfichas.com/en'><strong>GitFichas.com</strong></a>, and a part of <a target='_blank' href='https://www.linkedin.com/learning/instructors/jessica-temporal'><strong>LinkedIn Learning</strong></a> instructors team. Jessica helped develop the AI that identifies possible unlawful expenses from Brazilian politicians. She is part of the PyLadies initiative that works to improve diversity and inclusion in technology. In her free time, she likes to knit, play video games, use her 3D printer, and is learning to create 3D models.

Sr. Developer Advocate

Jessica Temporal

The official Auth0 MCP Server is now available. MCP Hosts can securely manage Auth0 tenant resources using natural language.

**TL;DR:** The official Auth0 MCP Server is available now. We’ll go over how you can use Claude Desktop, Cursor, Windsurf and other MCP Clients to securely manage your Auth0 tenant using natural language. Learn more with [our Get Started guide](https://auth0.com/docs/get-started/auth0-mcp-server/getting-started-with-auth0-mcp-server).

<AmpContent>
<amp-youtube
    data-videoid="-Oq022WDIuY"
    layout="responsive"
    width="480" height="270">
</amp-youtube>
</AmpContent>
<NonAmpContent>
<div class='embed-container' style="position: relative; padding-bottom: 56.25%; height: 0; overflow: hidden; max-width: 100%;margin-bottom:40px;"><iframe style="position: absolute; top: 0; left: 0; width: 100%; height: 100%;" src='https://www.youtube.com/embed/-Oq022WDIuY' frameborder='0' allowfullscreen></iframe></div>
</NonAmpContent>


We want to make it easier for you to secure your apps with Auth0. Maybe you use an AI tool to help test your code, write documentation, or just “vibe code” your way through a new proof-of-concept app. Imagine saying to your favorite AI tool:

> “I want to create a mobile app with passkey and Google Sign-In, and access to an API with these scopes…”

and having Auth0 set up everything for you automatically.

Well, now you can.

We’re excited to introduce the **Auth0 MCP Server**, which enables AI tools like Claude Desktop, Cursor, Windsurf and other [MCP Clients](https://modelcontextprotocol.io/clients) to securely configure your Auth0 tenant using natural language through the [Model Context Protocol (MCP)](https://modelcontextprotocol.io/introduction).

With the Auth0 MCP Server, you can delegate tasks like creating applications, configuring APIs, or deploying Auth0 Actions without exposing credentials and without interrupting your flow to interact with the Auth0 Dashboard.

MCP is just the bridge, what really matters is how effortlessly you can now configure Auth0.

If you want to understand more about MCP in general and how auth plays a role in the world of MCP read the following guide:

<include src="LinkCard" 
    link="https://auth0.com/blog/an-introduction-to-mcp-and-authorization/"
    title="An Introduction to MCP and Authorization"
    description="Discover the Model Context Protocol (MCP) and its authorization mechanisms. Learn how to use API keys, OAuth 2.1 implementation, and best practices for secure LLM API connections." 
    img="https://images.ctfassets.net/23aumh6u8s0i/ImPbKVGMqKM4FMs9Flncw/f715edcaec63105c95189125436cc3a1/MCP_and_Authorization.jpg" />

## What Is the Auth0 MCP Server?

**MCP** is an open protocol that standardizes how AI applications talk and pass context along to an LLM. With the Auth0 MCP Server, you can use commands like the one below in the supported AI client of your preference:

> “Create a new Auth0 application named staging-app with a callback URL of https://staging.example.com/callback.”

The Auth0 MCP Server will receive the request in the MCP format and turn them into actual Auth0 Management API calls while enforcing secure authentication, scoping, and permissions through OAuth 2.0.

![High level diagram showing how the Auth0 MCP Server](https://images.ctfassets.net/23aumh6u8s0i/5pwkaCQFO7xNuQUnKQNdue/6418d6e3446c0d779ce9304ccb3b0f6a/Uploaded_from_Auth0_MCP_Server_Announcement)

This means you can delegate identity management operations to your favourite supported AI tool without handing over raw API tokens or direct access to the Auth0 Management API.

## What You Can Do with Auth0 MCP Server

With the Auth0 MCP Server, your AI tool can:

*   **List and manage Auth0 applications** – List, create, update or Applications (Web Apps, Native, and SPAs)
*   **Access and configure APIs (Resource Servers)** – Create, update or APIs
*   **Inspect tenant-level Auth0 Actions** – List, update, or deploy Auth0 Actions in a tenant
*   **Interact with Tenant Logs** – Get and search logs
*   **Manage Forms** – List, create, update, or Auth0 Forms

These capabilities mean that Claude Desktop, Cursor, and others can become your personal Auth0-assistant, setting up configurations so that you can secure applications with Auth0 even faster. Imagine building your application in Cursor while telling Cursor to create the corresponding Auth0 Application with the necessary Callback URL and Logout URLs configuration in a single message.

### Auth0 MCP Server Key Features

##### Secure Authentication

Uses Device Authorization Flow to give all supported AI tools scoped-access to your Auth0 account. This allows you to manage applications, APIs, Auth0 Actions, and more by prompting your AI tool to do so.

##### Protected Credentials

Stores credentials securely in the system keychain, preventing unauthorized access. Only the Auth0 MCP Server has access to the Auth0 access token and refresh token stored.

##### Comprehensive Tools

Supports a collection of operations for your Auth0 tenant management. CRUD operations for your APIs and applications protected with Auth0 through the Management API, deployment of tenant-level Auth0 Actions, and more. See the [complete list of operations available here](https://auth0.com/docs/get-started/auth0-mcp-server/auth0-mcp-tools-reference).

##### Seamless Integration

Follows the standard Model Context Protocol and allows you to work directly with [any supported MCP Client](https://modelcontextprotocol.io/clients). The Auth0 MCP Server setup will take care of making all the configuration for you so you can start prompting right away in Claude Desktop, Cursor, and Windsurf.

## How The Auth0 MCP Server Works

Under the hood, the Auth0 MCP Server serves as a bridge between the MCP JSON schema and the **Auth0 Management API**.

![Device Authorization Flow in the Auth0 MCP Server context](https://images.ctfassets.net/23aumh6u8s0i/5YRh5xZe6m6M4qnrsUjJUY/e56bbab80cb012b3b12b3ec465e6e7b9/Uploaded_from_Auth0_MCP_Server_Announcement)

When you initialize the Auth0 MCP Server you’ll go through the [device authorization flow](https://auth0.com/docs/get-started/authentication-and-authorization-flow/device-authorization-flow): a browser window will open up for you to authenticate to Auth0 and choose your tenant. After authenticating, your credentials will be safely stored in your system’s keychain or equivalent app depending on your operating system. Once configuration is done, you’ll be able to interact with Auth0 through any supported AI tool and all of that without having to copy your API key.

![Auth0 consent screen](https://images.ctfassets.net/23aumh6u8s0i/MA5ybpuZEcPiM3qUprt9i/7ea2cf5bf2902da7a47413cd561c6406/Uploaded_from_Auth0_MCP_Server_Announcement)

No matter which tool you are using, all of them will follow a similar collection of steps as outlined above.

## Getting Started with the Auth0 MCP Server

To get started with the Auth0 MCP Server, follow the steps below.

### Prerequisites

*   [Node.js v18](http://node.js)+
*   [Claude Desktop](https://claude.ai/download), [Cursor](https://www.cursor.com/downloads), or [Windsurf](https://www.windsurf.com/editor/download), or your favorite MCP host.
*   Auth0 account

### Install and Configure

Install and initialize the Auth0 MCP Server with a single command:

```sh
npx @auth0/auth0-mcp-server init
```

Then, you need to restart your tool for the updates to take effect. That’s it.

![Terminal showing the result of running ‘npx @auth0/auth0-mcp-server init’](https://images.ctfassets.net/23aumh6u8s0i/6v898a9HHNxLJw0XN5dVGy/1b6db2a87c7690e169c0b3ebfb8290ee/Uploaded_from_Auth0_MCP_Server_Announcement)

The initialization will:

1.  Start the [device authorization flow](https://auth0.com/docs/get-started/authentication-and-authorization-flow/device-authorization-flow);
2.  Open your browser for you to authenticate with Auth0, select your preferred Auth0 tenant, and confirm permissions on the consent screen;
3.  Store your credentials (Auth0 access token and refresh token) securely in your system's keychain;
4.  Create configurations for Claude Desktop to use the Auth0 MCP Server.

Since the stored credentials are an Auth0 access token and a refresh token, you don’t have to authenticate every time you want to use the MCP Server. The server will take care of getting new access tokens when they expire. Additionally, if you want to change the tenant you are currently using, run the `init` command again, this will allow you to select a different tenant.

The MCP Host you are using e.g.: Claude Desktop, identifies which MCP Server you want to use based on your prompt. The MCP Host will then use the configuration files to interact with that MCP Server. This is what a configuration file for Claude Desktop looks like:

```json
{
  "mcpServers": {
    "auth0": {
      "command": "npx",
      "args": [
        "-y",
        "@auth0/auth0-mcp-server",
        "run"
      ],
      "capabilities": [
        "tools"
      ],
      "env": {
        "DEBUG": "auth0-mcp",
        "PATH": "..."
      }
    }
  }
}
```

For instructions on [how to set up other clients read this documentation](https://auth0.com/docs/get-started/auth0-mcp-server/getting-started-with-auth0-mcp-server#other-mcp-clients).

Let’s take a look at what happens when you want to use Cursor with the Auth0 MCP Server to secure a FastAPI web app:

1.  You initialize the Auth0 MCP Server passing Cursor as the client like so:

```sh
npx @auth0/auth0-mcp-server init --client cursor
```

And go through the authentication and selection of your tenant

1.  Then you open Cursor and implement your web app in FastAPI like you normally would and protect it using Auth0
2.  Once implemented, you prompt Cursor to create a new Auth0 application with a prompt similar to this:

    “Create a new Auth0 web app application named ‘My FastAPI App’, with a Callback URL [http://localhost:4040/callback](http://localhost:4040/callback) and an Allowed Logout URL [http://localhost:4040](http://localhost:4040) and make sure it is OIDC compliant and set the JWT to use `alg` RS256”

1.  In the background Cursor identifies the MCP Server you are trying to use then asks you to allow it to run the tool. Cursor shows you the parameters it is going to use, something like this:

```json
{
  "name": "My FastAPI App",
  "app_type": "regular_web",
  "callbacks": [
    "http://localhost:4040/callback"
  ],
  "allowed_logout_urls": [
    "http://localhost:4040"
  ],
  "oidc_conformant": true,
  "jwt_configuration": {
    "alg": "RS256"
  }
}
```

You should double check the parameters, and then you can give your consent for Cursor to run the MCP tool call. It then passes the request in the MCP transport format to the Auth0 MCP Server

1.  The Auth0 MCP Server then maps the request from Cursor to the action in the Auth0 Management API and makes the request using the access tokens stored in the system’s keychain;
2.  Auth0 then checks the credentials and sends back the information to the Auth0 MCP Server which in turn passes the information in the MCP transport to Cursor;
3.  Cursor then takes the received information and transforms it in a natural language answer using the LLM to show the information of your recently created, it even asks if it should add that to your application environment.

You can see all of this happening in the video below:

<include src="Vidyard" id="PJn2DTV7gjXmmf4rcGeGbg" />

This way Cursor never has access to the access tokens and the Auth0 MCP Server is the only one responsible for interacting with the Auth0 Management API.

Now that you’ve seen how it works you can tell that the possibilities are endless: Can you imagine telling your favorite AI IDE to build a mobile application with Auth0 and the application being built for you without you having to do any setup? We plan to cover this and how to leverage the Auth0 MCP Server with AI tools in future blog posts.

## Recap

Most developers today are leveraging AI tools to write and test code even faster.

With the **Auth0 MCP Server** your MCP Hosts can safely, reliably, and intelligently manage your Auth0 configurations using natural language.

Identity management should be integrated in these tools so developers won’t compromise on security and still keep their productivity levels high.

Share feedback, ideas, and use cases below. We are looking forward to seeing what you’ll build and how you’ll use the Auth0 MCP Server.

### Try It Now 👉 [Check out the source code on GitHub](https://github.com/auth0/auth0-mcp-server) and [our Get Started guide](https://auth0.com/docs/get-started/auth0-mcp-server/getting-started-with-auth0-mcp-server)

The Auth0 MCP Server is here!

I stream, blog, and make youtube videos about tech stuff. I love coding, I love AI, and I love building stuff!

Staff Developer Advocate

Juan Cruz Martinez

Use Pulumi to provision Auth0 resources using your familiar programming languages

Pulumi is a fantastic solution for IaC (Infrastructure as Code). It allows you to manage your cloud services with high-level SDKs for popular programming languages like TypeScript, C#, GoLang, and Python. The familiarity and characteristics of those programming languages make it easier to set up, maintain and write code for your cloud services, including your friendly authentication provider Auth0.

This blog post will show you how to provision Auth0 resources using TypeScript and Pulumi. We will use the Pulumi tool to create and manage our infrastructure as code which is a great way to keep your infrastructure in a safe, version-controlled repository.

Let's get started!

## What Is Pulumi

![Pulumi](https://images.ctfassets.net/23aumh6u8s0i/1B42BPCAgRpINA6tClMT0O/36c34bd180b6eccb98c57b431e028b5e/logo-on-white.png)

Managing your cloud infrastructure can be a daunting task. When even automated, you need to learn a new programming language (or multiple languages) to write code for your cloud services.

Pulumi is a tool that enables developers to write code for their cloud services using familiar programming languages like TypeScript, C#, GoLang, and Python. This makes it easier than ever to get started with Infrastructure as Code.

Pulumi also abstracts away the cloud provider-specific resources and provides a unified view of all your resources in one place. This makes it easy to see what changes need to be made when you want to migrate to a different cloud provider.

## What Is Auth0 and the Auth0 Marketplace

Auth0 is a cloud-based identity and authentication management platform. It provides a platform for developers to add user authentication to their applications and supports a variety of authentication methods, including social login, username and password, and SSO.

The [Auth0 marketplace](https://marketplace.auth0.com) is where developers can find and use pre-built integrations for their applications. These integrations provide user authentication, management, and security features. The Auth0 marketplace offers a variety of integrations, including social login, enterprise federation, and developer tools.

## Setting Up Pulumi with Auth0

For this tutorial, you don't need to have prior knowledge of either Pulumi or Auth0, and we will guide you through the process of signing up, installing, setting up, and seeing your cloud resources created.

### Installing Pulumi

The first step before we start working on our project is to install Pulumi.

Pulumi is easy to install but slightly different on each operating system.

On a Mac, open your terminal, and enter.

```bash
brew install pulumi/tap/pulumi
```

On Linux, similarly, open your terminal, and enter:

```bash
curl -fsSL https://get.pulumi.com | sh
```

On Windows, it does require downloading an installer, so visit their [official installation guide](https://www.pulumi.com/docs/get-started/install/) for more information.

Once installed on any OS, you can verify that it is properly installed by running the following command on your terminal:

```bash
pulumi version
```

If everything is fine, it will output the current Pulumi version at the time of writing `v3.40.1`.

### Signing up for Pulumi

Pulumi is an open-source project and completely free to use; it requires having the Pulumi CLI installed and a backend system where the state and other configurations are installed.

You can set up and run a [self-managed backend instance](https://www.pulumi.com/docs/intro/concepts/state/#logging-into-a-self-managed-backend) or use Pulumi's cloud service, which is [free for individuals and offers several prices for teams and enterprises](https://www.pulumi.com/pricing/).

![Pulumi Sign up screen](https://images.ctfassets.net/23aumh6u8s0i/3KGglqkAt1OvK5Gey6N3au/29e794127f2390baf0aa002540b14a8c/pulumi-signup.png)

Since we want to get started quickly, we will [sign up for a FREE  account](https://app.pulumi.com/signup) using any authentication provider.

After you log in to pulumi.com, go to your terminal and run the following command:

```bash
pulumi login
```

You will see an output like

```bash
Manage your Pulumi stacks by logging in.
Run `pulumi login --help` for alternative login options.
Enter your access token from https://app.pulumi.com/account/tokens
    or hit <ENTER> to log in using your browser                   : 
```

Hit `<Enter>` to log in through your browser, and it's done. Alternatively, you can manually login into https://app.pulumi.com/account/tokens to generate a token and enter it into the CLI.

### Create an Auth0 application for the Pulumi service

Pulumi can manage a lot of the resources of your Auth0 account, but it can't create one for you. Fortunately, that's easy to do. Go ahead and <a href="https://auth0.com/signup" data-amp-replace="CLIENT_ID" data-amp-addparams="anonId=CLIENT_ID(cid-scope-cookie-fallback-name)">sign up for a free Auth0 account</a> now.

While on the [Auth0 dashboard](https://manage.auth0.com/dashboard/), navigate to the "Applications" section on the left-side menu.

![Auth0 Dashboard](https://images.ctfassets.net/23aumh6u8s0i/5ycVL5iWad2WI70iVG3Y3M/92c626c2ddfcd5bca16f881190ac48f1/auth0-dashboard.png)

Next, the new application dialog appears; enter an application name, e.g., "Pulumi App", and select the "Machine to Machine Applications" type.

![Auth0 new app dialog](https://images.ctfassets.net/23aumh6u8s0i/2ssONixKyuoHY6YgZMdPdi/72fd242d7701892ebeb165f03c5ed088/auth0-create-app.png)

Since we selected the "Machine to Machine" type, we won't need a user for Pulumi; instead, we will use client credentials. But first, we need to authorize the app to access an API, and in our case, we will select the _Auth0 Management API_, which is available by default with your tenant.

![Auth0 authorize machine to machine application dialog](https://images.ctfassets.net/23aumh6u8s0i/0IaEdXG0RMXv7c9CXBrKo/1de4c982417dd75f1811ffef6576ac8a/auth-authorize-app.png)

After selecting the API, the dialog will expand, listing all the permissions available for that API. We recommended that you follow the [principle of least-privilege](https://www.okta.com/identity-101/what-is-least-privilege-access/) and choose the authorizations carefully based on your project requirements, and no more.

With that said, and only because this is a sandbox account, we'll select all to continue, so you are not limited while following this tutorial and dealing with unauthorized access due to missing grants.

### Create a new Pulumi project

We are done with all the platform sign-ups and configurations, and we are ready to start coding.

When working with Pulumi, or any other IaC tool, you'll have to decide if you want to include your Pulumi code alongside your application code or on a separate repository. The steps won't differ, though you may want to name and place directories differently.

To start, let's create a new working directory where we'll place all our Pulumi code:

```bash
mkdir pulumi-auth0-quickstart && cd pulumi-auth0-quickstart
```

Next, we will generate a new project using the Auth0 template:

```bash
pulumi new auth0-typescript
```

> Note that we specified the template name `auth0-typescript`, but there are other languages available. You can read more about Auth0 and Pulumi in the [Auth0 Marketplace](https://marketplace.auth0.com/integrations/pulumi) and the [Pulumi registry docs](https://www.pulumi.com/registry/packages/auth0/).

Once you run the command above, the terminal window will prompt you for a few values:

- Project name: A unique project name.
- Project description: A short description of your project.
- Stack name: typically referred to as the environment or the organization plus the environment, e.g., "dev" or "auth0/dev".
- auth0:clientId: The Auth0 client id for the Pulumi App; we'll go into details on how to get this information next.
- auth0:clientSecret: The Auth0 client secret for the Pulumi App.
- auth0:domain: The Auth0 domain where your Pulumi App is running.

#### How to capture the Auth0 values from my Auth0 account

Heading back to the [Auth0 dashboard](https://manage.auth0.com/dashboard/) and into the recently created application "Pulumi App", you'll see the app overview, then click the _Settings_ tab to access the information we need.

![Auth0 Application Quick Start](https://images.ctfassets.net/23aumh6u8s0i/37CfC12yd0FCOg7lKYWw4F/c25e701c2b6f420836885fa6557e7fba/auth0-app-home.png)

Once on the settings page, the three values we need, clientId, client secret, and domain, are readily available to copy on your screen.

![Auth0 application settings](https://images.ctfassets.net/23aumh6u8s0i/H6CftW0mFWlOYj7VK7pAW/d669e9c327a1ef495e57b95f74ba6da1/auth0-app-settings.png)

Finally, enter those values in the terminal and way for the project to generate. It may take a minute or two, depending on the programming language.

And don't worry about adding your client secret here, it will be only [stored encrypted](https://www.pulumi.com/learn/building-with-pulumi/secrets/), and you can decide the level of control and encryption provider of your choice if necessary.

#### Pulumi and Auth0 quick start project structure

After your project completes, Pulumi will have generated an npm project with three essential files:

- `index.ts`
- `Pulumi.[env].yaml`: Configuration file where all your Auth0 values are stored.
- `Pulumi`: Project related metadata

Let's next take a look at the generated `index.ts` file;

```typescript
import * as pulumi from "@pulumi/pulumi";
import * as auth0 from "@pulumi/auth0";

const client = new auth0.Client("client", {
    allowedLogoutUrls: ["https://www.example.com/logout"],
    allowedOrigins: ["https://www.example.com"],
    callbacks: ["https://example.com/auth/callback"],
    appType: "regular_web",
    jwtConfiguration: {
        alg: "RS256"
    },

})

export const clientId = client.clientId
export const clientSecret = client.clientSecret
```

It is a simple file that will create a new _Auth0 Client_ (or _Auth0 application_), and will set configurations like the application type, logout URLs, callbacks, and allowed origins, all the typical settings you'll need to set up a regular web application.

### Set up the auth0 provider into an existing Pulumi project

If you already have an existing Pulumi project and would like to provision Auth0's resources, you'll first have to install the Auth0 provider for your programming language.

If using typescript, from your terminal, on the root of your Pulumi project, run:

```bash
npm i @pulumi/auth0
```

If you are using other programming languages, check out their official documentation on [how to install the Auth0 provider](https://www.pulumi.com/registry/packages/auth0/installation-configuration/)

After installing the provider, you'll have to configure the Auth0 clientId, client secret, and domain from your "Pulumi App".

To capture the value, check the previous section [How to capture the Auth0 values from my Auth0 Account](#how-to-capture-the-auth0-values-from-my-auth0-account) and, on your terminal, enter the following command with the updated values:

```bash
pulumi config set auth0:domain XXXXXXXXXXXXXX
pulumi config set auth0:client_id YYYYYYYYYYYYYY --secret
pulumi config set auth0:client_secret ZZZZZZZZZZZZZZ --secret
```

Don't forget to use `--secret` for _client_id_ and _client_secret_ as that will tell Pulumi to encrypt the values.

## Running Pulumi and Provisioning the Auth0 Resources

Now we are ready to use Pulumi to provision our Auth0 resources.

On your terminal, run:

```bash
pulumi up
```

Pulumi will first compare the current state (generated by the written code) versus the previously saved state (empty since it is our first execution) and will prepare a plan based on the results.

Here is what it looks like on the terminal:

```text
Previewing update (dev)

View Live: https://app.pulumi.com/bajcmartinez/pulumi-auth0-quickstart/dev/previews/e93bebef-eecf-49ec-a58f-86d0b7ea11db

     Type                   Name                         Plan       
 +   pulumi:pulumi:Stack    pulumi-auth0-quickstart-dev  create     
 +   └─ auth0:index:Client  client                       create     
 
Outputs:
    clientId    : output<string>
    clientSecret: output<string>

Resources:
    + 2 to create

Do you want to perform this update? [Use arrows to move, enter to select, type to filter]
  yes
> no
  details
```

Since it is the first time we run Pulumi for this project, it will create a new Pulumi stack on the backend and will provision the Auth0 application as we defined it in the `index.ts`.

Since we agree with the plan, we proceed to execute by selecting the option `yes` on the screen.

Now Pulumi is creating all the resources and will print the results on the terminal when it finishes.

```text
Updating (dev)

View Live: https://app.pulumi.com/bajcmartinez/pulumi-auth0-quickstart/dev/updates/1

     Type                   Name                         Status      
 +   pulumi:pulumi:Stack    pulumi-auth0-quickstart-dev  created     
 +   └─ auth0:index:Client  client                       created     
 
Outputs:
    clientId    : "ltiZx0e53LJoqr5IpIJrmZHAuwhsj2WZ"
    clientSecret: [secret]

Resources:
    + 2 created

Duration: 7s
```

What would happen if I were to run `pulumi up` again? It should be totally safe, so let's try it and see the results.

```text
Previewing update (dev)

View Live: https://app.pulumi.com/bajcmartinez/pulumi-auth0-quickstart/dev/previews/7fd259e6-cadf-43ab-8b74-3e2329ed818c

     Type                 Name                         Plan     
     pulumi:pulumi:Stack  pulumi-auth0-quickstart-dev           
 
Resources:
    2 unchanged

Do you want to perform this update? [Use arrows to move, enter to select, type to filter]
  yes
> no
  details
```

As expected, Pulumi doesn't detect any changes, the state variable hosted in Pulumi's service and the local configuration given in the code match.

**But what exactly happened in our Auth0 account?** If we go back to the [Auth0 dashboard](https://manage.auth0.com/dashboard/), a new application will appear with the name `client-{unique identifier}`, e.g. `client-8c41df9`. Pulumi, by default, adds that unique identifier at the end of each resource name to prevent name clashing.

![Example of application created with Pulumi in the Auth0 dashboard](https://images.ctfassets.net/23aumh6u8s0i/5qA7YmlNDvzg5GIYngXN0b/e906f8c2e552eeb91420c533fce37d31/auth0-provisioned-app.png)

## Use Case Examples for the Pulumi Auth0 SDK
Let's see next some examples of what can be done with the Pulumi Auth0 SDK.

### Provision a new Auth0 application
One of the most common tasks when automating the provisioning of Auth0 resources is to create applications, and as we discussed, we do that by leveraging the [_Client module_](https://www.pulumi.com/registry/packages/auth0/api-docs/client/).

The [official documentation](https://www.pulumi.com/registry/packages/auth0/api-docs/client/) goes into detail on all the parameters and presets for applications, but here is a small sample for a typical scenario for a SPA application (since we already covered web apps):

```typescript
const client = new auth0.Client("my-spa", {
    allowedLogoutUrls: ["https://www.my-spa.com/logout"],
    allowedOrigins: ["https://www.my-spa.com"],
    callbacks: ["https://my-spa.com/auth/callback"],
    appType: "spa",
});
```

### Provision a new Auth0 user
Another typical use case is to create users. This is commonly done for admins, other super users, or even test users.

Let's see an example of creating an _admins_ role and a user belonging to the group.

```typescript
const adminGroup = new auth0.Role("admin", {description: "Administrator"});
const jc = new auth0.User("bajcmartinez", {
    connectionName: "Username-Password-Authentication",
    givenName: "Juan Cruz",
    familyName: "Martinez",
    email: "youremail@yourcompany.com",
    password: "very-secure-!nitial-passw0rd",
    emailVerified: true, // We don't want to email the user to confirm its registration
    roles: [adminGroup.id],
});
```

In the example above, we use the [default database connection](https://auth0.com/docs/authenticate/database-connections) "Username-Password-Authentication". Optionally you can create and use other connections.

> Remember that the user requirements from your connection will apply even when using Pulumi, and if a condition does not match, e.g., "Password is too weak", then the resource will fail to create.

### Set your Branding and personalization with Pulumi and Auth0
Another area where Auth0 excels is personalization, allowing you to personalize the experience with your brand, your colors, logo, messages, email addresses, and even email templates.

You can customize everything about your user's experience through the Auth0 dashboard, but if you are using Pulumi, you can change those parameters through code, thanks to the modules like [Branding](https://www.pulumi.com/registry/packages/auth0/api-docs/branding/), [Email template](https://www.pulumi.com/registry/packages/auth0/api-docs/emailtemplate/), [Prompts](https://www.pulumi.com/registry/packages/auth0/api-docs/promptcustomtext/) and more.

Here is an example of how to change your brand colors and logo using TypeScript:

```typescript
const myBrand = new auth0.Branding("my_brand", {
    colors: {
        pageBackground: "#000000",
        primary: "#0059d6",
    },
    logoUrl: "https://mycompany.org/logo.png",
    universalLogin: {
        body: "<!DOCTYPE html><html><head>{%- auth0:head -%}</head><body>{%- auth0:widget -%}</body></html>",
    },
});
```


### What resources are available with the Pulumi Auth0 integration?
With Pulumi, you can set up pretty much everything you can do with the Auth0 dashboard, so no surprise there are quite a few modules available for us to use, like [Actions](https://www.pulumi.com/registry/packages/auth0/api-docs/action/), [Client Grants](https://www.pulumi.com/registry/packages/auth0/api-docs/clientgrant/), [Attack Protection](https://www.pulumi.com/registry/packages/auth0/api-docs/attackprotection/).

You can read the full list on [Pulumi's official docs](https://www.pulumi.com/registry/packages/auth0/api-docs/).

## Final Thoughts
More and more companies embrace DevOps and infrastructure as code to provision, manage and maintain the ever-increasing complexity of cloud services.

Pulumi helps individuals and teams to handle their IaC strategy through familiar programming languages, reducing the effort and skills needed.

Thanks to its extensibility with libraries, you can provision your servers, databases, queues, and, for example, Auth0 resources to build and customize the online identity experiences of your apps.

Thanks for learning!

Provisioning Auth0 resources with TypeScript and Pulumi

auziros:jeana-tahnk

Jeana has been in the tech industry for 15+ years, both as a communications professional and writer. As Director of Global Communications at Auth0, she works with her internal team and external agencies to amplify the company's visibility worldwide and establish its leadership in the identity industry. When she is not working, she can most likely be found on a field watching one of her three kids playing sports, or cleaning up after her one-year-old retriever who chews everything.

Senior Director, Global Communications

Jeana Tahnk

New feature adds a dedicated security team and support for multiple languages to prevent fraudulent access with stolen credentials

**BELLEVUE, Wash. – February 9, 2022 – [Auth0](https://auth0.com/)**, a product unit within [Okta](https://www.okta.com/) (NASDAQ: OKTA), today announced the general availability of [Credential Guard](https://www.auth0.com/breached-passwords#credential-guard), a new security feature that helps enterprises prevent account takeover attacks by detecting and resetting stolen passwords faster. Credential Guard upgrades Auth0’s existing breached password detection with a dedicated security team, and support for more than 35 languages and 200+ countries and territories to reduce breach detection time.

Credential Guard gives application builders the tools to help secure their apps and to help protect their users from bad actors logging in with stolen credentials. Auth0’s breached password detection enables organizations to automatically screen for stolen passwords, and alert the user, prompt for additional verification, or block access by forcing a password reset. Credential Guard adds even more visibility and speed with a dedicated security team that infiltrates criminal communities to gain access to otherwise unavailable breach data.

Auth0’s security team conducted an internal test on 100,000 random usernames, and found that the ability to detect breached passwords (breach detection efficacy) increased by a minimum of 250% when using Credential Guard compared to an automated detection solution alone.

“The goal with Credential Guard is to help organizations detect breaches as soon as they happen, to reduce the risk to the business and its users,” said Shiv Ramji, Chief Product Officer at Auth0. “Traditional web scanners and scrapers rely on breach data being made public, which can be months or even years after the initial breach. Credential Guard enables security teams to shrink that gap, and better protect their customers’ digital identities on a global scale.”

Account takeover attacks with stolen credentials, targeting everything from sensitive healthcare data to loyalty points, are one of the most common and costly cyber threats. Verizon’s 2021 [Data Breach Investigations Report](https://www.verizon.com/business/resources/reports/dbir/) (DBIR) found that 89% of web application breaches involve some sort of credential abuse (use of stolen credentials or brute force). Reusing passwords across sites increases the risk of an attack and makes it more difficult for organizations to prevent fraudulent access to user accounts. With Credential Guard, organizations can secure their apps and protect their users during the login process by detecting and resetting exposed passwords before they fall into the wrong hands.

Credential Guard is available as an Enterprise Add-on for existing Auth0 customers. For more information, please visit the [Auth0 blog](https://auth0.com/blog/detect-breached-passwords-faster-with-auth0-credential-guard/).

<include src="asides/AboutAuth0" />

## About Okta

Okta is the leading independent identity provider. The Okta Identity Cloud enables organizations to securely connect the right people to the right technologies at the right time. With more than 7,000 pre-built integrations to applications and infrastructure providers, Okta provides simple and secure access to people and organizations everywhere, giving them the confidence to reach their full potential. More than 14,000 organizations, including JetBlue, Nordstrom, Siemens, Slack, Takeda, Teach for America, and Twilio, trust Okta to help protect the identities of their workforces and customers.

### Media Contacts

Global Communications<br />
Auth0 <br />
[press@auth0.com](mailto:press@auth0.com)<br />

### Investor Contact

Investor Relations<br />
[investor@okta.com](mailto:investor@okta.com)<br />

<br>
<div class="alert alert-info alert-icon">
  These materials and any recommendations within are not legal, privacy, security, compliance, or business advice. These materials are intended for general informational purposes only and may not reflect the most current security, privacy, and legal developments nor all relevant issues. You are responsible for obtaining legal, security, privacy, compliance, or business advice from your own lawyer or other professional advisor and should not rely on the recommendations herein. Okta is not liable to you for any loss or damages that may result from your implementation of any recommendations in these materials. Okta makes no representations, warranties, or other assurances regarding the content of these materials. Information regarding Okta's contractual assurances to its customers can be found at <a href="https://www.okta.com/agreements/">okta.com/agreements</a>.<br> 
</div>



Auth0 Credential Guard Detects Breached Passwords Faster to Prevent Account Takeover

andrea-chiarelli

I have over 20 years of experience as a software engineer and technical author. Throughout my career, I've used several programming languages and technologies for the projects I was involved in, ranging from C# to JavaScript, ASP.NET to Node.js, Angular to React, SOAP to REST APIs, etc.

In the last few years, I've been focusing on simplifying the developer experience with Identity and related topics, especially in the .NET ecosystem.

Principal Developer Advocate

Andrea Chiarelli

An overall view of .NET, Microsoft's cross-platform development environment that allows you to build any type of application with C# and other languages.



Microsoft's ambition to provide developers with one platform to solve any type of problem has been fulfilled by .NET. For a couple of decades already, the .NET platform has been powering up web, desktop, and mobile applications in both the startup and enterprise scenes.

Without any doubt, .NET plays a central role in the software development industry. .NET popularity in the developer community is a fact. You can measure it through the number of open source projects around the world and the presence of [C# among the five most popular programming languages](https://www.tiobe.com/tiobe-index/). Its popularity is going to grow even more, especially after [the latest release (.NET 5)](https://auth0.com/blog/dotnet-5-whats-new/), which revolutionizes the industry by pioneering the concept of universal software development.

To understand the power of .NET, let's explore some of its technical foundations.

## What is .NET?

.NET is an open-source and cross-platform development platform for building many types of applications. Designed by Microsoft, the platform supports multiple programming languages and libraries to build web, mobile, desktop, IoT applications, and more.

![.NET 5 platform](https://images.ctfassets.net/23aumh6u8s0i/2bsVrNvzMOk64yfFw0ZU3O/b88d3412d42844d54011f31d69d5860f/dotnet5_platform)

<p align="center"><i><a href="https://devblogs.microsoft.com/dotnet/introducing-net-5/">[Source: Microsoft]</a></i></p>

Even if C# is considered the main programming language for .NET, you can use many other different languages of your choice. The languages directly supported by Microsoft are:

- [C# (C sharp)](https://docs.microsoft.com/en-us/dotnet/csharp/): A modern object-oriented programming language that belongs to the C language family. Its syntax may look familiar to C, C++, Java, and JavaScript developers.

- [F# (F sharp)](https://dotnet.microsoft.com/languages/fsharp): A functional-oriented programming language, member of the [ML](https://en.wikipedia.org/wiki/ML_(programming_language%29) language family. It also supports the object-oriented programming paradigm.

- [Visual Basic](https://docs.microsoft.com/en-us/dotnet/visual-basic/): The historical Microsoft programming language. It has become a full object-oriented programming language within the context of .NET.

.NET supports the [*Common Language Infrastructure*](https://en.wikipedia.org/wiki/Common_Language_Infrastructure) (CLI), so your source code is compiled into a [*Common Intermediate Language*](https://en.wikipedia.org/wiki/Common_Intermediate_Language) (CIL), independently of the programming language you use. This guarantees great interoperability between languages in the platform.

Besides the above mentioned languages supported directly by Microsoft, many other programming languages can compile to the .NET CIL. For example, ClojureCLR, Eiffel, IronPython, PowerBuilder, and many others. For a complete list, check out [this page](https://en.wikipedia.org/wiki/List_of_CLI_languages).

## .NET Architecture and Components

.NET allows you to build different application types, ranging from command-line to desktop applications, from web to mobile applications, from gaming to IoT applications.

This is possible thanks to its modular and optimized architecture.

### .NET Components

The .NET architecture is based on two main components:

- *CoreCLR*: This is the .NET runtime. It is responsible for executing CLI programs and includes a just-in-time compiler.

- *CoreFX*: The platform’s API implementing the CLI Standard Libraries, that is, the set of libraries that provide the most common functionalities, such as file system management, exception handling, network communication, threading, reflection, and so on. The CoreFX component is sometimes called the *Unified Base Class Library*.

### .NET Application Models

Above the core components, you have the different **application model frameworks**, that is, the libraries that offer support for developing different types of applications. So, for example, you have:

- [ASP.NET](https://dotnet.microsoft.com/apps/aspnet): The framework that allows you to build [web applications](https://auth0.com/docs/quickstart/webapp/aspnet-core-3) and [web APIs](https://auth0.com/blog/how-to-build-and-secure-web-apis-with-aspnet-core-3/).

- [Windows Presentation Foundation (WPF)](https://docs.microsoft.com/en-us/dotnet/desktop/wpf/?view=netdesktop-5.0): A graphical user interface for [Windows desktop applications](https://auth0.com/docs/quickstart/native/wpf-winforms).

- [Xamarin](https://auth0.com/blog/easy-authentication-xamarin-auth0/): The framework for building cross-platform mobile, TV, and desktop applications.

- [Blazor](https://auth0.com/blog/what-is-blazor-tutorial-on-building-webapp-with-authentication/): The framework to build client web applications by using C#. It also allows you to generate [client web apps in WebAssembly code](https://auth0.com/blog/securing-blazor-webassembly-apps/).

- [ML.NET](https://dotnet.microsoft.com/apps/machinelearning-ai): The machine learning framework that simplifies the integration of machine learning models in your .NET application.

In addition to application model frameworks, .NET offers you support for most of the common programming tasks: from file management to network communication, from security to database access. For example, on the networking side, it supports socket programming, HTTP communication, and [gRPC](https://auth0.com/blog/securing-grpc-microservices-dotnet-core/). This allows you to [create microservices](https://auth0.com/blog/implementing-microservices-grpc-dotnet-core-3/) with the protocol that better fits your needs.

For any other needs not embedded in the framework, you can find a huge number of specific libraries on the public [NuGet repository](https://www.nuget.org/). In fact, [NuGet](https://docs.microsoft.com/en-us/nuget/) is the package manager for .NET. It allows you to create, share, and use many .NET libraries for almost any purpose.

## .NET Design and Development Support

.NET support for software development is not limited to the multiple programming languages you can use. .NET also promotes the use of some best practices while letting you use the approach you prefer to build your application.

For example, it encourages you to [use dependency injection to decouple your application’s components](https://auth0.com/blog/dependency-injection-in-dotnet-core/). Dependency injection helps you design better software by limiting the component interdependence and facilitating reuse. In addition, it makes it easier to test your components.

By the way, on the testing side, .NET also comes with support for [unit and integration tests via xUnit](https://auth0.com/blog/xunit-to-test-csharp-code/).

On the front of the development experience, developers can choose from different approaches. They can use the [.NET CLI ](https://docs.microsoft.com/en-us/dotnet/core/tools/)environment, using the command line to create new projects, adding dependencies, build, run, and so on.

They can use [Visual Studio Code](https://code.visualstudio.com/) for an intermediate approach: an advanced cross-platform editor on top of the .NET CLI. Or they can use a powerful IDE like [Visual Studio](https://visualstudio.microsoft.com/vs/), available for both Windows and Mac, that provides you an interactive programming experience.

Regardless of the tool you choose, you can use many project templates to quickly start creating your new application. You can also [create your own .NET project template](https://auth0.com/blog/create-dotnet-project-template/).

## From the .NET Framework to the .NET Platform

Microsoft launched the .NET project in 2002. Since the beginning, the .NET goal was to create a universal platform for programming with any language. Of course, as the first step, Windows was the main .NET target.

However, Microsoft submitted the specifications of the .NET runtime infrastructure and the C# programming language to [ECMA](https://www.ecma-international.org/) for standardization. This led to the birth of a few porting projects on other platforms: Linux, embedded systems, mobile devices, browsers, and so on.

This also led to a fragmentation of the platform and sometimes generated confusion among developers. Take a look at [this article to learn more about the evolution of .NET](https://auth0.com/blog/navigating-dotnet-maze/).

Let’s try to clarify the differences among a few common concepts.

### .NET Framework

The .NET Framework was the initial flavor of .NET. It provides the developer with a set of APIs for the most common programming needs and interacts with the underlying operating system. It runs only on Windows, and its lifecycle is coming to an the end right now, after [the release of .NET 5](https://auth0.com/blog/dotnet-5-whats-new/).

### Mono

The Mono project brings .NET to Linux machines. It is the best known porting project based on the .NET standard specifications. Even if Mono's aim is to run on Linux applications built for the .NET Framework and vice versa, the compatibility is not always guaranteed. There are a couple of reasons for this: some .NET Framework features are too tied to the Windows operating system, and often the Mono implementation lags behind the newest .NET Framework features.

### .NET Core

.NET Core is a complete rewriting of the .NET Framework with the cross-platform goal in mind. Its redesigned architecture defines a minimal feature set as the common core across Windows, Linux, and Mac platforms. The rest of the features can be downloaded as library packages.

### .NET Standard

The .NET Standard is not another .NET implementation. It is a formal specification of .NET APIs that helps to create cross-platform libraries. If a platform supports a given .NET Standard version, then a library supporting the same version will run on it, regardless of the device type and the framework implementation (.NET Framework, Mono, .NET Core).

### .NET

Since the beginning, the .NET term has been used to indicate the universal development platform. However, many implementations arose since then, so the .NET name created ambiguities. .NET 5 aims to make concrete the initial vision of a universal development platform. It replaces the current existing implementations: .NET Framework, .NET Core, and even Mono. So, from .NET 5 on, only .NET will exist as a name and as a platform.

## Auth0 and .NET

Auth0 has extensive support for .NET that allows you to easily integrate modern authentication and authorization into your .NET applications: from specific SDKs to documentation, from blog posts to sample projects. In this section, you find a list of the .NET resources that Auth0 provides you.

### .NET QuickStarts

Auth0 Quickstarts help you in setting up your first [authentication](https://auth0.com/docs/authentication) and [authorization](https://auth0.com/docs/authorization) integration. They guide you in adding the needed code and the required configuration step by step. If you are logged in, the code snippets are configured for your account. If you don't have an account, you <a href="https://auth0.com/signup" data-amp-replace="CLIENT_ID" data-amp-addparams="anonId=CLIENT_ID(cid-scope-cookie-fallback-name)">can sign up for free with Auth0</a>.

The following .NET-related Quickstarts are available:

- [**ASP.NET Core Web API v3.1**](https://auth0.com/docs/quickstart/backend/aspnet-core-webapi): This Quickstart helps you to add authorization to an ASP.NET Core Web API using the standard [JWT](https://jwt.io/) middleware.
- [**ASP.NET Core v3.1 Web Application**](https://auth0.com/docs/quickstart/webapp/aspnet-core-3): This Quickstart demonstrates how to add user login to an ASP.NET Core Web Application.
- [**WPF/Windows Forms (WinForms**)](https://auth0.com/docs/quickstart/native/wpf-winforms): The Quickstart guides you in adding user login Windows desktop C# applications.
- [**Xamarin**](https://auth0.com/docs/quickstart/native/xamarin): This Quickstart helps you add user login to Xamarin applications.
- [**Windows Universal App**](https://auth0.com/docs/quickstart/native/windows-uwp-csharp): Reading this Quickstart, you will learn how to add user login to [Windows Universal](https://docs.microsoft.com/en-us/windows/uwp/get-started/universal-application-platform-guide) C# applications.

### Software Development Kits (SDKs)

Auth0 provides you the following SDKs to help you to integrate authentication and authorization in your .NET applications:

- [**.NET Client Library for Auth0**](https://github.com/auth0/auth0.net): This SDK supports two APIs:
  - *The Authentication API*: This API allows you to add [OIDC](https://auth0.com/docs/protocols/openid-connect-protocol)-based authentication to your application
  - *The Management API*: This API allows you to interact with the [Auth0 Management API](https://auth0.com/docs/api/management/v2) and deal with your [Auth0 tenant](https://auth0.com/docs/videos/get-started-series/architect-your-tenant).
- [**Auth0 OIDC Client for .NET** ](https://github.com/auth0/auth0-oidc-client-net): This library supports [OIDC authentication](https://auth0.com/docs/protocols/openid-connect-protocol) for .NET desktop applications based on WinForms, WPF, and UWP as well as Xamarin mobile applications.

### .NET blog posts

In addition to SDKs and Quickstarts, Auth0 provides you with specific content, use cases, and code examples through its [developer blog](https://auth0.com/blog/developers/). You can find [many .NET-related articles](https://auth0.com/blog/search/?query=.net) that help you build and secure your applications and keep up to date with the most recent features. Most articles include a sample project to demonstrate how to practically implement your apps. You can download them from GitHub, <a href="https://auth0.com/signup" data-amp-replace="CLIENT_ID" data-amp-addparams="anonId=CLIENT_ID(cid-scope-cookie-fallback-name)">sign up with Auth0</a> if needed, configure the app, run it, and explore the code.

So, enjoy building your next .NET project with Auth0!



What is .NET? An Overview of the Platform

facundo-giuliani

Facundo is a Systems Engineer from Buenos Aires, Argentina with 15+ years of experience in software development. Full Stack Developer. Auth0 Ambassador. GitKraken Ambassador. Cloudinary Media Developer Expert. He is also an open-source contributor.

Systems Engineer, Full Stack Developer

Facundo Giuliani

Most languages and frameworks support asynchronous programming. But, what is it exactly? Learn about async programming and how to implement it in C#.

You probably already read about asynchronous programming. `async` and `await` words are used everywhere, no matter which programming language we choose. Talking about .NET framework, and C# in particular, we have some native functions, classes, and reserved words that we can use to implement asynchronous tasks and workflows in our projects.

In this article, we will talk about synchronism, parallelism, concurrency, and how to implement asynchronous algorithms in our C# applications.

## Synchronous and Asynchronous Tasks

As a developer, you surely faced scenarios where certain actions or operations took a considerable amount of time to execute. We regularly have to do long-running tasks such as reading a file, calling an API, or downloading a big file. We could wait for one of these tasks to be finished before executing another task. If that's the case, we say we are working in a "synchronous" way. By doing this, the whole application gets blocked and stops responding until the whole task is completed, and we can move on to a new one.

In some cases, we don't have any alternative. If we have Task1 and Task2 that depend on the result of the first action, we will have to wait until Task1 finishes executing to start Task2. But we could have the scenario where the subsequent tasks (or some of them) don't depend on the result of the previous long-running task. If that's the case, we have different strategies and approaches that we could take to make our application faster and in a more performant way.

For example, we could have an application that runs concurrent tasks internally. There is a button and a task executed when it is clicked. Right after the user clicks on the button, the application can trigger a separate thread to run the requested task. In the meantime, the main thread becomes available to execute other actions while the button's task is executed in the background. Doing this, we keep the UI responsive in case the user wants to interact with it.

Another scenario would be needing to run multiple copies of a certain group of actions or instructions. An example of this would be uploading many files at the same time. In this case, our application could trigger one thread per file and execute the necessary code inside of them. Doing this, we would be processing the files in a "parallel" way. In a nutshell, here is the difference between the two concepts: concurrency means the application is making progress on more than one task at the same time, while parallelism is about running multiple tasks simultaneously.

But let's say we have to read a big file, call an API, and do some complex calculations. There is no dependency between the three tasks, but we need the result of all of them to continue the execution of our application and update the UI. In this case, we could execute our tasks "asynchronously" with the three ones running simultaneously and wait for their result to do the subsequent tasks.

## What Is Asynchronous Programming?

We could define asynchronous programming as the way of executing programming code in a thread without having to wait for an I/O-bound or CPU-bound task to finish. I/O-bound operations could be file-system accesses, HTTP requests, API calls, or database queries. And CPU-bound operations would be actions like encrypting data, complex calculations, image or document management.

One of the ideas of asynchronous programming is to divide our logic into *awaitable* tasks so that we don't block the execution of our application. We can call an async method and get a task object that represents it. In the meantime, we can do some not related and not dependant work. After we execute those operations, we await the async task, which may already be finished or not. If the execution is finished, we will get the resulting value from the task and use it in the next dependant operations.

### Benefits

Some of the benefits we have working with asynchronous tasks are:

- We keep the UI of our app responsive.
- We improve the performance of our application.
- We avoid [thread pool starvation](https://medium.com/criteo-engineering/net-threadpool-starvation-and-how-queuing-makes-it-worse-512c8d570527).

### Drawbacks

Although, there are some drawbacks when working with async programming:

- Code gets more complex and harder to maintain.
- There is increased memory allocation, as some objects have to stay alive longer while awaiting other code to be executed.
- It can get hard to find bugs occurring in asynchronous tasks.
- When we're writing an asynchronous piece of code, all our application code tends to become asynchronous.

## Asynchronous Programming Patterns

To perform asynchronous operations in .NET, we can follow three different patterns:

**Asynchronous Programming Model (APM)**: Let's say we have two methods, and we name them `BeginOperation` and `EndOperation`. After calling `BeginOperation`, our application can continue executing tasks on the calling thread while the async task is executed on a different thread. For each call to `BeginOperation`, our app should also call `EndOperation` method to get the results. In .NET, it can be implemented using `IAsyncResult`. Let's see an example of this model:

```csharp
using System;
using System.IO;
using System.Threading;
public sealed class Program
{
    public static void Main()
    {
        var buffer = new byte[100];
        var fs = new FileStream("bigFile.txt", FileMode.Open, FileAccess.Read, FileShare.Read, 1024, FileOptions.Asynchronous);

        IAsyncResult result = fs.BeginRead(buffer, 0, buffer.Length, null, null);

        // Do other things...

        int numBytes = fs.EndRead(result);
        fs.Close();

        Console.WriteLine("Read {0}  Bytes:", numBytes);
    }
}
```

**Event-based Asynchronous Pattern (EAP)**: We start an async method that will trigger a `Completed` event when the task is completed, making the result available to our application. This would be an example of this model:

```csharp
public class ExampleHandler
{
    public event EventHandler OnTriggerCompleted;

    public void Start(int timeout)
    {
        var timer = new Timer(new TimerCallback((state) =>
        {
            OnTriggerCompleted?.Invoke(null, null);
        }));

        timer.Change(timeout, 0);
    }
}

class Program
{
    private static void Main()
    {
        var handler = new ExampleHandler();

        handler.OnTriggerCompleted += (sender, e) =>
        {
            Console.WriteLine($"Triggered at: { DateTime.Now.ToLongTimeString()}");
        };

        handler.Start(3000);

        Console.WriteLine($"Start waiting at {DateTime.Now.ToLongTimeString()}");
        Console.WriteLine($"Processing...");
        Console.ReadLine();
    }
}
```

**Task-based Asynchronous Pattern (TAP)**: We have an `OperationAsync` method that returns a `Task` object, as in the following example:

```csharp
class ClassName
{
    public Task OperationAsync(byte [] buffer, int offset, int count);
}
```

 We can await that method, using `async` and `await` keywords. We will go deeper into this approach in a while.

> Keep in mind that **the APM and EAP approaches are legacy models and they are no longer recommended**. Microsoft recommends using the *Task-based Asynchronous Pattern* to implement async programming in our applications.

## Asynchronous Programming in C#

As we mentioned, async programming in C# can be accomplished by implementing the *Task-based Asynchronous Pattern*. We will have methods that return a `Task` or `Task<T>` object. Defining those methods as async operations will enable us to await them and keep using the same execution thread to run other operations that are not linked to the awaited task.

C# provides us two keywords to handle `Task` objects in an easier way: `async` and `await`. Adding the keyword `async` to a method signature allows us to use the `await` keyword inside the method while instructs the compiler to create a state machine to handle the asynchronicity. On the other hand, the `await` keyword is used to pause the execution of a method and asynchronously wait for a `Task` to finish, while the current thread is sent back to the thread pool instead of keeping it in a blocked state. Everything happens in the background, avoiding us to implement and maintain the complexity of thread management and the state of the calls.

Let's analyze this piece of code:

```csharp
public async Task<User> GetLoggedUserEmailAsync()
{
  int userId = GetId();
  string email = await GetEmailAsync(userId);
  User user = GetUserByEmail(email);
  return user;
}

public async Task<string> GetEmailAsync(int userId)
{
  // Do something
}
```

An async method should return `void`, `Task`, or `Task<T>`, where `T` is the return data type that we need. Returning `void` is normally used for event handlers. The keyword `async` enables us to use the command `await` within the method so that we can wait for the asynchronous method processing as expected.

Notice that the methods end with "Async". Although it is not mandatory, there is a naming convention that an asynchronous method name should end with the word "Async". This convention aims to make it clear to the consumer of the functionality that the method won't complete all of its work synchronously.

In our previous example, `GetId()` is called synchronously. When the execution thread encounters the `await` keyword on `await GetEmailAsync(userId)`, it creates a `Task<User>` that contains the remainder of the `GetLoggedUserEmailAsync` method. This task is executed asynchronously after the `Task<string>` returned by `GetEmailAsync`. So, the `User` object is returned from the `Task<User>` created by the `await` keyword.

## Asynchronous Code in Action

Let's see a short example to review the concepts previously explained. Having the following console application:

```csharp
using System;
using System.IO;
using System.Threading.Tasks;

class Program
{
   static async Task Main(string[] args)
   {
       string filePath = "bigFile.txt";

       // Create a big file
       FileStream fs = new FileStream(filePath, FileMode.CreateNew);
       fs.Seek(1024 * 1024, SeekOrigin.Begin);
       fs.WriteByte(0);
       fs.Close();

       var task = ReadFileAsync(filePath);

       Console.WriteLine("A synchronous message");

       int length = await task;

       Console.WriteLine("Total file length: " + length);
       Console.WriteLine("After reading message");
       Console.ReadLine();
   }

   static async Task<int> ReadFileAsync(string file)
   {
       Console.WriteLine("Start reading file");

       int length = 0;

       using(StreamReader reader = new StreamReader(file))
       {
           string fileContent = await reader.ReadToEndAsync();
           length = fileContent.Length;
       }

       Console.WriteLine("Finished reading file");

       return length;
   }
}
```

In this application, we read a big file, count the number of characters it has, and print different messages in the console. The method that triggers the file reading operation is defined as asynchronous, and it's the one that starts the asynchronous thread reading the text. While the message "A synchronous message" is printed, the reading of the file continues. If we execute the application, we can see how the execution thread behaves based on the output messages:

![Asynchronous sample application output](https://images.ctfassets.net/23aumh6u8s0i/6QF3i0BPAoDOSdF0T1jm07/269b11a895d0f74b415d49aa5b23d106/async-program-console.png)

## Summary

In this article, we talked about how we can manage and organize the tasks in our application based on the dependency and order of execution. We talked about synchronism, parallelism, concurrency, and asynchronism. We described async programming, its benefits, and how we can implement it in our C# applications. You can find the code shown in this article in [this GitHub repository](https://github.com/auth0-blog/c-sharp-async-intro).

If you want to learn more about asynchronous programming in C# and what advanced features we have available, you can go to:

- [Async in depth](https://docs.microsoft.com/en-us/dotnet/standard/async-in-depth) by Microsoft.
- [Asynchronous programming with async and await](https://docs.microsoft.com/en-us/dotnet/csharp/programming-guide/concepts/async/) by Microsoft.
- [Asynchronous Programming Guidance](https://github.com/davidfowl/AspNetCoreDiagnosticScenarios/blob/master/AsyncGuidance.md) by David Fowler.
- [Async/Await - Best Practices in Asynchronous Programming](https://docs.microsoft.com/en-us/archive/msdn-magazine/2013/march/async-await-best-practices-in-asynchronous-programming) by Microsoft.

<include src="asides/DotNetCore" />




Introduction to Async Programming in C#

michael-bui

I'm a software developer with a background in consulting and experience in technical leadership roles. The majority of my career has been with using .NET to build applications across the full-stack and for mobile, desktop, and web. My main area of interest is in agile software development and building cross-platform applications using technologies like Flutter and Xamarin.Forms.

These days I do more work using Flutter. Besides using it professionally to build applications, I've done a talk at a meetup, maintain a blog where I post about Flutter in <a href="https://dexterx.dev">DexterX</a> and contribute to and maintain various open-source projects.

Sofware Developer

Michael Bui

Learn the basics of the Flutter development kit and the Dart programming language and build an app to manage your shopping wishlist.

Build a Flutter Wishlist App, Part 1: Introducing Flutter and Building a Basic Wishlist App

T025590N6-UA74EV4TB-edf9e73df2fc-512 avatar

T025590N6-UA74EV4TB-edf9e73df2fc-512

I’m a product designer based in Portland, OR. I specialize in breaking down big messy problems and coming up with elegant solutions.

Product Designer

Stacy Taylor

Read how we’re updating our language to be more inclusive.

Words matter. The words and phrases we use reflect our values and attitudes towards those around us. As language is constantly evolving, words and phrases that were commonplace in the past may strike us as deeply offensive today. It’s important that we reflect on the terms we use and consider how they may be harming others or how and how they might be perceived in the future. 

After injustices in our society were so glaringly emphasized in the summer of 2020, several tech companies, including [Github](https://www.zdnet.com/article/github-to-replace-master-with-alternative-term-to-avoid-slavery-references/), [Google](https://9to5google.com/2020/06/12/google-android-chrome-blacklist-blocklist-more-inclusive/), [Twitter](https://twitter.com/negroprogrammer/status/1278728952522043393), and [Intercom](https://www.intercom.com/blog/updating-our-terminology/), began removing terms with racist roots, like “master,” “slave,” “whitelist,” and “blacklist.” 

At Auth0, we wanted to go further and re-examine our use of other, more nuanced terms, such as gendered and patriarchal, as well as ableist, ageist, and violent language.

We began this investigation in 2019, and over the past several months, teams across Auth0 have been working to remove problematic terminology from our codebase, documentation, and internal and external communications. 

### We Give a Shit

Critics of these efforts are quick to claim that this shift is just one more example of virtue signaling or political correctness run amok. But while we understand these small changes are not going to solve systemic racism, that doesn’t mean the effort is wasted. Everyone deserves a seat at the table in the technology world, and inclusive language is one small step towards making that a reality.

### Putting a Plan in Place

Our first step was to identify the terms we wanted to replace—there were obvious ones, like “whitelist,” “blacklist,” “master,” “slave,” “white hat,” and “black hat.” But we also wanted to address ableist terms, like “dummy value,” “crazy,” and “sanity check,” as well as gendered terms, like “man-in-the-middle attack” and “man hours.”

We began by creating an #inclusive-language Slack channel to discuss and debate different words and suggested alternatives. Based on those conversations combined with an analysis of other companies’ changes, we arrived at an initial list of terms and replacements. We replaced master and slave with main and secondary, whitelist and blacklist became allowlist and denylist, and white hat and black hat hackers are now ethical and malicious hackers. Grandfathered became a legacy, and brown-bag lunches are now called lunch and learns. We replaced man hours with person-hours and man-in-the-middle attacks with bucket brigade attacks. Sanity check and dummy value were replaced by the less ableist terms confidence check and placeholder value. 

### One Team, One Score

Next, we put together an inventory of all places where those terms were being used in our product, marketing, and other communications. After that, we identified and contacted the primary stakeholder for each area, such as the head of documentation, marketing team, individual product managers, and engineering leads.

Despite having their own roadmaps and quarterly commitments to worry about, everyone was incredibly receptive and eager to tackle this project. We provided the inventory and the timeline, but it was up to each individual team to make the changes. Most teams were able to fit the work into upcoming sprints, and we tracked all of the tickets on a centralized page to keep everybody accountable.

### Keeping the Momentum Going

While the initial push to remove specific terms from our product and communications was a good start, we also wanted to empower individuals to keep moving forward. To do so, we put together a set of principles and guidelines:

#### Impact matters more than intent

If a term perpetuates harm, it should be replaced regardless of the intent behind it.

While it is useful to consider the etymology of a term to determine whether it has biased roots, it’s important to remember that language is constantly evolving, and dictionary definitions are not how people use language in real life. Just because a term’s roots aren’t explicitly racist doesn’t mean the term itself doesn’t cause harm.

#### Use direct language

Writing should be clear and concise.

Avoiding idioms and metaphors removes value judgments, eliminates obfuscation, reduces the chance of accidentally using a term with problematic roots, makes localization easier, and improves readability.

#### Be the change you wish to see

We have the opportunity and responsibility to lead change in our industry.

We believe that inclusive language can show how we are inclusive for all users. We encourage other companies to follow our lead.


Auth0’s principles, guidelines, replacement terms, and additional resources are available to all employees. The `#inclusive-language` Slack channel continues to be a safe space for employees to engage in dialogue about biased language. These resources are also being added to our onboarding program so that new employees understand our commitment to inclusive language right from the start.  

### N + 1 > N

At Auth0, we believe that consistent, iterative improvement leads to incredible results. We recognize that addressing our use of biased language is an ongoing process rather than a one-and-done effort. With our guidelines and principles in place, all employees are empowered to address biased language as they find it. We all have an obligation to be intentional with our language and consider how all words we use have the potential to reflect our values and beliefs.

<include src="asides/AboutAuth0" />

Our Language Reflects Our Values

vincenzo-chianese

Vincenzo Chianese is an Italian Software Developer focused on Web APIs and User Interfaces. He has been working for the last years in API companies such as Apiary, Oracle, LunchBadger, Stoplight. Currently, he is working for Microsoft to help move Microsoft Graph forward and authored some open-source tools in the market (Prism, Express Gateway).

API Architect

Vincenzo Chianese

A high-level overview of Clojure, a functional programming language based on LISP and powered by the JVM.



In a [previous article](https://auth0.com/blog/refactoring-breaking-functions-apart-typescript/), we borrowed some concepts from [Clojure](https://clojure.org) and applied them to other programming languages (TypeScript in our specific example). In this blog post, we’re going to explore some rationales about Clojure itself and why you should give it a shot.

## Clojure History and Rationale
Clojure has been designed and implemented by [Rich Hickey](https://twitter.com/richhickey) as an attempt to solve the pain points he was having when writing [situational programs](https://www.youtube.com/watch?v=2V1FtfBDsLU). In particular, no matter the programming language, he would always end up with software requiring herculean efforts to make relatively minimal changes.

That is not that far from the situations a lot of us are living at our daily job.

On another project, he decided that the imperative approach was a misfit and tried to do things differently. By using immutable data structures and a custom-designed functional library, his team had a much more enjoyable experience, and the project was ultimately successful.

Functional programming was a win, but applying it in a language that’s not functional in the core felt cumbersome.

That sparked the idea of working on a language where functional programming would be at least the default approach and possibly, the only one.

Clojure is the result of all this. It’s a **LISP** **functional** programming language running on the **JVM** designed for **concurrent** programs.

We’re going to take a deeper look into all of these points but, for anybody interested in understanding more about the history and the rationale behind Clojure, the [10 years of Clojure paper](https://download.clojure.org/papers/clojure-hopl-iv-final.pdf) is a great resource to look at.

## How I Ended up Programming in Clojure
My history with Clojure is probably unconventional. 

I have been working in the Web API industry for the last six years. One of the struggles that we have been having since forever has been _caching_. Many APIs that I see on the market usually decide to pass on most of the caching opportunities rather than dealing with them correctly.

One day I found myself discovering [Datomic](https://datomic.com) while watching a talk recording. I was particularly interested in its immutability features that, from a caching standpoint, were very appealing to me.

There was only one (big) problem: Datomic can only be used from Clojure or Java or through a deprecated HTTP API because of its peculiar model.

Java was not an option for me, and whenever I was looking at Clojure code, I would just give up after 10 minutes or so of understanding the syntax.

One day I decided that I had enough, and I had to figure out how to write Clojure. I did some research, and I found a great [introduction video from Rich Hickey himself](https://www.youtube.com/watch?v=P76Vbsk_3J0) that I still consider to be the best resource to start with Clojure.

From there, I was finally able to experiment how caching would look like with Datomic, and consequently, I got more proficient. Ultimately I liked it up to a point where I thought it'd make a lot of sense to use it in my job.

## It’s a LISP
Clojure is a [LISP 1](https://en.wikipedia.org/w/index.php?title=Common_Lisp&oldid=402600249#The_function_namespace) — with some minor modifications.

That is usually enough to scare a lot of people and move on. The [number](https://i.redd.it/9gwghrz9rcs11.jpg) of memes about [LISP](https://onweb3.files.wordpress.com/2017/09/practical-nlp-with-lisp-27-728.jpg) says it all, but keep reading: we can figure it out.

While this is not going to be a Clojure guide, I want to be offering a 10k feet view of the language. I hope the Clojurians will forgive me for some inaccuracies in the terminology, but in the spirit of being pragmatic, I had to take some… poetic licenses.

### Fundamental data structures
Clojure supports all the atomic data types you'd expect from any other language: _integers, doubles, strings, booleans, keywords, symbols, null_ — with the unique additions: _ratios_ without precision loss such as [22/7](https://en.wikipedia.org/wiki/Proof_that_22/7_exceeds_%CF%80).

### Aggregates
Clojure supports lists `(1 2 3 4)`, vectors `[1 2 3 4]`, maps `{:name Clark :surname Kent}`, and sets `#{1 2 3 4}`.

LISP does not require commas to separate values. They are like whitespaces, but you still can use them if they make you feel better. We could rewrite our previous examples to be `(1, 2, 3, 4), [1, 2, 3, 4] {:name Clark, :surname Kent} and #{1, 2, 3, 4}`, yielding the same final result.

### Evaluation rules
That is 90% of the Clojure (and LISP) syntax, and it's all you need to start writing programs.

LISP indeed stands for **LISt Processing**: the basic idea is that the evaluator will receive nothing but data structures, and according to the evaluation rules, it will perform an action.

The golden rule, enabling a good chunk of functionalities in LISP languages, is that when the evaluator encounters a **list**, it will treat the **first** element as a symbol. It will try to resolve and "call" it with the other list elements as arguments.

For instance:

``` clojure  
(println "Hello")
```

This is a list containing the symbol `println` and then the string `"Hello"`.

When the evaluator encounters this, it will try to resolve the symbol in the first element. In this case, it's a function automatically imported from the `clojure.core` namespace. So, the resolution completes successfully, and the system will invoke its content and supply the rest of the list as the arguments to the function.

There are other [special forms](https://clojure.org/reference/special_forms) that the evaluator treats differently with respect to the regular evaluation rules. Still, generally speaking, you can think of the first element in a list as the command for the evaluator.

Let's go through some very common special forms:

``` clojure  
; Binds a value to a symbol and then prints it
(def value 3)
(println value)

; Binds a symbol to a function definition
(defn add [a b] (+ a b))

; Binds a symbol to a result of a function call
(def result (add 2 3))
```

I want to reiterate this one more time: all these are nothing but data structures. It is indeed possible to instruct the evaluator to avoid the default rule and treat the list as… a list by quoting it: `'(hello 1 2 3)`.

On the other hand, it is also possible to ask the evaluator to eval a list using the default rule: `(eval '(println "Hello"))`.

### Code is data, data is code
Most programming languages have their own syntax and grammar. Compilers then have a **lexer** that outputs a series of data structures that will then be used to create the byte code (or the assembly instructions, in the case of native compilers).

In Clojure (and LISP languages), there is no such thing as syntax. We are essentially writing the program directly as a set of data structures: the developer and the compiler speak the same language, with no translation involved. This concept is known as **homoiconicity**, and it is explained in detail in [this great talk by Stuart Sierra](https://www.youtube.com/watch?v=o7zyGMcav3c).

So what does "Code is data, data is code" mean, without being philosophical?

Well, if we really want to be pragmatic:

1.  All the code of a Clojure program is ultimately data structures.

``` clojure  
(defn -main [] (println (rand-int 10)))
```

This small program that outputs a random integer between 1 and 10 is nothing more than a list containing some data. Specifically, we are looking at a list whose elements are:

1.  A symbol: `defn`.
2.  Another symbol: `-main`.
3.  An empty vector.
4.  Another list.

The evaluator, with its rules, will turn that set of data into something executable.

Every list in Clojure can potentially be executed:

``` clojure  
(def code '(defn -main [] (println (rand-int 10))))

((eval code))
```

In this counterexample, we have the symbol containing some data, and we can ask the evaluator to execute it according to its rules.

This is also one of the principles behind [Datalog](http://www.learndatalogtoday.org), the database query language that is powering [Datomic](https://datomic.com).

Many interesting implications come out of this (for example, how easy it is to write [macros](https://clojure.org/reference/macros)), but this goes beyond the article's scope. 

<include src="TweetQuote" quoteText="In Clojure, code is data, data is code."/>

## Leaning to Functional
Clojure is usually categorized as a _functional_ language.

Now, everybody has his own definition of functional, and it's not my intention to debate it, so I'm going to say that Clojure _leans_ to functional programming, and we'll show why in this section.

### Immutable data structures
In Clojure, most of the data structures you work with are immutable and cannot be changed. For example, adding a new key to a map will return a new map.

``` clojure  
(def user {:name "Clark"})

(assoc user :surname "Kent")
```

The `assoc` function returns a new map instead of modifying the old value associated with the `user` symbol. Yet, it’s efficient and meets all the performance expectations of the regular data structures you'd find in other languages because of their clever [implementation](https://clojure.org/reference/data_structures).

The `let` macro can be used to create a new lexical scope with modified data:

``` clojure  
(def user {:name "Clark"})

(let [user-with-surname (assoc user :surname "Kent")] (

  (add-user user-with-surname))
```

### Multithreading

Immutable data flowing is immensely useful when writing multithreaded programs.

We are not going to go that much into detail, but a significant hassle of multithreading programming is due to resource access synchronization, which can lead to deadlock if not handled correctly.

That problem does not exist in Clojure. Because of immutable data structures, you have a guarantee that nobody will change the data while you’re using it. Even when a shared state is required, Clojure provides a [great story](https://clojure.org/reference/refs) to handle it.

Essentially, Clojure separates the  **reference types** (a label for something that can change) and the **values**.

It turns out such an approach is very effective and is the _opposite_ of what usually Object-Oriented programming languages do.

<include src="TweetQuote" quoteText="Clojure leans to functional programming."/>

## No Objects
Clojure rejects [the Object-Oriented model](https://clojure.org/about/rationale#_object_orientation_is_overrated) and considers it overrated and not particularly useful to the kind of applications we write these days ("situational programs").

Rich Hickey elaborates in great detail why objects might not be a good idea in his [*Simple made easy* talk](https://www.youtube.com/watch?v=kGlVcSMgtV4). There's also a [short clip](https://www.youtube.com/watch?v=aSEQfqNYNAc) that summarizes most of his frustration about objects. I do suggest to stop reading the article and watch this clip right now.

In Clojure, you have data and functions, and yes, you can create very sophisticated programs with a set of tools significantly simpler than the one we use today.

## Runs on the JVM and the Browser
Clojure was designed to be a hosted language since its inception. 

While originally conceived to run on both the JVM and the .NET runtime, its primary target is the JVM, but there’s a [.NET core version](https://github.com/clojure/clojure-clr/compare/newframework?expand=1) being worked on and not far from being complete.

This implies that Clojure has a good interop story, and it has access to all the superb number of components and libraries that the host can offer (whether it’s the JVM or the .NET).

Clojure indeed provides some special forms that can be used to deal with Java code:

``` clojure  
; Calling a static method on a namespace
(System/getenv) ; Same as System.getenv() in Java

; Creating a new object
(def n (new Integer 10)) ; same as new Integer(10) in Java

; Accessing an instance method
(. n toString) ; Same as n.toString() in Java
```

The opposite is also true. If your project is using Java, you can call Clojure functions:

``` java  
IFn plus = Clojure.var("clojure.core", "+");
plus.invoke(1, 2);
```

The Clojure website has an [interop reference page](https://clojure.org/reference/java_interop) where everything is explained in detail.

Additionally, Clojure [runs in the browser as well](https://clojurescript.org) via ClojureScript, a compiler that targets JavaScript.

## REPL
Some runtime environments offer a REPL (Read, Evaluate, Print, Loop) as part of the kit you’re downloading.

The basic idea is that — by running the runtime in REPL mode, you can send instructions from an external source — and not necessarily from a file — and get the results printed out on the screen as soon as the results are ready.

Clojure brings this concept to a new level, allowing you to run a remote REPL and expose it over a socket from your running program (even from a production environment) and interact with the system live while it’s up and running.

This comes to be very handy in case of debugging sessions but also during the day to day development. 

You can fix a function while your program is running without having to restart it and lose all the accumulated state.

To be fair, this feature is also available in [other runtime environments](https://nodejs.org/en/knowledge/REPL/how-to-create-a-custom-repl/), but Clojure has been the only language I’ve seen where this approach is the rule. Also, the tooling is crafted to encourage such an approach.

## Ecosystem
Every programming language is only as good as its own ecosystem. Components, libraries, and community are an essential part of a successful project, and Clojure is not behind.

### Community
Clojure programmers (aka Clojurians) hang out in a [slack channel](http://clojurians.slack.com) that is free to join. Some of their maintainers are actively monitoring it.

There is also a dedicated [forum](https://ask.clojure.org) maintained by the Clojure team and a number of [annual events](https://clojure.org/community/events).

I was amused to learn that, by using Clojure, I instantly had almost doubled the number of speaking opportunities I had. The JVM is a big deal.

### Deprecating policy vs. ended project
As a JavaScript developer, I am used to the idea that my projects' dependencies are updated almost on a daily basis, and “update day” is part of my weekly errands.

I was surprised to see that, generally speaking, that is not a thing in Clojure.

Seeing a library that hasn’t been updated for months or so is common, and that is not an index that the project has been abandoned or that its quality is bad.

In Clojure, libraries tend to have a really narrow scope: when the main aim has been reached, the project is _done_, and people move on.

I have never updated a dependency so far in my Clojure projects.

## What Is Not that Cool
Clojure is not all fun and games. In this section, we’re going to take a quick look at some parts that I personally do not like.

### Pleasing the compiler
Clojure’s reader is single pass, making mandatory for all the used symbols to be defined before they can be used

For example, the following code will not work:

``` clojure  
(add-numbers 3 4)

(defn add-numbers [x y] (+ x y)
```

On the other hand, its JavaScript counterpart will run because functions and variables get hoisted:

``` javascript  
addNumbers(2,3);

function addNumbers(x, y) {
  return x + y;
}
```

> **Note:** this is not true for arrow functions, but you get the point.

This little example shows the idea that the user has to please the compiler.  For somebody, that is not a big deal; for somebody, it is.

An example of an actual implication is how you organize your code: this forces you to put the most specific functions on the top of the file.

When reading the source code, it’s usually easier to reason about when the high level exported functions are on the top and then go deeper in implementation details as you scroll the file.

While this might be partially prevented by putting the functions on a different file and then importing them, that is not always a viable solution.

### The external world is still messy
Clojure has a very rich repository of libraries and components called [Clojars](https://clojars.org).

The issues come when you have to exit the Clojure “bubble” and import external code. Side effects, in place mutations, [death by specificity](https://www.youtube.com/watch?v=aSEQfqNYNAc) are back again, making it necessary to write a functional interface/wrapper to make it play nicely with the rest of your Clojure program.

In some cases, somebody has already done the work, such as [HTTP clients](https://github.com/dakrone/clj-http) or [JDBC](https://github.com/seancorfield/next-jdbc), but otherwise, you’re left to have to do the work.

<include src="asides/AboutAuth0" />

## Conclusions
I have been skeptical with Clojure for a while, mostly because I considered that LISP was not a syntax I was willing to learn.

I couldn’t be more wrong. Give Clojure a try. Regardless of whether you’re going to like it or not, it’s going to give you new ideas and make you rethink the way you write software.



Why Developers Should Look into Clojure

Vittorio

Vittorio Bertocci is a Principal Architect for Auth0. Before Auth0, he had a lengthy career with Microsoft, where Vittorio worked with Fortune 100 and Global 100 companies, including working on Microsoft’s Azure Active Directory team as principal program manager focusing on the developer experience. He contributed to the inception and launch of Microsoft's claims-based platform components (Windows Identity Foundation and ADFS, ADAL and MSAL SDKs, ASP.NET middleware). Vittorio is a well known speaker, educator and published author.

Principal Architect

Vittorio Bertocci

A step towards creating a visual language for describing identity.



TL;DR: Auth0 is releasing [a set of royalty-free, free-to-use icons and clipart](https://identicons.dev/) representing fundamental identity concepts and artifacts frequently used to describe topologies and solutions in presentations, specifications, and documentation.

<include src="TweetQuote" quoteText="A step towards creating a universal visual language for #identity. Check out the royalty-free and free-to-use Identicons courtesy of Auth0's @vibronet and @guillemesyngier."/>

## A Visual Language for Identity

One of the things I enjoy most about working at Auth0 is the pivotal role design plays in nearly everything we do. Far from being just a frivolous desire to make everything beautiful, thoughtful design is what makes everything easier to understand and use: it eliminates unnecessary distractions, emphasizes what's salient, nudges without forcing... ultimately, it's the magic sauce behind the feeling of effortless success that is typical of a well-crafted tool.

[After joining Auth0 last year](https://auth0.com/blog/auth0-welcomes-vittorio-bertocci/), one of my first responsibilities was to review a large number of solution proposals. With the company's explosive growth, the number of engagements taking advantage of our extensibility points to implement advanced solutions kept multiplying at an amazing rate. Reviewing solution proposals was eating more and more time! That's an excellent problem to have, but a problem nonetheless.

Searching for ways to streamline the process, I noticed that often the solution description diagrams were the most informative element of the document &mdash; and the part requiring the most review time and effort.

For each new solution document, I had to spend time reverse engineering how a particular author chose to visually represent authorization servers, access tokens vs ID tokens, APIs or web applications, and so on. If we could eliminate that ambiguity, we could not only recoup precious time during solution reviews &mdash; we'd also gain a lingua franca for all the situations where we need to represent identity architectures, a common visual alphabet that would also produce artifacts whose readability endures beyond the review phase.

Visual notations have always been a bit of a pet peeve of mine (see this [ancient post](https://www.cloudidentity.com/blog/2005/04/18/visual-notation-for-representing-message-security/) about it), and my presentation style led me to always have a fixed stencil of reusable clipart for putting together slides explaining this or that aspect of identity development.

I approached our design team, pitching the idea of creating a standard set of icons and clipart to be used wherever there's a need to explain identity architectures: solution proposals, for sure &mdash; but also documentation, specifications, blog posts, presentations... everywhere.

Our designers, and in particular the amazingly talented [Guillermo Mesyngier](https://twitter.com/guillemesyngier), threw themselves at the challenge. Using my initial list, they developed a beautiful set of icons and clipart for every concept &mdash; a set designed to be composable and retain as much clarity as possible even in very busy topologies.

We published the set on our company Slack, and the reaction was immediate and enthusiastic. Within a few days, I started receiving solution proposals incorporating the new visuals, and over the months this is now pretty much the standard everywhere for new artifacts. That achieved the desired effect: now no one has ever a doubt about how to differentiate an access token from a refresh token, everyone knows what an authorization server looks like, and in general, this simple act of standardization made communication less ambiguous. More importantly, it achieved this result with little or no effort from the diagrams authors. The fact that everything now looks in the same style and in line with the company color schemes is nearly a side effect, albeit a very welcome one.

Below you can find examples from our docs, from [Auth0 Ambassador presentations](https://github.com/auth0-ambassadors/presentations/tree/master/Auth0-Architecture-Setting-Up-Your-Tenant) delivered from our evangelists, and from our video courseware.

![Identicons in use in docs, presentations, and video courseware](https://images.ctfassets.net/23aumh6u8s0i/5xHw3yfEhEywatosaGnWAc/fed5159b4e201f4c496d7a117241b8d4/composition-with-identicons-in-use)

## The Open Source Identity Icons Are Released Today

I, of course, started using those icons with passion in my live presentations, substituting my old, rudimentary collection with those beautifully designed clipart; and the near-universal request I'd get after each session would be "how can I get my hands on your clipart collection?"
Which makes a lot of sense, given that the concepts represented are universal in the world of protocols and identity development &mdash; the collection has nearly nothing that is Auth0 specific.

With that in mind, we decided to make the collection available to the identity community at large.

We created a dedicated website, [identicons.dev](https://identicons.dev), where you can find the full collection of icons in SVG format. We have versions for light and dark themes, and you can even select individual icons for specific concepts &mdash; no need to download the entire stencil, although that is also a possibility if you so choose.

![An image of identicons.dev home page](https://images.ctfassets.net/23aumh6u8s0i/436tS2hVjsk04n5TAIZ8PJ/4fed45e2a92eaedae7506731b89f349d/a-visual-language-for-identity)

<include src="TweetQuote" quoteText="Need to talk through an identity solution? Auth0 just released #identicons, a set of royalty-free and free-to-use icons and clipart representing fundamental identity concepts"/>

All the icons can be freely used by anyone, royalty-free, and are made available to you as-is, with no guarantees, under the MIT license.

These [identity icons](https://identicons.dev) come from the corresponding GitHub repo, available at <https://github.com/auth0/identicons>. You can contribute your own clipart to the collection, and discuss changes using the tools you are familiar with including opening issues and pull requests for new symbols. We cannot guarantee an SLA at this time, but we can assure you that we will read and discuss every message.

Standardizing on a common visual language worked great for us at Auth0, driving clarity and consistency: we hope that by contributing our stencil to the community, we'll help you to do the same!

> Design is a first-class citizen at Auth0. Would you like to help us build both our product and our brand? Check out the [Auth0 Design Careers page](https://auth0.com/careers/design) for any open positions that may interest you.


Introducing Identicons.dev!

steven-rees-pullman

I am an Internationally proven professional with experience including full P&L, Business Sector and Corporate planning and execution roles. My specialities — driving revenue and organisational growth in the EMEA.

General Manager EMEA

Steven Rees-Pullman

Why Auth0 is succeeding in a diverse region of cultures, languages, and regulatory requirements



> EDITOR’S NOTE: Welcome to the EMEA Blog Takeover, where our EMEA employees take over the Auth0 blog to share success stories from the region. This week, you’ll meet our thought leaders across the pond, discover some of our most compelling use cases, and read about the trends that influence how we do business.

We grew 241% in Q1 2019 vs. Q1 2018 in EMEA. Nearly 30% of that growth came from expansion, which is a direct result of our stellar and growing Customer Success team. We drove more pipeline through the channel and more PR coverage through the media. We set goals in key areas, and we delivered on them.

There’s a massive amount of teamwork that goes on here every day, but I want to touch on three areas that are particularly critical to our success: freedom and space to grow; a localized approach; and a London hub.

{% unless page.url contains '/amp/' %}

  <script src="https://fast.wistia.com/embed/medias/grwc519jwy.jsonp" async></script><script src="https://fast.wistia.com/assets/external/E-v1.js" async></script><div class="wistia_responsive_padding" style="padding:56.25% 0 0 0;position:relative;"><div class="wistia_responsive_wrapper" style="height:100%;left:0;position:absolute;top:0;width:100%;"><div class="wistia_embed wistia_async_grwc519jwy videoFoam=true" style="height:100%;position:relative;width:100%"><div class="wistia_swatch" style="height:100%;left:0;opacity:0;overflow:hidden;position:absolute;top:0;transition:opacity 200ms;width:100%;"><img src="https://images.ctfassets.net/23aumh6u8s0i/5tTCidmZ65eJCaXtuLOmVZ/7f0183ee822bca2ffc3f8ace79f05ff5/swatch" style="filter:blur(5px);height:100%;object-fit:contain;width:100%;" alt="" onload="this.parentNode.style.opacity=1;" /></div></div></div></div>

{% endunless %}

## Nearly 30% of Auth0’s Business, with Freedom and Space to Grow

I’m very fortunate that I work with a group of people who recognize they’re based in America, and they need expertise in other markets. They’ve recruited a team that’s very European, with good diversity across the region, and trust them to build a scalable, and sustainable business. We have an appropriate amount of autonomy to make decisions, and it has paid off.

<include src="TweetQuote" quoteText="Auth0 grew 241% in Q1 2019 vs. Q1 2018 in EMEA."/>

In 2017, from an EMEA perspective, we accounted for between 18-20% of the business. Now, we’re creeping up toward 30%, working with enterprise customers like [Whitbread](https://auth0.com/learn/whitbread-secures-1-2-billion-hotel-website-with-auth0/), [The Economist Group](https://auth0.com/blog/the-economist-wins-2019-kuppingercole-european-identity-and-cloud-award/), and [Nando’s](https://auth0.com/learn/nandos-case-study/).

**Auth0 2018 Revenue by Geography**

![Auth0 2018 Revenue by Geography](https://images.ctfassets.net/23aumh6u8s0i/6ZA7zSHrFD81RGoh568VVC/0003d43d40ab634a9948abb380e6574a/emea-growth_auth0-revenue)

## A Localized Approach for Each Unique Market

Europe is not one region, and we recognize the need and strength of diversity to properly address local markets. We know the markets well, and we have a good set of skills that have helped us reach out to those markets and develop them appropriately. We recently launched a [German version of our website](https://auth0.com/de/), use European laws as opposed to US laws on our contracts, and generally embrace all the things that make us more European friendly.

We have people all across Europe with local language skills. Having someone just down the road who speaks your language, and can share success stories from other customers in the area that you can benefit from as an organization, is priceless. Local knowledge allows you to offer something above software sales and truly add value to the organization, much more than a supplier can.

<include src="TweetQuote" quoteText="Auth0 recently launched a German version of their website - https://auth0.com/de/"/>

So far this year, we’ve added more than 20 new employees in EMEA. Here are some of our recent hires.

<include src="ProfileCard" picture="https://cdn.auth0.com/blog/emea-growth:kevin-switala.png" name="Kevin Switala" title="Enterprise Account Executive" location="Frankfurt, Germany" body="Kevin Switala is responsible for sales strategy in the DACH region, and collaborates with the regional team to gain market share, build the partner network, and expand local brand awareness. He has been in IT industry sales serving Central European Markets for the past 10  years. Prior to Auth0, Kevin was regional sales manager for BeyondTrust, a leader in Privileged Access Management, where he increased qualified pipeline in the DACH region. Follow his travels and food adventures on Instagram @swilalaa."/>

<include src="ProfileCard" picture="https://cdn.auth0.com/blog/emea-growth:mathias-conradt-square.png" name="Mathias Conradt" title="Senior Solutions Engineer" location="Stuttgart, Germany" body="Mathias Conradt engages with Auth0 prospects to understand their technical requirements and guide them to the best identity solution. He has more than 20 years of experience in software engineering and business process management with several certifications. Prior to Auth0, Mathias was managing director for a boutique software company in Germany and Hong Kong, in charge of key accounts such as Atos Origin, Bayer, Blue Cross Blue Shield, China Telecom, Dräger, META Group/Gartner, Philips, SAP, Unilever, and Vodafone. He is a frequent speaker at industry events, and contributes to the Auth0 blog on technical topics (e.g. custom social connections for Verimi and netID). Mathias enjoys sports, sport shooting, motorbiking, playing video games, and reading cyberpunk novels. "/>

<include src="ProfileCard" picture="https://cdn.auth0.com/blog/emea-growth:kris-imbrechts.png" name="Kris Imbrechts" title="Enterprise Account Executive" location="Betekom, Belgium" body="Kris Imbrechts is responsible for revenue growth and new customer acquisition in Benelux and the Nordics. He has more than 20 years of sales management experience with global companies like Oracle, SAP, and Dell. Prior to Auth0, he was key account executive at ForgeRock selling identity solutions to companies in the Benelux region. Kris is a trainer at Belgian sportclub, Team Impact, where you can join him for Muay Thai."/>

<include src="ProfileCard" picture="https://cdn.auth0.com/blog/emea-growth:yvo-van-doorn.png" name="Yvo VanDoorn" title="Senior Solutions Engineer" location="Amsterdam, Netherlands" body="Yvo van Doorn is a technical expert for Auth0 customers seeking to understand the benefits of identity and cloud. He has more than a decade of system administration experience, and manually built and configured bare-metal servers for the first part of his career. Prior to Auth0, Yvo was mission critical engineer at Schuberg Philis, where he specialized in designing and implementing public cloud/SaaS-first solutions for clients in the Benelux region. Yvo is also one of the main organizers for Devopsdays Amsterdam, which attracts more than 500 people every year. Find Yvo sipping a hoppy IPA, exploring the great outdoors, or celebrating Dutch heritage with food and sport."/>

<include src="ProfileCard" picture="https://cdn.auth0.com/blog/emea-growth:matt-gibson.png" name="Matthew Gibson" title="SMB Account Executive" location="London, United Kingdom" body="Matthew (Matt) Gibson acquires new small and medium-sized accounts through direct sales of Auth0’s Identity-as-a-Service (IDaaS) platform in Northern Europe. He has been in business development and sales serving EMEA markets for nearly five years. Prior to Auth0, Matt worked in IT Security at Varonis, where helped organizations protect their data from insider threats, and understand and achieve compliance with  PCI, HIPPA, and GDPR. Outside the office, Matt enjoys playing or watching sports, and socializing with friends."/>

<include src="ProfileCard" picture="https://cdn.auth0.com/blog/emea-growth:charlotte-pichereau-square.png" name="Charlotte Pichereau" title="Account Development Rep" location="London, United Kingdom" body="Charlotte Pichereau works side-by-side with Account Executives to drive meetings with target accounts in France, Middle East, UK. She has more than 10 years of experience in sales and building strong customer relationships. Prior to Auth0, Charlotte was account manager at Inside Marketing, a lead generation company focused on IT and Marketing, where she was responsible for customer growth and retention for Oracle, SAP, Exclusive Networks, and Pulse Secure. Charlotte enjoys simple, good food, dancing, and celebrating her Caribbean heritage."/>

<include src="ProfileCard" picture="https://cdn.auth0.com/blog/emea-growth:frederic-lormeau.png" name="Frederic Lormeau" title="Account Development Rep" location="London, United Kingdom" body="Frederic (Fred) Lormeau is responsible for sales account development in the Nordics and Benelux regions. He has been in the business development sector for more than five years. Prior to Auth0, Fred was business development manager EMEA for Inside Marketing, where he led a team of eight business development reps and secured renewals with Oracle, Gigamon, Rocket Software, Malwarebytes, and other enterprise clients. Follow his travels adventures and acroyoga moves on Instagram @fredbcbg"/>

## A Truly European Business with a London Hub

We hire the best talent regardless of location, and our employees live all over the world. At the same time, we have headquarter offices in Seattle, London, Buenos Aires, Sydney, and Tokyo. We are remote-friendly, but it's important that we also provide spaces where people can come together and work face-to-face.

Over the last few years, software companies have migrated from along the M4 corridor, back into the center of London. It's a hotbed of talent: people who don't have cars, but have fresh ideas, and want to be involved in innovative, fast-growing organizations, as opposed to the old behemoths.

Sitting in London, particularly on the Waterloo side, where coworking spaces are springing up every day, is a distinct advantage for recruiting. And whether we're hosting our colleagues from Seattle, or a customer day, it's easy to get to us in Central London – and conversely, it's easy for us to get to our customers, whether via train, plane, or other means.

As a company, we chose London to tap into the energy. We favor experimentation, innovation, and the people who come with new ideas, wanting to contribute, and make a difference, versus showing up to grind through a day's work.

We hope you’ll want to join Auth0 as an employee, customer, or partner. There are so many areas where we continue to get better and do more, and we’re looking to hire more talented people for our team.

Want to join the Auth0 team in EMEA? [Visit our Careers page here](https://auth0.com/careers/positions?locations=EMEA).

<include src="asides/AboutAuth0" />

---


How We Achieve 241% YOY Growth in EMEA

idee

Software Engineer building with Kotlin and Flutter.

Software Engineer at Busha

Idorenyin Obong

Learn how to build modern APIs with Kotlin, the flexible programming language that can run on JVMs.

Building GraphQL APIs with Kotlin, Spring Boot, and MongoDB

bruno-krebs

I am passionate about developing highly scalable, resilient applications. I love everything from the database, to microservices (Kubernetes, Docker, etc), to the frontend. I find amazing to think about how all pieces work together to provide a fast and pleasurable experience to end users, mainly because they have no clue how complex that "simple" app is.

R&D Content Architect

Bruno Krebs

Project Amber incubates smaller, productivity-oriented Java language features that have been accepted as candidate JEPs. Take a quick glimpse of the features that will arrive on the platform soon.



Recently, [Java changed its release cycle to a more rapidly cadence](https://www.forbes.com/sites/oracle/2018/03/20/what-java-10-and-javas-new-6-month-release-cadence-mean-for-developers/#7ed00d4a271a), affecting the way the language evolves overtime. With this new cadence, features can now reach the market faster. Besides that, this cadence enables the community to work on (and deliver) smaller features instead of expending all their energy on the big changes (e.g., lambda, generics, and modules).

Throughout the next sections, you will learn about Amber, the project that incubates small, productivity-oriented Java language features.

<include src="TweetQuote" quoteText="Stay on top of Project Amber and learn what productivity-oriented @java language features will arrive soon."/>

## Project Amber

Project Amber, [as explained on its homepage](https://openjdk.java.net/projects/amber/), is an effort focused on "exploring and incubating smaller, productivity-oriented Java language features that have been accepted as candidate JEPs under [the OpenJDK JEP process](https://openjdk.java.net/jeps/1)." At the time of writing, this project has already delivered two enhancements and is planning on delivering five more. Let's learn about these enhancements.

> Not sure what JEP (JDK Enhancement Proposal) means? Check out this article and [learn more about the Java platform and the community process that is responsible for evolving it](https://auth0.com/blog/java-platform-and-java-community-process-overview/).

### Enhancements delivered

The first enhancement already released, called [_Local-Variable Type Inference_](https://openjdk.java.net/jeps/286), was introduced in Java 10 and allows developers to reduce the ceremony associated with writing Java code while maintaining Java's commitment to static type safety. With this enhancement, developers can now declare variables like this:

```java
var list = new ArrayList<String>(); // infers ArrayList<String>
var stream = list.stream(); // infers Stream<String>
```

```java
List<String> list = new ArrayList<String>();
Stream<String> stream = list.stream();
```

The second enhancement, called [_Local-Variable Syntax for Lambda Parameters_](https://openjdk.java.net/jeps/323), was introduced in Java 11 and extends the _Local-Variable Type Inference_ feature by allowing `var` to be used when declaring the formal parameters of implicitly typed lambda expressions. For example, with this enhancement, if you write the following code:

```java
IntStream.of(1, 2, 3, 5, 6, 7)
          .filter((var i) -> i % 3 == 0)
          .forEach(System.out::println);
```

Java will have no problem identifying that the `i` variable is an integer.

### Enhancements being developed

Besides the enhancements already released, Project Amber is planning on delivering _Lambda Leftovers_, _Pattern Matching_, _Switch Expressions_, _Raw String Literals_, and _Concise Method Bodies_.

#### **Lambda Leftovers**

The [_Lambda Leftovers_ enhancement](http://openjdk.java.net/jeps/302) aims at bringing two new features to the Java language. First, this enhancement will allow developers to use an underscore (_) to denote an unnamed lambda parameter. Second, the enhancement will allow lambda parameters to shadow variables already defined in the enclosing context. For example, this last feature will enable developers to write code as follows:

```java
Map<String, Integer> msi = ...

String key = computeSomeKey();
msi.computeIfAbsent(key, key -> key.length());
```

In this case, the inner `key` variable will cause no conflict with the external one (derived from the `computeSomeKey()` call).

#### **Pattern Matching**

The [_Pattern Matching_ enhancement](https://openjdk.java.net/jeps/305) will allow developers to be more concise when dealing with the `instanceof` operator. For example, with this feature, whenever developers want to check if an object is a `String` and use it as such, instead of doing this:

```java
if (obj instanceof String) {
    String s = (String) obj;
    // use s
}
```

They will be able to do this:

```java
if (obj instanceof String s) {
    // can use s here
}
```

By using the new pattern matching feature, developers will reduce the overall number of explicit casts in Java programs considerably. For example, as type test patterns are particularly useful when writing equality methods, instead of having a method like this:

```java
@Override public boolean equals(Object o) { 
    return (o instanceof CaseInsensitiveString) && 
        ((CaseInsensitiveString) o).s.equalsIgnoreCase(s); 
}
```

Developers will be able to simplify the code (and avoid the explicit cast), as shown here:

```java
@Override public boolean equals(Object o) { 
    return (o instanceof CaseInsensitiveString cis) && 
        cis.s.equalsIgnoreCase(s); 
}
```

#### **Switch Expressions**

The [_Switch Expressions_ enhancement](https://openjdk.java.net/jeps/325) will enable developers to use the `switch` feature as either a statement (the _traditional_ way) or as an expression (the _simplified_ version). This change will simplify some code, as you can see on the following code snippets. The first one shows how you would use the traditional `switch` keyword to make a decision:

```java
switch (day) {
    case MONDAY:
    case FRIDAY:
    case SUNDAY:
        System.out.println(6);
        break;
    case TUESDAY:
        System.out.println(7);
        break;
    case THURSDAY:
    case SATURDAY:
        System.out.println(8);
        break;
    case WEDNESDAY:
        System.out.println(9);
        break;
}
```

The second one shows how you would use the simplified version to achieve the same result:

```java
switch (day) {
    case MONDAY, FRIDAY, SUNDAY -> System.out.println(6);
    case TUESDAY                -> System.out.println(7);
    case THURSDAY, SATURDAY     -> System.out.println(8);
    case WEDNESDAY              -> System.out.println(9);
}
```

Pretty nice, huh?

<include src="TweetQuote" quoteText="The new Switch Expressions proposal will allow @java developers to use switch as expressions to write more concise code."/>

#### **Raw String Literals**

The [_Raw String Literals_](https://openjdk.java.net/jeps/326) enhancement will add, as the name states, raw string literals to the Java programming language. This type of string can span multiple lines of source code and does not interpret escape sequences, such as `\n`, or Unicode escapes, of the form `\uXXXX`. Among its goals, the enhancement plans on:

- make it easier for developers to express sequences of characters in a readable form, free of Java indicators;
- supply strings targeted for grammars other than Java;
- and supply strings that span several lines of source without supplying special indicators for new lines.

One good way to see the benefits of this enhancement is to consider what you would need to do to write a long SQL query:

```text
String query = "SELECT `EMP_ID`, `LAST_NAME` FROM `EMPLOYEE_TB` " +
               "WHERE `CITY` = ‘INDIANAPOLIS' " +
               "ORDER BY `EMP_ID`, `LAST_NAME`;";
```

By using _Raw String Literals_ you will be able to rewrite the previous code snippet as follows:

```text
String query = ``SELECT `EMP_ID`, `LAST_NAME` FROM `EMPLOYEE_TB`
                 WHERE `CITY` = ‘INDIANAPOLIS'
                 ORDER BY `EMP_ID`, `LAST_NAME`;
               ``;
```

#### **Concise Method Bodies**

The [_Concise Method Bodies_](https://openjdk.java.net/jeps/8209434) enhancement is all about supporting _more_ concise methods in the Java programming language. The Java 8 version, released back in 2014, introduced what is known as the [_Lambda Expressions_](https://jcp.org/en/jsr/detail?id=335) enhancement. This enhancement, known as Java's first step into functional programming, allowed developers to define methods that do not belong to any class. As such, these methods (which have a very concise syntax) can be passed around as if they were objects and can be executed on demand.

For example, prior to the Lambda Expressions introduction, if you needed to do some calculation and return an integer, you would have to find a class where to define a new method:

```java
public static class Utils {
  public static int calculate(Object someParameter) {
    // ... calculate
    return result;
  }
}
```

After that, you would be able to call this method whenever you wanted, after importing the `Util` class. With the introduction of this new feature, you can now replace all this boilerplate with something much simpler:

```java
ToIntFunction<Object> calculate = (Object o) -> {
  // ... calculate
    return result;
};
```

The code above, instead of belonging to some random class (like `Utils`, on the example), can be written and called right where you need it. This can be considered the first _concise methods_ introduced in the programming language.

Now, back to the _Concise Method Bodies_ enhancement that Project Amber will introduce, when this feature is released, developers will be able to apply this kind of syntax in more places. For example, if you ever did something like creating a method like this:

```java
int length(String s) {
  return s.length();
}
```

In the near future, you will be able to rewrite it like this:

```java
int length(String s) -> s.length();
```

## Conclusion

As you learned in this short blog post, Project Amber is the project that you have to keep an eye on to learn about the productivity-oriented features that will arrive at the Java programming language soon. If you want to stay on top of this, [follow us on Twitter](https://twitter.com/auth0), or subscribe to our newsletter.

<include src="asides/AboutAuth0" />


The Future of Java - Project Amber

Let's learn how to properly handle exceptions on Spring Boot APIs while providing multi-language support (I18N) for the messages.

Exception Handling and I18N on Spring Boots APIs

685342d5e7f42c3ab8d251d7d4a53308?s=100&d=mm&r=g avatar

685342d5e7f42c3ab8d251d7d4a53308?s=100&d=mm&r=g

Former Auth0 Employee

Robin Percy

Crystal Language claims to be as fast as C and as easy to learn as Ruby.  Here, I put it to the test and give my 2 cents!



Crystal is a statically-typed, compiled, systems programming language with the aims of being as fast as c/c++, while having a syntax as readable as Ruby.  This article is an introduction to the Crystal Language, through the eyes of a polyglot programmer.  Being a former programmer of both C and Ruby, I have been able to explore the ins-and-outs of Crystal with an objective mindset and give an unbiased opinion on its features; from it's low-level primitives to its familiar syntax, and much in-between.

I first came across Crystal when I saw [@sferik](https://twitter.com/sferik)  giving a talk on it in Poland back in 2015.  [Video here.](https://www.youtube.com/watch?v=Ysm4IU4aWoQ)  It was a great talk, and sparked my interest to Crystal right there and then.  When I initially checked out Crystal, I thought it looked awesome but I was too busy with all the other languages I was using on a daily basis to be able to focus my time properly on it.

Alongside being too busy, I couldn't really see why I'd use Crystal instead of using C/Erlang/Go/Ruby - languages that I already knew.  What I can say with confidence now though; is that whilst those languages may all be able to achieve the same end-goal they're all *better* in their own, different ways entirely.

When I want to build distributed apps, like my *Fist/Bump Heartbeat Monitor* - I use Erlang/Elixir.  When I want to build an API backend I use Golang.  When I want to spend the day with my brains scattered, and most probably in tears - I use C.  For readibility and demonstrations, I use Ruby.  When it comes to writing low-level systems such as daemons and obtuse Kernels, while it would be most performant to turn to C - it'd also take me a **LONG** time to achieve relatively little and the aforementioned tears would be very-likely flowing.  *This is where Crystal comes in.*

Having a syntax *very* similar to Ruby means that the familiarity of Crystal is incredibly enticing.  Since the world is obsessed with web apps now, let's take a look at the code required to build a minimal web server in both Crystal and Ruby.

In **Ruby**, using *Sinatra*, the code is as follows:

~~~ ruby
require "sinatra"
 
set :logging, false
 
get "/" do
  content_type "text/plain"
  "Hello, Auth0!"
end
~~~

Now in **Crystal**, check out the equivalent code:

~~~ ruby
require "kemal"
 
logging false
 
get "/" do |ctx|
  ctx.response.content_type = "text/plain"
  "Hello, Auth0!"
end
 
Kemal.run
~~~

The fact that you can use Ruby syntax highlighting natively for Crystal says everything!  Coming from Ruby to Crystal is a remarkably easy adaptation.  The fact is; one copy and paste code from Ruby to Crystal and 90% of the time it will run with no errors.  The creators of Crystal understand that Ruby is undoubtedly the most visually appealing language, and therefore built Crystal to take as much influence as possible from a design perspective.  You can even run Crystal programs using the `Ruby` shell command and vice versa since the syntax is valid for both languages!


## Binding C

One of the big selling points for Crystal is the ease with which you can interface with C libraries.  "Crystal allows you to bind to existing C libraries without writing a single line in C.  Additionally, it provides some conveniences like `out` and `to_unsafe` so writing bindings is as painless as possible."

Let's build a simple script in C that says "hi!".  We'll then write a Crystal app to bind to our C library.  This is a great starting point for anyone who wants to know about binding C in Crystal.

First off, let's create a project with Crystal's scaffolding tool (I'll cover this feature later).  Run:

~~~ bash
$ crystal init app sayhi_c
~~~

Then head into the directory `sayhi_c/src/sayhi_c` and let's create a file `sayhi.c` with the following contents:

~~~ c
#include <stdio.h>

void hi(const char * name){
  printf("Hi %s!\n", name);
}
~~~

Now we need to compile our C file into an object.  On Ubuntu or Mac using `gcc` we can run:

~~~ bash
$ gcc -c sayhi.c -o sayhi.o
~~~

Using the `-o` flags allow us to create an Object filetype.  Once we've got our Object file, we can bind it from within our Crystal app.  Open up our `sayhi_c.cr` file, and have it reflect the following:

~~~ ruby
require "./sayhi_c/*"

@[Link(ldflags: "#{__DIR__}/sayhi_c/sayhi.o")]

lib Say
  fun hi(name : LibC::Char*) : Void
end


Say.hi("Auth0")
~~~ 

I'll mention now that there are no implicit type conversions except `to_unsafe` - [explained here](https://crystal-lang.org/docs/syntax_and_semantics/c_bindings/to_unsafe.html) when invoking a C function: you must pass the exact type that is expected.

Also worth noting at this point is that since we have built our C file into an object file, we can include it in the project directory and link from there.  When we want to link dynamic libraries or installed C packages, we can just link them without including a path.

So, if we build our project file and run it, we get the following:

~~~ bash
$ crystal build --release src/sayhi_c.cr

$ ./sayhi_c

 > Hi Auth0!
~~~

It's really easy to bind to C in Crystal, and is definitely one of the features that attracts me most to the language.  I'm really looking forward to writing a C binding for a useful library and being able to utilise this functionality in production!


## Concurrency Primitives

One of my favourite parts of *Golang* is the `goroutine` threading system.  Working in the Database industry, I got a real passion for concurrency &amp; parallelism and when looking to a new language, one of the first things I explore are the concurrency primitives.  In Crystal, we can use the `Spawn` functionality in a very similar way to `Goroutines` in Golang, `core.async` in Clojure, or the lightweight threading in Elixir/Erlang.

For a simple test, I wrote two quick scripts to test the Spawn functionality in Crystal alongside Ruby.  We all know that Ruby is **not** a great language for threading, so I'm interested to see how much better Crystal is in small experiments.  Let's take the following example in ***Ruby***:

~~~ ruby
1000.times.map do
  Thread.new do
    puts "Hello?"
  end
end.each(&:join)
~~~

Running this from terminal I got the following results:

~~~ bash
$ time ruby spawntest.rb

real	0m0.288s
user	0m0.132s
sys	0m0.116s
~~~

I ran this little script on one of my ancient laptops that runs only 2gb of RAM and a terrible, *terrible* processor.  Now, porting this script to ***Crystal***, we can write:

~~~ ruby
channel = Channel(String).new
1000.times do
  spawn {
    channel.send "Hello?"
  }
  puts channel.receive
end
~~~

Running this script with the `crystal` command, I got the following results:

~~~ bash
$ time crystal spawntest.cr

real	0m1.129s
user	0m0.952s
sys	0m0.276s
~~~

Hmmmm, very interesting indeed!  Well, seen as Crystal is a compiled language and meant to be used to build small binaries that are easily distributed, it'd be a good idea to compile this small script and use *that* data instead!  I compiled the script using the `--release` flag - this tells the Crystal compiler to optimise the bytecode.

~~~ bash
$ crystal build --release spawntest.cr

$ time ./spawntest

real	0m0.008s
user	0m0.004s
sys		0m0.000s
~~~

As you can see, this result is markedly different.  Using the `--release` flag when building the Crystal executable cuts out a lot of bloating and optimises the executable to be as efficient as possible.  Obviously, the above test is a very naive use of the Spawn functionality, and unfortunately, I haven't had the opportunity to test in a load-heavy production environment. But soon I fully intend to, and I'll write another article benchmarking this in detail when I have a good usecase and get the chance to!


## Built-in Tooling in Crystal

One of the things I like most about Crystal is the excellent built-in tooling available.  When I look at new languages, especially relatively immature languages; it's always very reassuring when the language has extensive built-in tooling available to help developers stay productive &amp; happy!  In Crystal, there are a bunch of tools that make hacking around in the language super fun, but also help us to stay on the right track with semantics etc.

#### Testing

If you're coming from a Ruby/Rails background, I think you'll be ***very*** happy with the built-in testing framework that ships with Crystal.  It's rather reminiscent of *RSpec*, and will be really easy to use for anyone coming from a similar background.  Even if you're not from a Ruby/Rails background, it's a great testing tool and is super effective.

Using the `Greeter` demo app from the Crystal docs, we could write our Specs as follows:

~~~ ruby
require "spec"
require "../lib/greeter" # demo greeter class

describe Greeter do
  describe "#shout" do
    it "returns upcased string" do
      Greeter.new.shout('hello auth0').should eq "HELLO AUTH0"
    end
  end

  describe ".hello" do
    it "returns a static Hello string" do
      Greeter.hello.should eq "Hello"
    end
  end
end
~~~

As you can see, this spec should look *very* familiar to any Rubyists, and is becoming the more preferred syntax for application testing across many languages - there being RSpec clone libraries across most languages now!

#### Project Scaffold

Much the same as Elixir having the `Mix` manager, and Erlang the `Rebar` manager, Crystal has it's own built-in project scaffolder &amp; package manager.  I'd recommend using this at all times to ensure sematics are followed.  We can use it with the following:

~~~ bash
$ crystal init lib my_cool_lib
      create  my_cool_lib/.gitignore
      create  my_cool_lib/LICENSE
      create  my_cool_lib/README.md
      create  my_cool_lib/.travis.yml
      create  my_cool_lib/shard.yml
      create  my_cool_lib/src/my_cool_lib.cr
      create  my_cool_lib/src/my_cool_lib/version.cr
      create  my_cool_lib/spec/spec_helper.cr
      create  my_cool_lib/spec/my_cool_lib_spec.cr
Initialized empty Git repository in ~/my_cool_lib/.git/
~~~

#### Sharding

No - not creating Database Shards (luckily)!  Shards are Crystal's packages distributed in the same way as Ruby Gems, Elixir Libs or Golang packages.  Each application we create contains a file in the root directory named `shard.yml`.  This file contains project details and external dependencies.  The `shard.yml` file in my `sayhi_c` app above looks like this:

~~~ yml
name: sayhi_c
version: 0.1.0

authors:
  - Robin Percy <robin@percy.pw>

targets:
  sayhi_c:
    main: src/sayhi_c.cr

crystal: 0.22.0

license: MIT
~~~

The app I built has no dependencies to use, but if we want to include external packages we can do so by adding them at the bottom of the file:

~~~ yml
dependencies:
  github:
    github: felipeelias/crystal-github
    version: ~> 0.1.0
~~~

#### Documentation & Formatting

Crystal has a great built-in tool for generating documentation and formatting files.  The documentation that is generated is excellent - built-in html/css and almost instantly ready to deploy.

To generate documentation, from the project root directory we can simply run:

~~~ bash
$ crystal doc
~~~

This will create a docs directory, with a doc/index.html entry point. All files inside the root src directory of the project from which we ran the command will be considered.

Alongside this, the built-in *Formatter* tool is a great feature of the language.  We can run the formatter over our project by running:

~~~ bash
$ crystal tool format
~~~

We can use this tool to unify code styles and to submit documentation improvements to Crystal itself.  The formatter is also very fast, so very little time is lost if you format the entire project's codebase instead of just a single file.

*Both of these features are very cool, and highly useful!*

## What I don't like

Like anything in this world, Crystal can't possibly be perfect!  There are two ***very*** small issues that I find with it...

As a Polyglot programmer, I've had to learn a bunch of different programming paradigms.  While this isn't a fault in Crystal, the fact that it's object orientated is pretty much the only thing I'm not too keen on in Crystal.  Other than that; being a relatively young &amp; immature language, there's often a lack of documentation available when you want to do something incredibly specific.

Seeing this as an opportunity instead of a foible - it's actually kind of cool, because this means we can write documentation ourselves and hack sample apps together to become early adopters and decent contributors in the Crystal community!


## Aside - Auth0 & JWTs in Crystal 

**Update:** - I have written about [securing a Crystal web app with Auth0 &amp; JWT's here.](https://auth0.com/blog/building-your-first-crystal-app-with-jwt-authentication/)

At the moment, there is no Crystal-Auth0 library to use for end-to-end application securing.  However, there *is* a JWT library available for Crystal already [here](https://github.com/greyblake/crystal-jwt).

One thing to note here is that the Crystal-JWT library does not yet support the `RS256` algorithm, which is the preffered algorithm and only supports the `HS256` algorithm.  When setting up your application in the Auth0 control panel, make sure to select the `HS256` algorithm to reflect this.

In my next series of articles, I will be writing specifically about using Auth0 in a ***NON-jwt*** context, and I'll make sure I demonstrate this in Crystal!

Of course, if you're looking to secure a Crystal-based web app, you can always simply use the [Auth0 Centralised Login](https://auth0.com/docs/hosted-pages/login).  The Centralised Login will allow you to have immediate drop-in user management functionality.

## Conclusion

**I really rather like it!**

Although relatively immature, Crystal is a promising language with a growing Dev community surrounding it.  In my previous article about Auth0 Lock / Iris Image Recognition, I mentioned the fact that it'd be better to use the pHash / Blockhash libraries for a production environment.  If I was to build that system, I would most definitely use Crystal to bind to those C libraries.  I know that I'd be getting fantastically close-to-C speeds, and with the ease and joy of writing Crystal!

I am very much looking forward to seeing where this language goes.  I think the adoption rate will rapidly increase and I'm excited to see startups using it in production systems.  I am currently experimenting in building a Crystal library for the Auth0 API.  I will write another article on building an API client in Crystal when I'm finished.

I do hope this article has inspired you to give Crystal a try, and look forward to hearing your feedback if/when you do!  If you need any help and want to ask questions, [reach out to me via email](mailto:robin@percy.pw) and [@rbin](http://twitter.com/rbin) on twitter, I'm happy to help!

## Handy Resources

 - [https://github.com/veelenga/awesome-crystal](https://github.com/veelenga/awesome-crystal) 
 - [https://play.crystal-lang.org/#/cr](https://play.crystal-lang.org/#/cr) 
 - [https://www.reddit.com/r/crystal_programming/](https://www.reddit.com/r/crystal_programming/) 
 - [http://kemalcr.com/](http://kemalcr.com/) 


The Highs & Lows of Crystal - an Introduction to Crystal Lang

avatar

Guest Author

Sathyaish Chakravarthy

Learn how to create a simple application using Kotlin, a statically typed programming language that targets the Java Virtual Machine (JVM)

Create an Application in Kotlin and Secure It Using JWTs

001c9ddc5ceb9829b6aaf24f5d28502a

I am software developer with a keen interest in open-source technologies, Linux, and native development. I've worked on many different platforms Android, iOS, Win32, Linux, FreeRTOS, the Web, and others. I've gone through the whole stack and I enjoy learning and using the latest technologies. I now work as a full-stack developer at Auth0.

Senior Engineer

Sebastian Peyrott

We take a look at the evolution of JavaScript, arguably one of the most important languages of today, and tomorrow

A Brief History of JavaScript

eHk3ciM

I am the Group Manager, Developer Content at Okta, and a Google Developer Expert in Web Technologies and Angular. I'm passionate about identity, authentication, constant learning, and developer communities. As a developer advocate, engineer, mentor, and international speaker, I love learning from and sharing with other inhabitants of the tech space.

Group Manager, Developer Content

Kim Maida

Explore building an app in the functional front-end language Elm. Part 2 focuses on adding authentication to an Elm App.

Creating Your First Elm App: From Authentication to Calling an API (Part 2)

Explore building an app in the functional front-end language Elm. Part 1 focuses on Elm history, architecture, syntax, and calling an API.

Creating Your First Elm App: From Authentication to Calling an API (Part 1)

27396b3fa24389198ef5d3e7e410e9c4?size=60 avatar

27396b3fa24389198ef5d3e7e410e9c4?size=60

Ricky Rauch

Our lessons in defining a cohesive design language <br /> across all our products.



For the past year, Auth0 has been growing at a fast pace and, naturally, so has the number of fronts that the Design Team has had to tackle.

In this post, we’ll explain what we've learned as we’ve implemented practices that help integrate design into our products, guarantee consistency, and optimize design choices.

![Auth0 design process](https://images.ctfassets.net/23aumh6u8s0i/5ekkYcvh13pEbE8iA9JwTi/105d9aae129b931385c61c0bf06f77fd/process)

## 1. Blueprints

The first practice we introduced was design from blueprints. A blueprint is just a monochrome draft of the final product, with as little focus on styling as possible.

![Design process blueprints](https://images.ctfassets.net/23aumh6u8s0i/5FuxxzraFKWNJlOWpEqNu8/7460f5608279a68310127f6904fe4263/blueprint)

We go through a lot of feedback from different company stakeholders, including engineers, marketers, analytics, and our own clients. By taking subjective factors like color and embellishment out of the process, blueprints help us get better feedback and achieve simpler solutions in a shorter length of time.

## 2. Frontend

### Asset production

We constantly review previous work when producing new assets to check for consistency and understand how they have evolved over time so we don’t repeat mistakes.

Our website is mapped out on a 1:1 scale with design files and is available to the whole team on Dropbox.

![Design process Dropbox usage](https://images.ctfassets.net/23aumh6u8s0i/1zAKxMtgDA21IoRLFBPvr9/c24b3209362d5ef65412e6f4fa91ddbd/dropbox)

Using Sketch has dramatically improved the way we create and export assets. We think it’s the best tool for the job because it was designed with the Web in mind.

### Mobile first

Most of the HTML and CSS at Auth0 it handled or refactored by a designer at some point. We’ve set [clear guidelines](https://github.com/auth0/code-conventions/blob/master/frontend/README.md) for front-end code, and we’ve chosen [Stylus](https://learnboost.github.io/stylus/) and [Jade](http://jade-lang.com/) to optimize our productivity. As a result, we write concise, clear code much faster.

Over the past year, we have started to migrate all of our pages as part of a mobile-first strategy.

The rationale behind this strategy starts with the design perspective: we set out to present only information that we can make available in a way that works on any device. This simplifies our approach to information architecture by getting rid of unnecessary elements and solving problems in the simplest way, which also reduces the potential for errors during development.

![Design process mobile first approach](https://images.ctfassets.net/23aumh6u8s0i/5g9IkjRDtYNOx42VQ8tdDj/cc277baee7dc60539557f462a3007177/mobile-first)

To maintain stability, we are making these changes progressively. Each page that gets a redesign gets a mobile-first refactor to go with it.

A key factor in preventing Responsive Design from getting messy was abstracting all of our media queries to a [Stylus mixin](https://github.com/auth0/styleguide/blob/master/lib/mixins/index.styl#L11) and keeping them as close as possible to their relevant selectors, making them harder to overlook and easier to maintain.

```css
.hero-cta
  color: blue;
  border-radius: 3px;
  padding: 10px 20px;
  max-width: 100%;

  +breakpoint("tablet")
    max-width: 620px;
    font-size: 18px;

  +breakpoint("desktop")
    max-width: 740px;
    font-size: 20px;
```
### Styleguide for consistency

Styleguide is one of our most important projects. Its aim is to help maintain the same look and feel across all of our products and to make our front-end code reusable, no matter the specifics of any project's codebase.

<a href="https://styleguide.auth0.com"><img src="https://images.ctfassets.net/23aumh6u8s0i/6MeGqjQoXZ6tRtmbTvBMEr/99c0ae67861c3baf3ad871b6bb4d095a/styleguide" class="expand" /></a>

Styleguide holds values, patterns, and specific components that repeat across pages, enabling designers and engineers quickly to reuse them on any product without worrying about markup or CSS.

![Design process consistency](https://images.ctfassets.net/23aumh6u8s0i/4sd8BnI6idcPWNOqsbZbGD/be684bd6cc03a3a2845bad9e670b4ff5/consistency)

- Elements like our [header](https://github.com/auth0/web-header), footer, and other components are easily maintained on different projects by sourcing them directly from [Styleguide](https://styleguide.auth0.com).

- By reducing complex html structures and patterns to Jade mixins available through [Styleguide](https://styleguide.auth0.com) and passing only content as parameters, we optimize development time.

![Design process icons](https://images.ctfassets.net/23aumh6u8s0i/4o7gHKzr7lrNkTwymz8Wh6/0c05df02c1c3ed39e6ce8bf653f003ab/icons)

- Company [colors](https://styleguide.auth0.com/#colors), [typography](https://styleguide.auth0.com/#typography), and [icons](https://styleguide.auth0.com/#icons) are kept consistent by using the same set of variables and files for every project.

- We use [semantic versioning](http://semver.org/) to enforce certain versions of Styleguide across projects. This helps maintain stability in our sites when we're doing heavy updates.

Today, we can include Styleguide using [Bower](http://bower.io/) or [Component](http://component.github.io/) or by linking [directly from the CDN](https://cdn.auth0.com/styleguide/latest/index.css).

If you are interested, [check the live version](https://styleguide.auth0.com) or [view the code on Github](https://github.com/auth0/styleguide).

## 3. Publish

### Deep testing

Once we reach the final step in producing a deliverable, we start a rough path of tests by using Heroku or Github pages as staging deployments. The whole point of this task is to have a last ride before publishing to the open when there is no take-back of the first impression statement.

Some of the things we review here:

Mobile rendering and response times on different real devices, browsers, and networks’ SEO optimizations (title on each page, description, sitemap…) and social sharing media elements like OpenGraph and Twitter Cards.

This method has always preceded the finest look and feel, in our experience.

![Design process cards](https://images.ctfassets.net/23aumh6u8s0i/6nqS5hbMqY2DJYVSHoBxq2/ddbb8f6d08b4fb9d91da159b8c793c45/cards)


And we’ll keep improving our test process to deliver no less than the best.

## Design meetings

Though we’re still a small group, there are already different kinds of designers on the team, some more adept in usability or visual design and some more focused on prototyping and code.

<blockquote class="instagram-media" data-instgrm-captioned data-instgrm-version="4" style=" background:#FFF; border:0; border-radius:3px; box-shadow:0 0 1px 0 rgba(0,0,0,0.5),0 1px 10px 0 rgba(0,0,0,0.15); margin: 1px; max-width:658px; padding:0; width:99.375%; width:-webkit-calc(100% - 2px); width:calc(100% - 2px);"><div style="padding:8px;"> <div style=" background:#F8F8F8; line-height:0; margin-top:40px; padding:50% 0; text-align:center; width:100%;"> <div style=" background:url(data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAACwAAAAsCAMAAAApWqozAAAAGFBMVEUiIiI9PT0eHh4gIB4hIBkcHBwcHBwcHBydr+JQAAAACHRSTlMABA4YHyQsM5jtaMwAAADfSURBVDjL7ZVBEgMhCAQBAf//42xcNbpAqakcM0ftUmFAAIBE81IqBJdS3lS6zs3bIpB9WED3YYXFPmHRfT8sgyrCP1x8uEUxLMzNWElFOYCV6mHWWwMzdPEKHlhLw7NWJqkHc4uIZphavDzA2JPzUDsBZziNae2S6owH8xPmX8G7zzgKEOPUoYHvGz1TBCxMkd3kwNVbU0gKHkx+iZILf77IofhrY1nYFnB/lQPb79drWOyJVa/DAvg9B/rLB4cC+Nqgdz/TvBbBnr6GBReqn/nRmDgaQEej7WhonozjF+Y2I/fZou/qAAAAAElFTkSuQmCC); display:block; height:44px; margin:0 auto -44px; position:relative; top:-22px; width:44px;"></div></div> <p style=" margin:8px 0 0 0; padding:0 4px;"> <a href="https://instagram.com/p/2HXZopiTi7/" style=" color:#000; font-family:Arial,sans-serif; font-size:14px; font-style:normal; font-weight:normal; line-height:17px; text-decoration:none; word-wrap:break-word;" target="_top">Design Meeting @auth0</a></p> <p style=" color:#c9c8cd; font-family:Arial,sans-serif; font-size:14px; line-height:17px; margin-bottom:0; margin-top:8px; overflow:hidden; padding:8px 0 7px; text-align:center; text-overflow:ellipsis; white-space:nowrap;">A photo posted by Ricardo Rauch (@rickyrauch) on <time style=" font-family:Arial,sans-serif; font-size:14px; line-height:17px;" datetime="2015-04-30T22:01:28+00:00">Apr 30, 2015 at 3:01pm PDT</time></p></div></blockquote>
<script async defer src="//platform.instagram.com/en_US/embeds.js"></script>

We have established weekly design meetings as a simple “show and tell” exercise to feed off each other's work and be in the loop of what’s been going on during the week with other projects. This adds a big-picture perspective to all the work that's been done and complements daily feedback by showing the whole team the impact of design on our products.

![Design process sites](https://images.ctfassets.net/23aumh6u8s0i/n1DUnXF6UJuQEcWCVuE6H/5a471cd69e9cb94ad6f12041187e28ae/sites)

We’re always looking for ways to improve and optimize our process. We hope that some of our practices can prove useful for anyone interested in collaborating on product design, and if you have suggestions or thoughts, we’d be glad to hear them.

Finally, processes are nothing without a great team. I am humbled to work every day with these amazing people: [Victor Fernandez](http://twitter.com/vctrfrnndz), [Benjamin Flores](https://twitter.com/beneliflo_), and [Nicolás Garro](https://twitter.com/evilrabbit_)

If this sparked some interest, [we are hiring](https://auth0.com/careers).


"c language"