andrea-chiarelli

I have over 20 years of experience as a software engineer and technical author. Throughout my career, I've used several programming languages and technologies for the projects I was involved in, ranging from C# to JavaScript, ASP.NET to Node.js, Angular to React, SOAP to REST APIs, etc.

In the last few years, I've been focusing on simplifying the developer experience with Identity and related topics, especially in the .NET ecosystem.

Principal Developer Advocate

Andrea Chiarelli

Learn how to enable your customers to customize the login experience of your B2B SaaS application and integrate it into their systems by accessing your APIs.

Throughout this series, we've journeyed through [the foundational aspects of B2B identity](https://auth0.com/blog/b2b-saas-identity-challenges-the-foundations/), including multi-tenancy and onboarding, then delved into [granular access control with RBAC, ABAC, and ReBAC](https://auth0.com/blog/b2b-saas-identity-challenges-granular-access-control/), and most recently tackled [the critical demands of enterprise integration and advanced security](https://auth0.com/blog/b2b-saas-identity-challenges-enterprise-integration-and-security/). Your Business-to-Business (B2B) Software-as-a-Service (SaaS) application is now robust, secure, and ready for demanding clients.

However, the ultimate success of a B2B application often hinges on its adaptability and seamless integration into a customer's environment. This means more than just functionality; it means brand consistency and programmatic access.

In this concluding article, we will explore the essential aspects of customization and extensibility, focusing on how to tailor the user experience and secure your backend APIs for machine-to-machine communication, ensuring your application is truly integrated and personalized for every customer.

## Branding and User Experience Customization

Your B2B customers will often expect a seamless brand experience, even on the login page. They want their users to feel like they are interacting directly with their application, not an external provider. This is also reflected in your application’s login pages: **How can I customize the login pages to match my customers' corporate identities?**

To be honest, in my previous experience in building a B2B SaaS application, we had a couple requests of this type. At that time, we decided to implement an additional set of login and reset password pages. Basically, they were customized versions of our default login page. As a result, we had to maintain more code and keep in sync with any updates we were going to apply to the default pages. It worked with some additional maintenance, but only because we had very few such requests. As a developer, you know that the more code you have, the more trouble you may get.

[Auth0's Universal Login](https://auth0.com/docs/authenticate/login/auth0-universal-login) is designed for extensive customization, allowing you to maintain a consistent brand experience across all your customer organizations. Customizing Auth0 Universal Login for individual Organizations is a powerful feature for B2B SaaS applications, allowing you to provide a truly branded experience for each of your customers. You can customize it at different levels: 

* With a **no-code approach**, which allows you to change the logo and colors of the login page.  
* With an **advanced approach** by customizing the Universal Login page template with Liquid.  
* With more powerful control by using the **Advanced Customizations** for Universal Login feature, which gives you control over every pixel of your Universal Login experience.

But that’s not all. Auth0 also allows you to customize the emails that users receive from the platform very easily.

> Read the following documents to learn more about customizing the login experience for your customers:
> 
> * [Customize Universal Login](https://auth0.com/docs/customize/login-pages/universal-login)  
> * [Advanced Customization for Universal Login](https://auth0.com/docs/customize/login-pages/advanced-customizations)  
> * [Customize Prompts and Email Templates for Organizations](https://auth0.com/docs/manage-users/organizations/create-first-organization#customize-prompts-and-email-templates)

## API Security for Your SaaS Backend

In the context of customization, it is likely that some customers will ask you to access your application's APIs to connect them with their systems, for example, to exchange data automatically. The challenge now becomes: **How can I protect my backend API so that my customer’s applications can only access their data securely?**

Auth0 enables you to implement this feature by providing Machine-to-Machine (M2M) Access for Organizations. To determine the Organization your API is scoped to, you will find an `org_id` claim in the access token sent by the customer’s application.

> Here is more information about securing your API in the context of Organizations:
> 
> * [Machine-to-Machine (M2M) Access for Organizations](https://auth0.com/docs/manage-users/organizations/organizations-for-m2m-applications)  
> * [Work with Tokens and Organizations](https://auth0.com/docs/manage-users/organizations/using-tokens)

## Real-time User Lifecycle Management with Event Streams

Beyond offering your customers direct API access and UI customization, your B2B SaaS application may need to react to changes in user identity in real time. Imagine needing to synchronize user data with your CRM, trigger welcome emails based on signup events, or update internal billing systems when a user's status changes. Relying on polling APIs or manual data exports is inefficient and can lead to inconsistencies.

The challenge here is: **How can I reliably and efficiently propagate user lifecycle events from Auth0 to my internal systems or third-party applications?**

[Auth0 Event Streams](https://auth0.com/docs/customize/events) provide a solution to this. Event Streams allow you to subscribe to a real-time feed of events generated by Auth0, such as:

* User creation  
* User updates (e.g., profile changes)  
* User deletions  
* Password changes  
* Login successes and failures

These events are delivered to a destination of your choice, such as Amazon EventBridge or an HTTP endpoint. This enables you to build event-driven architectures, ensuring that your other services are always up-to-date with the latest identity information without complex polling logic. By leveraging Event Streams, you can automate critical workflows and maintain data consistency across your B2B SaaS ecosystem.

> Learn more about Auth0 Event Streams:
> 
> * [Auth0 Event Streams](https://auth0.com/docs/customize/events)  
> * [Discover User Lifecycle Changes via Event Streams – Now in Early Access](https://auth0.com/blog/user-lifecycle-changes-via-event-streams-in-early-access/)

# Conclusion

Our journey through the identity landscape of B2B SaaS has traversed from the fundamental need for user authentication to the sophisticated demands of enterprise integration and bespoke logic. What might initially seem like a peripheral concern — simply letting users log in — quickly reveals itself as the bedrock upon which the security, scalability, and ultimate success of your B2B application are built.

We started by understanding that **B2B identity is fundamentally different** from Business-to-Customer (B2C), centered around organizations rather than just individual users. We then progressed through key developmental phases: from [laying the foundation with multi-tenancy support](https://auth0.com/blog/b2b-saas-identity-challenges-the-foundations/) to exploring [different approaches for granular access control](https://auth0.com/blog/b2b-saas-identity-challenges-granular-access-control/); from tackling the non-negotiable [integration needs for enterprise customers](https://auth0.com/blog/b2b-saas-identity-challenges-enterprise-integration-and-security/) to facing the customization and extensibility requirements.

By embracing a robust identity solution from the outset, you’re not just solving a technical problem; you're laying a strategic foundation for your B2B SaaS application to thrive in a competitive and security-conscious market. Your focus can remain on delivering exceptional business value, confident that your users and their data are in safe hands.

I hope this series has provided valuable insights and practical solutions for navigating the complex world of identity in B2B SaaS.

Ready to secure your B2B SaaS and accelerate your development with a trusted identity partner? Explore [Auth0's comprehensive offerings](https://auth0.com/b2b-saas) and see how they can transform your approach to identity and access management.



B2B SaaS Identity Challenges: Customization and Extensibility

michael-swanson

I live in Austin, TX with my wife, Anneke, and our two kiddos, Ilya (5) and Everett (2). I am a native Texan but lived in multiple places across the southern US as a kid. I have family in Houston TX and Midland TX that we visit on a regular basis. Prior to joining Okta, I worked with early stage startups as a hands-on Product Manager, team lead, and product designer, while also writing (mostly frontend) code. 
<br>

When I am not working you can usually find me chasing my kids around, reading sci-fi or fantasy novels, or playing needlessly complex strategy board games with friends. I am also a huge Star Wars fan and am always down to talk about the latest Star Wars movies, TV, and/or books. Additionally, Anneke and I love to travel and have been all over the world together. Much of our travel focuses on getting out of the Texas heat, tasting and learning about wine, and sampling the amazing food we find along the way!


Senior Product Manager

Michael Swanson

Businesses using Auth0 by Okta’s Universal Login, can leverage a pro-code option to customize signup and login flows to address unique needs.

Every company has unique user registration and login requirements. For example, needing to capture a first and a last name during signup or requiring users to agree to terms and conditions before they can create an account. 

To meet those specific business needs and use cases, we have introduced pro-code customizations for signup and login to the Universal Login experience. This capability is available to customers on our Enterprise and Professional plans.

Using this capability, customers can insert additional form fields and custom content into the signup and login screens and include client and server-side validations to ensure that required data, such as TOS acceptance, are completed and validated before completing the authentication process. 

Use cases include:

* Adding new fields to collect necessary customer data (name, phone number, email, preferences, consent, etc.)
* Adding new form elements for presenting and capturing TOS/privacy policy and opt-in before signup
* Adding custom content such as URLs, images, or marketing information
* Localizing custom elements in different languages

### Getting started

The new [Partials API](https://auth0.com/docs/api/management/v2/prompts/get-partials) allow developers to insert custom HTML, CSS, and Javascript into the Signup and Login screens. Developers can insert new form elements and custom content, perform asynchronous client-side validation via Javascript, and leverage [Liquid syntax](https://github.com/Shopify/liquid/wiki/Liquid-for-Designers) to perform conditional logic and insert dynamic variables. Here is an example of inserting custom code into the Signup screen:

```js
# eg: PUT /api/v2/prompts/signup/partials

# Request Body
{
  "signup": {
    "form-content-start": "<div class='ulp-field'><label for='first-name'>Full Name</label><input type='text' name='ulp-full-name' id='full-name'></div>",
    "form-content-end": "<div class='ulp-field'><input type='checkbox' name='ulp-terms-of-service' id='terms-of-service'><label for='terms-of-service'>I agree to the <a href='https://my.app/terms' target='_blank'>Terms of service</a></label></div>",
  }
}

```

Once the user submits the Signup form customers will have access to the data via Actions. Here is an example of saving user provided custom data to the user_metada for the end user

```js
/**
* Given this code in the signup form:
* <div class="ulp-field">
*   <label for="full-name">Full Name</label>
*   <input type="text" name="ulp-full-name" id="full-name">
* </div>
* <div class="ulp-field">
*   <label for="terms-of-service">
*     I agree to the <a href='https://my.app/terms' target='_blank'>Terms of service</a>
*   </label>
*   <input type='checkbox' name='ulp-terms-of-service' id='terms-of-service'>
* </div>
**/

exports.onExecutePreUserRegistration = async (event, api) => {
  const fullName = event.request.body['ulp-full-name'];
  const terms = event.request.body['ulp-terms-of-service'];
  
  if(!fullName) {
    api.validation.error("invalid_payload", "Missing Name");
    return;
  }
  
  if(!terms) {
    api.validation.error("invalid_payload", "Acceptance is Required");
    return; 
  }

  api.user.setUserMetadata("fullName", fullName);
  api.user.setUserMetadata("termsAcceptance", terms);
};

```

To learn more about how Signup and Login Prompt Customizations works and to view tutorials and examples, refer to the public documentation.

* Custom-facing Documentation: [Customize Signup and Login Prompts](https://auth0.com/docs/customize/universal-login-pages/customize-signup-and-login-prompts)
* Management API Documentation: [Auth0 Management API v2: Manage Partials](https://auth0.com/docs/api/management/v2/prompts/get-partials)

Customizations for Signup and Login are Generally Available

Customers and trial customers on Enterprise and Professional plans can now customize signup and login flows to address unique needs.

Each company has unique user registration and login requirements, for example, needing to capture a first and last name during signup or requiring users to agree to terms and conditions before they can create an account. 

In order to meet specific business needs and use cases, companies often have to build and maintain different experiences – hosted pages and sites – within their account registration and login flow(s). Unfortunately, this approach slows down the time to market by introducing separate code bases that require localization and maintenance while also creating an inconsistent customer experience.

To solve this problem, we have introduced custom prompts for signing up and logging in to Universal Login. This capability is now open for early access (EA) and available to our customers and trial customers on Enterprise and Professional plans. 

## Addressing Unique Use Cases

With custom prompts for signup and login, our customers can customize and add new fields to existing signup and login prompts; this includes client and server-side validation to ensure that required data and requirements, such as Terms of Service (TOS) acceptance, are completed and validated before completing the signup or login process. 

Leveraging Universal Login and our extensibility framework, our customers can tailor these two experiences to address data capture, security, regulatory, and customer experience requirements. Use cases included:

- Add new fields in order to collect necessary customer data (name, phone number, email, preferences, consent, etc.) 
- Add new form elements for presenting and capturing TOS/privacy policy and opt-in before sign up
- Add custom content such as URLs, images, marketing information
- Localize custom text in different languages

## Getting Started

During open early access, this feature will be automatically available to all of our Professional and Enterprise customers and trial accounts. To get started, please check out our documentation [here](https://auth0.com/docs/customize/universal-login-pages/customize-signup-and-login-prompts). If you have any questions, please reach out to your Account Executive.  

Before closing, I want to give a shout-out to our customers who provided feedback during the limited EA. We had over 75 customers join and received invaluable feedback. This underscores the importance of this capability, which we’ll continue to evolve and shape based on customer feedback, so please let us know how it goes.  


_Any products, features, or functionality referenced in this material that are not currently generally available may not be delivered on time or at all. Product roadmaps do not represent a commitment, obligation, or promise to deliver any product, feature, or functionality, and you should not rely on them to make your purchase decisions._


Customizations for Sign up and Login Now in Open Early Access

Tailor registration flows to maximize conversion while meeting business requirements.

Sign-up and login are two critical entity points for your business. They not only provide a means for your company to collect customer data, present and collect consent, and authenticate and verify users and their data, but they also serve as moments to establish brand image and trust. Because of that, these experiences need to be localized, branded, and consistent for your customers and would-be customers.  

For each company, this will be different. This means that companies require the flexibility to modify sign-up and login forms with additional fields and elements to address their unique use cases, business needs, evolving regulatory requirements, and customer demands for transparent, convenient, and personalized experiences.  

And with that, **we’re excited to announce that new sign-up customization capabilities are now available in early access within our Universal Login experience!** This flexibility will ensure that our customers can tailor their sign-up flows to meet their specific use cases.

## How Does It Work?

Customers can customize existing signup prompts by adding custom content and form elements to meet diverse customer preferences, business, localization, and internationalization requirements. No need to host your own pages, which introduce different URLs and separate code bases that slow time to market and create an inconsistent customer experience. 

This includes client and server-side validation, leveraging the Pre User Registration trigger, to ensure that required data, such as Terms of Service acceptance, are completed and validated before completing the signup process.

![How Does It Work](https://images.ctfassets.net/23aumh6u8s0i/1ka3a5mkTZz8NLSNjO7HPW/acb847f03bc1854ddfe55b83f40be34b/New_Sign_Up_Customizations_Now_in_Early_Access.png)

## What Use Cases Are Supported?

The initial early access release will provide support for various use cases, including: 

* Collect necessary customer data (name, phone number, email, preferences, consent, etc.) 
* Present Terms of Service/Privacy policy and opt-in before signing up
* Display marketing information and trust signals with URLs and/or images
* Add custom text, links, images, URLs, etc. 
* Localize or customize custom text in different languages (Note: EA release may not include a full scope of localization capabilities)
* Experiment with different designs, copies, and elements 

## How Can You Apply?

If you are interested in joining the early access program, please reach out to your account manager.  

_Any products, features, or functionality referenced in this material that are not currently generally available may not be delivered on time or at all. Product roadmaps do not represent a commitment, obligation, or promise to deliver any product, feature, or functionality, and you should not rely on them to make your purchase decisions._


New Sign-Up Customizations Now in Early Access

Oliver Wang

A product manager at Auth0 focuses on  Ecosystem and Extensibility.  With an engineering background, Oliver always puts developers' experience first.  He has mixed industrial experience as a Product Manager, Software Engineer and Data Analyst. This diverse profile unites different team members to deliver value to our customers. Besides work, you can catch him up on a ski hill in the Canadian Rockies.

Product Manager, Ecosystem

Three new capabilities are all now available in Auth0 Actions.

## Do More with Actions

You can now unlock deeper identity customization with Auth0 by Okta. Starting today, you can use advanced features in Auth0 Actions, which include SAML Mapping, Root-Level User Attributes, and Access Token Scope. These new capabilities enable you to seamlessly upgrade from Rules to Actions - our flagship extensibility product.


## Allow Deep Customization with Three New Capabilities in Actions

Our new functionalities bring unique benefits to developers and their customers alike. We dive deeper into these below.

### SAML mapping and configuration

The Security Assertion Markup Language (SAML) is essential for sharing authentication and authorization data between various identity and service providers. Our latest update integrates SAML mapping and configuration into Actions, streamlining the handling of user data and facilitating integration with SAML-based identity providers.

Developers can now map user attributes and claims from SAML assertions directly to user profiles using Actions. This integration simplifies the management of user attributes, ensuring a seamless flow of data between different identity providers and their applications. As a result, you can create context-aware, personalized experiences, bolstering your identity pipeline. Learn more about SAML in our [Docs](https://auth0.com/docs/customize/actions/flows-and-triggers/login-flow/api-object).

### Access Token scope

Access tokens are crucial for token-based authentication, allowing an application to access an API. With our upgrade, developers can freely add or remove claim scopes with custom APIs, enhancing their ability to meet their overall security needs. Learn more about Access Token in our [Docs](https://auth0.com/docs/customize/actions/flows-and-triggers/login-flow/api-object).

### Root-Level user attributes

The normalized Auth0 user profile includes both root attributes and profile attributes from various identity providers. Our latest update provides a comprehensive exposure to these attributes, enabling developers to better customize their identity solutions. This means you can make more use of standard properties such as `user.roles`, `user.groups`, and `user.permissions` to understand customer profiles and protect user interests better. Learn more about User Attributes in our [Docs](https://auth0.com/docs/customize/actions/flows-and-triggers/login-flow/event-object).

## Migrating to Actions: It’s All about out-of-Box Customization

In today's shifting digital landscape, off-the-shelf identity solutions are often insufficient. Given unique organizational needs and ever-changing regulations, customization and flexibility are critical. Auth0 Actions offers an opportunity for deep customization, benefiting customers, partners, and developers alike.

We encourage you to move from Rules and Hooks to Actions for improved developer experiences and ongoing feature enhancements. By using Actions, you can directly integrate third-party solutions, bypassing the need for custom code and benefiting from improved caching performance. Embrace simplicity and flexibility in identity management— transition to Auth0 Actions today.

We are here to help. Visit our [Move to Actions](https://auth0.com/extensibility/movetoactions) page for more migration information and learn more about SAML, Access Token, and User Attributes in our [Docs](https://auth0.com/docs/).


Unlock Deeper Customization in Actions with Three New Capabilities

joey devilla headshot 900px

I’m a Senior Developer Advocate at Auth0, and I like to work on various technologies. I’ve developed software for all sorts of platforms, from CD-ROM and the PalmPilot to my current area of focus, mobile phones, IoT devices, and AI. When I’m not looking for strange new platforms to write software for, I’m playing a strange old instrument — the accordion!

Senior Developer Advocate

Joey deVilla

With Auth0’s Actions, it’s easy to ensure that users can sign up for an account only between a specific start date and end date.

Some applications have a limited lifetime. A website or app for limited-time events such as a conference, convention, or concert will only be useful when the event takes place. Since there’s no point in allowing people to sign up for an account after the event is over, you may want to limit registration to a specific set of dates.

It usually takes a considerable amount of work to limit the dates when new users could register an account. However, if you’re using Auth0 to authenticate your users, this task became a lot easier thanks to Actions!

Actions are a new feature that allows you to extend Auth0 beyond what it can do “out of the box”. They’re Node.js functions that you can add to various flows within Auth0’s processes, including logging in, changing passwords, and signing up for a new account. You write and store these functions in the Auth0 dashboard, where they’re part of your tenant’s settings, and Auth0’s servers execute them.

In this article’s exercise, you’ll learn how to write an Action that limits when users can sign up for an account for a specific application. If a user signs up for an account outside the defined valid registration period, their attempt to sign up will be canceled, and they will see a message explaining why.


## Prerequisites

You’ll need the following for this exercise:

- **Auth0 account:** Actions are an Auth0 feature, which means you need an Auth0 account to use them. <a href="https://auth0.com/signup" data-amp-replace="CLIENT_ID" data-amp-addparams="anonId=CLIENT_ID(cid-scope-cookie-fallback-name)">You can sign up for free,</a> and the process is pretty painless.
- **Any application that uses your Auth0 tenant to provide Universal Login.** Any web-based, mobile, or desktop application will do, just as long as it is one of your tenant’s applications. You’ll need it to log in and see how defining Actions changes how login works. If you don’t have any applications that use Auth0 for authentication, you can download one from the [Auth0 Quickstarts](https://auth0.com/docs/quickstarts/) page.


## Create a New Action

The first step in creating a new Action is navigating to the appropriate authentication flow. Do this by selecting **Actions** from the left-side menu, then select **Flows** from the sub-menu that appears:

![The Auth0 dashboard’s “Getting Started” page, with instructions to select “Actions” and “Flows” from the left side menu.](https://images.ctfassets.net/23aumh6u8s0i/6Fm12KNWxp84G1d0fo7Mwe/5a5e2ed7081685188631b9bd24210534/select_actions_then_select_flows.png)

You’ll be at the *Choose Flow* page, where you can select the flow for your Action. In this case, we want to create an Action that runs immediately after the user submits an email address and password to sign up for an account. Do this by selecting the **Pre User Registration** flow:

![The “Choose Flow” page, with an instruction to select “Pre User Registration”.](https://images.ctfassets.net/23aumh6u8s0i/1FuLu1sJEPZAkqr1NrCrs7/8687dc2967b23e8a8047e98fdcdb9b72/select_pre_user_registration.png)

This will take you to the *Pre User Registration* flow page, which contains a flowchart depicting the pre-user registration flow in the center of the page, and a column labeled *Add Action*, which lists Actions you can add to the flow.

It’s time to create an Action to add to the flow. Do this by clicking the **+** button in the *Add Action* column, then select **Build Custom** from the menu that appears:

![The “Pre User Registration” page, with instructions to click the “+” button, then select “Build Custom”.](https://images.ctfassets.net/23aumh6u8s0i/6oAnPkD7GIzbH7Xum2x4ra/03191b4a3cd51bbdc39e1cc073b65c6e/click_the_plus_button_then_build_custom.png)

The *Create Action* dialog box will appear. Give the Action an appropriate name in the **Name** field. I chose **Limit App 001 registration to Jan 2022**. Leave the **Trigger** and **Runtime** menus at their default settings, and click the **Create** button:

![The “Create Action” dialog box.](https://images.ctfassets.net/23aumh6u8s0i/185ogMV4v4tNO9darSqBPj/94ed284bac44add5983108887c3611f0/create_action.png)

You’ll be taken to the code editor for your newly created Action:

![The code editor for the newly created Action.](https://images.ctfassets.net/23aumh6u8s0i/4s2yJTUGUYJvQGWr7khSdV/389419f0fa32a28ff1968e33d4dfb1f9/code_editor.png)


## Write Code for the Action

Let’s write a quick specification for the Action before we code it.

The Action should:

- Only affect sign-ups for a given application. In this exercise, we’ll call it “App 001”. It should not affect sign-ups for any other applications in the tenant.
- Limit registration so that users can sign up for an account only between a given start date and end date. For this exercise, let’s limit registration to January 2022.
- If a user tries to sign up before or after the registration period above, their attempt should fail, and they should be shown a message explaining why.

Here’s the code that implements that specification. It limits registration to the month of January 2022. You should adjust the start and end dates for the registration period as you see fit:

```javascript
exports.onExecutePreUserRegistration = async (event, api) => {
  if (event.client.client_id === /* CLIENT ID GOES HERE */) {
    // Remember, Date objects are GMT by default!
    const startDate = new Date(/* START DATE/TIME GOES HERE */) 
    const endDate = new Date(/* END DATE/TIME GOES HERE */)
    const now = new Date()

    if (now < startDate || now > endDate) {
      const LOG_MESSAGE = "APP 001 registration outside January 2022"
      const USER_MESSAGE = "Registration for this app is limited to January 2022."
      api.access.deny(LOG_MESSAGE, USER_MESSAGE)
    }
  }
}
```

You’ll need to customize the code above for your situation:

- Replace the `/* CLIENT ID GOES HERE */` comment with the application’s client ID that this Action should apply to. The Auth0 dashboard’s *Applications* list (select **Applications** → **Applications** from the menu on the left side of the page) shows the client ID of every application in your tenant.

![Copying a client ID from the “Applications” page.](https://images.ctfassets.net/23aumh6u8s0i/3p7mcb0rAUFt1zl8eSV8Uf/2234916fcfe8217c85d685fdd20fe10d/copy_client_id.png)

- Replace the `/* START DATE/TIME GOES HERE */` comment with the date and time of the start of the valid registration period. Since we want to limit registration to January 2022, use a start date value of “2021-01-01T00:00:00”.
- Replace the `/* END DATE/TIME GOES HERE */` comment with the date and time of the start of the valid registration period. For this exercise, use an end date value of “2021-01-31T23:59:59”.

Auth0 calls the `onExecutePreUserRegistration()` function just after the user has provided an email address and password to sign up for an account but before the account is created. Any code entered into this function can examine the credentials provided by the user or use any other information to decide if the registration should take place or be canceled.

`onExecutePreUserRegistration()` takes two parameters, whose properties you can use to perform tasks prior to the user being registered:

1. `event`: An object that contains details about the request to register a new user. The Action uses `event` ’s `client.client_id` property to identify the application that triggered it. Remember, the limited registration period should apply only to App 001.
2. `api`: An object with methods that you can use to change the behavior of the Pre User Registration flow. The Action uses `api`’s `access.deny()` method to cancel registration. `access.deny()` has two parameters:
  - `reason`: A string containing an *internal-facing* reason why registration is being canceled. This value will appear in your tenant’s logs.
  - `userMessage`: A string containing an *external-facing* reason why registration is being canceled. This value will be displayed to the user to explain why they can’t sign up for a new account.

With the code entered, click the **Deploy** button to save it. 


## Add the Action to the Flow

Now that you now have a working Action, it’s time to incorporate it into the flow.

Go back to the *Pre User Registration* page. There are a couple of ways to do this:

- Select **Actions** → **Flows** from the menu on the left side of the page, then click on **Pre User Registration**.
- If it’s onscreen, click on the **Back to Flow** link. It will be near the upper left corner of the code editor).

Once you’re on the *Pre User Registration* page, you should see the Action you just created in the *Add Action* column:

![The “Pre User Registration” flow, with an instruction to start dragging the newly-created action.](https://images.ctfassets.net/23aumh6u8s0i/7fNARXSPtCo7Gt0gwinM9h/682c304760f28e3dc3c250f484885b44/pre_user_registration_flow_1.png)

Drag the Action into the flow, as shown in the screenshots above and below.

![The “Pre User Registration” flow, with an instruction to drag the newly-created action into the flow.](https://images.ctfassets.net/23aumh6u8s0i/p6eeehO3r4ZHl2kMrRSSu/90a3d139cca604a9c7430ead524dc1e1/pre_user_registration_flow_2.png)

Click the **Apply** button near the upper right corner of the page. The change you just made to the flow will not take effect until you do so.


## Try to Sign Up for an Account

At this point, your Action is now part of the Pre User Registration flow. Whenever a user submits their email address and password to sign up for a new account, your Action will be triggered and execute its code.

Run the app that you wrote the Action for. Sign up for a new account instead of logging in when you reach the login screen. As long as the current date is outside your Action’s start date and end date, you should be able to enter any valid email address and password because the registration will never happen. You should see the following instead:

![The login box for the application, with a message under the “Password” field that says “Registration for this app is limited to January 2022.”](https://images.ctfassets.net/23aumh6u8s0i/w362yU7dfAnTDbLT42YHU/a2dcb648b06602cd95583cd5c2bbf591/sign-in_canceled.png)


## Experiment!

Now that you know the basics of restricting new registrations, you might want to try some different test conditions, such as:

- **Limiting sign-ups to users in specific countries.** There may be legal, business, or security reasons for letting only users in specific countries sign up for an account. The `event` object provides a lot of information about the request to create a new user account, including the user’s geographical location based on their IP address, which you can access using `event.request.geoip.countryName`. Check out our article, [*Country-Based Access with Auth0 Actions*](https://auth0.com/blog/country-based-access-with-auth0-actions/), to see how you can apply this technique to logins.
- **Disallowing sign-ups from certain IP addresses.** If you see a lot of malicious activity from certain IP addresses, you can block their sign-up requests. This is another use case where the `event` object comes in handy. Use `event.request.ip` to determine the address of the user attempting to register and deny their registration if it appears in a list of known malicious addresses.
- **Limiting sign-ups to weekdays.** You can use JavaScript’s `getDay()` function to see if the current date/time falls is a weekend day. Keep in mind that while Saturday (for which `getDay()` returns `6`) and Sunday (for which `getDay()` returns `0`) constitute the weekend in most places, some regions have different weekend days. Once again, you may also have to account for time zone differences.

Limit User Registration to Specific Dates with Auth0 Actions

Here’s a collection of Actions that you can write quickly to perform useful tasks.

[Actions](https://auth0.com/docs/actions) make it possible for you to customize the way Auth0 works. They do this by letting you insert scripts — called *Actions* — into various Auth0 workflows to add functionality and enhance your users’ experience.

Actions can be complex, but they don’t need to be. In this article, I’ll show you a handful of Actions that can you can enter in a minute or two, but perform tasks that you’ll find useful in the day-to-day running of your applications.


## Redirect Users to a “Downtime” Page

Sooner or later, your application will have downtime. If all goes well, it will be *scheduled* downtime, but there will likely be *unscheduled* downtime too. In either case, it’s useful to have a web page where you can redirect users to inform them that your application is unavailable and provide additional details.

You can do this by adding the following Action to the [Login flow](https://manage.auth0.com/#/actions/flows/login/), replacing `{SYSTEM DOWNTIME PAGE URL}` with the location of the web page explaining the downtime:

```javascript
// Login flow

exports.onExecutePostLogin = async (event, api) => {
  api.redirect.sendUserTo("{SYSTEM DOWNTIME PAGE URL}");
};
```

When your application is down, drag this Action into your tenant’s Login flow. It uses the `api.redirect.sendUserTo()` method to redirect the user to the given URL after they log in.

Keep in mind that users will see the downtime page only after logging in successfully.


## Temporarily Disable New Account Sign-ups

It *is* possible to have too much of a good thing. You generally want many users signing up to use your application, but there can be times when you need to stop registration to scale up your systems or allow your staff to catch up.

If you’re ever in this kind of situation, one of the measures you can take is to disable sign-ups temporarily. You can do this by creating a new Action named “Refuse New Sign-ups” in the [Pre User Registration flow](https://manage.auth0.com/#/actions/flows/pre-user-signup/):

```javascript
// Pre User Registration flow

exports.onExecutePreUserRegistration = async (event, api) => {
  api.access.deny('too_many_signups', "We’re not accepting sign-ups at the moment.");
};
```

This Action uses the `api.access.deny()` method, which cancels the user registration process and any subsequent Actions. It takes two arguments:

* `reason`: This is a string that provides an internal reason why you’re denying the user’s attempt to sign up for an account. This is for the benefit of the application’s developers and administrators and will appear in the tenant’s logs. We recommend that this be a short label rather than a sentence.
* `userMessage`: This is also a string, and it’s the *user-facing* reason why they’re not able to sign up for an account. You want this message to be user-friendly, and we recommend that this be a full sentence. 

With the “Refuse New Sign-ups” Action deployed and added to the Pre User Registration flow, this is what the user will see when they attempt to sign up:

![“Sign up” screen displaying the message “We’re not accepting sign-ups at the moment.”](https://images.ctfassets.net/23aumh6u8s0i/1vuCHpnYHpEWrtbjREPvBN/32ae15dbc0db8e5f02d2bc7e25f9bb54/refuse_sign-up_action_1.png)

While the login box shows the “We’re not accepting sign-ups at the moment” message, you can see that the message is dwarfed by the big red box containing password requirements. 

At the moment, there’s no way to “turn off” that big red box, which was created before we had Actions and the Pre User Registration flow. For now, you should use messages that are at least two sentences long in order for them to be more easily seen:

![“Sign up” screen displaying a longer version of the mesage “We’re not accepting sign-ups at the moment.”](https://images.ctfassets.net/23aumh6u8s0i/2Cafl2dxdCzPCF1Po4mNcH/47721e5f44f0cd693432cf189c7384ba/refuse_sign-up_action_2.png)


## Initialize a New User’s Metadata

Every Auth0 user account stores information about the user as metadata, which your application access. Two kinds of metadata are stored:

1. **User metadata:** A set of attributes about the user that *don’t* affect the app’s core functionality. The user *can* view and modify this information, which typically comprises user preferences and settings.
2. **App metadata:**  A set of attributes about the user that *do* affect the app’s core functionality.  The user *cannot* view and modify this information, which includes things such as their status and state within the application, or any other settings that determine what features or activities are available to the user.

You can use an Action in the Pre User Registration flow to set the user’s user and app metadata to their initial values. In the example below, the Action sets values in both a newly-created user’s user metadata and app metadata:


```javascript
// Pre User Registration flow

exports.onExecutePreUserRegistration = async (event, api) => {
  api.user.setUserMetadata("ui_color", "default");
  api.user.setUserMetadata("use_verbose_messages", false);  
  api.user.setAppMetadata("is_new_user", true);
  api.user.setAppMetadata("reward_status", 0)
};
```

The code above uses two methods — `api.user.setUserMetadata()` and `api.user.setAppMetadata()` — to initialize the new user’s user and app metadata respectively.

With this Action inserted into the Pre User Registration flow, every new user — whether created by clicking the **Sign up** link in the login box, or through the Auth0 dashboard or management API — will have the following user and app metadata:

![A user account’s user and app metadata displaying the initialized metadata after the Action is run.](https://images.ctfassets.net/23aumh6u8s0i/2h5wwSK8OlMj6k0uqQMLw8/eacb8b3157c4bebc9b65b38de5d244f7/new_user_metadata.png)


## Email the User after a Password Change

It’s good to email the user immediately after the password to their account changes. If the user made the change, the email is a reminder of when they last updated their password. If the user *didn’t* make the change, it could be a sign that an unwanted party has access to their account. 

You can set up this kind of email notification by adding an Action to the [Post Change Password flow](https://manage.auth0.com/#/actions/flows/post-change-password/), as shown below:

```javascript
// Post Change Password flow

function sendGmail(username, password, emailAddress, subject, message) {
  try {
    const send = require('gmail-send')({
      user: username,
      pass: password,
      to: emailAddress,
      subject: subject,
    });
    send({
      text: message,  
    }, (error, result, fullResult) => {
      if (error) console.error(error);
      console.log(result);
    })
  } catch (err) {
    console.log(`Error sending email to ${emailAddress}:`, err.message)
  }
}

exports.onExecutePostChangePassword = async (event) => {
  sendGmail(
    event.secrets.GMAIL_USERNAME,
    event.secrets.GMAIL_PASSWORD,
    event.user.email,
    "Your password has been changed",
    `
This is a quick message to let you know that your password has been changed. If you made this change,
you can ignore this email. If you DIDN’T make this change, please contact the administrator.
    `
  );
};
```

This is a more complex Action than the previous examples. It requires more setup, which I’ve outlined below.


### Wait… a *Gmail* account?

While you shouldn’t use Gmail as an email server for a production app, I find that a Gmail account dedicated to testing can be useful for prototyping.

To set up such an account, [sign up for a new Gmail account](https://accounts.google.com/signup). Don’t enable two-factor authentication on this account, because doing so makes the next step in the process unavailable.

[Go to the home page for your newly-created account](https://myaccount.google.com/) and select *Security* from the menu on the left side of the page. Scroll down until you see the *Less secure app access* section and click on the *Turn on access (not recommended)* link. Set the *Allow less secure apps* switch to the ON position.

You will now be able to use this Gmail account to send emails on behalf of your Action.

Please remember you should use this account for testing purposes only! For a production application, use a dedicated email-sending API.

> Don’t forget that [Gmail has an API](https://developers.google.com/gmail/api) that provides authorized access to the data in a user’s Gmail account and can be used to perform several actions, including reading, sorting, sending, and backing up mail, as well as managing user settings such as aliases, signatures, filtering, and forwarding.


### Store your secrets

The `onExecutePostChangePassword()` function delegates the sending of email to another function, `sendGmail()`. When the time comes to move the Action out of the prototyping phase, I can have `onExecutePostChangePassword()` call a different function with the same parameters that accesses an email API that’s more suitable for production.

You may have noticed that I didn’t hard-code the Gmail account’s username and password values into the Action. Instead, they appear to be properties of the `event.secrets` object. These are ***secrets*** — values that are securely stored in the *Secrets* section of the action.

To manage an Action’s secrets, click on the key icon on the left side of the Action editor. This will open the *Secrets* panel, where you can add, edit, and delete values that you want to keep secret:

![The “Secrets” panel and its controls.](https://images.ctfassets.net/23aumh6u8s0i/1wINrTk7gpX8oZsg4WbpUg/2f8c8b27c033256d2280790d911a8045/secrets_panel.png)

When you click the *Add Secret* button, a pop-up appears, allowing you to define a secret as a key-value pair:

![The “Define Secret” dialog box.](https://images.ctfassets.net/23aumh6u8s0i/N8Y5cvyvcAL8ybLaKkzmz/6f7d7fa02932b4f1755595608dfa1c4a/define_secret.png)

Once defined, you can access secrets as properties of the `event.secrets` object. The two secrets that I defined — `GMAIL_USERNAME` for the username of my prototyping Gmail account and `GMAIL_PASSWORD` for its password — can be accessed in the Action code as `event.secrets.GMAIL_USERNAME` and `event.secrets.GMAIL_PASSWORD`.


### Add modules

The `sendGmail()` function uses the `require()` function to include the `gmail-send` npm module to send email notifications to the user through Gmail. But how do you make `gmail-send` available to your Action?

You do it using the *Modules* panel, which you can access by clicking on the package icon on the left side of the Action editor:

![The “Modules” panel and its controls.](https://images.ctfassets.net/23aumh6u8s0i/5x4ommIbuuJMF4Y5da7JFG/a55ecf98020fa510ab0e3bd9349b2891/modules_panel.png)

The *Modules* panel lets you bring in functionality from any combination of modules in npm’s vast collection. 

To add a module to your Action, click the *Add Module* button. A pop-up will appear, allowing you to specify an npm module to include and optionally, which version:

![The “Add Module” dialog box.](https://images.ctfassets.net/23aumh6u8s0i/2EbQuMtGl1ELWQiPrZxZ2d/d592ca4a09e572aa19a48d9f63c396f3/add_module.png)

I added the latest version of the `gmail-send` module to the Action.


## Conclusion

As I mentioned in the beginning, Actions don’t need to be lengthy or complicated to achieve useful results. Sometimes a single line is all you need!

You should use the Actions provided above as a “jumping-off point” for writing your own custom Actions to meet your users’ needs. Use your imagination, and don’t be afraid to experiment!


Quick Tips and Tricks for Auth0 Actions

Vittorio

Vittorio Bertocci is a Principal Architect for Auth0. Before Auth0, he had a lengthy career with Microsoft, where Vittorio worked with Fortune 100 and Global 100 companies, including working on Microsoft’s Azure Active Directory team as principal program manager focusing on the developer experience. He contributed to the inception and launch of Microsoft's claims-based platform components (Windows Identity Foundation and ADFS, ADAL and MSAL SDKs, ASP.NET middleware). Vittorio is a well known speaker, educator and published author.

Principal Architect

Vittorio Bertocci

Choosing the right customization strategy can make the difference between success and failure in your next identity project.



Every identity professional is familiar with that vaguely frustrating feeling arising from working on a scenario that is _almost_ perfect. If only that user store could support OpenID Connect… If only that legacy app could be slightly modified… Similar deviations from the canonical scenarios are the true norm, making it hard to provide a solution that only relies on the out of the box features commonly found in identity products.

Businesses, system integrators, and software vendors deal with those challenges following what looks like a disjointed set of different strategies. Some take a brute force approach and code every identity functionality from scratch. Others implement their identity functions deploying installable instances of server products, or rely on operating system features, and take advantage of the degree of control that can be achieved by running your private instance. Yet others rely on IDaaS (Identity-as-a-Service) offerings, leveraging whatever extensibility technology is offered to adapt the defaults to the specific needs of their particular scenarios.

<include src="TweetQuote" quoteText="How do you know if the identity solution you are evaluating will give you the power and flexibility your scenarios require? The answer is in their extensibility features.#taoofextensibility"/>

In that apparent chaos, choosing the strategy that best fits your requirements isn’t easy. To help with that difficult task, we authored a whitepaper that compares and contrasts the main approaches to identity customization. By placing every strategy on a continuum based on the expressive power and ease of implementation dimensions, we expose individual strengths and weaknesses while offering you a logical progression you can use as a reference when considering hybrid approaches. Here’s the chart that summarizes it all:

![IDENTINOMICS](https://images.ctfassets.net/23aumh6u8s0i/2NFqrjWN3ckUWRyfyc0U0H/f1ed9f13daaddd38bb02a5f97415c6cd/IDENTINOMICS)

The strategies considered cluster around two macro approaches, one which favors full control at the price of taking more responsibility in the implementation (lower left quadrant) and one where most functionality is outsourced to a service, with the expressive power bounded by the extensibility choices of the selected service (top right quadrant). You’ll have to download the whitepaper to find out the whole story, but let me give you a spoiler alert here. 

At Auth0 we believe in the power of outsourcing identity concerns to a service run by professionals, but we are also strong believers in the power of code. This is why we deem the IDaaS+code approach to be the one offering the absolute best compromise: identity essentials taken care of by an easy to use service while retaining the ability to address last-mile customizations with code — the same control and power you’d have if you would have coded everything from scratch.

Download the [Identity in the Real Word: the Tao of Extensibility](https://auth0.com/resources/whitepapers/tao-of-extensibility) whitepaper.

Auth0 Principal Architect Vittorio Bertocci’s new whitepaper can help CTOs, architects, and developers understand the trade-offs between the different customization strategies offered by today’s identity solutions, explaining how to pick the right one for each scenario in the “Tao of Extensibility.”

<include src="TweetQuote" quoteText="Today’s identity products approach customization with many different strategies. Auth0 Principal Architect @vibronet evaluates the strengths of each approach. #taoofextensibility"/>

<include src="asides/AboutAuth0" />


New Whitepaper: The Tao of Extensibility

jenny-obrien

I'm a former business journalist who's fascinated by the intersection of tech and business strategy — in particular how the right solution can transform an idea into reality. I specialize in ROI, data privacy, and identity.

Business Content Manager

Jenny O'Brien

How innovation, customization can still speed time to market (and increase ROI)



The unisex t-shirt — fits everyone, right?

You know it doesn’t. Not all your employees. Not all your customers. 

But you got the bulk rate, so it’s good for the bottom line, right?

Unlike the t-shirt targeted for donation, one-size-fits-all identity can’t just be put to other uses. Your teams will be forced to come up with workarounds, delaying your time to market while driving up maintenance costs — and stealing your team away from your core business while shrinking your team’s innovation bandwidth to a trickle.

Doing identity wrong can lead to sleepless nights, poor user experiences, brand challenges, data-privacy-related fines, and security threats. [Doing it right](https://auth0.com/blog/how-to-have-a-successful-idm-project/) can enhance any digital transformation effort, [reduce development costs and maintenance overhead](https://auth0.com/blog/auth0-roi-how-are-you-calculating-your-build-formula/), and provide revenue-enhancing customer experiences. 

Ideally, your identity solution adapts to your end users’ needs (even if they don’t know what they are yet) rather than the other way around.

![An identity management solution can set you up for steady growth](https://images.ctfassets.net/23aumh6u8s0i/3mYnaCAVsD5ifrgaOSp4s0/f9efa5f60b42e99bb5905687fd8533fb/roi)

<include src="TweetQuote" quoteText="Unlike the t-shirt targeted for donation, one-size-fits-all identity can’t just be put to other uses."/>

## Implementing at Future-Speed

During due diligence, many of our customers share that [competitor’s](https://auth0.com/auth0-vs) proofs-of-concepts can take months to execute and implementations, particularly in the B2B and B2C space can take longer even with just minimal customization. This time loss quickly negates the benefits of the one-size-fits-all solution. Auth0 believes that organizations should be entitled to the best of both from their IAM provider: value from day one out-of-the-box with the ability to easily adapt and customize over time  — several key areas stand out:

### Scaling for Steady Growth and Spikes

Internal IAM solutions leveraged for external purposes often fail due to required scale.

Enterprises may manage tens, hundreds, or thousands of employee identities with an internal IAM, but customer identities can range well into the millions or even billions. The need for scale might be slow and steady, but customer use might spike during specific times of the year, say with the Super Bowl, like with Auth0 customer [fuboTV](https://auth0.com/learn/sports-centric-streaming-service-fubotv-sees-50-roi-just-auth0s-security/). A flexible IAM solution can easily accommodate dramatic shifts in need.

### Increasing Account Security

When it comes to employee identity and data created within internal applications, ownership belongs to the business. Customer identities created across sites and applications ultimately belong to consumers.

But while brands must gain permission to capture and collect consumer identity data, once a customer’s identity is on a business' property and his/her information is stored in its database, that business is responsible for protecting that customer’s data.

<include src="TweetQuote" quoteText="When it comes to employee identity and data created within internal applications, ownership belongs to the business."/>

Using a third-party identity expert like Auth0 makes it easier for companies to protect end user data because the company no longer needs to remain current with the cryptographic algorithms and best identity security practices — Auth0 does it for them. And we’re regularly tested by third-party assessors to maintain [certifications](https://auth0.com/security/) like ISO 27001, ISO27018, SOC 2, HIPAA, and others — all while enabling our customers to create user experiences tailored to their customer’s needs As our customer [Act.md](https://auth0.com/learn/act-md-sees-2x-dev-savings-auth0/) Chief Medical Officer Narath Carlile explains, “In creating a collaborative environment for you and your loved ones, we wanted to have the best level of security and authentication that’s available in the industry today. That’s why we partnered with Auth0.”

### Improving User Experience

[Seamless authentication experiences across multiple brands](https://auth0.com/learn/alma-media-sees-30-total-savings-seamless-brand-access/) can be easy with Auth0, as is coming up with solutions that may seem ‘impossible,’ like the Single Sign On for Microsoft products using G Suite [Auth0 helped create for Sprinklr](https://auth0.com/learn/sprinklr-achieves-impossible-sso-with-auth0/). We know that some logins need to rely on username/password, while others need social login, or end-user-specific solutions. We’ve even been recognized by Frost & Sullivan for our [innovative](https://auth0.com/blog/auth0-named-technology-innovation-award-winner-by-frost-and-sullivan/) approach to identity. We know your customer needs aren’t static, so we’ve created a solution that can give you out-of-the-box functionality within days that can be customized to your evolving needs.

## Balancing Security and User Experience Doesn’t Have to Hurt. 

Revisiting digital strategies and balancing user experiences can conjure up some painful experiences, but you can have an identity solution that suits your needs now — and the ones your future will demand. A “best-in-breed” solution doesn’t try to force your organization to fit into their identity sizing. You know best your organization’s specific challenges, goals, legacy infrastructure, culture, team skills, etc, so you should be in control, with a solution adapts to your evolving needs. If you’re ready to shift to a “best-in-breed” solution, please reach out to [sales@auth0.com](mailto:sales@auth0.com).

<include src="asides/AboutAuth0" />


One-Size Doesn’t Fit All

auziros:bobby-johnson

Bobby is a full-stack developer, advocate, and evangelist at Auth0. He is a passionate engineer with an interest in learning and teaching new technologies, using open source software, and engaging the greater software development community. His experience ranges from building line-of-business applications for financial professionals with Russell Investments and Milliman to distributed social content apps with Cheezeburger and Steller.

Developer Advocate Engineer

Bobby Johnson

Learn about the four-year-long journey Auth0 took to deliver the tools needed by both field engineers and our customers to implement last mile identity solutions quickly.



Previously, we wrote about the emerging pattern of [Serverless Extensibility](https://auth0.com/blog/why-is-serverless-extensibility-better-than-webhooks/). Examples of the concept are popping up in many of the services you use daily like [Twilio](https://www.twilio.com/functions) and here at [Auth0](https://auth0.com/). In this post, I will talk about challenges our customers were facing with our Auth0 Identity product, and how this led us down the path toward implementing the [extensibility](https://auth0.com/extensibility) pattern in a variety of features.

## The problem

![NASA Engineers working on MAVEN](https://images.ctfassets.net/23aumh6u8s0i/3KQXnuCX6H4EROaqBq3hRh/e3e24c8007258b4f7b45f0aef852cebd/engineers_working_on_the_high-gain_antenna_of_the_MAVEN_spacecraft)

*Placed into the public domain by [NASA](http://mars.jpl.nasa.gov/multimedia/images/?s=1) using [Creative Commons](https://creativecommons.org/publicdomain/zero/1.0/)*

In the early days at Auth0, there were two groups: Core and Field Engineering. Core focused on the core functionality of the authentication product, and the field engineers helped customers use the product in their applications. The company was discovering what customers needed in the product.

Our customers' focus was on the authentication transaction. A lot of interesting features can attach to the process of someone trying to login:

- Profile Enrichment
- Progressive Profiling
- Authorization
- Claims Transformation

Customers will come up with an unlimited supply of feature requests. We could not possibly build every feature at once.

Moreover, sometimes building features into the core product for customers is not the right approach. We needed a way to try ideas out. An idea may sound great, but in practice be problematic. Investing core engineering resources to these ideas is very expensive.

> **"The primary use case for extensibility at Auth0 was to empower field engineers to work on the last mile solutions for the customer without involving core engineering."**<br />
> Eugenio Pace - Co-Founder, CEO

If every interaction with a customer involved identifying an idea, putting it in the backlog and coming back to them at a later date, it would add friction to the process and turn customers away.

For example, we had customers who wanted to do profile enrichment. They used services like [FullContact](https://www.fullcontact.com/) to look up a new user and grab related information about them such as their company, role, and social media accounts. FullContact is just one service as there are several others. We had prospects that were depending on these capabilities to have confidence in using us as a platform, and without it would not become customers.

## Custom code extensibility

![NASA's "Webb-cam" Captures Engineers at Work on Webb at Johnson Space Center](https://images.ctfassets.net/23aumh6u8s0i/6UpPFk1QXmAs5xequW3Wpj/23c899dfcde145fb664480ffddd2cd9f/34827899312_571fa2a976_k)

*[NASA](https://www.flickr.com/photos/gsfc/34827899312) licensed under [Creative Commons 2.0](https://creativecommons.org/licenses/by/2.0/)*

To solve this problem, we introduced a method of adding custom code into the platform that could be defined by customers. The inspiration for custom code extensibility as a solution came from spreadsheets. Excel has significant functionality out of the box, but you can always add a function, macro or calculation that better reflects your goal. Moreover, you can write them yourself directly in Excel, removing the dependency on Microsoft engineers.

> **"We wanted a similar experience for our users. A user should be able to log in to the dashboard, write a small amount of node.js code that executes later during authorization transactions."**<br />
> Eugenio Pace - Co-Founder, CEO

Like Excel, we wanted to offer users a really simple experience for customizing our product through code. We believed a user should be able to write their logic in an editor, debug it in place, and make it live in production, all without having to stand up a service. This differed from the prevalent approach at the time for dealing with customization through webhooks, which were hosted by the user.

We quickly implemented an MVP to prove out the concept. It created a process boundary between the core Auth0 stack and the customer's code. It primarily prevented well behaved, well-intentioned code from accidentally bringing down the authorization service or other sandboxed code.

Although the MVP had its limitations, it proved that the user experience for customization could be greatly improved, aligning well with our philosophy of "Identity made simple for developers."

## Evolving customization features

![NASA engineers cleaning mirror with carbon dioxide snow](https://images.ctfassets.net/23aumh6u8s0i/2NQmBSwzenRP0r4HFvU0hZ/1b0447fd2fa9bc307d91d3772f94f6c9/17402277412_5e2834517c_k)

*[NASA](https://www.flickr.com/photos/gsfc/17402277412) licensed under [Creative Commons 2.0](https://creativecommons.org/licenses/by/2.0/)*

Custom code extensibility is exposed in our customer dashboard in three ways: Auth0 Rules, Hooks, and Extensions.

**[Auth0 Rules](https://auth0.com/docs/rules/current)** were the first publically available use case where our customers could easily add custom functionality to their authorization flow directly in the dashboard. Rules execute after authentication but before authorization. We offer a gallery of Rule templates that make it easy for customers to address common scenarios out of the box. Because Rules are code though, customers can easily customize the logic further to meet their specific needs.

A customer clicks a button to add a new Rule, selects one from a set of standard templates which they can customize with a simple editor right in their browser. When saved, the Rule is active on their account for all authentication requests.

![Rules UI](https://images.ctfassets.net/23aumh6u8s0i/A8nlyZBGaECLAhpZ2k9CK/892d84cff88e39e3a51a370ba302964b/rules)

Rules allow you to easily customize and extend Auth0's capabilities. They can be chained together for modular coding and can be turned on and off individually.

Rules were really powerful but were limited only to login. Once customers got a taste of rules, they started to ask us for more places where they can customize the product, and so Hooks were born.

**[Auth0 Hooks](https://auth0.com/docs/hooks)** allow you to customize the behavior of Auth0 using custom code that is executed against several extensibility points. Not only can you introduce customization during the client credentials exchange, but also pre and post user registration. Hooks also take advantage of a more feature rich editor.

![Hooks UI](https://images.ctfassets.net/23aumh6u8s0i/5z6VxLuwFqfKdKRba9vA6W/f63a755d3c63187999e262867c1fdff0/hooks)

While both Auth0 Rules and Hooks give you fine-grained control of the authentication pipeline, **[Auth0 Extensions](https://auth0.com/docs/extensions)** are mini-applications that extend the Auth0 identity product with 3rd party integrations.

They do not directly tie to any specific event in the system. Instead, they can invoke any Auth0 API, can configure the customer tenant, deploy Hooks or Rules on installation and even have an associated user interface. They are extremely powerful and opened up many use cases.

![Extensions UI](https://images.ctfassets.net/23aumh6u8s0i/3z6SONf0xAGkS2UBQavAUL/ce74f139ed89bb283121f9f69abe7482/extensions)

Auth0 Extensions are written using the Webtasks infrastructure. Customers can select an Extension from our gallery and provide a set of configuration options to begin using one.

This is just the beginning. We're constantly looking to enable richer and richer customization in our product, and you'll continue to see us opening new doors as we learn.

## The impact on our sales engineers and customers

![NASA engineers celebrating curiosity](https://images.ctfassets.net/23aumh6u8s0i/5pFHSx1biEJCYLFEKsuh6g/c75c5def4fcb853016d4d68e853ea9e7/celebrating_curiosity)

*Placed into the public domain by [NASA](https://commons.wikimedia.org/wiki/File:Celebrating_Curiosity.jpg) using [Creative Commons](https://creativecommons.org/publicdomain/zero/1.0/)*

Adding extensibility to the identity product opened up a window of customization where field engineers could work independently from core engineering. They could deliver customizations very quickly without waiting weeks or even days, enabling many successful sales engagements.

> **"In some cases, we were able to deliver demos where we implemented feature requests in the demo during the meeting. It was amazing for field engineers and our customers."**<br />
> Eugenio Pace - Co-Founder, CEO

Putting extensibility into the hands of customers also gives us great insights into where the market is going. If we see an extension being implemented again and again through the use of custom code, that is a validation of that feature and an opportunity to add in the core product.

Multi-Factor Authentication came about this way. MFA was not a switch on the dashboard initially. It was merely a rule you applied to your account. Over time, our customers' usage of this rule indicated MFA was an important feature to have in the core product.

For more examples, take a look at our [rules repository](https://github.com/auth0/rules) on Github. Every single one comes from a real-world customer use case.

> **"Every event in the life cycle of the user can be expressed through code and in that way we can support any backend out there in a flash. No matter how customers encrypt or hash passwords; whatever they do is supported because they can provide the details using custom code."**<br />
> Sandrino Di Mattia - Engineering Lead

## The impact on our business

![Happy Employees](https://images.ctfassets.net/23aumh6u8s0i/3tb9Pbddo96TUGVZMxu68U/39443eb09615ed15655b82f45bc54862/culture-2)

Not only did we make our customers happier, opening up customization provided us a direct return on revenue. Looking at our data, we found our customer retention increased up to 10x for those users that took advantage of customizing. Not only that, but our largest deals depend on these customizations even today, bringing 70% of our cloud revenue.

## Summary
In the past four years, we've been exploring how to better enable our users to customize and extend our SaaS. On our journey, we discovered the Serverless Extensibility pattern provided a great solution. We found that allowing extensions to be authored in-line provided tremendous value both to our customers and to the business. It allowed us to close more deals and deliver customer features much more quickly and cheaply than before. 

_I would like to thank [Eugenio Pace](https://twitter.com/eugenio_pace), [Sandrino Di Mattia](https://twitter.com/sandrinodm) and [Tomasz Janczuk](https://twitter.com/tjanczuk) for taking time out of their busy schedules to be interviewed for this post._

<include src="asides/AboutAuth0" />


Our Journey toward SaaS Customization and Extensibility at Auth0

Factor in the cost of time to market, roadmap changes, accreditation, as well as security and customization ease


If you're building your own identity solution, how are you calculating your build formula? You've probably scoped labor and initial dev costs, but our customers tell us that customization and getting to market faster than the competition while eliminating ongoing maintenance, identity-related security, and accreditation costs are some of the reasons why they choose Auth0.

<include src="TweetQuote" quoteText="Building identity is complex. Getting a strong ROI while tailoring it to your needs doesn’t have to be — with @Auth0."/>

## Time to Market

We've had customers with complex projects tell us they've chosen Auth0 after doing a rapid proof-of-concept (POC) while waiting for months for our competitors to scope the work. Since we were built for developers, by developers, we've done the hard work to simplify the complexity of identity. That said, our customers often take on exciting customization challenges, but still manage to beat their competitors to market by taking advantage of Auth0's out-of-the-box features that can be easily customized by their team or with the help of our professional services team. We're just able to get them [to market faster](https://auth0.com/overview/#time-to-market).

"We would have had to probably delay the projects at least six months to get to a point where we are with Auth0. To implement Auth0, we are talking days, not even weeks," says [Nicolas Dormont, Vice President of Information Systems, abas USA and Corporate Product Manager, abas AG](https://auth0.com/learn/abas-sees-1100-roi-launch-market-6-months-faster-auth0/).

## Innovation Costs

Having to rip and replace because you find yourself locked into a solution that isn't flexible enough to adapt to a business-mandated change to your roadmap six months after launch can be expensive. [Auth0's flexibility and extensibility](https://auth0.com/overview/#adaptability) means you can write your own code or use one of our 100+ pre-built Rules and Extensions to provide an easy route to customization, saving both talent and time without the need to rely on an army of professional services staff &mdash; or let a vendor dictate your customization.

"There's a real fine line between building features that customers ask for and providing features that take a leap beyond that and provide an exceptional experience to the customer that they didn't know they could get. Auth0 is innovating in that space and looking at better ways to provide more convenient authentication to customers while reducing security concerns for us and them," says [Ansarada's Chief Systems and Security Officer Steven Rogers](https://auth0.com/learn/ansarada/)

## Security

Last year Ponemon reported [$3.86 million](https://www.ibm.com/security/data-breach) as the average cost of a security breach, but was pre-GDPR. [Consequences plus additional data privacy regulations](https://auth0.com/blog/data-privacy-2019-the-lowdown/) mean that breaches are just going to get more expensive &mdash; and even if you aren't breached, you need to factor in the potential cost of non-compliance (Google was [recently fined $57 million](https://techcrunch.com/2019/01/21/french-data-protection-watchdog-fines-google-57-million-under-the-gdpr/) for not following GDPR regulations).

Have you factored in the time to build active security features for your customers like anomaly detection or brute force protection as well as deal with bugs and vulnerabilities introduced by work-arounds? Auth0's ready-made platform lets you securely customize the authentication process.

You can also add on Enterprise grade Security features such as 24/7 eyes on glass security monitoring without the overhead of standing up a large internal or outsourced Security Operations Center (SOC).

Auth0 takes protecting our customers identity transactions seriously. "We invest heavily in our Security team, building out a cutting edge programme and hiring talented engineers who want to build the security of a security company" says Auth0 Senior Director of Security Duncan Godfrey.

And that adds up to an effective effort for our customers. "The cost to build the identity solution ourselves would have been significant. We're getting at least 50% ROI on the investment just for security alone," says [fuboTV Co-Founder Sung Ho Choi](https://auth0.com/learn/sports-centric-streaming-service-fubotv-sees-50-roi-just-auth0s-security/).

## The Cost of Accreditation

Certifications like SOC 2, HIPAA, and ISO 27001 require an upfront investment to achieve the accreditation plus yearly costs to maintain it. "Most Fortune 500 companies won't sign deals if you don't have the applicable certifications," says Auth0 Senior Manager of Governance Risk and Compliance Adam Nunn. "Yearly tooling costs can vary from organization to organization, ranging from $25,000 to multi-millions, depending on the size of the org."

Auth0 invests yearly on third-party auditors, salaries for the staff who make sure we're compliant, and internal compliance tools (excluding engineering tools and/or tools deployed for security purposes), and continually improving our processes &mdash; eliminating both certification worry and cost for our customers.

## ROI

Auth0's return-on-investment (ROI) numbers can seem eye-popping for companies used to lengthy proof-of-concept (POC) processes and heavy professional services engagements. We do recommend [professional services](https://auth0.com/professional-services/) to help you get to market faster and resolve complex identity challenges, but a long engagement isn't necessarily required.

"Doing what Auth0 does in-house would cost hundreds of thousands of dollars each year, and that's just to manage the service and keep it running. To roll out additional features, that cost would rise directly in proportion to the number of features we would want to add and how many developers we would need to make it happen. Anytime Auth0 releases a feature, that's something we don't have to do ourselves. Ultimately, that benefits not only us, but the hotel customers that rely on us to continue supporting them through our own enhancements and innovations," says [Mike Rogers, CTO and Co-Founder of SiteMinder](https://auth0.com/learn/siteminder-enhances-experience-security-30000-hotels-auth0/).

If you'd like to have us to factor your identity-related ROI with Auth0, please reach out to sales@auth0.com.

<include src="TweetQuote" quoteText="Building your own identity? Are you sure you’ve factored in all the costs that will lead to a strong ROI? Learn how @auth0 can help."/>

### Analyst Insights

[Total Economic Impact of Auth0 (Forrester)](https://auth0.com/forrester-total-economic-impact/)<br/>
[KuppingerCole Leadership Compass: Consumer Identity Access Management](https://auth0.com/resources/whitepapers/leadership-compass-for-ciam)<br/>
[Frost & Sullivan's 2019 Global IAM Technology Innovation Award winner](https://auth0.com/resources/whitepapers/frost-sullivan-global-iam-technology-award)

### From Selected Customers

[Servcorp Saves Months of Development Time Thanks to Auth0](https://auth0.com/learn/servcorp-saves-months-development-time-thanks-auth0/)<br/>
[New Business Accessed the Cimpress Platform in 5 Minutes with Auth0](https://auth0.com/learn/new-business-accessed-cimpress-platform-5-minutes-auth0/)<br/>
[Finn AI Saves 10% + 5% Ongoing in Engineering Time With Auth0](https://auth0.com/learn/finn-ai-saves-10-5-ongoing-engineering-time-auth0/)<br/>
[Alma Media Sees 30% Total Savings for Seamless Brand Access](https://auth0.com/learn/alma-media-sees-30-total-savings-seamless-brand-access/)<br/>
[ACT.md Sees 2x Dev Savings With Auth0](https://auth0.com/learn/act-md-sees-2x-dev-savings-auth0/)<br/>
[Sprinklr Achieves 'Impossible' SSO for Microsoft Products without Active Directory using G Suite with Auth0](https://auth0.com/learn/sprinklr-achieves-impossible-sso-with-auth0/)


Auth0 ROI: How Are You Calculating Your Build Formula?

ec1016a9a63da65998b75f35b6ceb3bb

Javascript junkie, technology enthusiast, tinkerer. Currently Technical Evangelist at Auth0 (https://auth0.com ). I like to learn new things and share that knowledge at conferences.

Technical Evangelist

Joel Lord

Learn how to ensure that only real users are registering to your applications using Kickbox and Auth0 Hooks.



When building an application, it is critical to ensure that the users who are signing up for services or products are real users. By using Auth0, email verification services are provided out of the box; however, wouldn't it be better if verification emails didn't have to be sent at all? By using a combination of [Kickbox](https://kickbox.com/) and [Auth0 Hooks](https://auth0.com/docs/hooks), user email addresses can be validated without sending any emails.

## How does Kickbox work?

Kickbox is an [email technology company](https://kickbox.com/about) with products that help verify email addresses and prevent fake sign-ups applications.

To create a free account, we can visit the [Kickbox sign-up page](https://app.kickbox.com/signup).

<include src="TweetQuote" quoteText="Kickbox ensures we only send email to real users and helps us separate the low-quality addresses from high-value contacts."/>

## Preparing an Auth0 Tenant to Integrate with Kickbox

To demonstrate the integration of Kickbox with Auth0, we are going to use an existing [Auth0 Tenant](https://auth0.com/docs/getting-started/the-basics#account-and-tenants).

> If you haven't already done so, <a href="https://auth0.com/signup" data-amp-replace="CLIENT_ID" data-amp-addparams="anonId=CLIENT_ID(cid-scope-cookie-fallback-name)">sign up for a free Auth0 account here</a>.

Since we don’t want an email verification to be sent any more, we need to deactivate that option in the tenant. On the left sidebar of the Auth0 Dashboard, let's click on **Emails** first and then on **Templates** to get to the [Email Templates section](https://manage.auth0.com/#/emails). In this section, the **Verification Email** template should be selected by default. Find the **Status** toggle and turn it off.

![Auth0 Email Templates](https://images.ctfassets.net/23aumh6u8s0i/UitVKwTRyrujA8IOXGyfE/54bbbcefe7f54f7fa1dcfab90920d63b/auth0-email-templates)

We are now ready to add an Auth0 hook and integrate Kickbox.

## Kickbox Sendex™ Email Quality

As stated in the Kickbox documentation, Kickbox provides us with a [Sendex value](https://docs.kickbox.com/docs/the-sendex) which is an indicator of the quality of an email address. The existence or syntactical correctness of an email address does not indicate its quality. For example, `john.smith@example.com` can generally be seen as a higher quality email address than `sdfsdfsdf@example.com`.

Kickbox uses a number of algorithms, derived from the millions of email transactions it performs each hour, to determine the overall quality of an email address. These are some of the characteristics Kickbox considers when classifying the quality of an email address:

- Is the email address similar to a known, high-quality, valid email address? The Kickbox platform is always evaluating and learning what patterns good email addresses employ. Its evolving data is used to provide insight into the overall quality of a given address.

- Is the email address domain a commercial domain (example: `acme.com`) or a personal domain (`example: yahoo.com`)?

- Does the email address appear to be associated with a role (example: `postmaster@example.com`) instead of a person (example: `bob.smith@example.com`)?

The Sendex value ranges from a `0` (no quality) to `1` (excellent quality). The value of a good Sendex score depends on the specific purpose of the application. For a transactional email the following criteria may be applied:

- 1.00 - 0.55 = Good

- 0.54 - 0.20 = Fair

- 0.19 - 0.00 = Poor

While the Sendex code is useful to verify the quality of an email address, using it in a pre-registration hook could be problematic. In our case, we will want to validate the authenticity of the email, not the quality. To achieve this, Kickbox provides us with other useful information. We will use two of the properties that are provided by Kickbox to validate the email:

- The `result` property will tell us if this email will actually be delivered or if it's from a risky source. In our case, we will validate that this email is not `undeliverable`.

- The `disposable` property will tell us if this email comes from a service that offers disposable email addresses.

Using these two properties with a pre-registration hook, we'll determine if we'll either create the user account or send an error at the moment of the sign-up.

## Building an Auth0 Hook

[Auth0 Hooks](https://auth0.com/docs/hooks) allow us to customize the behavior of Auth0 using [Node.js](https://nodejs.org/en/) code that is executed against extensibility points (which are comparable to webhooks that come with a server). Hooks give us modularity when configuring our Auth0 implementation and extend the functionality of base Auth0 features.

On the left sidebar in the Auth0 Dashboard, let's click on [Hooks](https://manage.auth0.com/#/hooks). In the Hooks page, we will find different places where we can add a hook in the user login or sign-up life cycle. The one we are interested in is the **Pre User Registration** hook. We want to verify a user email before they register into our system.

To create a new hook, let's do the following:

- Click on the **Create New Hook** button.

- Give the hook a name.

- Select "Pre User Registration" from the "Hook" drop-down field.

- Click on the "Create" button.

Our newly created Auth0 hook will be shown under the "Pre User Registration" section with a green dot before its name. To edit it, let's click on the pencil button in the row below it.

![Newly created Auth0 Hook with an active indicator](https://images.ctfassets.net/23aumh6u8s0i/5YViqqBkxsCE9Am5KufZl8/2f6b325ac113e82ec75baf89547b2f47/newly-created-auth0-hook)

We are taken to the [Webtask editor](https://webtask.io/docs/editor) where we can easily edit our hook logic within the Auth0 Dashboard. In here, we will be able to edit the code that gets executed every time a new user registers. We can add new metadata to our users and return this or we can throw an error which will prevent the user registration.

We can remove all the default code that is there to start with an empty hook. The first thing that we will need is the function that will be executed upon a new user registration:

```javascript
module.exports = function(user, context, callback) {};
```

When our code execution is done, it will need to return the `callback` function with either an error or a valid response. So let’s add this:

```javascript
module.exports = function(user, context, callback) {
  const response = {};
  response.user = user;

  callback(null, response);
};
```

In order to connect to the Kickbox service, we will need to do a `GET` request using the Node `request` module. We can add that at the top of our code just before the `module.exports`:

```javascript
const request = require("request");

module.exports = function(user, context, callback) {
  // ...
};
```

The [Kickbox email verification API](https://docs.kickbox.com/v2.0/reference) is fairly simple to use. We simply make a `GET` call to the following endpoint:

```shell
https://api.kickbox.com/v2/verify?email=<email>&apikey=<API_KEY>
```

In the URL above, `<email>` is the address that we want to verify and `<API_KEY>` is our [Kickbox API key](https://docs.kickbox.com/docs/using-the-api).

Let’s build the `GET` request:

```javascript
const request = require("request");

module.exports = function(user, context, callback) {
  const response = {};
  response.user = user;
  const API_KEY = context.webtask.secrets.KICKBOX_API_KEY;
  const email = user.email;
  const url = `https://api.kickbox.com/v2/verify?timeout=6000&email=${email}&apikey=${API_KEY}`;

  request.get({ url }, function(err, resp, body) {
    // Process the response and send back the callback
    callback(null, response);
  });
};
```

Now, we will automatically reject any email address that comes from a disposable email service or email addresses that are known to be undeliverable:

```javascript
const request = require("request");

module.exports = function(user, context, callback) {
  const response = {};
  response.user = user;
  const API_KEY = context.webtask.secrets.KICKBOX_API_KEY;
  const email = user.email;
  const url = `https://api.kickbox.com/v2/verify?timeout=6000&email=${email}&apikey=${API_KEY}`;

  request.get({ url }, function(err, resp, body) {
    body = JSON.parse(body);

    // Add the user_metadata property if not present already
    if (!response.user.user_metadata) response.user.user_metadata = {};

    if (body.result != "undeliverable" && !body.disposable) {
      // Good email
      console.log("This email is valid, run the callback");
      callback(null, response);
    } else {
      console.log("Probably not a valid email address");
      callback(`Access Denied by Kickbox server. (${body.sendex})`);
    }
  });
};
```

In this case, we are looking at the Sendex score only. If the Sendex score is over `0.75`, we assume that the email address is safe and good to go. There are various other checks that we could make to decide if we want to accept the user or not.

Using this code will send back a generic error message to the end-user on the [Auth0 Universal Login page](https://auth0.com/docs/hosted-pages/login) when the user is trying to sign up with an invalid email.

<include src="TweetQuote" quoteText="Auth0 Hooks are a new extensibility mechanism in Auth0 that allows us to customize the behavior of the Auth0 platform using Node.js."/>

## Taking the User Experience One Step Further

This workflow may not create the most user-friendly experience. In order to show a more meaningful message, we could use the [Auth0 Hosted Pages editor](https://auth0.com/docs/hosted-pages#customize-your-hosted-page). Now that we have access to the Kickbox email data, we could still let our users login but we could perform email verification if we are feeling unsure. There are many other options that we can add to this workflow from here on. There is no limit at what we can do using the Auth0 hooks! I encourage everyone to give them a try.

<include src="asides/AboutAuth0" />


Validate User Emails Fast using Kickbox and Auth0 Hooks

df6c864847fba9687d962cb80b482764?size=200 avatar

df6c864847fba9687d962cb80b482764?size=200

Martin Gontovnikas, a.k.a Gonto, is a software engineer at heart who moved to the ‘dark side’ and became VP of Marketing at Auth0. He considers himself lucky to have found a way to combine his two passions and apply his engineering thinking model to marketing.<br/><br/> Gonto’s analytical thinking is a huge driver of his data-driven approach to marketing strategy and experimental design. He is based in the Bay area, and in his spare time, can be found eating gourmet food at the best new restaurants, visiting every local brewery he can find, or traveling the globe in search of new experiences.

Former SVP of Marketing and Growth at Auth0

Martin Gontovnikas

Keep up with product customization by letting your IAM do the heavy lifting



<div class="alert alert-info alert-icon">
  <i class="icon-budicon-500"></i>
  <strong>Forrester Consulting analysis determines that using Auth0 can yield a 548% ROI and $3.7M in identity-related savings. Read the full report: <a href="https://resources.auth0.com/forrester-tei-research-case-study/">Total Economic Impact of Auth0</a>.</strong>
</div>

---
When it comes to appealing to customers, slowly but surely, personalization has become the name of the game. From Netflix's personalized recommendations algorithm to Amazon's suggested items, users are learning to expect that the interactions they have with a digital product or company will be catered to them.

However, most companies don't have the manpower to create a constantly updating algorithm that allows each user to experience a totally individualized version of their product. In fact, most companies leave personalization to a minimum, because it can be difficult to keep track of data for individual users and then put that data to work.

 Identity and Access Management (IAM) might not be able to build you a completely customized product, but it can help you understand your users and make smarter, more personalized choices about how you engage them. Moreover, because you're already utilizing IAM, you don't even need to have a dedicated team to do it.

## Individualize your analytics

An identity management system can help you to simplify the process of bringing in personalized data to your analytics.

One way it can do this is by providing a way to circumvent the problems of relying on client-side analytics while still getting data to your internal systems. Client-side analytics are not very reliable—for example, customers might use an ad blocker that disrupts your JavaScript, or click on and off pages too fast for all your code to run.

With Auth0, you can circumvent this problem by automating a variety of actions at login. You do this by adding a [Rule](https://auth0.com/docs/rules), a snippet of code, to your authentication sequence. When a user is authenticated—which, for example, won't be affected by an ad blocker—you can record that login or send their information to your CRM right from login.

![Auth0 rules](https://images.ctfassets.net/23aumh6u8s0i/3CeEXuCn55xrtgQOqgtGaC/1c7d26adc6d9ed779c21106bf2150d1f/flow)

So, say you want to trigger an onboarding email the third time someone logs into your site. You can set up a Rule that works with your email marketing system to fire them off a message on their third login that's tailored to their understanding of your service.

Or maybe you set up a Rule that collects and checks when a user has reset their password. If they reset their password a  certain number of times, you could trigger a question about setting up passwordless login, catering to their frustration at constantly forgetting what their password is.

Whether you're sending a user's first-time login to your CRM or automating specific moments at login, combining your IAM with even basic analytics—like the number of password resets—can give a more customized user experience.  

## Make sure your support has a personal touch

People don't want to spend half their time on the phone with support having to explain the basic details of their identity or product history.  

But centralizing their user information—their likes, dislikes, analytics, basic personal information, etc.—can be overly complicated. User preferences might be stored in one place, key analytics and in-product behavior in a totally different software, and sales information in yet another.

For a customer success person trying to give personalized support, it's difficult to juggle all the places user information can be stored while trying to give them real-time help.

This is where the concept of modern authentication really shines. Because identity management systems like Auth0 work to create a full view of a user, you can access most relevant data in one place.

Auth0 sets up a basic profile for every user in your system. It stores the information they provide, like their name and handle, but also has space for a lot more information. You can see things like what devices they have, how many times they've logged in, whether or not they've verified their email.

You can also add data to store customized information about users. You can modify any user's profile in your system manually. If you want to automate, you can do that with Rules. For example, you can add a Rule that enriches the user profile with information from a CRM like FullContact.

Or, you can ask users to give you specific pieces of information, like job title or company, at login. Those will be automatically stored and added to their profile.

![Rules to enrich profile on Auth0](https://images.ctfassets.net/23aumh6u8s0i/2L7q5Bb6dmYuv4dI4XEmyM/6365e8ff8f986b5a7f54156e315b02a2/auth0-enrich-profile-rules)

That way, if your support needs to pull up information on a user quickly, they can get a structured view of the user as an individual, and their general product use information. This makes providing more personalized support a no-brainer.

## Tap into the benefit of social login in no time

We've just looked at some ways that an IAM can help coordinate a more personalized user experience across complex systems. However, if you want to get jump started on setting up a more personalized user experience, the easiest way to do so is to set up social login.

With Auth0, you can [configure your login](https://auth0.com/docs/identityproviders) with a huge number of social sites in minutes. When people start logging in to your site via their social login, you will be able to take the information you want from their social profile (location, birthday, friends, etc.) and you can funnel all that valuable social data right into your user profile.

![Enrich profiles from social networks](https://images.ctfassets.net/23aumh6u8s0i/78k9QevtMkNcknlIo0LsQf/118949cb80efe2f9aba5a7f25c06434c/enrich-from-social)

This makes it easy to start personalizing a user's experience from the first time they use your product, like being able to sync an in-app feature to the customer's location immediately. The information that you add to your user's profile from social login is a strong base for any customized experience. If you want the most amount of data and the least amount of hassle, start with social login and work outwards from there.

## Let your identity management work for you

There's much more to identity management than just securely storing passwords. When you have an identity management system that's capable of more than gatekeeping, it's worth taking the time to set up a few extra steps that help your IAM work for you. Those extra steps can turn into happier, more engaged customers, which turns into more revenue.

Especially as customization and personalization become more and more popular, having an IAM that can keep track of a variety of different data in one centralized place will become even more valuable. With all the data that online services continue to collect, using a sophisticated IAM will allow you to conquer personalization.


How Identity Management Helps You Personalize Your User Experience

bc94ff6211e645a2bdb4fdc60e23ad85

Former Auth0 Employee

Kassandra Perch

This is the second episode of the Lock screencast series, where we show the various customization options in Lock.js


Hi, this is Kassandra with Auth0. In [the first episode of our new Getting Started with Lock screencast](https://auth0.com/blog/2016/02/03/getting-started-with-auth0-lock-series-implementing-lock/), we talked about how to implement Lock. Today, we'll be talking about customizing Lock with the various options in our Lock library.

<include src="Vidyard" id="aBsEczc79qmKefGdg6o4CP" />

But first, I'd like to introduce viewers to the [Lock Playground](https://auth0.github.io/playground/). This is a tool Auth0 has that allows users to test the options out on Lock without having to implement it! The code on the left affects the window on the right in real time. A documented list of all of the options are available [in our docs](https://auth0.com/docs/libraries/lock/customization).

![Auth0 Playground](https://images.ctfassets.net/23aumh6u8s0i/7GRbERkpUEt4wGDkrAxbKU/ee65f91956278c63bbabb6a17285e6e7/playground)

Here's a snapshot of the options we'll be looking at today:

```javascript

lock.show({
	connections: ['Username-Password-Authentication', 'Facebook'],
	dictionary: 'en',
	icon: 'https://mycdn.com/myImage.png',
	closable: true,
	socialBigButtons: true,
	focusInput: true,
	usernameStyle: 'email',
	gravatar: true,
	disableSignupAction: false,
	disableResetAction: false
});

```

First, we'll talk about the `connections` option: this option allows us to select a subset of our configured login providers to show to a user. This is handy if you have configured a login type, but do not want it to be an open option to potential users. This is an array of the connections you'd like to show.

Next is `dictionary`: you can convert the dialogue to a different language by using its language code (e.g. 'es' for Spanish).

The `icon` option accepts a URL and allows you to change the logo at the top of the dialog to an image of your choosing. Recommended size is 85x85px.

`closable`, when set to `true`, allows users to close the Lock dialog, and can be set to false to prevent users from dismissing your login screen.

You can change the presentation of the social provider buttons using the `socialBigbuttons` option: this defaults to `false` if the username and password dialog is shown, and `true` otherwise. However, you can change it to suit your needs.

`focusInput` places focus on the username field in the Lock dialog, when set to `true`. This can be especially handy in situations where your login dialog is mandatory or overlays the screen-- however, it's best set to `false` in optional or embedded contexts. (It's set to false in the playground so that our cursor stays with the code.)

The `usernameStyle` option is handy if you'd rather use usernames instead of emails to identify themselves. By default, the prompt in username is set to 'Email', but by setting `usernameStyle` to `username`, the prompt will change to 'Username'.

The `gravatar` options, which defaults to `true`, watches the email entered in the Email field, and, if it matches a gravatar account, will replace the logo at the top of the dialog with the user's gravatar.

When you are showing your username and password login option, you will see a 'Sign Up' tab and a 'forgot your password?' link on the Lock dialog. You can disable these by setting `disableSignupAction` and `disableResetAction` to `true`.

In our next episode, we'll talk about the differences between Lock's two modes: popover and redirect.

Thanks for reading!


"customization"