Linda Gong

Linda Gong is a Product Marketing Manager for Orchestration at Okta, where she leads go-to-market strategy for Okta Workflows and Auth0 Extensibility. With a background in demand generations and marketing analytics, she brings a data-driven mindset to messaging, product launches, and driving adoption. When she’s not crafting product narratives, you’ll likely find her hunting down the best local coffee shops or planning her next travel adventure.

Product Marketing Manager

Auth0 + Sift integration delivers real-time, risk-based fraud detection and prevention while enabling frictionless logins for legitimate users.

Nearly [$13 billion](https://javelinstrategy.com/research/2024-identity-fraud-study-resolving-shattered-identity-crisis) — that’s how much account takeover (ATO) fraud cost businesses in 2023 alone. This isn’t just another alarming stat — it’s a wake-up call for any organization managing user accounts. Industries like e-commerce and financial services are feeling the heat, with ATO attack rates spiking [36%](https://sift.com/index-reports-account-takeover-fraud-q3-2024) and [10%](https://sift.com/index-reports-account-takeover-fraud-q3-2024) year-over-year, respectively.

The methods behind these attacks aren’t new: stolen credentials from data breaches, phishing attacks, and malware are still the go-to tools for fraudsters. What is new? The scale, sophistication, and speed of these attacks. And traditional defenses—CAPTCHA, static rules, even MFA—aren’t enough on their own.

### What you need: Real-time, AI-driven fraud defense

That’s where Auth0 + Sift comes in. Together, they deliver real-time, risk-based fraud detection and authentication at scale. With the pre-built integration, businesses can achieve robust ATO defenses quickly and with minimal engineering lift. 

With the Auth0 extensible identity platform and Sift’s AI-powered risk engine, you can automatically score risk, trigger adaptive MFA, and block bad actors—without slowing down your trusted users.

![Auth0 + Sift integration](https://images.ctfassets.net/23aumh6u8s0i/4E3Z7xaIl3d7lFbAY1qJWH/265b3594668967191449fad982a03f06/Screenshot_2025-04-28_at_6.03.34_PM.png)

### Check out the solution brief to learn how to stay ahead of account takeover attacks

Download [Auth0 + Sift integration solution brief](https://cdn.auth0.com/blog/blog/auth0sift-solution-brief.pdf) to discover:

* Why real-time, AI-powered risk assessment is essential to stop ATO fraud
* How the Auth0 + Sift integration works
* A real-world example from a global e-commerce platform
* Key outcomes: reduced fraud losses, enhanced user experiences, and increased operational efficiency



Account Takeover Attacks Are Surging — Stop Them With AI-Powered Fraud Defense

Aliyah Winfrey

I'm Aliyah Winfrey, a staff design researcher who’s passionate about creating clarity and alignment in complex research spaces. I thrive on asking the right questions and uncovering insights that drive meaningful design. Outside work, I tend to my garden, experiment with new baking recipes, or get lost in a classic PS2 game.

Staff Design Researcher

Exploring the evolving tech/identifier trends, needs, and behaviors of a global audience

As an advocate for developers and a company that trusts the developer community, we are open-sourcing this survey data to foster dialogue, innovation, and shared learning. By making these insights publicly available, we invite researchers, developers, and CIAM leaders to analyze and build upon our findings. Understanding global digital identity trends requires diverse perspectives, and an open-source approach allows for an informed and equitable discussion. 

Digital technologies continue to change human interactions, shaping global attitudes toward identity, security, and new technological innovations in similar and different ways. Our latest End-User Device & Login Sentiment survey highlights key trends in digital identity preferences, authentication methods, and security concerns. This survey and high-level takeaways contribute to the broader discourse of technology, CIAM, and an evolving general population market. Please find details on the purpose, audience, and collection below:

## Purpose

Understand the general population of global users' evolving technology needs and behaviors to identify key trends and shifts. The following Key topics were covered: 

**Device/OS usage**

* Personal vs. Work device usage 
* Device registration preference
* Work application usage

**Attitude towards technology**

* Overall tech familiarity 
* Hardware update motives
* Frequency of technology updates

**Identifier preference**

* Identifier familiarity 
* Identifier registration preference
* Perceived vulnerability and convenience 

**Password management**

* Reuse & Change Password
* Compromised PII
* Fraud Check

![Key Topics](https://images.ctfassets.net/23aumh6u8s0i/34N68QuL8Q9JZBT8ql8wXB/218ff72b8716be2887562adb892c3e28/key_topics.png)

### Research Questions

1. Understand current technology devices and usage patterns 
2. Identifying emerging trends in end-user preference 
3. Discover unmet needs and pain points to capitalize on new opportunities, driving innovation and strategic growth

### Target Audience

Partnered with Qualtrics for a 33-question survey in the following regions/countries: EMEA (France & United Kingdom), NAMR (United States & Canada), LATAM (Mexico & Brazil), and India. 

### Sample

**N=1049**

* Age
 * Age 18-23: 19%
 * Age 24-30 19%
 * Age 35-54: 32%
 * Age 55+: 30%
* Region
 * NAMR 25%
 * EMEA 25%
 * LATAM 25%
 * APAC 25%
* Gender
 * Male:48%
 * Female: 52%
* Community Type
 * 1/3 Rural
 * 1/3 Suburban
 * 1/3 Urban
* Household Income
 * Less than $25,000- 5%
 * $25,001 - $50,000- 10%
 * $50,001 - $75,000- 20%
 * $75,001 - $100,000- 30%
 * $100,001 - $150,000- 20%
 * $150,001 - $200,000- 10%
 * More than $200,000- 5%

### Data Integrity 

No personally identifying information (PII) was collected. All responses shorter than 3 minutes (180 seconds) were removed. The median completion time was 6.08 minutes. Participants were compensated for completing the survey. 

Samplings across regions are representative of age and gender distributions. For example, given the larger youth population, more youth aged 18 to 30 were sampled in India. Given the country's demographics, ages ranging from 45 to 59+ were skewed towards EMEA and NAMR. 

Additionally, LATAM skewed predominantly toward the urban community type, EMEA represented much of the rural community type, and NAMR led heavily toward the Suburban community type.

### Regression analysis

![Regression analysis](https://images.ctfassets.net/23aumh6u8s0i/2cF18Iz0eEWlprYHPlHlFR/f21d36a8cb21cabedd6100f1037f7aba/Regression_analysis.png)
_Logistic Regression on survey data was completed to gauge if any response options forecast an individual's Willingness to Try New Identifiers. No substantial evidence indicates these factors are significant predictors._

 
Six low-level predictors for Willingness to Try New Identifiers were identified. These include the following:

1. Attitude towards New Tech
2. Familiarity with Identifiers other than Email and Username
3. How often do individuals update their devices
4. Age
5. Apple-Only OS Owners
6. APAC/India region 

Data was collected in October of 2024. Data is accessible via a[ CSV. file](https://cdn.auth0.com/blog/blog/End-User-Sentiments-Survey.csv).

#### Citation

1 End-User Device and Login Sentiment, Auth0, 2024. [Link](https://auth0.com/blog/digital-identity-what-users-think-about-devices-and-logins/)

## Insights

### Top 10 Learnings 

1. Android Phone and Windows OS more widely adopted across diverse groups: 
 - Adoption more prevalent in LATAM and APAC
 - Android users tend to be lower to middle-household income 
![Android, Windows OS lead in adoption](https://images.ctfassets.net/23aumh6u8s0i/1cz14tdcdDmqEZI5ZBgD9M/15021e7a00fe7d4967d9255f16f99b7d/Screenshot_2025-03-21_at_12.39.11_PM.png)
2. Younger demographics and higher income are more likely to use Apple OS 
 - Apple OS more pronounced in EMEA and NAMR
3. Younger demographics and higher income are more likely to use Apple OS 
 - Positive attitude toward new technology, higher frequency of device updates, and more open to adopting new identifiers
4. EMEA and NAMR are more cautious about approaching new technologies 
 - Preference could be influenced by cultural differences and regulations
![General comfortability with adopting tech once mainstream](https://images.ctfassets.net/23aumh6u8s0i/6LXzCLV1QzEPUbZk2rh5c9/33bea12287c85db2359d9e8990a5bda4/Screenshot_2025-03-21_at_12.29.28_PM.png)
5. Top upgrade motivators are new features, device damage, battery issues, and limited memory. 
 - India/APAC unique concern for social brand preference and security concerns
![New features and de ice damage lead us upgrade motivators](https://images.ctfassets.net/23aumh6u8s0i/7CbnGFomOPj6PfmU4IfzeD/e92edbcce72f7994c1ca55ac4575dfa8/Screenshot_2025-03-21_at_12.30.33_PM.png)
6. Respondents who are more familiar with alternative identifiers (email and username) show higher readiness to adopt new ones. 
 - Apple OS users less likely to try new identifiers 
7. The most familiar and used identifiers include Email, username, phone/SMS, and biometrics. In contrast, the least used and familiar include Blockchain and hardware security keys. 
 - Social login is slightly more prevalent in LATAM and APAC
![APAC lead in familiarity and use for most methods](https://images.ctfassets.net/23aumh6u8s0i/71S0j1xEeG6isV67O1SwkP/4a7cdda42233bd8cc16c2a6a2f5829cf/Screenshot_2025-03-21_at_12.35.26_PM.png)
8. Username, email, and fingerprint are rated as the most convenient across all regions. 
 - EMEA and NAMR seem to be more sensitive to non-conventional identifiers such as government ID, security key, and voice ID, while even social login is ranked neutral. 
![Username, email, and fingerprint rated as most convenient](https://images.ctfassets.net/23aumh6u8s0i/7JSF843aMWSNsNSTxBBF0d/c1e9723a8b0efd52cc02748b81256bf6/Screenshot_2025-03-21_at_12.36.02_PM.png)
9. In contrast, Social Login is perceived as the most vulnerable to hackers and cyber-attacks. 
 - Our recent article, Demystifying Social Login, dives deeper into the security of leveraging Auth0 social connections for end-users. 
![Social Login seen as most vulnerable to cyberattacks](https://images.ctfassets.net/23aumh6u8s0i/7zuPvErvRjmZo3uflHsRdG/49f35a40cc73261e8d7ad06cffba6f8b/Screenshot_2024-12-17_at_10.27.55_AM.png)
10. Security and Privacy priority for motivations to try new identifiers 
 - NAMR and EMEA rank innovation as one of the lowest drivers
![Security and Privacy priority for motivations to try new identifiers](https://images.ctfassets.net/23aumh6u8s0i/3LpGrqWztktMy8Nw1H2lYJ/550ad822c4f8684ef18c2cea1f751d56/Screenshot_2025-03-21_at_12.34.25_PM.png)

> Download the [.CSV data here](https://cdn.auth0.com/blog/blog/End-User-Sentiments-Survey.csv).

Join the conversation! Share your thoughts, repost, and tag us to discuss the future of digital identity.

Digital Identity: What Users Think About Devices and Logins

Michelle Agroskin

Michelle Agroskin is a Staff Product Marketing Manager for Okta. She leads the Customer Identity AI, Authorization, and Consumer portfolios; driving go-to-market strategy, messaging, launches, and strategic growth initiatives.

She lives in NYC and in her free time, loves to travel the world and try new restaurants!

Staff Product Marketing Manager, Auth0

Auth0’s latest features enhance user experience with secure, customizable logins, flexible authentication, and improved security—without compromising convenience.

Customer expectations are higher than ever. They want security, convenience, and personalization, all without friction. Businesses need to deliver seamless experiences while keeping user data safe. The challenge? Balancing security with ease of access.

At Auth0, we believe you shouldn’t have to choose between security and experience. That’s why we’re introducing innovations that strengthen security and improve user experience—before, at, and after login.

## Powerful New Features for Secure, Seamless Login

Today’s businesses need to build trust with their users. Customers *expect* engaging experiences, convenient journeys, and secure digital platforms. Before they give you their business, they need to know that you can cater to their unique needs, provide ease of use across multiple channels, and protect their data and sensitive information. When security and user experience are seamlessly integrated, customers engage more, businesses grow, and digital experiences become effortless. And that starts with getting identity right. 

> We’ve updated the authentication journey to help businesses deliver trusted, customized experiences while keeping users safe.

#### **Before login**: greater flexibility with Tenant Access Control

**Security starts before users even log in. **Tenant Access Contro**l (Generally Available, March 2025) helps protect applications and APIs from threats like denial-of-service attacks. Stopping lousy traffic before it reaches your applications prevents disruptions and keeps them running. This feature allows organizations to create granular policies to manage access and mitigate threats, giving them more control over protecting their applications and users.

#### **At login**: Advanced Customization for Universal Login

**The login box is often the first interaction users have with your brand and the one they repeatedly return to as they continue engaging with it. Now, with **Advanced Customization for Universal Login** (Early Access, February 2025), businesses can control every piece of their login experience while leveraging Auth0’s security and built-in authentication process. Create pixel-perfect experiences and tailor every detail to match your brand with the same built-in security Auth0 is known for. 

#### **After login**: strengthen security

**Security doesn’t stop after users are logged in. We’re introducing key enhancements to secure the entire customer journey:

 * **FAPI 2 Certification **(Achieved, March 2025) strengthens API security with financial-grade protections that prevent transaction tampering and data leaks within our Highly Regulated Identity product.
 * **Client-initiated backchannel Authentication** (Limited Early Access, Generally Available Q2 2025) enables a client application (e.g., call center system, POS terminal, autonomous AI agent) to initiate the authentication process on behalf of the customer, making authentication easier.
 * **Native to Web SSO** (Early Access, April 2025) keeps users signed in as they move between mobile and web apps, eliminating unnecessary logins (and frustrated customers!).

## Identity Is the Key to Better Experiences 

In the past, businesses struggled with trade-offs, prioritizing security at the expense of user experience or vice versa. Modern identity removes that compromise, ensuring that security enhances, rather than hinders, customer experience.

Businesses that get identity right can deliver effortless logins, personalized interactions, and enterprise-grade security without slowing growth. These latest innovations make it easier than ever to:

* Protect against fraud and unauthorized access
* Build seamless, branded login experiences
* Maintain compliance with industry standards
* Enable flexible, secure authentication
* Keep users signed in across platforms

## Get Started Today

Auth0 makes identity **simple**, **scalable**, and more **secure.** These latest innovations help businesses stay ahead by offering users the frictionless, secure experiences they expect.

> Stop building identity from scratch. Start building with Auth0.

Learn more about these updates in our [documentation](https://auth0.com/docs/get-started) or [contact our team](https://auth0.com/contact-us) today.

_Any products, features, functionalities, certifications, authorizations, or attestations referenced in this material that are not currently generally available or, have not yet been obtained, or are not currently maintained may not be delivered or obtained on time or at all. Product roadmaps do not represent a commitment, obligation, or promise to deliver any product, feature, functionality, certification, or attestation, and you should not rely on them to make your purchase decisions._

Better User Experiences, Stronger Security

amanda-giannelli

Senior Software Engineer

Amanda Giannelli

Simplify logins, boost security, and enhance productivity with the power of Single Sign On!

## Introduction

Are you tired of juggling a bunch of usernames and passwords just to get your work done? You’re not alone. In today’s world, where we use so many different apps and services, keeping track of login details can feel like a full-time job. 

Enter Single Sign On (SSO), a simple yet powerful solution that lets you access all your apps with just one login. Let’s dive into what SSO is and why it’s such a game-changer for businesses.

## What is SSO?

You may have already used SSO without realizing it. Whenever you log into a website that leverages [identity providers](https://auth0.com/docs/authenticate/identity-providers) such as Google, Facebook, or Apple (to name a few), that is single sign-on in action.

SSO is a fancy term for a straightforward concept: log in once, and you’re good to go across all your apps. Whether it’s checking your email, collaborating on a project, or logging into your CRM with SSO, one login gets you everywhere you need to be. It’s like having an all-access pass to everything you need for work.

## How Does SSO Work? 

When SSO is enabled, and you attempt to authenticate to App A, you are sent to the authentication server to provide your credentials. Once authenticated, you are redirected back to App A and signed in. If you then access any other services (for example, another app) connected to the same auth server, you will be immediately authenticated into this application.

![SSO authentication and how it works](https://images.ctfassets.net/23aumh6u8s0i/1rHF8E9UCO7abbWzLRntV0/6856815f4ee9b078d83093d2a21a6bc7/typical-sso.png)

> Read more about [SSO authentication and how it works](https://auth0.com/blog/what-is-and-how-does-single-sign-on-work/). 

## Benefits of SSO

Now that you have a general understanding of what SSO is, let’s take a look at some of the benefits.

### Enhanced User Experience

Remembering a bunch of different passwords is a hassle. With SSO, you only need to remember one password. No more struggling to recall if your password for App A has a special character or if App B requires an uppercase letter. Log in once, and you’re in — it’s that simple.

#### Goodbye, Password Overload

Keeping track of passwords can feel overwhelming. While a password manager is an option, SSO puts an end to needing scores of passwords. By reducing the number of passwords you have to remember, it’s less likely you’ll get locked out or end up using the same password everywhere (which, let’s be honest, [isn’t very safe](https://www.security.org/resources/online-password-strategies/)).

#### Get to Work Faster

SSO saves you time. Instead of typing in different credentials every time you switch apps, SSO gives you instant access. It’s like walking through an open door instead of fumbling for keys — you get to work faster and with less hassle.

SSO providers also typically provide a dashboard with all of the apps you have access to. Open the dashboard, select your app, and you’re in. 

### Boost Security

You might think that having one login for everything sounds risky, but SSO actually makes your business more secure. Here’s how:

#### One Secure Login Point

With SSO, all your logins are managed in one place. This means your IT team can keep a close eye on things and quickly respond if something looks suspicious. It’s like having all your valuables in one safe instead of scattered around the house.

#### Reduced Chance of Phishing 

[Phishing scams](https://auth0.com/blog/protecting-against-phishing-attacks/) — fake emails trying to steal your info — are a big problem. But with SSO, you’re not entering your password over and over, so you’re less likely to fall for a phishing trap. Fewer logins mean fewer chances for scammers to trick you.

#### Add Extra Security with MFA

Most SSO solutions let you add [Multi-Factor Authentication](https://auth0.com/docs/secure/multi-factor-authentication) (MFA), which provides another layer of security by requiring more than just a password to log in. Maybe you’ll need to enter a code sent to your phone or scan your fingerprint. This extra step makes it much harder for hackers to get in, even if they have your password.

### Lighten the Load on Your IT Team

SSO isn’t just great for users. It's also a lifesaver for your IT department. Managing user accounts and passwords can be a real headache, but SSO makes it a breeze.

#### Easier User Management

With SSO, your IT team can manage who has access to what from a single dashboard. Need to give new employees access to all the tools they need? Done in a few clicks. Need to remove access when someone leaves? Just as easy. It’s all centralized, which saves time and reduces errors.

#### Fewer Helpdesk Calls

Did you know that [up to 50% of helpdesk calls](https://agio.com/your-employees-are-wasting-30-of-their-time-resetting-passwords/) are for password resets? SSO cuts down on the need to [reset your password](https://auth0.com/learn/password-reset), freeing up your IT team to focus on bigger issues and your employees to work on what truly matters. Less time resetting passwords means more time to solve real problems.

#### Smooth Compliance and Reporting

If your business is in a regulated industry (such as finance or healthcare), SSO can make compliance a lot easier. It keeps detailed logs of who accessed what and when, so when it’s time for an audit, you’ve got everything you need at your fingertips.

### Scale Up with Ease

As your business grows, so do your tech needs. The good news? SSO grows with you. Whether you’re adding new apps or expanding your team, SSO makes it easy to scale up.

#### Integrates with What You Already Have

SSO solutions are designed to work with the tools you’re already using, whether they’re in the cloud, on your servers, or a mix of both. So, no need to overhaul your entire system — just plug SSO in and keep moving forward.

#### Works Across All Environments

Many businesses today use a mix of on-premises and cloud-based applications. SSO bridges the gap, providing a seamless login experience across all platforms. So, as you move more of your operations to the cloud, SSO keeps everything running smoothly.

#### Future-Proof Your Business

By implementing SSO, you’re setting your business up for success as you grow. No matter how many new apps or services you add, SSO will be there to keep everything secure and accessible, ensuring your team can stay productive without getting bogged down by tech hurdles.

### Better Collaboration with Partners

If your business works with external partners or clients, SSO can make those relationships smoother and more secure. Here’s how:

#### Secure Partner Access

SSO lets you extend secure access to your partners without compromising your internal security. You control who sees what, so everyone has the access they need — and nothing more.

#### Easier Collaboration

When your partners can log in easily without juggling multiple credentials, it’s easier to work together. Whether you’re sharing documents or managing a project, SSO makes collaboration a breeze.

### Challenges

For all of its amazing benefits, SSO is not without its challenges. Understanding these considerations can help you plan effectively and ensure that your SSO implementation is successful. Here are a few to keep in mind:

#### Single Point of Failure

SSO centralizes authentication, so if the SSO system goes down, users may lose access to all connected applications. This is why high availability coupled with redundancy for your SSO solution is critical to reduce downtime. High availability means the system is always on and available no matter what happens. Redundancy enables high availability by acting as a backup plan in the event of failure to ensure the services remain functional. 

#### Setup and Integration

Integrating SSO into existing applications can be complex and time consuming, especially when dealing with a mix of legacy and new systems. Careful planning and coordination between IT teams and application owners is crucial to ensure a smooth implementation.

#### Security Risks

While SSO can enhance security, it can pose a risk if not properly managed. If an attacker gains access to a user’s SSO credentials, they could potentially access multiple applications. Implementing strong authentication methods, such as MFA, is essential to mitigate this risk. 

#### User Adoption and Training

Users need to be educated on how SSO works and the importance of keeping their credentials secure. Without proper training, there may be confusion or resistance — especially in less tech-savvy organizations. 

## Conclusion

SSO isn’t just a buzzword. It’s a powerful tool that can make your business more efficient, secure, and scalable. By simplifying the login process, reducing security risks, and lightening the load on your IT team, SSO can help your business thrive in today’s fast-paced digital world.

If you’re not using SSO yet, now’s the perfect time to start. Whether you’re a small business looking to grow or an established company ready to streamline operations, SSO can give you the boost you need to stay ahead of the curve.

Benefits of Single Sign-On (SSO)

joey devilla headshot 900px

I’m a Senior Developer Advocate at Auth0, and I like to work on various technologies. I’ve developed software for all sorts of platforms, from CD-ROM and the PalmPilot to my current area of focus, mobile phones, IoT devices, and AI. When I’m not looking for strange new platforms to write software for, I’m playing a strange old instrument — the accordion!

Senior Developer Advocate

Joey deVilla

Detect hackers with Auth0 Actions and special accounts designed to catch them in the act.

Use Honeytokens and Auth0 Actions to Catch Malicious User Logins

MichaelW

Michael has worked in the security space for over 10 years, developing integrations for different vulnerability scanning, SIEM, and SOAR tools. He is passionate about discovering the exponential value that can be had by combining together multiple security datasets rather than using them on their own. As the lead on partner integrations for Pangea, Michael is working on bringing together a group of best-in-market security services for developers to use via API.

Senior Manager - Partner Integrations Pangea

Michael Weinberger

Pangea offers integrations to enhance security for new account registrations and logins

Do developers who are not security experts want to spend their valuable time developing security features? But _should they_, given the considerable room for error? 

Pangea helps remove this margin for error. Pangea is a comprehensive set of API-based security services that can quickly and easily be added to any cloud application, embedded as functions directly into the application source code. Pangea emerged from the idea that key security features should not be repeatedly reinvented by companies every time they build new products. 

Instead, with Pangea, application developers can access a wide selection of out-of-the-box security services to embed security easily in all of their applications. Comparable to AWS for compute APIs, Twilio for communications APIs, and Stripe for billing APIs, Pangea has created a single platform for security — [Security Platform-as-a-Service](https://www.prnewswire.com/news-releases/pangea-cyber-closes-26m-series-b-from-gv-decibel-and-okta-ventures-for-developer-first-security-framework-to-deliver-secure-apps-faster-301689531.html) (SPaaS).

## Keeping Security Simple with Pangea Integrations

As we like to say, Pangea makes it “dead simple to integrate security with just a few lines of code”. With a clear developer focus, Pangea simplifies the varied aspects of security that are required for virtually every application. 

Without Pangea’s SPaaS for developer-first security services, the security puzzle is made up of scattered commercial and open-source pieces. Usually, these pieces are not even API-first, which makes integrations difficult. Pangea specializes in bringing these pieces together in an API-first form, with consistent documentation and guaranteed services compatibility — making it easy for developers to embed security in their applications.

## Pangea Integrations for Marketplace

Three Pangea Integrations have been released for the Auth0 Marketplace — [Pangea - Domain Check](https://marketplace.auth0.com/integrations/pangea-domain-check), [Pangea - Embargo Check](https://marketplace.auth0.com/integrations/pangea-embargo-check), and the [Pangea - Validate Registration](https://marketplace.auth0.com/integrations/pangea-validate-registration). The Pangea - Validate Registration integration uses Pangea security APIs to validate new user registrations. This includes embargo checks using Pangea’s Embargo Check and domain score checks using Pangea’s domain intel service, which contains intelligence on over 390 million domain addresses. The results are all logged to the Pangea secure audit log service.

Configuration can then be done on the Pangea console to view and manage audit logs (redaction and retention), manage embargo lists, and select providers for domain scoring — with no additional code changes. 

## How the Pangea Integration Works

To use the Pangea Marketplace integration, you will need an Auth0 account and tenant as well as a Pangea account.

Pangea setup requires some light integration configuration before adding the Auth0 Action. Note that once the Action is successfully deployed, all new user registrations for a tenant will be processed by this integration. Before activating the integration in production, install and verify the Action on a test tenant.

Once the Action is added, new user registrations will be defended by Pangea APIs. Each new user registration will be checked against Pangea Embargo and Pangea Domain Intel. The user will either be accepted or rejected, and the results will be written to Pangea Secure Audit Log.

## Shifting “Left-of-Left”: Pangea Benefits 

Implementing Pangea provides a number of benefits, including: 

* **Prioritizing security from the get-go of app development**, i.e., shifting responsibility “left-of-left”. Pangea's library of APIs security and compliance requirements are addressed from the beginning, giving developers the ability to drop security into their app runtime code prior to publishing. This can reduce developer cognitive load while covering security from the outset. 
* **Leveraging security intel from leading providers**, such as Crowdstrike, DomainTools, and ReversingLabs, among others, in Pangea APIs.
* **Securing registration decisions with cryptographically secure audit logs**. Pangea audit logs provide built-in redaction and can be used to help meet compliance and regulatory requirements under GDPR, SOC2, HIPAA, and more.

## Simplify Application Security with Pangea 

It’s never been easier for developers to add security to their applications right out of the box. Check out the [Pangea - Validate Registration](https://marketplace.auth0.com/integrations/pangea-validate-registration) integration in the Marketplace to get started.

Pangea — Security with Ease, Now on Marketplace

Majid Hajian

I am a Google Developer Expert and Media Developer Expert and a passionate software developer with years of developing and architecting complex web and mobile applications. my passions are Flutter, PWA, and performance. I love sharing my knowledge with the community by writing and speaking, contributing to open source, and organizing meetups and events.

Google Developer Expert

In this tutorial, you’ll learn how to enhance your Flutter apps by enabling authentication, supporting federated identity providers, adding authorization by introducing roles and permissions, all leveraging Auth0.

In the exercise from the previous section, you added Auth0 authentication to an existing Flutter app. This added a username/password authentication flow to the app. You also gave the app the ability to request and submit refresh tokens, which enhance the user experience by not requiring the user to authenticate every time they use the app.

This section will expand on the app by examining some useful Auth0 features:

* Refresh token rotation
* Social logins
* Managing your Auth0 account

> **Look for the 🛠 emoji if you’d like to skim through the content while focusing on the build and execution steps.**


## Add Refresh Token Rotation

When the app makes an authentication request to Auth0’s authentication server, it includes the `offline_access` scope. This causes the authentication server to issue a refresh token, which the app can use to re-authenticate without requiring the user to log in again. The app stores this token in the device’s secure storage.

While this enhances the app’s user experience, it also introduces risk. The refresh token is long-lived, and the app could use it as a “lifetime pass” to endlessly request new access tokens and keep the user logged in forever.

I highly recommend taking advantage of *Refresh Token Rotation* and *Automatic Reuse Detection* to help mitigate this risk. With these features enabled, each refresh token can be used only once. When the app exchanges its refresh token for a new access token, the authentication server also returns a new refresh token and invalidates the old one. 

Let’s enable these features!

🛠 Navigate to the **Applications** section of your Auth0 dashboard, select the **MJ Coffee** application, and then select its **Settings** tab. Scroll down the page to the **Refresh Token Rotation** section and turn on the **Rotation** and **Absolute Expiration** options:

![Turn on the “Rotation” and “Absolute Expiration” options.](https://images.ctfassets.net/23aumh6u8s0i/6EizPZZnkGjxoAOle1Q8eL/e06c99f4a49413572736bbf0f470436c/rotation_and_absolute_expiration.png)

It is recommended that you issue a refresh token that expires after a preset lifetime. The refresh token’s lifetime can be extended each time one is used to get a new access token or access token/refresh token pair.

There are two options for token lifetimes, and they can be set independently of each other:

- **Absolute Lifetime:** Enabling **Absolute Expiration** sets a specified *absolute lifetime* for the application’s refresh tokens. Refresh tokens can be exchanged for new access tokens during this lifetime. Once the token’s age goes past its lifetime, the user will need to re-authenticate in order to get a new access token. If **Absolute Expiration** is disabled, the refresh token has an indefinite absolute lifetime.
- **Inactivity Lifetime:** Enabling **Inactivity Expiration** specified *inactivity lifetime* for the application’s refresh tokens. Refresh tokens can be exchanged for new access tokens if the user is active in the application during this lifetime. If the user is inactive in the application for a period longer than the inactivity lifetime, they will need to re-authenticate in order to get a new access token.

🛠 Scroll to the bottom of the page and click the **Save Changes** button:

![The “Save Changes” button. The user is directed to click it.](https://images.ctfassets.net/23aumh6u8s0i/7KsLW4adJ6PNIPAI12al4g/f2c0e8abf6d7377595cfb7df11493e67/save_changes.png)


## Social Logins

These days, it's pretty common to have login methods beyond the standard username/password combination. These include logging in with social media account, which will significantly enhance your users’ experiences.

Implementing these additional login methods and adding them to your authorization server is time-consuming and will come with many considerations and risks. 

Luckily, Auth0 provides lots of integration with well-known third parties’ authentication systems, and even allows you to write your custom connections. Let's add connections to both Google’s and Apple’s authentication systems.


### Create a Google/Gmail social connection

🛠 In the Auth0 dashboard, select **Authentication** in the left column menu, then select **Social**. This takes you to the **Social Connections** page, where you should click the **Create Social Connection** button:

![The steps to create a new social connection in Auth0](https://images.ctfassets.net/23aumh6u8s0i/61w1eXrbY7bGOpNo6ODbaU/da810c63bacd28cabf71e6dee4baa349/create_social_connection.png)

You will be taken to the **New Social Connection** page, which has a list of social login providers that integrate with Auth0. 

🛠 Select **Google**:

![Selecting Google from all the available social connections](https://images.ctfassets.net/23aumh6u8s0i/2YdUxIkwmCTcc9QFlo584q/22f7fd0bf4bc1c93c4ebc555e21009f8/select_google.png)

You will now be on the  **New Google / Gmail Social Connection** page, which tells you what kind of user information is accessed by Google social login.

🛠 Click **Continue**:

![Initial page for creating a new Google/Gmail social connection](https://images.ctfassets.net/23aumh6u8s0i/2SQwtF0vqtXJucnGbE3DNS/baf5bd9d7103a6ecbd59b879bbe2aaf4/click_continue.png)

A new page with a number of fields will appear; this is the connection’s **Settings** tab. 

As long as you’re working in a development environment, you only need to fill the **Name** field (which provides a name for this connection) and leave all the other fields empty. You can always use the default value in the **Name** field:

![New Google/Gmail social connection](https://images.ctfassets.net/23aumh6u8s0i/7Jzsn4ryILOOdACN2urlSo/fdaa205ef09352c0b9aba0acbd592977/new_google_gmail_social_connection.png)

However, production apps require you to provide a **Client ID** and **Client Secret** ([doc](https://auth0.com/docs/connections/social/google)) and specify the **Allowed Mobile Client IDs**. These topics will be covered in another video or article.

🛠 Create the Google/Gmail connection by scrolling to the bottom of the page and clicking **Create**:

![Creating the Google/Gmail connection](https://images.ctfassets.net/23aumh6u8s0i/4S8AJUaj4xehVwVxhNDt5X/69eb88b8bec557d310d0e9d678fe9b7e/click_create.png)

This will create the connection, and you’ll be taken to its **Applications** tab. You’ll see a list of your applications, which will allow you to enable the Google/Gmail connection for any of them. Enable the connection for the *MJ Coffee* application:

![The Google/OAuth2 applications tab](https://images.ctfassets.net/23aumh6u8s0i/681u1RRcha4ABJJ5GRZivy/c7eea90ca4e19ec5ab3b333caa47e5ba/google-oauth2_applications_tab.png)

You may also set more permissions that the end-user will need to approve during authorization. These permissions depend on your application and what you want to do on behalf of the user. The *MJ Coffee* app doesn’t need any extra permissions beyond the basic and extended profile.

![Google Permission](https://images.ctfassets.net/23aumh6u8s0i/13CvLX8tQUTuqU6jpZ6K94/a0eaac13b8fc83fc11b3ca3f6651ebd9/google_permissions.png)

🛠 Make sure you sync user profile attributes at each login and hit the **Save** button.


### Create an Apple ID social connection

🛠 Once again in the Auth0 dashboard, select **Authentication** in the left column menu, then select **Social**. This takes you to the **Social Connections** page, where you should click the **Create Social Connection** button:

![The steps to create a new social connection in Auth0](https://images.ctfassets.net/23aumh6u8s0i/1sohaZxDHuq8X8ZvT5nhvE/d2b7a7e2647708327f8fc6971ddb43a9/create_connection.png)

🛠 This time, select **Apple**:

![Selecting Apple from all the available social connections](https://images.ctfassets.net/23aumh6u8s0i/3JAgbtDSNOsfYrjxkE1wCI/e51d80f7418706c29cd6e9dc06b93719/select_apple.png)

You will now be on the  **New Apple Social Connection** page, which tells you what kind of user information is accessed by Apple social login.

🛠 Click **Continue**:

![Continue](https://images.ctfassets.net/23aumh6u8s0i/3zt2ntLwoHwp6bldLmOOsD/8db3e7f5c057d5782c7202b748013420/click_connect_-_apple.png)

As long as you’re working in a development environment, you can leave the **Client ID** and **Client Secret Signing Key** fields empty. You *will* need proper keys for those fields when the app goes to production; [this document covers that topic in more detail](https://auth0.com/docs/connections/apple-siwa/set-up-apple).

The **Apple Team ID** and **Key ID** values are required:

![Google Permission](https://images.ctfassets.net/23aumh6u8s0i/2qNvT5zkxB1TY06ywkH5Re/7c46fa1399743de9e7bb05d1d804fab0/apple_dev.png)

* To get your Apple Team ID, you need an Apple Developer Account.
* To get a Key ID for your app, you need to register that app using your Apple Developer Account. 

🛠 Sign in to your Apple Developer Account, and go to the **Membership** page and make a note of your Team ID.

🛠 If you have a registered app, you can skip the following steps and jump to the list of tasks for creating a service ID. Otherwise, follow the steps below:

- In the Apple Developer Portal, go to **Certificates, IDs, & Profiles > Identifiers** and click the blue “plus” icon next to **Identifiers** to create a new App ID.
- Choose **App IDs** as the identifier type and click **Continue**.
- Provide a description and a Bundle ID in reverse-domain name format (e.g.: `com.mydomain.mjcoffee`).
- Scroll down and check **Sign In with Apple**.
- Click **Continue**, and then click **Register**.

🛠 Once the app is registered, it’s time to create a service ID:

- Return to the **Certificates, IDs, & Profiles** section, and click the blue “plus” icon next to **Identifiers**.
- Choose **Service IDs** and select **Continue**. Fill in the description and identifier (e.g.: `com.mydomain.mjcoffee`).
- After checking **Sign In with Apple**, select **Configure**, and define your Web Domain (e.g.: `com.mydomain.mjcoffee`) and your "Return URL". Ensure that your Return URL is your Auth0 domain and that it follows this format: `https://YOUR_AUTH0_DOMAIN/login/callback`.

![Return URL apple sign in](https://images.ctfassets.net/23aumh6u8s0i/5Wetff0Tutv55UXsYz0gKq/ab19cd3e48604aea314410d22d194982/callback_apple.png)

🛠 Finally: save, continue and then register the service.


#### Set up your Client Secret Signing Key

🛠 Follow these steps:

- Go to **Keys**, which is located in the **Certificates, Identifiers, & Profiles** section of your Apple developer dashboard.
- Select the blue “plus” icon to add a new key.
- Enter a **Key Name** and check the **Sign In with Apple** option.
- Select **Configure** to make sure the **Choose a Primary App ID** field is filled with the correct App ID.
- Select **Save, Continue**, and then **Register**.
- On the page to which you're redirected after registering, make a note of the Key ID. Then download the key; it will have a `.p8` filename extension.

🛠 Go back to your Apple social connection settings and paste the Key ID. Ensure the proper attributes are selected (Name, Email) and sync user profile at each login is enabled. Hit **Save**.


## Enable Social Connections

🛠 Once you have created all your social connections and set them up correctly, go back to your applications. Go to the **Connections** tab and enable your newly-made social connections:

![app social connections](https://images.ctfassets.net/23aumh6u8s0i/59SCRbiX055qDcmTSNwPVl/fa175f974ceb43515893f24f7747d549/app_social_connections.png)

As you can see, adding and removing social connections for your apps is now as simple and flicking a switch.

On the Flutter side, I have good news: you don’t need to implement anything there! 

Restart the app, log out, then try to log in. You’ll see this:

![app social connections](https://images.ctfassets.net/23aumh6u8s0i/4b6BIaeZ8EHcN1a3MYVOrF/91c9039cf0d56051c99397d1a7524a3e/social_buttons_flutter.png)

That's it! The login screen will now display social login buttons, and their login flows will be ready to use.


## Branding 

While it’s fine to use the default branding in development, you want the login page to be customized to your “look and feel” once the app’s in production.

Auth0 allows you to customize your login page through a number of options. You can change the look and feel of the login page by adding colors and logos, and you can customize the user notification part of the process as well: email templates, text messages, and so on. It’s all in the **Branding** section of the Auth0 dashboard:

![Auth0 branding](https://images.ctfassets.net/23aumh6u8s0i/7oq6VzFQ3nSUcStZTXvjQu/38d1e272f3bef751d9feaca704d580dc/branding.png)


### Add Roles

You may want to provide certain functionalities to the user based on their roles. This is easy with proper authorization server such as Auth0, which facilitates adding roles and specifying what users in each role are allowed to do. 

In the MJ Coffee app, there are three different roles:

- **Admin:** These are administrators, and they will have access to all the app’s functionality with full permissions.
- **Customer:** This is the default role for registered or logged-in users. They are limited to the app’s customer-facing features. You will automatically assign this role to all users upon registration or login, and you will learn how to do so later on in this tutorial.
- **Employee:** These are coffee shop employees. They can access the community screen to answer customer requests in the support chat, as well as other employee-facing features.

![Auth0 roles](https://images.ctfassets.net/23aumh6u8s0i/7nVdiU86TPCF1tLXrBg6ID/54a078bfe7d2382a6776c26adfc5cba4/roles.png)

You can add more roles to the app as the need arises.


## User Management in Auth0

Auth0 provides the infrastructure to store users and their information on its cloud database.

For the *MJ Coffee* app, Auth0’s cloud database is sufficient. One of Auth0’s goals is to reduce the cost of extra infrastructure maintenance and cost.

You can access users by selecting **User Management** in the left column menu of the Auth0 dashboard. The **Users** page allows you to create new users and manage your existing ones by changing their details, adding permissions and roles, or revoking their access.

![Auth0 users](https://images.ctfassets.net/23aumh6u8s0i/3O0JDGBqXHmPfrKaEavP2D/260c804cf50a308e696ecd9a446ab4a9/users.png)

When you open a user, you’ll see that Auth0 provides in-depth details about that user, including basic account data, metadata, their devices, and their history, which might be pretty helpful for debugging the application or investigating a particular user’s access activity, permissions, and roles.

![Auth0 user roles](https://images.ctfassets.net/23aumh6u8s0i/JcGTMspZ9hKtu9RAi4Oq9/257a692aa9a65cd12e96f645b56aafd1/user_roles.png)

Each user account stores some basic information about the user: name, email address, the date and time when the account was created, and so on. 

Additional information can be attached to a user by adding to these metadata stores:  their user metadata, which is a key-value structure for storing information about the user. You can also store information in the user_metadata or manipulating `app_metadata`, which helps to provide more information to the Flutter application while receiving user details.


## Moving Forward

In the next section of this tutorial, you will learn how to add real-time chat to the app.


Flutter Authentication and Authorization with Auth0, Part 2: Refresh Tokens, Social Logins, and More

andrea-chiarelli

I have over 20 years of experience as a software engineer and technical author. Throughout my career, I've used several programming languages and technologies for the projects I was involved in, ranging from C# to JavaScript, ASP.NET to Node.js, Angular to React, SOAP to REST APIs, etc.

In the last few years, I've been focusing on simplifying the developer experience with Identity and related topics, especially in the .NET ecosystem.

Principal Developer Advocate

Andrea Chiarelli

How to deal with logins that must meet specific criteria based on the user’s country? Let's see how you can do this.

If your application needs conditional access based on the user’s country, you can easily achieve it with a simple Auth0 Action. Let’s see how you can do it.

## Why a Country-based Login?

Controlling user access based on the country where they're located when they log in to your application may have different reasons. To mention just a few of them:

- *Legal reasons*. Laws are different around the world. This leads to adapting access to services or content offered by your application so that it does not break the laws of a particular country. For example, think of online gambling: it is illegal in some countries. Also, think of the liability requirements of [GDPR](https://en.wikipedia.org/wiki/General_Data_Protection_Regulation) for Europe: you must comply with them in order to offer your services to European citizens.
- *Business reasons*. A company may decide not to offer their services or product to a country for business reasons: maybe because the cost of delivering that product or service in a given country is not affordable, or because the pricing strategy may depend on the country. You can even consider copyright licenses: think of the availability of video on-demand services due to copyright restrictions, for example.
- *Security reasons*. You may consider accesses coming from a given country dangerous because most traffic is statistically malicious.

Depending on the reason you want to control user access and on the services or content offered by your application, you can apply different restriction levels. You can range from blocking access to your application ([geo-blocking](https://en.wikipedia.org/wiki/Geo-blocking)) to adapting your services or content to that country's audience.

> Be aware that the most common technique to geolocate a user is based on their IP address. However, blocking users based on their IP address can be easily circumvented through VPNs or anonymizer services.

## Using Auth0 Actions

This article will focus on how you can use [Auth0 Actions](https://auth0.com/actions) to detect the user's country and how to block them or require a second authentication factor. Auth0 Actions are JavaScript functions running in a Node.js environment executed when specific events happen in a few internal Auth0 Flows, such as the Login Flow, the Change Password Flow, the User Registration Flow, etc.

Each Flow is made up of one or more triggers. For example, the Login Flow runs when a user logs in. This Flow has a post-login trigger: an event fired after the user logs in. You can handle this event through one or more Actions. You can think of Actions as event handlers that run when a specific event fires in an Auth0 Flow.

The following is a graphical representation of an Action (*AddRoles*) that will be executed in the Login Flow after the user logs in:

![Auth0 Action in the Login Flow](https://images.ctfassets.net/23aumh6u8s0i/1pJn7J2p7cICewJkSv4Ecj/4030cd2fa04c3df43e8c29b3c537b68c/auth0-action-in-login-flow.png)

In the following, you will use the post-login trigger of the Login Flow to detect the user's country and apply your control strategy.

To learn more, you can check out this blog post for [a quick introduction to Auth0 Actions](https://auth0.com/blog/introducing-auth0-actions/).

## Blocking Logins from a Country

Let's assume you want to block users coming from a given country. As I said, you need to create an Auth0 Action to handle the post-login trigger. So, head to your [Auth0 dashboard](https://manage.auth0.com/). If you don't have an Auth0 account yet, you can <a href="https://auth0.com/signup" data-amp-replace="CLIENT_ID" data-amp-addparams="anonId=CLIENT_ID(cid-scope-cookie-fallback-name)">sign up for a free one</a>.

Select *Actions* on the left side menu and then [*Flows*](https://manage.auth0.com/#/actions/flows). You should land on the following page:

![Auth0 Flows in the Auth0 Dashboard](https://images.ctfassets.net/23aumh6u8s0i/4rUFsGdm1cYpgP6jS8xF98/ed055e37e3cb144cc7f5d540095b9ab3/auth0-flows-dashboard.png)

Click the *Login* Flow and enter the Flow editor, as shown below:

![Auth0 Flow editor](https://images.ctfassets.net/23aumh6u8s0i/4uIJUK8GRjAkfo5eksSffh/0c62aeb77c6178fba58b1bdc30a21491/auth0-flow-editor.png)

Here, you can add a custom Action by clicking the *Build Custom* menu item in the Add Action section of the Flow editor:

![Add Custom Action menu](https://images.ctfassets.net/23aumh6u8s0i/WD1Alxdh14g8jrzztaD58/9597f8fd5a522f02b5816fdc525b4f60/add-custom-action-menu.png)

This allows you to assign a name to the Action you are going to create and to access the Action editor:

![Auth0 Action editor](https://images.ctfassets.net/23aumh6u8s0i/5uI0EGTobmSMBbTcifj6dL/382a78976db5dd4f250759f6f8c47b53/auth0-action-editor-block-users-by-country.png)

Replace the code in the editor with the following:

```javascript
exports.onExecutePostLogin = async (event, api) => {
 if (event.request.geoip.countryCode === "AQ") {
 const countryName = event.request.geoip.countryName;
 
 api.access.deny(`Users from ${countryName} are not allowed!`);
 };
};
```

This code defines the `onExecutePostLogin()` method, which handles the post-login trigger. It receives two parameters: `event` and `api`.

The `event` parameter provides some information about the current running environment. For example, it allows you to access the current user's data, the current request, the tenant, etc. For more details about [the Pre User Registration `event` object, check out the documentation](https://auth0.com/docs/actions/triggers/pre-user-registration/event-object).

The `api` parameter provides methods for changing the behavior of the Flow. For example, it allows you to deny access to your application or set specific metadata for the user or the application. For more details about [the Pre User Registration `api` object, check out the documentation](https://auth0.com/docs/actions/triggers/pre-user-registration/api-object).

In your Action, you used the `event.request.geoip` object to get geolocation information about the user logging in. In particular, you checked the `countryCode` property, which can have one of the [ISO country codes](https://en.wikipedia.org/wiki/List_of_ISO_3166_country_codes) as a value. In the example, you want to block users coming from Antarctica, whose country code is `AQ`. The `geoip` object also provides you with other information about the user's country. For example, you used the `countryName` property to get the full name of the country. Check out [the post-login `event` object documentation](https://auth0.com/docs/customize/actions/triggers/post-login/event-object) for more details.

If the user's country is Antarctica, access is denied through the `api.access.deny()` method. The string passed to the `deny()` method briefly explains the reason for the denied access.

Click the *Save Draft* button to store the Action you just created.

To test this Action, you should... move to Antarctica and try to log in to your application from there. This approach is a bit expensive and ineffective 🙂. Alternatively, you can test the Action by using the *Test* button on the upper-left corner of the Action editor. It opens a sliding window whose content is the `event` object that will be passed to the Action:

![Testing Auth0 Action](https://images.ctfassets.net/23aumh6u8s0i/1VA1JtGrCB9hzt5fasJC0p/0b758ea2dea47ebb8e3ee10e7d5b08ca/testing-auth0-action.png)

You can modify the `geoip` object's properties to simulate a request coming from Antarctica and click the *Run* button. At this point, you will get a window showing a result similar to the following:

![geoip test result](https://images.ctfassets.net/23aumh6u8s0i/dqH3FqfMGOJUGh2Jeg84x/e442c573c846355a336edfd734eb3084/geoip-test-result.png)

## Requesting MFA from a Country

In addition to or instead of blocking users, you may want to enforce [Multi-Factor Authentication (MFA)](https://auth0.com/docs/secure/multi-factor-authentication) for users logging in from specific regions. First, you must have [configured MFA in your Auth0 dashboard](https://auth0.com/docs/secure/multi-factor-authentication/enable-mfa). This lets you define what additional factor you want to use. The next step is to force MFA when a user logs in from specific regions.

For example, assume you want to enforce MFA for North American users. You can create an Action with the following code:

```javascript
exports.onExecutePostLogin = async (event, api) => {
 if (event.request.geoip.continentCode === "NA") {
 api.multifactor.enable("any");
 };
};
```

In this case, you used the `continentCode` property of the `geoip` object. If a user logs in to your application from one of the North American countries, you force MFA by invoking the `api.multifactor.enable()` method. The `"any"` string passed to the method tells Auth0 to use any of the configured factors. Alternatively, you can pass a string identifying a specific provider. Check out [the documentation to learn the available values for MFA providers](https://auth0.com/docs/customize/actions/triggers/post-login/api-object).

> To make your Action available to the Login Flow in your production environment, you have to click the *Deploy* button and drag the newly created Action into the Flow editor, as explained in [the introduction to Auth0 Actions](https://auth0.com/blog/introducing-auth0-actions/#Creating-Your-First-Auth0-Action).

## Recap

In conclusion, throughout this article, you learned the main reasons you may want to control user access to your application on a country-based criterion and how you can implement it with Auth0 Actions. You learned the geolocation features of the `event.request.geoip` object and how to leverage them to block users or enable MFA when they come from specific countries.

However, remember that while the geolocation approach is pretty straightforward, it is not infallible.

Country-Based Access with Auth0 Actions

auziros:jeana-tahnk

Jeana has been in the tech industry for 15+ years, both as a communications professional and writer. As Director of Global Communications at Auth0, she works with her internal team and external agencies to amplify the company's visibility worldwide and establish its leadership in the identity industry. When she is not working, she can most likely be found on a field watching one of her three kids playing sports, or cleaning up after her one-year-old retriever who chews everything.

Senior Director, Global Communications

Jeana Tahnk

Advanced contextual-based feature only triggered by risky logins, mitigating hacking attacks, and reducing threat of data breaches while preserving user experience.

**BELLEVUE, Wash. – Dec. 15, 2020 –** The [Auth0](https://auth0.com/) Identity Platform, a product unit within Okta, today launched [Adaptive Multi-factor Authentication (MFA)](https://auth0.com/blog/auth0-introduces-adaptive-mfa), a sophisticated security feature that helps reduce the threat of hacks and data breaches. Adaptive MFA is an important addition to Auth0's expanding security portfolio&mdash;which also includes Bot Detection, Breached Password Detection, Brute Force Protection, and Suspicious IP Throttling&mdash;and is one of the platform's most advanced context-based security features.

Adaptive MFA is designed to help companies address the inherent challenges of enabling security while preserving user experience. Unlike traditional MFA, which is triggered upon every login attempt and creates an additional step for the end user, Adaptive MFA only appears when a login is deemed risky. This is calculated by an overall risk score that measures abnormal behavior from known devices, impossible travel, and/or IP reputation. Customers can have the confidence that with Adaptive MFA, their end users are asked for secondary authentication only when behavioral signals don't conform to usual patterns for a particular user. 

For example, for a user who normally signs into their account at the same time every morning in San Francisco from a personal laptop, Adaptive MFA would only present a second-factor authenticator if login was attempted outside of the region, usual timeframe, or from a different computer or IP address. Developers can determine how much weight each signal is given to define the risk score that sets off the trigger. 

Many companies are reluctant to implement MFA&mdash;proven to be an effective defense against account hacking attacks&mdash;out of fear of negatively impacting user experience and thus their conversion and retention performance. However, additional friction during the signup, login, or checkout experiences can affect user conversion/retention, resulting in lost sales, and can potentially increase support incidents. Forrester predicts that the MFA market will grow to $2 billion by 2023[1], and this anticipated growth signals the need for a more intelligent and contextually-based MFA solution. 

"Auth0's mission is to provide secure access for everyone. Securing identities is core to that mission, and this new capability adds to the already powerful features in our security profile, designed to counter a variety of sophisticated threats, such as automated attacks, account takeovers, and phishing attacks," said Shiven Ramji, Chief Product Officer at Auth0. "Adaptive MFA should be a key consideration for any enterprise that has previously had to make a tradeoff between security and user experience. The ability to reduce friction while increasing security is a competitive differentiator for our customers."

More detailed information on Adaptive MFA can be found here: [When is MFA the Right Choice?](https://auth0.com/resources/whitepapers/is-mfa-the-right-choice) (whitepaper) and on Auth0's [Multi-factor Authentication](https://auth0.com/multifactor-authentication) page.

<include src="asides/AboutAuth0" />

### Media Contacts
Global Communications 
Auth0 
[press@auth0.com](mailto:press@auth0.com) 

Matter for Auth0 
[auth0@matternow.com](mailto:auth0@matternow.com) 

(1): Forrester Analytics: IAM Software Forecast, 2018 to 2023 (Global)

Auth0 Launches Adaptive MFA to Increase Security and Reduce Friction for End Users

jessica-sealby

Jessica drives public relations and global communications efforts for Auth0 across Asia Pacific. Outside Auth0, she frequents Melbourne’s live music venues and chases after her two energetic dogs.

PR Manager - APAC

Jessica Sealby

Auth0 enables SSO and Social Logins to save months of development time and help scale for expansion

**SINGAPORE – 28 May 2020 –** The [Auth0](https://auth0.com/) Identity Platform, a product unit within Okta, today announced that it has partnered with a digital signage software company, ScreenCloud, to provide authentication for its growing enterprise offering. [ScreenCloud](https://screen.cloud/) will use Auth0 for enterprise federation, Single Sign On (SSO), and Social Logins to help its enterprise customers securely create and control content from anywhere. 

ScreenCloud helps leading brands transform how they communicate with employees and customers using simple, smart, and secure digital signage software. Its digital signage solution is trusted by more than 9,000 customers around the world, including Amazon, Uber, and Dropbox.

As the company sets its sights on significant international growth for its enterprise offering, ScreenCloud chose Auth0 as its primary identity management platform that offers the best combination of versatility, security, and ease of implementation. Auth0 will help support the diverse authentication and access management requirements of ScreenCloud’s enterprise customers, including SSO and Social Logins.

“Many of our customers store highly confidential data on our platform, so they demand secure authentication, and Auth0 makes it very easy for us to seamlessly tailor the authentication experience to suit each customers’ requirements,” said Brian Dewangga, Enterprise Product Manager at ScreenCloud, Thailand. “From a time-saving standpoint, it’s not just the big investment of time to build the solution, but also the long-term maintenance of the system.
By using Auth0, we also save significant resources on maintaining and updating identity management, which provides enormous value for us.” 

“Our growth in the region is marked by exciting fast-growth companies like ScreenCloud,” said Richard Marr, General Manager for Asia Pacific at Auth0. “Their pace of innovation and growing global demand required an identity solution that they could onboard and implement quickly to serve their customers better. We look forward to supporting their ongoing expansion.” 

Auth0 is helping ScreenCloud quickly build resiliency and scale for expansion. With a growing user base around the world working remotely due to COVID-19, ScreenCloud is developing new features to support the remote workforce and anticipates a significant increase in logins. 

“The world looks very different now to what it did a few months ago. We want to help remote workers interact with their company without needing to be in the physical presence of a company-owned screen,” said Dewangga. “It’s increasingly important for us to allow distributed teams to log on easily, without exposing sensitive company information. We feel we’re in good hands with Auth0.”

ScreenCloud believes using Auth0 will deliver a return on investment in the form of saved developer time and peace of mind, allowing them to focus on their core product.

<include src="asides/AboutAuth0" />

ScreenCloud Chooses Auth0 for Global Enterprise Offering

Dirceu-Tiegs

What I enjoy the most about being an SRE at Auth0 is that it allows me to exercise different areas such as coding, architecture, writing, training, investigations, debugging, and incident response. It's great to be able to think deeply about all aspects related to reliability and then apply it to large-scale, real-world projects.

Site Reliability Engineering Team

Dirceu Tiegs

Learn more about how Auth0 architects its services to ensure scalability and high availability to handle more than 1.5 billion logins per month.

Auth0 provides authentication, authorization, and single sign-on services for apps of any type (mobile, web, native) on any stack. Authentication is critical for the vast majority of apps. We designed Auth0 from the beginning so that it could run anywhere: on our cloud, on your cloud, or even on your own private infrastructure.

In this post, we'll talk more about our public SaaS deployments and provide a brief introduction to the infrastructure behind [auth0.com](https://auth0.com/) and the strategies we use to keep it up and running with high availability. This is an updated version of the [2014 High Scalability post about Auth0's architecture](http://highscalability.com/blog/2014/12/1/auth0-architecture-running-in-multiple-cloud-providers-and-r.html).

A lot has changed since then in Auth0. These are some of the highlights:

- We went from processing a couple of million logins per month to 2.5 billion logins per month, serving thousands of customers, including [FuboTV](https://auth0.com/learn/sports-centric-streaming-service-fubotv-sees-50-roi-just-auth0s-security/), [Mozilla](https://auth0.com/blog/auth0-mozilla-partnership/), [InterMiles](https://auth0.com/learn/jetprivilege-case-study/), and more.

- We implemented new features like [custom domains](https://auth0.com/docs/custom-domains), [scaled bcrypt operations](https://auth0.engineering/bcrypt-as-a-service-9e71707bda47), vastly [improved user search](https://auth0.com/docs/users/search/v3), and much more.

- The number of services that compose our product in order to scale our organization and handle the increases in traffic went from under 10 to over 30 services.

- The number of cloud resources grew immensely as well; we used to have a couple dozen nodes in one environment (US), now we have more than a thousand over four environments (US, US-2, EU, AU).

- We doubled-down decided to use a single cloud provider for each of our environments and moved all our public cloud infrastructure to AWS.

## Core service architecture

![Auth0.com core service architecture](https://images.ctfassets.net/23aumh6u8s0i/2mden7W7brrYGv8LHDK2Lp/5347634d4197ae655555cf93b8209c2d/auth0-core-service-architecture)

The core service is composed of different layers:

- Core applications: Auto-scaling groups of servers running different services of our stack (authentication, management API, multi-factor authentication API, and much more).

- Data storage: Clusters of MongoDB, Elasticsearch, Redis, and PostgreSQL storing a variety of datasets for different applications and features.

- Transports/Queues: Kinesis streams and RabbitMQ, SNS, and SQS queues.

- Base services: Services for rate-limiting, bcrypt clusters, feature-flags, and more.

- Routing: AWS load balancers (ALB, NLB, and ELB from AWS) and some nodes running NGINX as a proxy.

## High Availability

In 2014 we used a multi-cloud architecture (using Azure and AWS, with some extra resources on Google Cloud) and that served us well for years. As our usage (and load) rapidly increased, we found ourselves relying on AWS resources more and more.

At first, we switched our primary region in our environment to be in AWS, keeping Azure as failover. As we began using more AWS resources like Kinesis and SQS, we started having trouble keeping the same feature set in both providers. As our need to move (and scale) faster grew, we opted to keep supporting Azure with a limited feature parity: if everything went down on AWS, we could still support core authentication features using the Azure clusters, but not much of the new stuff we had been developing.

After some bad outages in 2016, we decided to finally converge on AWS. We stopped all efforts related to keeping the services and automation platform-independent and instead focused on:

- Providing a better failover story inside AWS, using multiple regions and at least 3 Availability Zones per region.

- Increasing usage of AWS-specific resources like auto-scaling groups (instead of using fixed clusters of nodes), application load balancers (ALBs), and more.

- Writing better automation: we revamped our automation, completely embracing infrastructure as code using TerraForm and SaltStack to provision new Auth0 environments (and also to replace existing ones). This allowed us to grow from partially automated environments doing ~300 logins per second to fully automated environments doing more than ~3.4 thousand logins per second; using the new tooling makes it easier to scale up (and down, whenever it makes sense). The level of automation we achieved is not perfect but is allowing us to grow to new regions and create new environments in a much more convenient way.

- Writing better playbooks: with more time and focus, we saw that besides automation we also needed better playbooks in order to understand, manage, and respond to incidents related to our ever-growing mesh of services. This vastly improved scalability and reliability while also allowing us to onboard new employees faster.

<include src="TweetQuote" quoteText="Writing better automation let us grow from partially automated environments doing ~300 logins per second to fully automated environments doing more than ~3.4 thousand logins per second"/>

Let's take a look at our US environment architecture, for instance. We have this general structure:

![Auth0 US Environment Architecture](https://images.ctfassets.net/23aumh6u8s0i/4hGMwY5n4jk2aoJyyRAhjF/0ca131b596da7068aced34ca69fbbc5c/auth0-us-environment-architecture)

And this is the structure inside a single AZ:

![Auth0 Single Availablity Zone](https://images.ctfassets.net/23aumh6u8s0i/4EtOG7to5lHmyYnU5Q3aaC/a22b74fe7b0a58d0f54a78a6b801bbd2/auth0-single-availability-zone)

In this case, we use two AWS regions: us-west-2 (our primary) and us-west-1 (our failover). Under normal circumstances, all requests will go to us-west-2, being served by three separate availability zones.

This is how we achieve high availability: all services (including databases) have running instances on every availability zone (AZ). If one AZ is down due to a data center failure, we still have two AZs to serve requests from. If the entire region is down or having errors, we can update Route53 to failover to us-west-1 and resume operations.

<include src="TweetQuote" quoteText="We achieve high availability by running all services instances on every AWS availability zone"/>

We have different maturity levels for service failover: some services, like user search v2 (that builds a cache on Elasticsearch) might work but with slightly stale data; still, core functionality keeps working as expected.

In the data layer, we use:

- A cross-region cluster for MongoDB.

- RDS replication for PostgreSQL.

- Clusters per region for Elasticsearch with automated snapshot and restores running regularly to account for the lack of cross-region clustering.

We exercise failover at least once per year, and we have playbooks and automation to help new infrastructure engineers get up to speed on how to do it and what are the implications.

Our deployments are usually triggered by a Jenkins node; depending on the service we either use Puppet, SaltStack, and/or Ansible to update individual or groups of nodes, or we update our AMIs and create new autoscaling groups for immutable deployments. We have different types of deployments for new and old services, and this has been shown to be largely ineffective as we need to maintain automation, docs, and monitoring for something that should be unified.

We are currently rolling out blue/green deployments for some of the core services, and we intend to implement the same for every core and supporting service.

## Automated Testing

Besides unit test coverage on every project, we have multiple functional test suites that run in every environment; we run it on a staging environment before we deploy to production, and we run them again in production after finishing a deployment to ensure that everything works.

The highlights:

- We have thousands of unit tests in different projects.

- We use Pingdom probes that run every minute to check core functionality.

- We use a mix of Selenium and CodeceptJS-based functional tests before and after every deployment. The functional test suites test different API endpoints, authentication flows, identity providers, and much more.

<include src="TweetQuote" quoteText="Besides unit test coverage on every project, we have multiple functional test suites that run in every environment: staging before deploying to production and again in production after finishing deployment."/>

## CDN

Until 2017 we ran our own, custom-built CDN using NGINX, Varnish, and EC2 nodes in multiple regions. Since then, we transitioned to CloudFront, which has given us several benefits that include:

- More edge locations, which means less latency for our customers.

- Lower maintenance costs.

- Easier configuration.

There are a few downsides, like the fact that we need to run Lambdas to perform some configurations (like adding custom headers to PDF files and things like that). Still, the upsides definitely make up for that.

## Extend

One of the features we provide is the ability to run custom code as part of the login transaction, either via [_authentication rules_](https://auth0.com/docs/rules/current) or [_custom database connections_](https://auth0.com/docs/connections/database/custom-db). These features are powered by [_Extend_](https://goextend.io/), an extensibility platform that grew out of Auth0 and is now being used by other companies as well. With Extend, our customers can write anything they want in those scripts and rules, allowing them to extend profiles, normalize attributes, send notifications, and much more.

We have Extend clusters specifically for Auth0; they use a combination of EC2 auto-scaling groups, Docker containers, and custom proxies to handle requests from our tenants, processing thousands of requests per second and responding fast to variations of load. For more details about how this is built and run, check out this post on [how to build your own serverless platform](https://tomasz.janczuk.org/2018/03/how-to-build-your-own-serverless-platform.html).

## Monitoring

We use a combination of different tools for monitoring and debugging issues:

- CloudWatch

- DataDog

- Pingdom

- SENTINL

The vast majority of our alerts come from CloudWatch and DataDog.

We tend to configure CloudWatch alarms via TerraForm, and the main monitors we keep on CloudWatch are:

- HTTP errors from our main load balancers.

- Unhealthy instances in a target group.

- SQS processing delays.

CloudWatch is the best tool for alarms based on AWS-generated metrics (like ones from load balancers or autoscaling groups). CloudWatch alerts usually go to PagerDuty, and from PagerDuty to Slack/phones.

DataDog is a service we use to store and act on time-series metrics. We send metrics from Linux boxes, AWS resources, off-the-shelf services (like NGINX or MongoDB), and also custom services we have built (like our Management API).

We have many DataDog monitors. A few examples:

- Increase in response times in `$service` on `$environment`.

- Running out of space on `$volume` in `$instance` (`$ip_address`).

- Issue with `$process` on `$environment` / `$host` (`$ip_address`).

- Increase in processing time for `$service` on `$environment`.

- NTP drifting off / clock issue on `$host` (`$ip_address`).

- MongoDB replica-set change on `$environment`.

As you can see from the examples above, we have monitors on low-level metrics (like disk space) and high-level metrics (like MongoDB replica-set change, which alerts us if there was a change in the primary node definition, for example). We do much more and have some pretty sophisticated monitors around some services.

DataDog alerts are pretty flexible in their outputs and we usually send them all to Slack, sending to PagerDuty only those who should "wake people up" (like spikes of errors, or most things that we are sure that are having an effect on customers).

For logging we use Kibana and SumoLogic; we are using SumoLogic to record audit trails and many AWS-generated logs, and we use Kibana to store application logs from our own services and other "off-the-shelf" services like NGINX and MongoDB.

## The Future

Our platform evolved quite a bit in order to handle the extra load and the huge variety of use cases that are important to our customers, but we still have more room for optimizations.

Not only our platform grew, but our engineering organization increased in size: we have many new teams building their own services and are in need of automation, tooling, and guidance around scalability.
With that in mind, these are the initiatives in place for us to scale not only our platform but also our engineering practice:

- Build a Platform, PaaS style: As mentioned before, today we have different automation and deployment flows; this causes confusion and creates a barrier of entry for engineers as it's hard to experiment and scale up without touching too many repositories. We are developing a PoC for a platform (currently running on top of ECS) in which engineers can configure a YAML file and just deploy it to get computing resources, monitoring, logging, backups, and much more. All of that without having to configure it explicitly. This effort is in an early stage and might still change a lot (EKS?). However, we feel we are taking the right direction given our growing size and scalability constraints.

- Implement smoke tests for every new pull request: besides unit testing (that already runs on each new PR), we want to run integration tests on ephemeral environments wherever that's possible.

- Centralize our logging solution into just one provider. This might mean moving away from Kibana and using just SumoLogic, but we still need to evaluate feature set, data volume, and more.

- Automate metrics: Too much of our metric story is manual now: adding metrics-related calls to the code while deploying, and building dashboards and monitors using the DataDog interface. If we use a standard format and naming, we could do things like building dashboards/monitors automatically, extracting metrics from logs instead of explicitly adding calls to the code, and more.

- Ensure we have auto-scaling and blue/green deployments on every core service. This should come out-of-the-box from our new Platform, but while that is being built and tested we need to improve the scaling/deployment/rollback story for the core services that are still lacking in that regard.

<include src="asides/AboutAuth0" />

Auth0 Architecture: 5 Years In

Passwordless and Multifactor Authentication motivate companies to shift their approach to customer logins.

**BELLEVUE, Wash. -- July 9, 2018 --** [Auth0](https://auth0.com), a global leader in Identity-as-a-Service (IDaaS), today announced key findings on how companies are approaching the Customer Login Experience as new technologies like Passwordless, Multifactor Authentication, and social login options become more prevalent. According to anonymized data collected in May from a large sampling of Auth0 customers across all verticals, including financial services, media, retail, transportation, SaaS, and more, Auth0 found that companies are eager to embrace and adopt methods for streamlining the login process, suggesting that we should see an increase in passwordless usage in the near future. 

The emergence of [FIDO 2.0](https://fidoalliance.org/specs/fido-v2.0-rd-20170927/fido-overview-v2.0-rd-20170927.html) and [WebAuthn](https://auth0.com/blog/introduction-to-web-authentication) have encouraged more companies to take the leap into a passwordless future. Auth0’s customers are leading the charge, with 19.4 percent already using its [Passwordless](https://auth0.com/passwordless) feature, allowing developers to easily enable sign-in to apps without the need for passwords – a feature that Auth0 has offered since 2015. 

> Learn more and [try a WebAuthn demo crafted by Auth0, here](https://webauthn.me/).

The shift toward passwordless is a strategic one, considering that password changes are quite common for Auth0’s customers that use traditional username/password as a login method. Customers in the staffing & recruiting industry see 48.2 percent of their customers requesting a password change, followed by transportation (39.8 percent), federal (23.0 percent), and financial services (18.6 percent), the most common reason being forgotten passwords. “Gartner predicts that, through the end of 2020, enterprises that invest in new authentication methods and compensating controls will experience 50 percent fewer identity-related security breaches than peers that do not (Gartner).”[1](#myfootnote1)

As the industry evolves to a possibly passwordless future, the current state of the industry still finds a predominant use of passwords as the primary means of logging in. Before making the leap into passwordless, many companies have implemented [social login](https://auth0.com/learn/social-login) as an easier way to consolidate secure logins. 
 
Auth0 provides support for 30+ social providers, which 72 percent of its customers take advantage of, easing the login process for their users. The top five most widely used social login sites for Auth0 customers are: Google (60.3 percent), Facebook (24.1 percent), LinkedIn (8.8 percent), GitHub (7.1 percent), and Windows Live (6.8 percent). These percentages may shift in coming months based on recent news about how Cambridge Analytica handled Facebook data, which is a [cautionary tale](https://auth0.com/blog/cambridge-analytica-and-facebook/) for organizations about the implications of data breaches. 

With the prevalence of passwords still being used, the best way to protect identity credentials is to employ a feature like [Multifactor Authentication](https://auth0.com/multifactor-authentication) (MFA), which only 11.4 percent of Auth0 customers currently provide to their users. Of these customers, the top three industries consist of healthcare, manufacturing, followed by government. Adoption rates of MFA are on the low end due to the perception of added friction it supposedly creates for users, but it’s a critical feature for stopping phishing attacks, as well as decreasing the probability of getting hacked. In addition to this essential security layer, customers are relying on additional risk-based MFA that accommodates factors such as geographic location, IP filtering, type of device, which is a huge benefit with today’s global workforce. 

“The login experience is continually changing based on user demand and the need to protect against today’s sophisticated cybercriminal landscape. Passwordless is a signal of the kind of industry change we are all heading toward,” said Martin Gontovnikas, VP of Marketing and Growth at Auth0. “The insights we continually gather from our fantastic in-house data team fuel the continued innovation of our platform so customers stay several steps ahead in this constantly changing industry.” 

<a name="myfootnote1">1</a>: [Gartner Smarter with Gartner, Aim for a Workable Password Policy, Not a Perfect One October 9, 2017](https://www.gartner.com/smarterwithgartner/aim-for-a-workable-password-policy-not-a-perfect-one/)

<include src="asides/AboutAuth0" />

### **Media Contact:**

Jeana Tahnk 
Corporate Communications 
Auth0 
[jeana.tahnk@auth0.com](mailto:jeana.tahnk@auth0.com)

Kasia Hall 
Matter for Auth0 
[khall@matternow.com](mailto:khall@matternow.com) 
971-246-7898

Momentum Building for a More Streamlined Customer Login Experience, According to Auth0

001c9ddc5ceb9829b6aaf24f5d28502a

I am software developer with a keen interest in open-source technologies, Linux, and native development. I've worked on many different platforms Android, iOS, Win32, Linux, FreeRTOS, the Web, and others. I've gone through the whole stack and I enjoy learning and using the latest technologies. I now work as a full-stack developer at Auth0.

Senior Engineer

Sebastian Peyrott

In this tutorial we implement centralized logins for iOS both manually and using the Auth0 SDK.

Add Authentication To Your iOS Apps with Centralized Login

Learn how to implement social logins on Android with Facebook, Google, Twitter and Instagram as providers

Authenticate on Android Using Social Logins

Jose-Romaniello

I started working at Auth0 before the first line of code for our authentication platform existed. I’ve been able to go through the journey of seeing our ideas go from prototype to living production code that impacts millions of people. It’s satisfying to know that my actions here are having a positive impact in solving problems for developers like me.

Head of Engineering

Jose Romaniello

Auth0 is now available on Heroku as an add-on (private beta for now), making it incredibly easy to add Enterprise SSO, Consumer Logins, Directories queries

Auth0 is now available on [Heroku as an add-on](https://addons.heroku.com/auth0) (private beta for now), making it __incredibly easy__ to add Enterprise SSO, Consumer Logins, Directories queries, user access audit and many advanced identity management to any app hosted there. [See here for a complete list of supported identity providers in Auth0](http://docs.auth0.com/identityproviders): Consumer and Enterprise.

A 3 min video is worth 1,000,000 words. Take a look:



<iframe width="710" height="533" src="//www.youtube.com/embed/Q0MVRgC-ptg?rel=0&vq=hd1080" frameborder="0" allowfullscreen></iframe>

[Try Auth0 yourself!](https://auth0.com)

"logins"