ana-cidre

Ana Cidre is a passionate advocate for the developer community and leads the Developer Advocacy team at Auth0. She's committed to fostering a more inclusive and diverse tech world, drawing on her technical background and strategic vision to improve developer experiences and build meaningful connections.

 

As the founder of GalsTech, an initiative supporting women in tech in Galicia, and through her active efforts to create welcoming spaces for underrepresented groups, Ana's dedication to diversity and inclusion extends beyond her daily work.

 

Ana has a proven track record of building global Developer Relations teams, cultivating active developer communities, and crafting impactful educational content. She maintains a strong connection to the community through speaking engagements and direct interaction with developers.

Sr Manager, Developer Advocacy

Ana Cidre

Discover the latest releases, updates, events, and developer-related things from Auth0!

This month, Auth0 takes a big step toward the future of identity—one where AI agents, natural language interfaces, and human users coexist securely. April’s updates are centered on helping developers build for this new reality.

From Auth for GenAI, a developer-first identity solution purpose-built for AI agents and secure delegation, to the new MCP Server, which lets AI tools manage tenant configuration with natural language, this release is packed with tools that make complex auth feel simple, even in AI-first workflows.

Let’s take a look at what’s new, what’s in preview, and what you can start building with right now.

## Updates You Don’t Want to Miss

![Auth for GenAI](https://images.ctfassets.net/23aumh6u8s0i/LOv2KdQtOpluI2cySqCHR/a7ef46e280fb92ec35892b88ff91abf7/auth_for_genai.png)

### Auth for GenAI – Developer Preview now available

Generative AI is transforming how apps interact with users and how users interact with data. But securing those interactions hasn’t always been easy. That’s why we built [Auth for GenAI](https://auth0.com/blog/introducing-auth-for-genai-launching-identity-for-ai-agents/), now in **Developer Preview**.

This new solution brings together everything you need to securely build AI-powered applications, whether you're embedding AI agents, enabling human-in-the-loop workflows, or orchestrating actions across third-party APIs.

**Highlights:**

* **User Authentication** for AI agents, with support for linking, impersonation, and delegation
* **Token Vault** to securely manage and refresh access tokens for third-party APIs (e.g., Gmail, Slack, GitHub)
* **Async Authorization** to support workflows that require delayed human approval
* **Fine-Grained Authorization (FGA)** for document-level permissions in Retrieval-Augmented Generation (RAG)

Works with LangChain, LlamaIndex, GenKit, and Vercel’s AI SDK.

> [Get started with Auth for GenAI](https://auth0.com/ai/docs)

### Auth0 MCP Server – Natural language meets tenant management

The new [Auth0 MCP Server](https://auth0.com/blog/announcement-auth0-mcp-server-is-here/) brings the power of natural language interfaces directly to your Auth0 tenant.

Using the **Model Context Protocol (MCP)**, you can now authorize AI tools like **Claude Desktop, Cursor, or Windsurf** to safely interact with your tenant—whether that's updating configurations, deploying Actions, or managing APIs—all through secure, context-aware requests.

**Highlights:**

* **Secure login** via OAuth 2.0 Device Flow
* **Credential storage** via system keychain
* **Rich management APIs**, including support for tenant logs, app configuration, and more
* **Built-in access controls**, so AI agents only do what they’re allowed to.

> If you want to learn more about Auth0 MCP Server, you can read the announcement [here](https://auth0.com/blog/announcement-auth0-mcp-server-is-here/).

### Token Vault – Secure access to external APIs (Early Access)

Managing API access on behalf of users can be tricky—especially when it comes to storing and refreshing third-party tokens securely. Enter **Token Vault**, now in **Early Access** for Public Cloud tenants.

**Token Vault** allows your applications and AI agents to call external APIs—like Google Calendar, GitHub, or Microsoft Graph—**on behalf of the user**, without you having to build and maintain complex refresh workflows or custom integrations.

**Why it matters:**

* **Delegated API Access** – Securely call downstream APIs on the user’s behalf using short-lived access tokens.
* **No Refresh Token Handling** – Auth0 manages token storage and refresh cycles for you.
* **Supports Top Providers** – Integrates with popular identity providers like Google, GitHub, and Microsoft.
* **AI-Ready** – Designed to work seamlessly with **Auth for GenAI**, enabling AI agents to act on behalf of users across different services.

> Learn more in the [Token Vault documentation ](https://auth0.com/docs/secure/tokens/token-vault).

Or see how it works with GenAI apps: [Call APIs on User’s Behalf](https://auth0.com/ai/docs/call-others-apis-on-users-behalf).

 

<div class="alert alert-info alert-icon">

 Note: 
 Token Vault is currently available only for Public Cloud tenants. Contact your Technical Account Manager to enable Early Access. 
</div>

### More cool features we have shipped to improve your experience: 

#### Real-Time logs for Actions – Now Generally Available 

Debugging just got a whole lot easier. **Real-Time Logs for Actions**, Custom Database Scripts, and Custom Social Connections is now **GA**. Developers can now see console outputs (like `console.log`) in real-time directly from the Auth0 Dashboard. Find it under **Dashboard > Monitoring > Action Logs**

#### Mobile Driver’s License verification – Limited Early Access

We’re excited to introduce the **Mobile Driver’s License (mDL) Verification Service**, now in **Limited Early Access**. This new capability enables businesses and platforms to enrich user profiles during sign-up or login using **trusted, government-issued identity data**. Whether embedded in your **authorization flows** via our Forms widget or triggered **on-demand**, mDL verification unlocks a seamless, secure identity experience.

#### New US Public Cloud Region – prod-us-5 Now Live

Auth0 is growing with you. We’ve launched a new US Public Cloud environment: **`prod-us-5`**. This expansion increases regional capacity and performance for onboarding new Auth0 Public Cloud customers—while maintaining full support for **Auth0’s Authentication and Management capabilities**. 

## Community and Events

We’ve been on the road sharing ideas, best practices, and demos around the future of identity and AI.

### Where were we in April

![Where were we in April](https://images.ctfassets.net/23aumh6u8s0i/3gnJPuk7MKY2aGhRdzK2oV/25de7a9593747c5235ddb060596c0f2a/EventsApril.jpg)

* **VoxxedDays Amsterdam (Apr 3):** Deepu shared AI authorization strategies for LangChain and OpenFGA
* **Apidays Singapore (Apr 15–16):** Daizen covered scaling SaaS platforms for enterprise readiness
* **AWS Summit Amsterdam (Apr 16)**
* **React Miami (Apr 17–18)**
* **PyCon DE (Apr 23–25):** Juan Cruz Martinez presented on secure human-in-the-loop AI interactions
* **CityJS London (Apr 23–25)**
* **Vue.js Global Summit ‘25 – AI Edition (Apr 29–30):** Ramona Schwering’s talk: *Developer’s Guide to Not Summoning Skynet*
* **AWS Summit London (Apr 30)**

Thanks to everyone who stopped by &mdash; we loved connecting with builders across the world.

### Where we’ll be in May

**Looking ahead to May, you’ll find us at a variety of developer and tech-forward events across the globe. Come chat identity, APIs, AI, and all things dev with the Auth0 team:**

* **ADC Conference (5-7 May): **Ramona will be giving a talk, “The AI Developer's Guide to Not Accidentally Summoning Skynet.”
* **Infobip Shift (May 6) – **Carla will be talking about “Securing AI: A Journey Through Access Control Systems.”
* **API Days New York - Generation AI (May 14) – **Ramona will be talking about security and AI
* **Dublin Tech Summit (28-29 May)** – Two days of tech talks, networking, and developer energy

Planning to attend? Let us know—we’d love to meet up!

## That’s a Wrap for April

As AI becomes more integrated into the software we build, so does the need for thoughtful, secure identity design. With **Auth for GenAI**, **Token Vault**, the **MCP Server**, and new features like **mDL Verification** and **Real-Time Logs**, we’re here to help you ship smarter, safer, and more scalable apps.

Stay secure. 
Keep shipping. 
We’re here if you need us.

April 2025 in Auth0: Auth That Works for Humans and AI

Discover the latest releases, updates, events, and all things developer-related from Auth0!

Identity is foundational, but building and scaling it well is hard. That’s where we come in. Each month, we surface the updates most relevant to you, things you can actually use, build with, and ship. Here’s what shipped in March 2025 and why it matters.

## Updates You Don’t Want to Miss

### Event Streams for User Lifecycle - Public Beta

Tracking changes to user profiles, like when a user is created, updated, or deleted, hasn’t always been straightforward. Until now, most teams had to rely on workarounds like Actions or digging through logs.

With Event Streams, you can now subscribe to real-time user lifecycle events and route them to a **Webhook, Event-Stream** or **AWS EventBridge**, making it easier to build automations, sync data, or trigger downstream systems whenever user data changes regardless of the connection used.

**Highlights:**

* Get notified when users are created, updated, or deleted
* Route events to webhooks or EventBridge with minimal setup
* No need to poll the Management API or monitor logs manually

> Event Streams is currently in **Public Beta**, and we’re looking for developers to test and share feedback. Check out the [Auth0 Docs](https://auth0.com/docs/deploy-monitor/events/create-an-event-stream) to get started.

### Advanced Customizations for Universal Login (Early Access) - Organizations, MFA TOTP, and Password Reset Challenge!

Back in February, we introduced Advanced Customizations for Universal Login (ACUL), giving you full control over login and signup screens. Now we’re extending that flexibility even further.

As of March, ACUL now supports building custom, client-rendered versions of additional key screens—including organization flows, MFA TOTP (Time-based one-time password) screens, and related reset password challenges.

**Highlights:**

* Customize Organization screens like Accept Invitation and Organization Picker
* Fully brand MFA TOTP enrollment and challenge screens
* Tailor Reset Password challenges across OTP, email, push, and SMS flows

This release also includes updates to the ACUL SDK, Auth0 CLI, Deploy CLI, and Terraform Provider—all with support for these new screens. (Note: the TypeScript SDK includes a breaking change—check the changelog for details.)

> We’re continuing to expand support across the full Universal Login experience. Check out the [docs](https://auth0.com/docs/customize/login-pages/advanced-customizations) to get started today.

### 🇯🇵 Japanese Language Support Added to Auth0 Dashboard and Docs

To support our developer community in Japan (and global teams building for Japanese users), the **Auth0 Dashboard and Documentation are now available in Japanese**.

**How it works:**

* Browser language preference set to Japanese? The dashboard and docs will load in Japanese automatically.
* Prefer manual control? Use the language switcher in the top-right corner.

This makes it easier for devs in Japan and beyond to build secure identity solutions with less friction.

### Breached Password Detection for Password Reset Flows is Now Available!

Breached Password Detection is getting a major upgrade. Until now, it only applied during sign-up and login and now, it also protects the **password reset flow**.

That means users can no longer reset their password to something that’s already known to be compromised, reducing both security risks and unnecessary password changes down the line.

**Highlights:**

- Prevent password resets to known breached credentials
- Expanded coverage now includes sign-ups via the Management API
- Improves account protection across the entire password lifecycle

> This update brings stronger security and a better user experience with minimal configuration. Check the [docs](https://auth0.com/docs/secure/attack-protection/breached-password-detection) to get started.

### Custom Phone Providers and Unified Phone Experience Now Generally Available

Custom Phone Providers and the Unified Phone Experience are now GA, giving you more control and simplicity when building phone-based authentication flows.

With **Custom Phone Providers**, you can use your own SMS provider and customize messages across Phones as ID, MFA, and Passwordless. It’s fully supported in Auth0 CLI, Deploy CLI, and Terraform for seamless integration with your CI/CD workflows.

The **Unified Phone Experience** simplifies configuration by consolidating phone settings and templates in one place. New tenants will use this by default, and existing tenants can opt-in anytime.

> [Learn how to get started in the docs](https://auth0.com/docs/customize/phone-messages/unified-phone/use-auth0s-unified-phone-experience-for-multi-factor-authentication)

### More cool features we have shipped to improve your experience: 

**Swift Package Manager Support for Guardian SDK**

Integrating Auth0 Guardian into your iOS projects is now easier than ever. With support for Swift Package Manager (SPM), you can add Guardian directly in Xcode without manual setup or external dependency management. This update simplifies mobile integration and streamlines authentication setup in your Apple ecosystem.

**Credential Guard Now Available for Private Cloud on Azure**

Credential Guard is now supported for customers running Auth0 in Private Cloud on Azure. This enhancement offers faster breach detection, up to 250% quicker than traditional automated tools, along with global password protection coverage in 200+ regions and real-time threat intelligence powered by a dedicated security team.

**Actions – Execution Error Logs Now Available**

We’ve introduced better observability for unhandled execution errors in Actions. A new event type is now available in the Auth0 Dashboard under Monitoring > Logs and can also be streamed to your existing Log Stream platforms. You’ll also find a dedicated filter for Actions-related errors, helping you monitor and debug custom logic more efficiently.

## Community and Events

At Auth0, we’re all about showing up for developers, whether it's at a major conference or a local meetup. March was packed with great conversations around identity, security, and the future of application development.

### Where We Were in March

Here’s a quick look at where we’ve been and the awesome developer communities we connected with:

* **All Things Open AI** – March 17–18
* **NAVIGATE Kongress 2025**
* **Gartner IAM Summit London**
* **Tech.eu Summit** – March 25–26

![Community and Events](https://images.ctfassets.net/23aumh6u8s0i/65ZQfEpouwgVrXBqsDIEa8/243d53c9255ae9e5ffcb8b71f74a2773/Community_and_Events_-_March.jpg)

Thanks to everyone who dropped by to talk shop with us. We loved chatting about secure AI integrations, passwordless strategies, and how developers are solving identity challenges at scale.

### Where We’ll Be in April

We’re keeping the momentum going in April! If you're attending any of these, come say hi; we'd love to meet you and hear what you're building.

* **VoxxedDays Amsterdam (April 3rd)** – Don’t miss **Deepu’s talk** on *Securing the Future of AI: Authorization Strategies for RAG Systems with LangChain4J and OpenFGA*
* **Apidays Singapore 2025 (April 15–16th) – Daizen Ikehara **will discuss "Is your SaaS scalable? 4 things to consider to support large organizations."
* **AWS Summit Amsterdam (April 16th) **
* **React Miami (April 17–18th)**
* **PyCon DE (April 23–25th) – Juan Cruz Martinez **will present on "Secure 'Human in the Loop' Interactions for AI Agents."​
* **CityJS London (April 23rd–25th) **
* **Vue.js Global Summit '25 – AI Edition (April 29–30th) – Ramona Schwering** will deliver "Developer's Guide to Not Summoning Skynet."​
* **AWS Summit London (April 30th)**

Stop by our booth, catch a talk, or just grab some Auth0 swag; we’re excited to connect!

That’s all for March! 
We’ll be back next month with even more updates to help you build secure, scalable, and modern identity solutions. In the meantime, build something great and let us know how we can support your journey.

Stay secure. 
Keep shipping. 
We’re here if you need us.

March 2025 Updates: What’s New in Auth0 (Developer Edition)

Mira Sharma

Mira is a Product Manager on Auth0’s Enterprise Federations team. She is passionate about building connections, whether they involve OIDC tokens, puzzling out the shape of new product features, or frustrating New York Times games. When she’s not working, she’s probably writing intergalactic stories, out on a run, or in a pool somewhere.


Product Manager

At DeveloperWeek 2025, AI took center stage—highlighting trust issues, security gaps, and transparency challenges as companies push for more reliable AI.

![Developer Week 2025](https://images.ctfassets.net/23aumh6u8s0i/5eSfirnEouOlpOO8dXMdhr/839499a4d80d00dd6278d0cdab94b2df/developer-week-header.jpg)

[DeveloperWeek 2025](https://www.developerweek.com/) was an AI-lover’s dream, a cornucopia of AI-driven innovation emerging from small startups to established industry leaders. There were dancing robot dogs, a plethora of cyber trucks, and a robot so intent on shaking human hands that it alarmed a few passersby as it scuttled speedily toward them. Attendees were privy to demos of voice cloning, roundtables with people from a diverse array of expertise, an enthusiastic DJ, and a small inflatable slide that lay in bouncy disuse. Any spies would be alarmed at the number of “agents” being openly discussed around them.

There is no denying that AI is the future. Yet like any nascent relationship, there are looming hurdles that must be navigated on the road to a happily-ever-after.

## Trust Issues 


While many envision the ultimate AI solution as an autonomous agent capable of reasoning and handling complex tasks independently, today’s reality spans a wide range of autonomy. Most of the AI tools displayed at DeveloperWeek still require significant human input, with only a few pushing toward greater independence. 

<img src="https://images.ctfassets.net/23aumh6u8s0i/LxsZn0xN57pNGGo4iZZAv/ed74ed928f1c281636b91ceb8093c8c8/developer-week-bot.jpg" width="200" align="left" style="padding: 10px; alt="Bot" /> After attending several popular speaker sessions, it became clear that a central challenge in achieving true autonomy is trust: how can AI-based products be designed to deliver reliable, accurate outputs? Many of today’s successful AI tools—such as GitHub Copilot and Cursor.ai—are B2B products used by trained developers, inherently relying on human oversight for verification. Rules and procedures for proper usage can be created and followed systematically, reducing the risk of hallucinated code or other errors impacting production environments. 


 
B2C products, on the other hand, have fewer means of imposing usage rules on customers. AI tools may work as expected with prompts provided for testing, but there is an infinite number of prompts that customers could inadvertently create. Attempting to circumvent things like hallucination and training data bias may superficially appear to act as guardrails, but they are hardly guaranteed. 

[Generative AI never doesn’t have an answer](https://www.ibm.com/think/topics/ai-hallucinations): This is wildly appealing in some use cases and terrifyingly misleading in others. The wild west of unreliable AI products, however, will not last forever; technology is improving at exponential rates, and people are learning how to interact with AI in more effective ways. In one of the most well-attended sessions, “Give Your LLM a Left Brain,” Neo4j’s Stephen Chin highlighted GraphRAG as a powerful tool to enhance the creativity of LLMs by incorporating actual data and helping models generate more logical and relevant outputs. Limiting AI expertise and function is also a simple way to enable more comprehensive output testing and promote greater transparency in acknowledging the model's limitations. The work to refine and balance these capabilities—much like connecting the left and right hemispheres of the brain—is already in motion.

## All Talk? 

Augmenting AI prompts with real data to enhance results–going from RAGs to riches, if you will–is not a new concept, and neither were many of the ideas bubbling around the booths. Although AI is still new in terms of its technical revolution, it is no longer shiny and novel to the wider world–we’ve been hearing about it since 2022. And while all sorts of flashy demos have been presented to show off the glittering promise of the AI-led future, where is that future now? 

A slide from Auth0’s keynote, delivered by Shiv Ramji, was particularly apt for describing the lifetime of an AI product. Getting a product ready to demo is not the same as shipping it; many AI products are in the liminal stretch between demo and shipping, as illustrated below. 

![Auth0’s keynote](https://images.ctfassets.net/23aumh6u8s0i/1jzUQMIWfPiBNrTwG3vBNj/c3b485195c0d6e8d9bb28f9692f410c5/developer-week-phases.png)

In short, this means that an explosion in AI technology is still imminent, with increasing numbers of ready-to-use, publicly available tools released regularly. As more companies push beyond [Gartner’s "trough of disillusionment"](https://www.gartner.com/en/articles/what-s-new-in-artificial-intelligence-from-the-2023-gartner-hype-cycle), we’re witnessing a shift from skepticism to real, tangible progress, signaling that AI’s potential is beginning to be fully realized in ways that were once thought far off.

![Gartner](https://images.ctfassets.net/23aumh6u8s0i/7JCZEDrbN3IC0gOEF7KGcj/b020910303fb75dfb8f721093712a95e/hype-cycle-for-artificial-intelligence-2023.png)
_Source_: [Gartner](https://www.gartner.com/en/articles/what-s-new-in-artificial-intelligence-from-the-2023-gartner-hype-cycle)

## Lack of Transparency 

Part of AI’s sparkling allure is its ability to abstract away the nuisances of code and technicalities under the familiar veil of natural language. It’s this very abstraction, however, that turns AI into a black box that makes modification, testing, and usage more complicated. There is a growing gap between those who create AI models—the engineers and researchers developing the foundational architectures—and those who design AI-powered products—the product managers, UX designers, and business strategists shaping how AI is integrated into real-world applications. In one session, the presenter asked the packed audience if any of them had ever built an AI agent themselves, seeing as agents were the subject of the 25-minute session. Not a single hand was raised. 

This audience may have been particularly bashful, but this was a clear indicator of the opaqueness that still surrounds the AI space. Everyone wants AI, but how many truly understand it—from the theory behind it to its actual development and proper usage? As no-code solutions become more common, this gap in practical knowledge will inevitably increase–and while this enables accessibility, another broadly beneficial aspect of the natural language abstraction, it also leaves room for oversights in development and usage. 

Another consequence of the growing opaqueness of AI products is the simultaneous demand for increased visibility. Many companies at the event showcased products aimed at improving clarity through visualization, while others acknowledged that this need for visibility was a pressing concern. In some cases, companies leveraged the black box nature of AI to their advantage, using its opacity to conceal underlying deficiencies – like when it came to product security.

## Insecurities 

Security is often a shocking afterthought in the development of many AI products despite [widespread overlapping security concerns across the industry](https://auth0.com/blog/the-rise-of-ai-agents-and-the-security-challenges-ahead/). Companies working with solutions involving RAG highlighted [Fine-Grained Authorization (FGA)](https://auth0.com/blog/streamline-your-authorization-workflow-with-auth0-fga/) and [Role-Based Access Control (RBAC)](https://auth0.com/docs/authorization/rbac) as key focuses, while others using AI agents to call APIs pointed to issues around [permissions and scope](https://auth0.com/blog/permissions-privileges-and-scopes/) as their most pressing security concerns. To address these challenges, companies took several different approaches.

### 1. Implementing FGA or RBAC Internally
This approach, which was the most commonly mentioned in ad-hoc interviews during the event, involves companies handling security frameworks themselves. While this can be an effective way to ensure that sensitive data is protected, it raises an important question: why continue reinventing the wheel? Much like AI tools often build on the same foundational models, it seems inefficient for every company to address the same security challenge individually when much of the industry will ultimately tackle it in similar ways. Standardized solutions could save time and resources and enhance overall security across the board.

### 2. Offloading Security to Customers
Some companies initially reduce their security overhead by offloading the responsibility to their customers. This might seem like an attractive strategy early in product development, as it enables faster go-to-market timelines. However, this approach is unlikely to scale in the long term. As AI products mature, customers expect products to include robust, built-in security features, not to carry the burden themselves. 

### 3. Implementing Guardrails to Limit AI Functionality
Another approach companies are taking involves creating restrictions on what AI can and cannot do. Some limit AI to read-only access or severely restrict its interaction with APIs. One company took the latter approach even further, disabling the AI’s ability to make API calls altogether. Instead, the AI would leave placeholders where API calls should be made, requiring a human to fill in the gaps. This “human-in-the-loop” method reflects a cautious approach to security, recognizing that while AI is powerful, there are still areas where human oversight is indispensable. It also underscores the ongoing debate around [AI autonomy](https://auth0.com/blog/secure-human-in-the-loop-interactions-for-ai-agents/)—how much trust can we place in an AI to perform tasks traditionally handled by humans? (Also, should AI developers be counted as legitimate attendees at developer conferences?)

### 4. Proceeding Without Considering Security
Finally, the most concerning approach—still alarmingly common—entails moving forward without proper security measures in place. As AI continues to be integrated into production environments, neglecting security becomes an even greater risk, particularly with the rise of malicious actors leveraging AI capabilities. Security is most effective when it’s built-in from the start, not added as an afterthought or band-aid to patch vulnerabilities later on.

## An Exciting Future 

So, AI has some issues, and so do we. The challenges we face today—trust issues, security concerns, and the need for transparency, along with others—are simply part of the process of building a long-term, reliable partnership with this incipient technology. DeveloperWeek 2025 highlighted the significant progress made in the span of just a few years but also underscored the importance of addressing these challenges as we move forward. As we refine our approach to AI development, it will be crucial to balance innovation with responsibility. 

Security, in particular, remains one of the most pressing concerns. As AI systems become more capable and deeply integrated into business operations, ensuring secure authentication and access control will be critical to preventing vulnerabilities. Products like Auth0 are already tackling this challenge, offering insights into securing Generative AI applications with stronger identity and authorization frameworks. AI security is something that is most effective built-in from the start, enabling developers and businesses alike to balance AI innovation with robust safeguards. 

> Explore how you can integrate robust AI security strategies with Auth0: [Auth for GenAI](https://auth0.com/blog/auth-for-genai/).

The future of AI holds tremendous promise, and with continued collaboration and thoughtful problem-solving, the potential for positive, transformative impact is within reach. 

## AI Resources

* [Building a Secure RAG with Python, LangChain, and OpenFGA](https://auth0.com/blog/building-a-secure-rag-with-python-langchain-and-openfga/)
* [Build a Secure RAG Agent Using LlamaIndex and Okta FGA on Node.js](https://auth0.com/blog/genai-llamaindex-js-fga/)
* [Identity Challenges for AI-Powered Applications](https://auth0.com/blog/identity-challenges-for-ai-powered-apps/)
* [Secure “Human in the Loop” Interactions for AI Agents](https://auth0.com/blog/secure-human-in-the-loop-interactions-for-ai-agents/)
* [The Rise of AI Agents and the Security Challenges Ahead](https://auth0.com/blog/the-rise-of-ai-agents-and-the-security-challenges-ahead/)

Developer Week 2025: Building a Long-Term Relationship with AI

In the ever-evolving world of application development, managing identity is no small feat. But with the right tools, you can streamline your security and user management like never before. In this recap, we’ll dive into the latest updates from Auth0, showcasing how we’re enhancing your development experience with new features, integrations, and updates that bring both simplicity and power to the forefront.

Let’s explore the key updates you’ll want to know about and see how they can help you streamline your identity management, bolster security, and deliver more powerful, user-centric applications.

## Updates You Don’t Want to Miss

![Auth0 Next.js SDK](https://images.ctfassets.net/23aumh6u8s0i/40qRm7ybg04Di2kdebAuQc/745efea8a558a7c7e8c51a6b9bb03326/auth0_nextjs_sdk.png)

### Next.js SDK v4 (GA) Released

If you’re a **Next.js** developer, this update will significantly enhance your workflow. With **Next.js SDK v4**, now fully compatible with **Next.js 15** and **React 19**, you can take advantage of cutting-edge features like:

* **Middleware-Based Authentication**: A streamlined approach that makes authentication management easier and reduces maintenance.
* **Improved Security**: Encrypted cookies replace outdated logic, bringing your app's security up to date.
* **Better Session Management**: Features like rolling sessions and custom database support ensure a smoother user experience.

> This update is designed to help you take full advantage of the latest web development advancements without sacrificing security or performance.

### Advanced Customizations for Universal Login (Early Access)

For customers who want to take their Universal Login experience to the next level, we’ve launched Advanced Customizations for Universal Login (ACUL) in Early Access. ACUL enables you to create fully custom, client-rendered versions of each Universal Login screen. With ACUL, you get full control over every pixel of the login and signup screens.

Supported flows include Single Step Signup/Login, ID First Signup/Login with various authentication methods (password, passwordless, passkeys, etc.), and more.

This is just the beginning, with more features and a new configuration UI coming in the months ahead. [Check out the online documentation](https://auth0.com/docs/customize/login-pages/advanced-customizations) for all the details, and start building today!

### Okta Universal Logout Integration Now Supported in Auth0

For teams using **Okta** to manage their workforce identity, we’re rolling out [Universal Logout](https://auth0.com/blog/okta-universal-logout-integration-now-supported-in-auth0/) integration with Auth0. This update means you no longer need to build a global token revocation endpoint. Instead, when Okta detects a change in risk, it will automatically revoke sessions and refresh tokens.

> It’s a simple **integration** with minimal configuration, but the **security** benefits are huge, making it easier for you to ensure your applications are always up-to-date and protected.

### Custom Token Exchange – Early Access

We’re thrilled to announce[ Custom Token Exchange](https://auth0.com/docs/custom-token-exchange-early-access) in Early Access. This OAuth grant-type feature allows you to exchange security tokens for other tokens, such as access tokens and offers flexibility using Actions for custom logic.

This new feature enables advanced use cases like:

* Migrating users to Auth0
* Integrating external IDPs
* Exchanging Auth0 tokens for different audiences

> **Custom Token Exchange** provides the flexibility you need to handle sophisticated integrations where regular federation and OIDC flows aren’t feasible.

### More cool features we have shipped to improve your experience: 

- **Optimised TOTP Enrollment for Mobile Devices:** We’ve made the process of enrolling in TOTP (Time-Based One-Time Password) on mobile devices more intuitive. Check out [**Auth0 Temporary OTP**](https://auth0.com/docs/secure/multi-factor-authentication/auth0-guardian#temporary-one-time-passwords) for more details!

- **Email OTP Verification – Email OTP(One Time Password) Verification:** is now Generally Available (GA), providing an additional layer of security during signup and password reset. This feature requires **Universal Login** and can be enabled by changing the **Verification Method** from Verification Link to OTP in your connection settings.

- **Usage Metrics Dashboard for Auth0 FGA:** We’re introducing the **Usage Metrics Dashboard** for **Auth0 Fine-Grained Authorization (FGA)**. This new tool gives teams deep visibility into their authorization usage, enabling more efficient monitoring and management of monthly active users, total number of tuples, and monthly average requests per second.

- **New Private Cloud Region in India:** We’ve expanded our Private Cloud availability by adding a new region in Hyderabad. This follows the Mumbai AWS region in India, providing additional flexibility, reduced latency, and improved data residency options for Auth0 customers in the region.

### Deprecations

**Node.js 12 and 16 Extensibility Runtimes Deprecation:** We’re phasing out the Node.js 12 and 16 runtimes for extensibility integrations, such as Actions, Rules, Hooks, Custom Database Connections, and Custom Social Connections. If you’re using these runtimes, we strongly recommend migrating to Node.js 22, which is our recommended runtime for all new and existing extensibility integrations.

**Unwarranted Session Removal After User Updates (Deprecated):** In a bid to improve the user experience, we’ve deprecated the automatic invalidation of user sessions when performing database connection user updates with unchanged email or `email_verified` attributes. This change will ensure that the session invalidation behavior aligns more closely with the email verification flows. 

## Community and Events

### Partnering with LangChain and LlamaIndex

As Generative AI (GenAI) applications become more powerful, securing these systems becomes essential. The "[Auth for GenAI](https://auth0.com/blog/auth-for-genai/)" initiative is here to help developers integrate strong authentication and authorization into their GenAI applications, ensuring sensitive data is protected when interacting with external APIs and data sources.

We’re thrilled to announce our partnerships with [LangChain](https://auth0.com/blog/building-a-secure-rag-with-python-langchain-and-openfga/) and [LlamaIndex](https://auth0.com/blog/genai-llamaindex-js-fga/)—two leading frameworks in the GenAI space. Together, we’re demonstrating how Auth0 can seamlessly integrate with these tools to secure your AI applications.

Key aspects of our collaboration include:

* **Framework-Specific SDKs** to simplify the integration of Auth0’s authentication and authorization solutions.
* **Informative Developer Content** that offers best practices, guides, and examples for secure GenAI app development.
* **Fine-Grained Access Control** using **Auth0 FGA (Fine-Grained Authorization)**, which ensures that AI applications can securely access external data sources and APIs.

This partnership is a great step toward building secure, scalable, and compliant AI applications. We’re excited to collaborate with **LangChain** and **LlamaIndex**, and provide developers with the tools and resources they need to build the next generation of secure AI-powered systems.

> Together, we’re building the future of secure **Generative AI**. Let’s innovate and secure the AI applications of tomorrow!

* [Building a Secure RAG with Python, LangChain, and OpenFGA](https://auth0.com/blog/building-a-secure-rag-with-python-langchain-and-openfga/)
* [Build a Secure RAG Agent Using LlamaIndex and Okta FGA on Node.js](https://auth0.com/blog/genai-llamaindex-js-fga/)

### Events

At Auth0, we’re passionate about engaging with the developer community and sharing insights at events worldwide. Whether we’re speaking at conferences, hosting workshops, or simply connecting with like-minded developers, we’re excited to be part of the conversations shaping the future of identity and security. Here’s a look at where we’ve been recently and where you can catch us next!

#### Where Were We?

In the past few weeks, we’ve had the privilege of attending some amazing events and meeting incredible developers:

* [JFokus](https://www.jfokus.se/talks/1839) – February 3-6
* [Developer Week](https://www.developerweek.com/) – February 11-13
* [DevWorld Amsterdam](https://devworldconference.com/) – February 27-28

![Events](https://images.ctfassets.net/23aumh6u8s0i/4t1GBeVZ6OXdhXZ2CFbTHs/d1ef9abcb6f96fdaa98143c6890623e0/events2025.jpg)

It’s been a blast connecting with the community, and if you joined us at any of these events, we hope you had a chance to chat with the team and explore what’s new with Auth0.

Looking ahead, we’ve got a busy schedule and can’t wait to meet more of you at these upcoming events:

* [All Things Open AI](https://allthingsopen.ai/) – March 17-18
* [Tech.eu Summit](https://tech.eu/event/2025/summit-london/) – March 25-26

Make sure to swing by our booth if you’ll be at any of these events, we’d love to talk all things identity, security, and the future of AI-powered applications!

That’s all for this month! We’re committed to keeping you updated with the latest and greatest features to help you build secure, scalable applications. Stay tuned for more in March!


February 2025 Updates: What's New in Auth0

Abbie Carlson

As a Product Marketing Manager, I'm responsible for communicating the value of Identity for consumer apps as well as focusing on the developer experience. I'm forever curious about how Identity plays a role in our everyday lives as consumers and how a great Customer Identity solution can make or break a business through patron loyalty and retention. 

Outside of work can catch me watching Seattle sports, going to as many concerts as I can or listening to true crime podcasts.

Senior Product Marketing Manager

Keep scrolling to learn more about our newest releases, updates, and all things developer.

As builders and developers, you know how quickly the Identity landscape can change and pivot. And here at Auth0, we’re right there with you. To be in the loop, you gotta always be two steps ahead.

You’re shaping the future of Identity as you build and scale your app. You’re adding to open-source projects to support the wider good. And you’re learning as you go and adopting new standards to stay on top of it all.

With that, we want to share some new and updated releases that can help you continue to grow, support, and learn in this ever-changing Identity world.

[**Auth0 Plans Just Got an Upgrade**](https://auth0.com/blog/auth0-plans-got-an-upgrade/) 🎉 Auth0’s vision is to free any consumer or SaaS application user to safely use any technology. This means giving developers the products that help make building, deploying, and scaling applications easy. In the last few years, we’ve added more capabilities that allow developers to battle malicious attacks and attackers.

We’re happy to bring you more on our Free, Essential, Professional, and Enterprise Plans. A few highlights to mention- the Free Plan now includes 25,000 MAUs and a Custom Domain. 10 Organizations are now available on our B2C Plans and Unlimited[^1] Organizations on our B2B Plans as well as increased MFA offerings so you can mitigate the growing threat of AI-based attacks.

![Free plan](https://images.ctfassets.net/23aumh6u8s0i/sFytL92hG7PJErfIvOoJc/c6facc7de0415a1b8db32b206809b457/Uploaded_from_Staying_up_to_date_in_Identity__Auth0_s_Q3_Developer_Releases)

_These are just our Free Plan updates. Take a look at our [blog](https://auth0.com/blog/auth0-plans-got-an-upgrade/) to learn more about the plan changes._

[**Forms**](https://auth0.com/docs/customize/forms) ✨ Frictionless sign-up and login experiences are crucial for winning over customers and staying competitive. Today's businesses need tools that support efficient and secure operations but also help drive customer retention and growth, adapt to unique security needs, and unify and activate data across multiple apps and systems.

Forms enables developers and UX teams to streamline orchestration and create custom Identity flows tailored to their company's needs. This flexibility helps you build a more seamless user experience.

![Dashboard > Actions > Forms](https://images.ctfassets.net/23aumh6u8s0i/58pMHDbyfqe0thBPLzu4ij/5a4ac70a7a9be3d280b9dc4945158061/Uploaded_from_Staying_up_to_date_in_Identity__Auth0_s_Q3_Developer_Releases)

**What’s Next? Auth for GenAI** 🤖 Auth for GenAI is a series of features that allows you to confirm that your AI agents have the right and least privileged access to sensitive information. In addition, Auth for GenAI can call APIs securely on behalf of users to integrate with other apps and is capable of securely implementing on-demand user authentication when background or async AI agents need user confirmation for actions.

![auth0.ai](https://images.ctfassets.net/23aumh6u8s0i/FumWILM0KMtXGUdXuZxYw/0cc2ccf921997f0f0d3802f3dfdd8dd0/Uploaded_from_Staying_up_to_date_in_Identity__Auth0_s_Q3_Developer_Releases)

Interested? Join our waitlist [here](http://auth0.ai/) to be the first to find out when these features become available.

We hope that these product updates and releases support you in this ever-changing world of Identity and security. If you’d like to learn more about our other updates and releases (we’ve got a lot more to tell you about), take a look at our [Developer Releases Guide](https://www.okta.com/resources/datasheet-developer-releases-auth0-by-okta-q3-2024/). And if you’d like to dive even deeper, please check out our combined [Customer Identity and Workforce Identity Release Guide](https://www.okta.com/resources/product-release-overview-q3-2024-wic-cic/).

Outside of all these release updates, take a look at our developer resources at [www.developer.auth0.com](http://www.developer.auth0.com/).

[^1] : _subject to system limitations_

Staying up to date in Identity… Auth0’s Q3 Developer Releases

Being creative, finding solutions, and always looking to evolve. To me, that’s what encompasses a true developer. And maybe I’m living in Camelot, but honestly- what would apps be without the dev? (literally, we wouldn’t have any).

**Auth0 by Okta** understands that you, the developer, are here to, well, develop. 

And all that we can do is support you in your journey. Whether that’s at your 9-5  (more likely your 4-midnight) or on the weekends building your hobby app.

So with that, we want to share some new and updated products that can help solve your problems around all things Identity. 

## Highly Regulated Identity General Availability

**[Highly Regulated Identity General Availability](https://auth0.com/docs/secure/highly-regulated-identity)**. This Financial Grade Identity ™ solution suite delivers elevated security, privacy, and UX controls for sensitive customer operations beyond login— such as updating account information, accessing sensitive data, sending money, or making an open banking payment. Enable financial grade API protections, step-up security and consent. 

![Highly Regulated Identity General Availability](https://images.ctfassets.net/23aumh6u8s0i/7eRSbWJjEVlxClg7D8DdTM/8d675fdef576d67efbd56f6a9493e785/Uploaded_from_Coming_in_Hot__Auth0_s_Q2_Developer_Releases)
_Highly Regulated Identity Phase 1_

## Forms for Actions EA

**[Forms for Actions EA](https://auth0.com/docs/customize/forms)**. This feature provides a new visual editor for customers to build custom forms to extend login and signup flows within their tenant’s domain. This gives our customers better control over user experience and additional flexible building blocks. 

![Dashboard > Actions > Forms](https://images.ctfassets.net/23aumh6u8s0i/3DTIQSawDVsEGJhHIRJ4Gg/55df24a93d55e784fa0f01ee1e7ae14b/Uploaded_from_Coming_in_Hot__Auth0_s_Q2_Developer_Releases)

## Flexible Identifiers

**[Flexible Identifiers](https://auth0.com/docs/authenticate/database-connections/flexible-identifiers-and-attributes)**. Now, in EA... keep an eye out for GA (coming soon) This feature allows the use of multiple attributes such as email, phone number, and username as unique identifiers, either individually or in combination, to authenticate users. Including the option to configure Phone Number as a Sole Identifier.

![Flexible Identifiers](https://images.ctfassets.net/23aumh6u8s0i/SsqfcCZArhGlfn4vGMVul/39cc10bfa6e3e0cd6914d8c5ba0fea0a/Uploaded_from_Coming_in_Hot__Auth0_s_Q2_Developer_Releases)

We truly hope that these product updates and releases can help you continue to create, build, and solve problems- whether it’s a work or personal project. If you’d like to learn more about our other updates and releases (we’ve got a whole lot more to tell you about), take a look at our [Developer Release Guide](https://www.okta.com/resources/datasheet-developer-releases-auth0-by-okta-q2-2024/). And if you’d like to dive even deeper, please check out our combined [Customer Identity and Workforce Identity Release pdf](https://www.okta.com/resources/product-release-overview-q2-2024-wic-cic/). 

Outside of all these release updates, take a look at our developer resources at [**developer.auth0.com**](http://www.developer.auth0.com/).

Coming in Hot… Auth0’s Q2 Developer Releases

andrea-chiarelli

I have over 20 years of experience as a software engineer and technical author. Throughout my career, I've used several programming languages and technologies for the projects I was involved in, ranging from C# to JavaScript, ASP.NET to Node.js, Angular to React, SOAP to REST APIs, etc.

In the last few years, I've been focusing on simplifying the developer experience with Identity and related topics, especially in the .NET ecosystem.

Principal Developer Advocate

Andrea Chiarelli

Should developers know Identity protocols like OIDC and OAuth, or should they only rely on high-level abstractions like SDKs?

Do developers need to understand the underlying details of OpenID Connect, OAuth, and other standards to implement authentication and authorization? Maybe yes, maybe no. Let’s explore some different points of view.

## The Hard Journey to Identity

Sooner or later, a developer will have to deal with authentication and authorization, whether they are building a SPA, an API, a mobile app, or a microservice, whether they are using Java, C#, JavaScript, or other programming languages.

Some will probably try to implement a homemade solution because it is, after all, a simple login box 😱. And after overcoming the hurdle of username and password authentication, they face the burden of [single sign-on](https://auth0.com/docs/authenticate/single-sign-on), delegated authorization, [Multi-Factor Authentication](https://auth0.com/docs/secure/multi-factor-authentication), and so on. Perhaps just by trying to build a homemade solution, they will understand the complexity of the problem and look for proven solutions.

As they learn about standards such as [SAML](https://auth0.com/blog/how-saml-authentication-works/), [OIDC](https://auth0.com/docs/authenticate/protocols/openid-connect-protocol), [OAuth](https://auth0.com/docs/authenticate/protocols/oauth), [WebAuthn](https://auth0.com/docs/secure/multi-factor-authentication/fido-authentication-with-webauthn), etc., they will probably realize that they have tried to reinvent the wheel. And most likely, they have not considered scenarios that could compromise the security of their application.

But even if you look at these standards from a high level, you will realize that there are many facets, many different scenarios to consider, several details and nuances.

In summary, sooner or later, developers will learn that Identity management is hard.

## To Know or to Ignore? That Is the Question

Once they understand that following standards is the high road to managing the identity of their application users, developers are at a crossroads:

1. Understand and implement the details of these standards.
2. Use a library or SDK and completely ignore the underlying complexity.

The two options seem divergent: know the details or ignore them altogether. Perhaps they reflect the two approaches that developers can take to deal with standards, not just in the Identity space. The choice may depend on the developer's inclination but also on other factors, such as competencies, available time and budget, and so on.

### Developers don't care...

[Someone has argued](https://developer.okta.com/blog/2019/01/23/nobody-cares-about-oauth-or-openid-connect) that "*99.99% of developers out there don’t know (or want to know) anything about OAuth, OIDC, or any other security specifications. All they want to do is find the simplest and most straightforward way to support user authentication and authorization in their application. They don’t care about standards, specifications, grant types, JWTs, or scopes and timeouts – all they want to do is log a user in and check to see what permissions they have.*"

That's pretty understandable. As a developer, I want to solve my problem as quickly as possible without getting lost in the details. If I'm developing an e-commerce application, I want to focus on the business logic of my application. I don't want to worry about every technical detail that my application relies on. I don't want to know the little internal details of the framework my application runs on, the necessary compilation steps, or the network infrastructure that it will use. I prefer to use tools that take care of that and abstract the internal behavior. Tools that are accurately built by real experts in their field. After all, that is what we at Auth0 are trying to do: take care of the complexity of Identity and free developers from knowing the details of standards and security issues.

### ...developers do care

On the other hand, there are [those who argue](https://www.scottbrady91.com/oauth/why-developers-do-care-about-oauth-and-openid-connect) that "*there is an appetite from developers to learn more about OAuth and OpenID Connect and how to use them effectively. So maybe it’s a little too much to state that developers don’t care.*"

Well, in my experience, that is also true. I've found a lot of developers trying to understand how to properly use an [access token](https://auth0.com/docs/secure/tokens/access-tokens) and which [OAuth flow](https://auth0.com/docs/get-started/authentication-and-authorization-flow/which-oauth-2-0-flow-should-i-use) to use in a given scenario, even if they're using a third-party library. And I think that's pretty understandable as well. While I don't want to learn every little detail of the infrastructure my application will run on, I can't ignore it completely. Some features of my application might depend on it to work well.

So, what is the right choice to make when dealing with standards in the Identity management space (and also in other areas)? Know their details or ignore them?

<include src="ebook-ads/JwtHandbook" />

## The Third Way

“[Zen and the Art of Motorcycle Maintenance](https://en.wikipedia.org/wiki/Zen_and_the_Art_of_Motorcycle_Maintenance)” is one of the cult books of the 1970s. It is a kind of philosophical novel in which the author, [Robert M. Pirsig](https://en.wikipedia.org/wiki/Robert_M._Pirsig), explores the concept of quality by interweaving it with his almost-fictional biography and his passion for motorcycles.

### Two types of developers

In one of the book's disquisitions, the main character divides humanity into two types:

- Those who see the world as a complex mechanism to be explored in its inner workings (*classical understanding*).
- Those who see the world primarily in its superficial appearances (*romantic understanding*).

Romantic people are those who ride their motorcycles without worrying about how they work. They are not interested in the mechanics of the drivetrain or the ignition or the lubrication system. If their motorcycle breaks down, they take it to the mechanic. And they hardly hear in advance that something is going to break down.

Classical people are those who feel their motorcycle. When they ride it, they hear every little noise, they imagine the movement of the chain, they are one with their means of transportation. They feel when something is about to go wrong because they know every little part of their bike and prefer to fix it themselves.

These two categories of people also apply to developers, in my opinion. Romantic developers don't care about the underlying technology or standard. They want to use a library that simplifies their lives and gets right to the point. Classical developers, on the other hand, want to know what happens inside a library: what technology, standard, and algorithm it uses. Classical developers are the traditional hackers, the ones who get their hands dirty with grease to fix or customize the engine of their motorcycle.

Maybe the choice between the two options for dealing with Identity management is driven by these two developer personalities. And perhaps each of you can identify with one of these two profiles.

<include src="BigQuote" quoteText="Although motorcycle riding is romantic, motorcycle maintenance is purely classic." quoteAuthor="R. M. Pirsig" />

### In medio stat virtus

Starting from a *classical* position, the protagonist realizes that virtue lies in the middle, just as the Latins used to say (*in medio stat virtus*). And virtue, excellence, quality is what he is looking for: what the ancient Greeks called *areté* and Eastern cultures call *Dharma*.

While each developer tends to use a romantic or classical approach to the Identity management problem, based on their personal nature, I think that each of the two positions should only be a starting point.

If Identity management is not your business, it is not cost-effective to implement standards from scratch and take care of all the details. Standards evolve, as do scenarios, best practices, etc. If your core business is not Identity management, implementing OIDC, OAuth, and the other standards may be too expensive and risky for your project.

On the other hand, simply using a library or SDK and ignoring what lies beneath it cannot last long. It can be frustrating when problems occur and you have no idea what is going on. You don't know if the problem depends on your code, your configuration, your library, the environment your application is running in. Understanding at least at a high level how the library you are using works and what standards it uses can help you at least to narrow down the area of investigation when problems occur.

In summary, I think every developer has their own starting point for dealing with problems. But whether you decide to do everything yourself based on standards or prefer to ignore everything under a library, in either case, it will impact the cost of your application.

I think the best solution is to get a medium level of expertise in technologies and standards so that you can at least choose your library with knowledge. What do we call this type of developer? The *pragmatic developer*?

<include src="SignupCTA" text="Try out Auth0 authentication for free." linkText="Get started →" />

## What Auth0 Offers

Whether you are a romantic or classical developer, Auth0 helps you integrate authentication and authorization into your applications by letting you use the approach you prefer.

You have [SDKs and libraries](https://auth0.com/docs/libraries) that abstract the complexity of Identity management, but you are not locked into using our libraries. Your choice is free. But you can look into [our code](https://github.com/auth0) and contribute.

You also have [documentation on standards](https://auth0.com/docs/authenticate/protocols), [guides](https://developer.auth0.com/resources/guides) specific to your favorite framework, [code samples](https://developer.auth0.com/resources/code-samples), [videos](https://www.youtube.com/oktadev), and a [community](https://community.auth0.com/) to share what you've learned.

You can choose your preferred path to becoming a *pragmatic* developer by taking advantage of the resources Auth0 provides.

What kind of developer are you? Are you romantic or classical? Are you aiming to become a pragmatic developer? How can we help you? Leave your comments below.

Zen and the Art of Identity Management

Damian Schenkelman

Damian was one of Auth0's earliest employees. He loves building products for developers and taking things from 0 to 1.
 
He played key roles in implementing product features and growing the engineering organization in the early stages, and later on defining Auth0's architecture for scale and creating new products. Today he helps shape Auth0's long term strategy and leads Auth0Lab, a small and amazing team doing research and development of forward-looking products.
 
He spends his spare time with family, and friends, exercising, and catching up on all things NBA.

VP R&D (Auth0Lab)

We are excited to announce the Developer Community Preview for Auth0 Fine Grained Authorization (FGA), our upcoming SaaS to solve authorization-at-scale for developers.

## What Is Fine Grained Authorization?

[Authentication is about who the user is. Authorization is about what they can do.](https://auth0.com/intro-to-iam/authentication-vs-authorization/)

Historically, software applications have, in general, handled [authorization](https://auth0.com/intro-to-iam/what-is-authorization/) in a coarse grained manner. A user has one or more roles in an application, which grants them permissions to perform certain actions across the application. This worked well for a while because users didn't create content in systems. As social and work collaboration applications become mainstream, a different kind of authorization became necessary: fine grained authorization.

An application implements fine grained authorization when it can determine a user's permission to perform actions on any object in the application, and users can create objects in the application and manage permissions to those objects.

This is "fine grained" because there is no lower limit to the granularity at which builders of the system can make authorization decisions. It is up to the builders of the system to determine how granular they want authorization to be, and up to the users of the system to determine who has specific permissions on objects.

## Why Is Fine Grained Authorization Important?

Fine grained authorization is increasingly becoming a critical element in software. For example:

* **Collaboration and social** features are things users expect, such as the ‘Share’ button you see in so many applications. This applies to both business-related assets, such as documents and project boards, and personal assets like pictures and home IoT devices. Specifically sharing one of these objects with another user is a Fine Grained Authorization use case.
* **Security, compliance, and privacy** are musts for any software application from day 1, and authorization is a big part of solving those concerns. In fact, the [TOP OWASP 2021 risk is broken access control](https://owasp.org/Top10/).

However, solving authorization in an application is not a trivial matter. We believe applications solve authorization correctly if their authorization solution has the following characteristics:

1. **Reviewable:** It should be easy to determine "who can access what," essentially understand the rules used to enforce access control.
2. **Easy to manage change:** Authorization related changes must be explicit and traceable. Change management control for authorization is important.
3. **Auditable:** It should be possible to know what happened with regards to authorization, in essence "who tried to access what, and when?".
4. **Reliable:** Authorization decisions are made as part of most flows/requests, so authorization components need to always be running and returning the expected results.
5. **Fast:** Authorization decisions are made as part of most flows/requests, so they need to be fast. If authorization decisions are slow, then the end-user experience is slow as a whole.

Implementing all of the above is complex, even with expertise. So we looked at how we could solve authorization for our customers, and allow them to focus on their core business. This is what led us to create **Auth0 Fine Grained Authorization.**

## What Is Auth0 Fine Grained Authorization?

Auth0 Fine Grained Authorization (FGA) is a SaaS to solve **fine grained authorization at scale for developers**. It is inspired by [Google Zanzibar](http://zanzibar.academy), the [system Google uses to solve authorization](https://auth0.com/blog/auth0-introduces-zanzibar-academy/) across all their products, such as Google Drive, Youtube, Google Cloud, and others.

Auth0 FGA does not require you to be using Auth0 already. You can use Auth0 FGA with any identity provider: your own user database (e.g. MySQL, PostgreSQL), Auth0, Okta or anything else.

Auth0 FGA centralizes your authorization. It becomes your "authorization (micro)service" if you will. It's a single place for you to define your authorization model, store your authorization data and make your authorization decisions, across all your apps and products.

Centralizing your authorization logic and decisions into a single service that has the flexibility to handle use cases across your different products gives you distinct advantages:

* **Simplify security auditing:** Explicit authorization rules are easier to audit by internal and external parties.
* **Lower costs:** Standardizing how authorization is done across your company makes it easier for developers to switch teams.
* **Deliver faster:** You’ll be able to ship features and products faster, as the system is easily extensible to new requirements.
* **Security logging:** The Auth0 FGA service generates logs for all operations out-of-the-box, both reads and writes.
* **Empower your users:** Allow users to take control of granting access to their data directly in your application.
* **Fast and reliable at scale:** A centralized service dedicated to fine grained authorization should scale as your business and products grow. Since Auth0 FGA specializes in fine grained authorization and nothing else, it can be particularly optimized for access control patterns and use cases, improving the latency and reliability of your authorization approach.

 
Auth0 FGA supports granting access at an atomic object level in any system, easily enabling collaboration between users, going far beyond typical role-based access control (RBAC). It also supports building custom roles into any system, empowering your customers to define how to manage access. Auditing capabilities provide fundamental building blocks for security and compliance teams. The more we’ve spoken to customers about it, the more we’ve learned just how many use cases it can solve for.

![Auth0 FGA](https://images.ctfassets.net/23aumh6u8s0i/21LaMJQrrDSNHmIEP2oWhO/17fd5e2a825a937590557973d59678b3/Uploaded_from_Auth0_Fine_Grained_Authorization__Developer_Community_Preview_Release)

Organizations like [AirBNB](https://medium.com/airbnb-engineering/himeji-a-scalable-centralized-system-for-authorization-at-airbnb-341664924574) and [Carta](https://medium.com/building-carta/authz-cartas-highly-scalable-permissions-system-782a7f2c840f) have built [Zanzibar-like](https://zanzibar.academy/) systems to solve their authorization needs. We don’t think organizations should build the same authorization tooling, again and again, so we set out to build one version everyone can use. We developed Auth0 FGA as a service so you don't have to.

## How Do I Get Started?

To start using Auth0 FGA you need to do three things:

1. Define your authorization model ([docs](https://docs.fga.dev/modeling))
2. Write authorization data from your system to Auth0 FGA ([docs](https://docs.fga.dev/writing-data))
3. Add authorization to your API by adding access control checks to your system ([docs](https://docs.fga.dev/integration))


<div class="alert alert-info alert-icon">
 
 Note: 
 The Developer Community Preview is meant to help us learn how customers use the product. If you have feedback, reach out on our <a href="https://discord.gg/6jsgXhVBu6">Community Discord</a>. 
</div>

From that point on, all authorization decisions are centralized and made by Auth0 FGA. You can think of it as your "authorization microservice."

![Auth0 FGA](https://images.ctfassets.net/23aumh6u8s0i/tROyM1vl5FzzqImS1xjNU/d6a4a8f07e6aca48aed81f4aafadd821/Uploaded_from_Auth0_Fine_Grained_Authorization__Developer_Community_Preview_Release)

### A brief example

Let's say you were to start from a Node.js API to manage projects. That API doesn't have authorization capabilities yet, but it does have authentication.

You have an endpoint that would return a particular project given its project ID. In that endpoint, you might have code like the one from the following snippet. The second line verifies the [JSON Web Token](https://jwt.io/) (JWT) sent as part of the request to perform [authentication](https://auth0.com/intro-to-iam/what-is-authentication/), using [express-jwt](https://www.npmjs.com/package/express-jwt).

```js
app.get('/project/:id',
 jwt({ secret: PUBLIC_KEY, algorithms: ['RS256'] }),
 // authorize access
 async function(req, res, next) {
 // your business logic
 }
);
```

Now we want to add [authorization](https://auth0.com/docs/authorization) so only users that can **read** a project can call this endpoint.

First, we would install and setup the Auth0 Fine Grained Authorization Node.js SDK. You would need to obtain some data from your Auth0 Fine Grained Authorization account, and follow [these steps](https://docs.fga.dev/integration/getting-your-api-keys) to get it.

```js
const { Auth0FgaApi } = require('@auth0/fga');

const auth0Fga = new Auth0FgaApi({
 environment: AUTH0_FGA_ENVIRONMENT,
 storeId: AUTH0_FGA_STORE_ID,
 clientId: AUTH0_FGA_CLIENT_ID,
 clientSecret: AUTH0_FGA_CLIENT_SECRET,
});

...

app.get('/project/:id',
 jwt({ secret: PUBLIC_KEY, algorithms: ['RS256'] }),
 function(req, res) {
 // your business logic
 }
);
```


You would then add a new middleware that calls Auth0 Fine Grained Authorization to perform authorization on every request, after authentication has taken place. You know who the user is (authentication), now you want to check what they can do (authorization):

```js
app.get('/project/:id',
 jwt({ secret: PUBLIC_KEY, algorithms: ['RS256'] }),
 async function(req, res, next) {
 try {
 const result = await auth0Fga.check({
 tuple_key: {
 user: req.user.sub,
 relation: 'read',
 object: `project:${req.params.id}`,
 },
 });

 if (!result || !result.allowed) {
 return res.status(403)
 	.send({ code: 'missing_permissions', message: `ForbiddenError: Not allowed to access object ${req.params.id}` });
 }

 next();
 } catch (err) {
 // handle error
 return next(err);
 }
 },
 function(req, res) {
 // your business logic
 }
);
```

The key part of the new middleware is this one, where we call the Auth0 Fine Grained Authorization API:

```js
const result = await auth0Fga.check({
 tuple_key: {
 user: req.user.sub,
 relation: "read",
 object: `project:${req.params.id}`,
 },
});
```

We are conceptually asking the question **"can the {user} read project:{id}"?**:

* The **user** identifier is obtained from the JWT [sub (subject) claim](https://datatracker.ietf.org/doc/html/rfc7519#section-4.1.2), as the JWT validation middleware sets all claims for the JWT in the **req.user** object as properties. Whatever your existing authentication method is, you can easily integrate it with Auth0 FGA.
* The **relation** is "read" because the endpoint is a **GET**, it allows the caller to "**read"** one project. For **PUT** or **PATCH** you would use **"write"**.
* The **object** is made up of the object type (project) and the project ID. The **object** **ID** comes from the request parameters (the path). A full URL for the request might be GET {API\_URL}/projects/1234, so the **object** would be **project:1234**.

You can learn about **CHECK** requests in depth [here](https://docs.fga.dev/intro/auth0-fga-concepts#what-is-a-check-request).

The previous example is intentionally verbose to show you the inner workings of things. You can imagine having SDKs for any web framework, API Gateway, and even policy languages that easily allow you to configure authorization per endpoint. For example:

```js
app.get('/projects/:id',
 jwt({ secret: PUBLIC_KEY, algorithms: ['RS256'] }),
 authorize(req => ({
 user: req.user.sub,
 relation: 'read',
 object: `project:${req.params.id}`
 })),
 function(req, res) {
 // your business logic
 }
);
```

## What's in the Developer Community Preview?

The Auth0 FGA Developer Community Preview is completely free and includes the features below. This is a chance for you and your teams to try the product out, assess how you'd integrate it with your apps, and give us your feedback.


<div class="alert alert-info alert-icon">
 
 Note: 
 The rate limits in the API are intentionally set low and there are no SLAs, as the Developer Community Preview is meant to help us learn how customers use the product. For additional inquires, please reach out on the <a href="https://discord.gg/6jsgXhVBu6">Community Discord</a>. 
</div>

### Management dashboard

The management dashboard ([https://dashboard.fga.dev/](https://dashboard.fga.dev/)) allows you to create an account and a store. You can use the dashboard to define your authorization model, write authorization data, and perform authorization checks.

![Management dashboard](https://images.ctfassets.net/23aumh6u8s0i/3BFXmCWtMBx8Bqtrrj2sh0/91674dba44c3c779518b3421a2f16df1/02.jpg)

### Documentation

We have written extensive documentation ([https://docs.fga.dev/](https://docs.fga.dev/)) to help you learn the main concepts, get started, and explore advanced use cases.

![Documentation](https://images.ctfassets.net/23aumh6u8s0i/7wFQjqES9oqiEXTYOpshM1/aa3e08e49cdb20a80d6b24b9ca2639b0/01.jpg)

### HTTP API and SDKs

Auth0 FGA is a product built for developers. We’ve created an API for developers to integrate Auth0 FGA into their systems. Everything you can do with the dashboard you can also do with the API.

At launch, we are shipping with SDKs for [Javascript](https://github.com/auth0-lab/fga-js-sdk) and [Golang](https://github.com/auth0-lab/fga-go-sdk). If you'd like an SDK for another language let us know in [Discord](https://discord.gg/6jsgXhVBu6). We can easily generate it from our OpenAPI definitions.

![Auth0 FGA](https://images.ctfassets.net/23aumh6u8s0i/5Tdtrh6uySJPvMPsH2ms6/54517d4f5b1749909bce5f32c529a806/03.jpg)

## What's Next?

We are excited about the capabilities that Auth0 FGA will unlock for our customers. We want to make sure our roadmap items are driven by customer feedback and input. So if you’re interested in the product, please let us know your thoughts by joining our Auth0 Lab community [here](https://discord.gg/6jsgXhVBu6).

We are also looking forward to the future, especially the "better together" use cases that Auth0 Fine Grained Authorization will enable for both Auth0 and Okta customers.

We hope you'll join us on this journey and are eager to hear your thoughts on what we’ve built so far.

Take a look, try it out at [https://auth0.com/developers/lab/fine-grained-authorization](https://auth0.com/developers/lab/fine-grained-authorization), and let's learn together!

Auth0 Fine Grained Authorization: Developer Community Preview Release

william_johnson

Will Johnson is a Developer Advocate at Auth0. He loves teaching topics in a digestible way to empower more developers. He writes blog posts, records screencasts, and writes eBooks to help developers. He's also an instructor on <a target='_blank' rel='noopener noreferrer' href='https://egghead.io'>egghead.io</a>.

Developer Advocate

Will Johnson

Meet Will Johnson, part of the developer relations team at Auth0.

Hi! My name is Will Johnson, and I'm going to tell you the story of how I ended up in the Developer Relations world.
One thing I've learned is that where you begin does not guarantee where you will end. It's been an ever-changing path for me, but it's never too late to take control and direct your path.

## My Interest In Computers Is Sparked

I remember sitting in my 3rd-grade class: all the kids were quiet, but you could feel the excitement in the air. Something new was coming: our desks were lined around the walls of the room. At first, everyone faced the middle of the class. Then, the doors opened, everyone looked anxiously, waiting for what was to come through.

One by one, the computer lab team rolled in brand new colored iMacs! The class went wild! Before this, we had blocky computers with green and black UI's. They were huge, slow, and boring. The iMacs were cool, colorful, and small. Something completely new!

That sparked my interest in computers. I always wanted to be on the computer and do things on it. I remember telling my teachers I want to tell computers what to do. I had no idea what that meant, and usually, they would direct me to learn the hardware part of computers. But I had no interest in that. The programs were what caught my attention.

## Writing My First Lines of Code

Growing up, we never had a computer at home. I would only use the ones at school during lab time. I got my own computer right around the time the social media site MySpace was getting popular. One of the cool features was using HTML and CSS (even JavaScript, which I later learned) to customize my page. I spent hours googling different layouts and animations I could add to my page. (Yes, I used the `<marquee>` tag all over the place). Then I started doing my friends' pages. I enjoyed playing around with the code so much. I didn't even know you could use HTML and CSS to make real websites; I thought only MySpace used them. I would just search "how to make moving text myspace" without realizing I was using HTML and CSS at that time.

After MySpace lost its popularity, I stopped customizing pages. At that time, I was unaware that I had a valuable skill that aligned with my interests. I started planning what I would do for work, so I looked into the local college programs. They were all IT; no computer programming, computer science, or anything that would let me "tell computers what to do." Since I didn't want to go into a bunch of debt for something I wasn't sure was my thing, I put my tech dreams on hold.

## Getting Over My Fears

When working at my day jobs, I would still do random tech things on the side. Like taking broken cell phones and replacing the parts, so they looked like new. Once, I had a Windows smartphone that I modded to run Android. I think I even used Java for that, some instructions were quite tricky, but I enjoyed the process of learning and kept going. I would search Google or YouTube and try stuff, and because of that, I've broken and bricked plenty of phones, but I was always having fun.

Around this time, I started to hear more and more about making apps and coding. Every time computer programming came up, people said: "You have to be good at math or coding on a computer since you are young." Neither of those was me, so it made me stop pursuing any further. People always made it seem like working with computers was really hard, and you had to be a super genius or something like that.

After being fed up with manual labor jobs, I decided to change careers and try different things. Then one day, I came across a forum post where everyone was buying online courses. In particular, I noticed that everyone was buying a specific course on web development. I spent $10 and purchased that course. I was skeptical if this was legit or not. Could I get a job just by learning online? I was willing to give it a shot. I mean, it was only $10.

As soon as I started learning, I began to recognize the syntax. "Yo! This is the stuff from MySpace that I learned a long time ago. I've already done this."

## Breaking Into Tech

Learning to code and breaking into tech involved reading lots of blogs, watching videos, and listening to podcasts. I was so thankful that developers took time out of their day to create content to help other developers. So I started doing the same: I wrote blog posts, recorded screencasts, volunteered to mentor for workshops, spoke at meetups, and hosted a podcast. I would also tweet what I was learning and help others on Twitter as well. Every time I helped another dev get unstuck, it felt really good.

All of this content and community work was very fulfilling. I was learning new things and helping people reach new levels in their careers.
At that time, I started to see the role of Developer Advocate pop up a lot. I didn't quite understand it at first, but it aligned with me more as I learned more about it. I liked tinkering with code and showing others how to do the same. Then people started to tell me all the time, "You should get into Developer Relations" or "You'd be a great developer advocate."

It took me some time and a lot of thinking, and then it clicked: I love the tech community! I've met a lot of incredible people, and I love helping them learn new things so they can crush their goals. It's a great joy for me.

I like to be remembered as a person that tried his best to help people in any way I could. That's why, in August 2021, I joined the Auth0 developer relations team. Their vision of empowering developers aligns with mine perfectly. That's why I look forward to creating content that humanizes the technical jargon and helps developers with their daily work.

So, this is my story of how I ended up fulfilling my early dream. Even if you are not working on something that energizes you, it is never too late to pivot to what you are passionate about. Don't get discouraged, and keep pursuing your dreams.

Getting To Know Will Johnson, Developer Advocate @ Auth0

jess-author

Jessica Temporal is a Senior Developer Advocate at Auth0 and co-founder of the first Brazilian data science podcast called <a target='_blank' href='https://pizzadedados.com'>Pizza de Dados</a>. She’s the author of <a target='_blank' href='https://www.amazon.com/dp/B0CDNX6NS7/ref=sr_1_1?&_encoding=UTF8&tag=jesstempora0e-20&linkCode=ur2&linkId=efc4229f6b816609dfce4f185781d99a&camp=1789&creative=9325' >The Big Git Microbook</a>, creator of <a target='_blank' href='https://gitfichas.com/en'>GitFichas.com</a>, and a part of <a target='_blank' href='https://www.linkedin.com/learning/instructors/jessica-temporal'>LinkedIn Learning</a> instructors team. Jessica helped develop the AI that identifies possible unlawful expenses from Brazilian politicians. She is part of the PyLadies initiative that works to improve diversity and inclusion in technology. In her free time, she likes to knit, play video games, use her 3D printer, and is learning to create 3D models.

Sr. Developer Advocate

Jessica Temporal

Meet Jess Temporal, part of the developer relations team at Auth0.

I believe everybody has had an "aha moment" in their lifetime. I want to tell you about 2 of those moments for me. 

I also believe people mistake aha moments as something that happens out of nowhere, but when in reality, at least for me, those happen after much work.

Something just clicks, and things start falling into place.
Before I can tell you about my aha moments, you need to know me a little bit.

![Jess](https://images.ctfassets.net/23aumh6u8s0i/14GjmDRXdB7PmC6Ybt0idS/20b844d787d91a2c8e29dc7bf0c93176/jess-cover-image.JPG)

## Chapter 1: What I Want to Be When I Grow Up

I never said I wanted to be a computer scientist, even though I could tear apart a whole computer and build it back together by the time I was 15. I also used to say I wanted to be a doctor. I know, go figure. And when it came time for me to get into college, medicine didn't seem that appealing anymore.

After failing my first attempt, I went on a search, "_Did I really want to be a doctor?_". And the answer, as you may guess, was a hard "_No_". But after I came to terms with changing what I wanted to be when I grew up, I found a promising career path that seemed to be a good choice. Biomedical informatics was close enough to the medical field and close to my dearest technology.

Fast forward, 4 years into college. I researched cancer genome expression data, and I got a fantastic opportunity to go to New York City and do a month-long internship at the Weill Cornell Medical College. I was stoked. I had the chance to spend a whole month in the city I wanted to know, working on a project I thought was meaningful.

One week after I got there, I walked over to the lab. It was a dry lab which means it didn't have the usual chem-lab vibe; it was mostly top-of-the-line computers all around. It was early in the morning, so the lab was empty. I sat down with my coffee and blueberry muffin (a personal favorite), looking at the analysis and R code I wrote the previous day, and it hit me!

This is what I want to do when I grow up!

The internship was the whole package, having an impactful and interesting project to work on that would help people. I got to write code and tell people about it.

It was my first aha moment, right then and there, and it only took me 4 years of preparation and hard work to actually get there.

## Chapter 2: Becoming Passionate about Python and the Community

After I worked a lot with R doing research, at one college event, I met Python. It was a Django workshop, and I got to deploy my first site. I was thrilled! It was an easy language to pick up, and after a day of work, I had something to show for. It was freeing, especially from a data science perspective where it takes a while to see results.

In that workshop, I met some people that introduced me to Python, and the world of web development, where everything was fast-paced, much like my life. Python had this amazing community built around it. People there cared about diversity and inclusion, and mostly, that was a place I felt like home.

Even if you start going to conferences and meetups because of the language, you stay involved because of the community. The support system you find to keep learning and get better.

Programming became more than a tool. I found friends there, people that go through the same problems that I was facing and came out on the other side a better version of themselves. I also found my first, second, hell, all of my jobs because of my involvement in the community.

## Chapter 3: Giving Back to the Community

The Python community played a big part in making me love coding. I always liked to spend hours over something that intellectually challenges me, and programming gave me that. But the community completed the whole picture. It was easy to give back. There's always someone seeking to learn something that you know, even if you don't know that much, especially when you talk about the PyLadies.

My first job out of college was as a data scientist, and developer advocate in a civic tech project in Brazil called Serenata de Amor built using Python. Among maintaining the AI and interacting with contributors, I gave over 13 talks to spread the word about the project. I wrote several blog posts about it and Python-related subjects. Writing, giving talks, and helping other developers became important to me and something I love doing. 

Even after I moved to a different job and any positions I held after Serenata, I was always involved with the community, at times teaching what I know and times organizing events and other initiatives.

The second aha moment was long brewing inside my head: After 3 years that I left Serenata, my mind kept bringing me back to the "_I wanted to do that for a living, to write, and teach courses, and record videos_". What I did in my spare time was more interesting to me than what actually paid the bills.

Finally, last year I decided to make a career change and find somewhere where I could talk about technology and help others as my day job and not a side project anymore. Now I'm part of Auth0's developer relations team! Hopefully, I'll get to help many Pythonistas out there to secure identities in their applications.

<include src="TweetQuote" quoteText="So if you want to talk about Python, Auth0, and data, send me a message. I'm here for you. 😉" />

Getting to know Jessica Temporal, Sr. Developer Advocate @ Auth0

auziros:jeana-tahnk

Jeana has been in the tech industry for 15+ years, both as a communications professional and writer. As Director of Global Communications at Auth0, she works with her internal team and external agencies to amplify the company's visibility worldwide and establish its leadership in the identity industry. When she is not working, she can most likely be found on a field watching one of her three kids playing sports, or cleaning up after her one-year-old retriever who chews everything.

Senior Director, Global Communications

Jeana Tahnk

New survey reveals behaviors and usage patterns of application builders; authentication required in 83% of applications built

**BELLEVUE, Wash. – May 19, 2020 –** The [Auth0](https://auth0.com/) Identity Platform, a product unit within Okta, today released a [**2020 State of Application Assembly**](https://auth0.com/resources/whitepapers/state-app-assembly-2020) survey, revealing that a majority of development teams are turning to best-in-class SaaS services and the adaptability of APIs for building unique features and functionalities into the many apps they are responsible for each year.

Surveying 426 global technical professionals across a variety of roles (developers, engineers, CTOs, directors of engineering, software architects) and company sizes, Auth0 determined that 51% of respondents are responsible for building two to five apps per year, and more than a quarter (28%) build 6-10+ apps per year, with three-quarters of these apps being used for external audiences. There are currently more than 4.1 million apps available on leading app stores ([Statista](https://www.statista.com/statistics/276623/number-of-apps-available-in-leading-app-stores/)), indicating the staggering amount of development these builders are responsible for. 

The survey explored application builder behavior around several services and key findings included: 

* For applications that required payment, 74% of respondents outsourced, with Stripe being the dominant tool of choice.
* For applications that required messaging, 71% outsourced this solution, with Twilio being the highly preferred tool.
* The third service explored was authentication, cited as a requirement in 83% of applications built. However, the numbers for outsourcing authentication were lower than the other two services, with respondents outsourcing 58% of the time. 

With a substantial percentage of companies still building authentication tools in-house – and because authentication is present in the majority of apps – there’s a large potential opportunity for application building teams to streamline their processes and improve efficiency by using a third-party IDaaS tool. 

The accelerated timelines that come with app launches are driving teams away from in-house development and towards microservices – app ‘building blocks’ – that provide features and functionality that would be nearly impossible to build and maintain themselves. Relying on third-party services that are adaptable to their specific needs, significantly frees the team’s resources to focus on core innovation and speed-to-market. 

“These results confirm a trend of application development teams increasingly relying on first- and third-party APIs and external SaaS services when assembling apps, to simultaneously decrease time-to-market and increase completeness and security,” said Martin Gontovnikas, SVP of Marketing and Growth at Auth0. “Whether it’s payments, messaging, or authentication, this survey shows that teams are turning more to a ‘must-have SaaS stack’ to expedite development and enable them to focus on their core product.” 

The move to outsource services that are proven and fully adaptable gives application teams a competitive edge in innovation and implementation. By 2022, 90% of all apps will feature microservices architectures that improve the ability to design, debug, update, and leverage third-party code. Combined with agile/DevOps approaches and methodologies, enterprises can dramatically accelerate their ability to push out digital innovation – at 50-100x (or more) the frequency of traditional approaches ([IDC](https://www.idc.com/getdoc.jsp?containerId=prUS44417618)).

Please visit the [State of Application Assembly](https://auth0.com/resources/whitepapers/state-app-assembly-2020) for further details and to view all survey results.


<include src="asides/AboutAuth0" />

### Media Contacts
Jeana Tahnk 
Auth0 Global Communications 
[press@auth0.com](mailto:press@auth0.com)

Hannah Carroll 
Matter for Auth0 
[auth0@matternow.com](mailto:auth0@matternow.com)

Majority of Application Development Teams Rely More On SaaS Services vs. Building In-House

df6c864847fba9687d962cb80b482764?size=200 avatar

df6c864847fba9687d962cb80b482764?size=200

Martin Gontovnikas, a.k.a Gonto, is a software engineer at heart who moved to the ‘dark side’ and became VP of Marketing at Auth0. He considers himself lucky to have found a way to combine his two passions and apply his engineering thinking model to marketing. Gonto’s analytical thinking is a huge driver of his data-driven approach to marketing strategy and experimental design. He is based in the Bay area, and in his spare time, can be found eating gourmet food at the best new restaurants, visiting every local brewery he can find, or traveling the globe in search of new experiences.

Former SVP of Marketing and Growth at Auth0

Martin Gontovnikas

Implementation yields 50% reduction in identity-related development time, saving AMD 200+ hours

**BELLEVUE, WA**—Auth0, the leading Identity-as-a-Service (IDaaS) platform, announced that [AMD](http://www.amd.com/en/home) (NASDAQ: AMD), a leader in high-performance computing, graphics, and visualization technologies, is using Auth0 for authentication across its newly-built web portal for enterprise customers. As a result of the rapid implementation, AMD has realized a significant savings in identity-related development time, as well as successful Application Modernization of one of its legacy environments.

Auth0 provided a rapid and adaptable solution needed for AMD, as they were replacing a legacy Lotus/Domino platform with a new WordPress portal. The security and authentication offered by Auth0 enabled AMD to seamlessly merge the existing account user database into the new environment, and federate Active Directory domains for employees and customers, while keeping the portal’s confidential information secure.

“We were initially drawn to the simplicity of the solution and really appreciated not having to spend time doing extra coding,” said Kim Kane, Solution Architect - Developer Enablement Environment at AMD. “After a quick implementation, we were very impressed with the management interface of the Auth0 platform, as well as the support we received from their team. It has performed even better than we expected.”

The full implementation took less than a month to complete, giving AMD a more secure and improved experience for its enterprise customers. The positive experience with Auth0’s technology and support team has opened the door to other potential projects within AMD that are currently being discussed.

<include src="asides/AboutAuth0" />

"dev rel"