brandon-warner

Solutions Engineer, Auth0

Brandon Warner

Discover how Auth0's Actions Transaction Metadata simplifies authentication flows by providing a dedicated, efficient way to store and pass variables between Actions, reducing API usage and improving performance.

Introducing Transaction Metadata for Auth0 Actions

ana-cidre

Ana Cidre is a passionate advocate for the developer community and leads the Developer Advocacy team at Auth0. She's committed to fostering a more inclusive and diverse tech world, drawing on her technical background and strategic vision to improve developer experiences and build meaningful connections.

<br>

As the founder of GalsTech, an initiative supporting women in tech in Galicia, and through her active efforts to create welcoming spaces for underrepresented groups, Ana's dedication to diversity and inclusion extends beyond her daily work.

<br>

Ana has a proven track record of building global Developer Relations teams, cultivating active developer communities, and crafting impactful educational content. She maintains a strong connection to the community through speaking engagements and direct interaction with developers.

Sr Manager, Developer Advocacy

Ana Cidre

June delivered robust Auth0 updates focusing on enhanced security, greater control over authentication flows, and improved integration capabilities for developers.

June delivered a robust set of updates for developers, focusing on enhanced security, greater control over authentication flows, and improved integration capabilities. From powerful new token management and authentication methods to smarter bot detection and a clearer path for managing your Auth0 configurations, this month's releases are designed to help you build more secure and efficient identity solutions.

If you're building with Auth0, these updates will help you simplify complex authentication patterns, harden your applications against threats, and give you more granular control over user experiences.

***Let’s dig in!***

## What's New

### Native to Web SSO – Now in Early Access

This new capability is a game-changer for mobile and web app developers. It enables seamless session sharing between native mobile apps and web apps using a secure, standards-based approach, meaning users can authenticate once and maintain their session across platforms without re-logging in.

![Native to Web SSO Authentication Flow](https://images.ctfassets.net/cdy7uua7fh8z/4gFE2RP5ZCEcukiNF3Gpae/f957034f63c36d5a11f6a64d988c00e9/sequence-diagram.png)

Highlights:

* Seamless session carry-over from iOS/Android to browser  
* Uses secure, signed session tokens with device binding  
* Integrated with Actions, CLI, Terraform, and SDKs  
* Works with SAML, WS-FED, and Post Login Actions

[Learn more](https://auth0.com/changelog#72JltARfrooqHBmkuTzb8d)

### Multi-Resource Refresh Tokens (MRRT) – Now in Early Access

Tired of juggling refresh tokens for every API? Now you don’t have to.

[MRRT](https://auth0.com/docs/secure/tokens/refresh-tokens/multi-resource-refresh-token) lets your app use a single refresh token to get new access tokens for multiple APIs. This simplifies lifecycle management and improves developer UX.

Highlights: 

* One refresh token → multiple APIs  
* Define audience-specific token policies  
* Works with expiring \+ rotating refresh tokens  
* Available in Management API, Deploy CLI, Terraform, iOS/Android SDKs

Perfect for microservices, distributed APIs, or mobile/web hybrids.

[Learn more](https://auth0.com/changelog#46knYejnHFSYMc59ijmGjz)

### Enhanced Bot Detection for Signups

The improved model now recognizes more legit users, especially on mobile and new browsers, with fewer false positives and unnecessary CAPTCHA prompts.

Highlights:

* Smarter handling of user-agent signals (new OS/browser versions)  
* Native mobile traffic is now better recognized  
* Enhanced security with lower friction

Available to **Enterprise customers with the Attack Protection add-on**.

[Learn more](https://auth0.com/changelog#2CLx9gZ1YB1nfO59QqH8po)

### Passkey Enrollment via My Account – Limited Early Access

**Native Passkey Enrollment** is here via our new **My Account API**. Your app can now offer seamless passkey onboarding, directly from your UI.

Highlights:

* Full passkey management via API  
* Built for native \+ web flows  
* First of many new capabilities on the self-service My Account platform

[Learn more](https://auth0.com/changelog#eW4GjQ2zYshqK7593Z1LW)

### Customize the Brute-Force Protection unblock page with Universal Login 

You can now custom-brand the unblock page for Brute-Force Protection using Universal Login. This update allows for a fully branded experience when users are locked out due to repeated failed login attempts.

Highlights:

* Branded unblock experience via Universal Login
* Improved compatibility with email security scanners 

[Learn more](https://auth0.com/changelog#3EQxapnmbIRlkDlyIxGc6S)

## Deprecations

### Multiple actions for custom phone and email provider triggers

If you use the Management API [create an action endpoint](https://auth0.com/docs/api/management/v2/actions/post-action), we are deprecating the ability to create more than one action per tenant for actions supporting custom phone or email providers and introducing a maximum limit of one action in the respective triggers:

* `custom-phone-provider`  
* `custom-email-provider`

[Read more](https://auth0.com/changelog#3x8aOrDhj5zKgYWA4e7EeD)

### Removal of Access to Specific Event Request Properties in Actions

Starting September 16, 2025, the service will restrict access to additional property names within the `event.request.query` and `event.request.body` objects when executing actions for the post-login and credentials-exchange triggers.

Request-related objects:

* `auth_session`
* `authn_response`
* `client_secret`
* `client_assertion`
* `refresh_token`

[Read the details](https://auth0.com/changelog#3FKFF7m36s3iNW64RA9xSP)

## Community and Events

### Where we were in June

June was packed with dev-first events where we shared real-world lessons in auth, AI, and secure system design:

* [dev_day(25)](https://developerday.com/) – Our virtual event for AI agents and identity fundamentals. Sessions available on-demand, [watch now](https://developerday.com/agenda).
* [Frontend Nation](https://www.ai.engineer/) – [Ramona Schwering (Moe)](https://auth0.com/blog/authors/ramona-schwering/) shared frontend security best practices  
* [AI Engineering World's Fair](https://www.ai.engineer/) – Exploring auth for agent workflows  
* [AWS Summit Hamburg](https://aws.amazon.com/events/summits/hamburg/) – with [Juan Cruz Martinez](https://auth0.com/blog/authors/juan-cruz-martinez/) at the booth answering questions    
* [React Summit](https://reactsummit.com/) – Moe on modern identity in React  
* [VLCTechFest](https://vlctechfest.org/es/) – [Carla Urrea Stabile](https://auth0.com/blog/authors/carla-stabile/) joined Spain’s open-source community  
* [Open Source Summit North America](https://events.linuxfoundation.org/open-source-summit-north-america/) – Carla on FGA  
* [AWS Summit Japan](https://aws.amazon.com/jp/summits/japan/) – with [Daizen Ikahara](https://auth0.com/blog/authors/daizen-ikehara/) at the booth answering questions  
* [Vercel Ship](https://vercel.com/ship) – with Juan at the booth answering questions  
* [A Night Of AI (NYC) Mini Tech Conference](https://www.aicamp.ai/event/eventdetails/W2025062315) – with Juan talking about AI agents and practical tooling
* [RenderATL](https://www.renderatl.com/) – Auth0 at the booth and participating in panel discussions with Netlify
![Auth0 at RenderATL](https://images.ctfassets.net/23aumh6u8s0i/7DQYTIytz6S1joIFxOwLZi/9ffb9fbe36e0c2ae389f2bb6f8a43954/Screenshot_2025-07-07_at_1.17.33_PM.png)

### Where we’ll be in July

We're heading into July with a strong presence across developer, identity, and cloud-native events — from keynotes in Europe to hands-on engagements in Asia Pacific and the U.S.

* [DWX 2025](https://www.developer-world.de/dwx) (June 30 – July 3, EMEA) – Moe presents *"From the Crypt to the Code"*, diving into secure coding and modern auth strategies
* [WeAreDevelopers World Congress](https://www.wearedevelopers.com/world-congress) (July 9–11, EMEA) – Come say hi at the booth and watch sessions by:
  * Moe - *"The Cake Is a Lie... And So Is Your Login’s Accuracy"*, unpacking real-world login flaws and how to build trust in AI-era authentication
  * [Deepu K Sasidharan](https://auth0.com/blog/authors/deepu-sasidharan/)  *"Delay the AI Overlords: How OAuth and OpenFGA Can Keep Your AI Agents from Going Rogue"*  
* [AWS Summit New York](https://aws.amazon.com/events/summits/new-york/) (July 16, AMER) – Our team will be on the ground connecting with cloud builders about secure identity at scale

Planning to attend? Reach out! We’d love to meet you and hear what you’re building.

Expect talks, demos and plenty of real-world tips on building secure, AI-aware, and scalable identity experiences.

That’s a wrap on July\! We’ll be back next month with more dev-first updates.

Until then:

**Stay secure.**  
**Keep shipping.**  
**We’re here if you need us.**

June 2025 in Auth0: Security, Control, and New Integrations

Ramona-Schwering_square

Ramona, a Developer Advocate at Auth0, bridges roles as a tester and developer. She's a Google Dev Expert in Web Tech, Women Techmaker Ambassador, and Cypress Ambassador, building trust in test automation and identity topics.

Developer Advocate

Ramona Schwering

We're excited to announce the general availability of Auth0 Forms, a powerful visual editor that empowers you to create custom, dynamic forms that integrate seamlessly with your authentication flows.

We are thrilled to announce that Auth0 Forms is now **generally available**. Auth0 Forms is a robust visual editor that enables you to create custom, dynamic forms that seamlessly integrate with your authentication workflows. With [Auth0 Forms](https://auth0.com/features/forms), you can enhance customer experiences and save time by eliminating days or weeks of coding. This no-code visual editor allows developers to create personalized sign-up flows tailored to their company's requirements. Explore pre-built templates, debugger mode, multi-language support, and more.

<iframe width="560" height="315" src="https://www.youtube.com/embed/jkzwN2xwO5w?si=CNJZsw1M2wGPXHmW" title="YouTube video player" frameborder="0" allow="accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture; web-share" referrerpolicy="strict-origin-when-cross-origin" allowfullscreen></iframe>

## What's up with Auth0 Forms?

Auth0 Forms is a new feature of the Auth0 identity platform that allows you to use a visual editor to add custom steps and business logic to your authentication flow. You can now create customizable forms to collect user information that you can conditionally trigger when your users go through the login and authentication flow you've designed for your app.

The platform offers a visual, drag-and-drop editor for creating custom forms within login and signup flows. This allows for easy modifications without needing external redirects, simplifying identity workflows. Developers can use the low-code solution to build and manage forms with minimal coding, adding UI components, logic, and branding. Each form consists of a series of steps. In between the steps, you can trigger custom business logic to perform various actions on the data collected in the form. 

![Auth0 Forms Visual Editor](https://images.ctfassets.net/23aumh6u8s0i/7tAL7osVzrUEHQZ50GCCyz/93b8a7a5f951e56a6bdf9a9f8f0c443c/auth0_forms_01.png)

As a whole, a form behaves much like a state machine, where you can have different nodes that represent a state of the machine. In the context of forms, there are the following nodes: Start, Step, Flow, Router and End screen:

* **Start nodes** for managing hidden fields, as they are not visible to the user
* **Step nodes** are the visual representation of the form, such as visible user data input fields
* **Flow nodes** for defining custom logic and integration flows
* **Router nodes** for setting up rules to create conditional logic jumps between nodes
* **Ending screen nodes** for resuming the authentication flow post-submission

Each form must have a start and an end screen node. Within these two nodes, you can add any number of step, flow or router nodes to define the visual representation of your form and control its business logic. Components are dragged into fields using the drag-and-drop builder. 

The system also includes pre-built templates for common scenarios, making creating workflows for tasks like [progressive profiling](https://auth0.com/docs/manage-users/user-accounts/user-profiles/progressive-profiling) and policy acceptance easier. This means you can define conditions that prompt users to provide additional information as they interact with your product. For instance, upon the user's third login, you could request that they fill out their profile.  

<iframe width="560" height="315" src="https://www.youtube.com/embed/qh1NKbyaaJ4?si=IbT-vWCTw2reLs9V" title="YouTube video player" frameborder="0" allow="accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture; web-share" referrerpolicy="strict-origin-when-cross-origin" allowfullscreen></iframe>

Other use cases may include the following examples:

* **Enforce Policies**: If you need to update your policies, you can create logic to verify if users have accepted the latest policies. Depending on that, a custom form will be displayed for users who need to accept those updated policies.
* **Customize Authentication Flows**: Extend and customize your flows with additional steps and custom logic. For example, you can verify email or phone numbers with OTP and account linking, confirm payment details with Stripe, and more.
* **Trigger Custom Actions**: Initiate backend processes or workflows based on user input.
… and much more! 

## Close-up on Auth0 Form’s Features

Are you excited to use Auth0 Forms? 

* Explore our [comprehensive documentation](https://auth0.com/docs/customize/forms) for detailed information and resources. If you’re looking for guidance on your use cases, you might find it in the [template section](https://developer.auth0.com/resources/templates/forms) of our [Developer Center](https://developer.auth0.com). 
* Looking for a more hands-on approach? Explore the [Auth0 Developer Center Labs](https://developer.auth0.com/resources/labs?topic=forms) to explore a variety of use cases and guides on how to build, e.g., progressive Profiling, custom policies, and custom signup steps. 🤓
* If you're curious about examples and how to get started quickly, find a [demo experience](https://forms.auth0.dev/) and try it out. 🚀

![Auth0 Forms Visual Editor](https://images.ctfassets.net/23aumh6u8s0i/3hlVk0QphKHf2P2yOqV3Ht/6b05d9756123e0a07a84edc3c921581a/auth0_forms_02.png)

With Auth0 Forms, you're not just implementing authentication – you're crafting user experiences.
Happy coding! 🚀


Auth0 Forms Is Now Generally Available!

Calah Vargas

Calah Vargas is the Associate Manager of Product Led Growth, focusing on nonprofits, startups, and partnerships. She works on product marketing and customer marketing initiatives. Outside work, you can find her cooking, trying new restaurants, and traveling with friends and family.

Associate Manager, PLG

Upgrading made easy: from in-house authentication to modern login flows, flexible user profiles, and the convenience and security of passkey

Imagine you’re working on a monolithic application that includes a home-grown authentication system. Over the years, the authentication function has received upgrades here and there to improve security and to stay reasonably up-to-date in a changing world.

Sooner or later — perhaps triggered by considering different growth paths and how best to make use of developer time — you start to recognize that your in-house Identity stack is a limiting factor:

* Integrating with partners and other technology components requires custom work
* Maintenance obligations are distracting from work on your core app
* Meeting regulatory requirements for privacy is an ongoing challenge 
* Providing different access privileges to different types of end users is becoming more complicated than ever anticipated
* With every breach headline, you’re reminded of the constant need to strengthen security

Shopper Approved found themselves in a similar situation — in 2017, the company’s ambitions were outgrowing the home-grown Customer Identity capabilities of their monolithic PHP app.

With that realization, the search was for a third-party authentication solution.

# Why Shopper Approved chose Auth0 by Okta 

Since its launch in 2010, [Shopper Approved](https://www.shopperapproved.com/) has helped over 20,000 eCommerce brands — from mom-and-pop shops to global enterprises — generate more online trust, visibility, and conversions.

> “We knew we wanted to replace our login and authentication mechanism, and we needed a solution that would ‘tango’ with our [Laravel](https://laravel.com/) front-end templating engine,” Christopher Budge, Shopper Approved’s CTO recalled, “but we didn't know which direction we wanted to go in.”

<include src="QuoteCard" body="The Self-Service pricing was really attractive to us. The other providers that we found were prohibitively expensive for what was initially an experimental project, and not a lot of them had the adaptability that we needed to integrate into our existing application." name="Christopher Budge" title="CTO" team="" company="Shopper Approved" />

While searching online for ideas and options, Budge came across Auth0 — and, in particular, the Self-Service plans.

> “The other providers that we found were prohibitively expensive for what was initially an experimental project, and not a lot of them had the adaptability that we needed to integrate into our existing application.”

The Self-Service option gave Budge and the wider team plenty of time to perform due diligence. “_We looked for a long time before ultimately deciding upon Auth0,_” he shared. “_The more I dug into it, the better it looked._”

The ability to explore the solution in a hands-on manner, without a commitment, helped the team to make an informed choice. Budge explained that:

<include src="QuoteCard" body="I got together with our technical lead and programming contractor, and they started playing with it — and then they said, 'Yeah, we think this is going to work." name="Christopher Budge" title="CTO" team="" company="Shopper Approved" />

While every organization’s Identity journey is unique, here’s how Shopper Approved implemented Auth0.

## Migrating Users from the Legacy System to Auth0	

No matter how much preparation is done, a migration is always a nervy thing. As it turns out, those nerves were unnecessary — Shopper Approved’s migration from their legacy, home-grown authentication system to Auth0 went off without a hitch.

Budge recalled, “_We weren't sure how well our system would adapt to having its old authentication system ripped out and something new put in its place, but the migration actually exceeded expectations. Within 24 hours, we were able to ingest our entire user database into Auth0 and have them set up as users able to log in._”

However, migrating users was simply the foundation for modernizing the experience for Shopper Approved’s customers, with Budge adding, “_The universal login allows for such a smooth application login and flow. And our marketing team has really appreciated the customization and branding options that allow us to deliver a better customer experience._”

### Letting quickstarts guide the way

One of the first things Budge’s team did was explore Auth0’s step-by-step [quickstart guides](https://auth0.com/docs/quickstarts) to get a feel for the overall migration process.

“The quickstart guides were dead easy. Plus, between your host documentation and the notes in GitHub, it’s really, really easy as a developer to figure out ‘where am I and where do I need to go?’” and ‘What’s next?’”

![quickstarts](https://images.ctfassets.net/23aumh6u8s0i/58lZcrqemW0dCDEIrlLxef/fd17a831afcbbe647abd73d3420e9d95/01-migration.png)

### Leveraging SDKs

SDKs reduce the developer effort required to implement specific use cases, and Budge’s team found exactly what they needed among Auth0’s 40+ SDK libraries.

“Your SDKs are written really well, and your APIs are documented really well. So, code-wise, it’s extremely easy to interact with the platform — you can get going and don’t really have to think hard about it.”

![SDKs](https://images.ctfassets.net/23aumh6u8s0i/1cSZQDXlQ1VDHD7RFG71vu/6922a4a4409f3bab6453b7b48f12541e/02-migration.png)

## Building User Profiles

User data can come from many sources, including your own databases as well as social, legal, and enterprise identity providers. Some examples include Google, Facebook, Active Directory, and SAML.

In Shopper Approved’s case, there was an added complication — practically every user profile that had ever been created in their system still existed, and collectively, many of these profiles had inconsistent and incomplete data. But, perhaps counterintuitively, the upgrade actually presented an opportunity to clean up the user database. Budge’s migration script identified existing user records that were poorly formatted, allowing the team to quickly correct any issues — ultimately improving the overall structure of the company’s user data and laying a strong foundation for efficient scalability.

“The way your user profiles are set up — they’re just really easy to understand, manipulate, and customize. The data structure was easy to map to what we had and what we needed.” Maybe even more importantly, Budge recalled that “It just worked. When we were playing around with it, we saw that it does exactly what [your documentation](https://auth0.com/docs/manage-users/user-accounts/user-profiles) says it does.”

![User Profiles](https://images.ctfassets.net/23aumh6u8s0i/3EfvAVkkj9Ornz9JcTH5CJ/1783bd310eb0cd0722dbbe754aa606c4/03-migration.png)

## Innovating With Identity: Exploring Passkeys

The Identity domain is always evolving, with new specifications, standards, and [regulatory requirements](https://auth0.com/security) frequently appearing.

Unsurprisingly, one of the reasons why Budge was so eager to introduce a leading off-the-shelf solution was that it would allow the company to keep pace with these changes — while at the same time allowing the team to apply their finite resources on their core value proposition. In short, he knew that choosing Auth0 meant that Shopper Approved’s CIAM needs would be met today, tomorrow, and as far into the future as he could imagine.

Like many CTOs, Budge had closely been following [passkeys](https://learnpasskeys.io/) — FIDO credentials that are discoverable by browsers or housed within native applications to enable — and was excited by their potential to provide [a highly secure and very convenient user authentication experience](https://auth0.com/blog/webauthn-and-passkeys-for-developers/).

> “I’ve been watching passkeys for a long time, and — literally the day I got [the announcement that they were available](https://auth0.com/blog/activate-passkeys-let-users-log-in-without-password/) — I jumped right in. We really enjoyed rolling them out early to our organization, and we’ve had zero issues. And it’s great that we didn’t have to build passkey support ourselves!”
> _Christopher Budge_

![Passkeys](https://images.ctfassets.net/23aumh6u8s0i/3qOGVNCBexcnp5LqxkAcNB/7a0c5eaa7bdb2cd37987795f7a504712/passkeys.png)

## Enjoying Ongoing Value

Budge’s hopes for lower support and maintenance obligations have come to fruition. “We have not had to spend a single development hour at all on user authentication and login — it's never failed, and it's never broken.”

Similarly, the upgraded security is evident. 

> “We've had many security researchers and penetration testers try to break in. Every time they run smack-dab into Auth0.”

<include src="QuoteCard" body="We have not had to spend a single development hour at all on user authentication and login — it's never failed, and it's never broken." name="Christopher Budge" title="CTO" team="" company="Shopper Approved" />

### Get started in minutes — for free — with no humans (other than yourself) required!

We’ve always tried to make things less complex for developers, which is why [our Self-Service plans](https://auth0.com/pricing) allow you to create a trial account with nothing more than an email address. During your 22-day trial period, you can create a simple app, configure its look and behavior, and explore the Auth0 solution in detail — giving you plenty of time to really get your hands dirty.

![Get started](https://images.ctfassets.net/23aumh6u8s0i/3s3e2u6XsF3BitzYgE3TpY/1097a71343e41a488444684c12c2c248/identity_journey.png)

Plus, anyone using our products can take advantage of resources including [quickstarts](https://auth0.com/docs/quickstarts), [40+ SDKs](https://auth0.com/docs/libraries), [detailed guides](https://developer.auth0.com/resources/guides/web-app/nextjs/saas-basic-authentication), and [extensive (but easy-to-follow) documentation](https://auth0.com/docs/articles) to help get started and implement a strong Customer Identity function.

In fact, with only a few lines of code, you can have Auth0 integrated into any app, written in any language, and in any framework.

[Try for free](https://auth0.com/signup?utm_source=whitepaper&utm_medium=auth0&utm_campaign=whyauth0) and see for yourself.


"authentication flows"