eric wu

With over 7 years of experience in product marketing, I am passionate about creating and delivering impactful marketing strategies that drive customer value, business growth, and competitive differentiation. I have a strong background in launching new products, especially in Security, Generative AI and Cloud domains, where I have led several successful end-to-end product releases. I currently work as a Staff Product Marketing Manager at Okta, a leading identity and access management platform that empowers organizations to securely connect their people and technology.

Staff Product Marketing Manager, Auth0

Eric Wu

Auth0 for B2B Enhancements accelerates onboarding and streamlines identity management with self-service onboarding workflows, Group Provisioning with SCIM, Universal Logout, and more.

Identity That Helps You Sell: Introducing Auth0 for B2B Enhancements

auziros:jeana-tahnk

Jeana has been in the tech industry for 15+ years, both as a communications professional and writer. As Director of Global Communications at Auth0, she works with her internal team and external agencies to amplify the company's visibility worldwide and establish its leadership in the identity industry. When she is not working, she can most likely be found on a field watching one of her three kids playing sports, or cleaning up after her one-year-old retriever who chews everything.

Senior Director, Global Communications

Jeana Tahnk

Joins exclusive group of AWS Partners with deep expertise and proven success in helping customers around the world build a secure digital workplace

**BELLEVUE, Wash. – June 3, 2021 –** The [Auth0](https://auth0.com/) Identity Platform, a product unit within Okta, today announced that it has achieved [Amazon Web Services (AWS) Digital Workplace Competency](https://aws.amazon.com/products/end-user-computing/partner-solutions/?partner-solutions-cards.sort-by=item.additionalFields.partnerNameLower&partner-solutions-cards.sort-order=asc) status. This global designation recognizes that Auth0 provides identity and access management (IAM) and deep expertise in supporting customers that need to effectively support their remote workers and business continuity with end-to-end digital workplace solutions in the cloud.

AWS Digital Workplace Competency Partner solutions free end users from the office by allowing them to work securely on any device, from anywhere, at any time. Achieving the AWS Digital Workplace Competency differentiates Auth0 as an AWS Partner Network (APN) member that provides specialized demonstrated technical proficiency and proven customer success with specific focus on helping customers deploy digital workplace services on AWS. To receive the designation, AWS Partners must possess deep AWS expertise and deliver solutions seamlessly on AWS.

“The onset of COVID-19 has accelerated the transition to digital services and remote work, and identity is an essential role in that shift,” said Eric Snyder, Senior Director of Business Development at Auth0. “As a remote-centric company since 2013 and a leader in helping organizations across all industries secure their valued assets and data more firmly, we are proud to achieve AWS Digital Workplace Competency status and are dedicated to helping companies achieve their technology goals by leveraging the agility, breadth of services, and pace of innovation that AWS provides.”

AWS is enabling scalable, flexible, and cost-effective solutions from startups to global enterprises. To support the seamless integration and deployment of these solutions, AWS established the [AWS Competency Program](https://aws.amazon.com/partners/competencies/) to help customers identify Consulting and Technology AWS Partners with deep industry experience and expertise.

Auth0 is an AWS Partner in the APN and recently joined the [AWS Public Sector Partner (PSP) program](https://auth0.com/blog/auth0-joins-the-amazon-web-services-public-sector-partner-program/). Additionally, the company achieved the [AWS Security Competency](https://auth0.com/blog/auth0-achieves-aws-security-competency/) status in 2020 and provides AWS customers with seamless access to [professional services in AWS Marketplace](https://auth0.com/blog/auth0-supports-the-launch-of-professional-services-in-aws-marketplace/). For more details, please see [Auth0’s AWS integration options](https://auth0.com/docs/integrations/aws).

[Auth0, recently acquired by Okta](https://auth0.com/blog/okta-acquisition-announcement/), provides a modern identity platform that helps organizations meet the security, privacy, and convenience needs of their users. Please visit [Auth0 Identity Platform](https://auth0.com/identity-platform) to learn more.

<include src="asides/AboutAuth0" />
### Media Contacts
Global Communications<br />
Auth0 <br />
[press@auth0.com](mailto:press@auth0.com)<br />

Matter for Auth0<br />
[auth0@matternow.com](mailto:auth0@matternow.com)<br />

Auth0 Achieves AWS Digital Workplace Competency Status

Vittorio

Vittorio Bertocci is a Principal Architect for Auth0. Before Auth0, he had a lengthy career with Microsoft, where Vittorio worked with Fortune 100 and Global 100 companies, including working on Microsoft’s Azure Active Directory team as principal program manager focusing on the developer experience. He contributed to the inception and launch of Microsoft's claims-based platform components (Windows Identity Foundation and ADFS, ADAL and MSAL SDKs, ASP.NET middleware). Vittorio is a well known speaker, educator and published author.

Principal Architect

Vittorio Bertocci

SignIn.org and the genesis of the GNAP working group



## The Overview

In this episode of _Identity, Unlocked_, principal architect at [Auth0](https://auth0.com) and podcast host Vittorio Bertocci interviews Dick Hardt. Dick is the founder of SignIn.org, and he and Vittorio discuss the genesis and goals of a new IETF working group Dick helped to establish and served as chair until June 2020- the [Grant Negotiation and Authorization Protocol (GNAP)](https://datatracker.ietf.org/wg/gnap/documents/).

As the conversation begins, Dick overviews his background as a mechanical engineer moving into and working within the field of identity, highlights how he maneuvered ahead of the tech curve throughout his career, brings listeners to the current moment and his work to solve internet identification with SignIn.org, and talks about meeting Vittorio. Moving forward, he and Vittorio jump right into their discussion of GNAP, with Vittorio asking what it is and what problem it aims to solve. 

Vittorio also wants to explore how GNAP was developed, and Dick explains how a [Birds of a Feather](https://www.ietf.org/how/bofs/) working group was formed, a community and interest were built, and a mailing list and meeting were planned. The decision was made to create a new group apart from OAuth, and Dick clarifies that the GNAP working group does not feel constrained by existing technology; GNAP does not need to be backward-compatible, but Dick still hopes that the transition to GNAP will be smooth for those who use it. Further, Dick explains the two drafts behind GNAP, which together form the basis for going forward.[**IMPORTANT**: the episode was recorded in August 2020. Earlier this month (November 2020), the GNAP working group adopted one draft. You can find it on the working group’s documents page at [https://datatracker.ietf.org/wg/gnap/documents/](https://datatracker.ietf.org/wg/gnap/documents/)]. He then goes into detail, addressing his work on consumer identification at SignIn.org and the way in which GNAP might enable smooth functioning of SignIn.org’s program. Vittorio and Dick explore the significance of SignIn.org’s browser-based model, the interaction element of GNAP, and more!

## Key Takeaways:

**[7:37]** - What is GNAP and what problem does it solve?
<iframe width="100%" height="230px" scrolling="no" style="border: none" src="https://identityunlocked.auth0.com/player/13ce1925"></iframe>  <br />

**[11:54]** - What are the main issues in OAuth2, and what is the general idea of GNAP?
<iframe width="100%" height="230px" scrolling="no" style="border: none" src="https://identityunlocked.auth0.com/player/be1753a1"></iframe>  <br />

**[17:16]** - How was the working group formed?
<iframe width="100%" height="230px" scrolling="no" style="border: none" src="https://identityunlocked.auth0.com/player/739afe61"></iframe>  <br />

**[26:27]** - What is SignIn.org?
<iframe width="100%" height="230px" scrolling="no" style="border: none" src="https://identityunlocked.auth0.com/player/3a1af4df"></iframe>  <br />

**[33:20]** - There is interaction within GNAP.
<iframe width="100%" height="230px" scrolling="no" style="border: none" src="https://identityunlocked.auth0.com/player/3a1af4df"></iframe>  <br />


## Links/Resources: 

Learn more about [Dick Hardt](https://www.linkedin.com/in/dickhardt/) and follow him on [Twitter](https://www.ietf.org/how/bofs/)  <br />
Learn more about [SignIn.org](https://signin.org/)  <br />

Learn more about [GNAP](https://datatracker.ietf.org/wg/gnap/documents/)  <br />
Learn more about [OAuth](https://oauth.net/)  <br />

Vittorio Bertocci on [LinkedIn](https://www.linkedin.com/in/vittoriobertocci/)<br />
Vittorio Bertocci on [Twitter](https://twitter.com/vibronet)<br />

Learn more about [Identity, Unlocked](https://identityunlocked.auth0.com/public/49/Identity%2C-Unlocked.--bed7fada/episodes)<br />
Learn more about [Auth0](https://auth0.com/)<br />

<include src="asides/IdentityUnlocked" />

<include src="asides/AboutAuth0" />


Identity, Unlocked...Explained | Episode 6

kaycie-east

As PR Manager, Kaycie supports public relations and global communications efforts for Auth0 in the AMER region. When not promoting the Auth0 brand, Kaycie can be found hiking, traveling, or searching for the next best bite to eat.

PR Manager, AMER Region

Kaycie East

Joins exclusive group of APN Partners with deep expertise and proven success in secure identity management



**BELLEVUE, Wash. &mdash; July 30, 2020 &mdash;** The [Auth0](https://auth0.com/) Identity Platform, a product unit within Okta, today announced that it has achieved [Amazon Web Services (AWS) Security Competency](https://aws.amazon.com/security/partner-solutions/) status. This designation recognizes that Auth0 has demonstrated proven deep identity management expertise that helps customers achieve their cloud security goals.

Achieving the AWS Security Competency differentiates Auth0 as an AWS Partner Network (APN) member that provides specialized identity and access management solutions designed to help enterprises adopt, develop, and deploy complex security projects on AWS. To receive the designation, APN Partners must possess deep AWS expertise and deliver solutions seamlessly on AWS.

“Auth0 is proud to be an APN Partner and to have achieved AWS Security Competency status,” said Bill Lapcevic, VP of Business Development at Auth0. “Our team is dedicated to helping companies achieve their security goals by combining our identity expertise with the range of powerful security tools AWS provides.”
 
AWS is enabling scalable, flexible, and cost-effective solutions from startups to global enterprises. To support the seamless integration and deployment of these solutions, AWS established the [AWS Competency Program](https://aws.amazon.com/partners/competencies/) to help customers identify Consulting and Technology APN Partners with deep industry experience and expertise.

AWS customer, [**ChaosSearch**](https://chaossearch.io/), found Auth0 via the APN. ChaosSearch helps businesses organize Amazon Simple Storage Service (Amazon S3)-data lakes. Through Auth0’s services, ChaosSearch is now capable of accommodating any potential customer requirements for enterprise federation. “Our simplified architecture has very few moving parts, so we scrutinize every third-party component. We integrated with Auth0 because it delivers significant value to our platform and customers,” said Thomas Hazel, founder and CTO at ChaosSearch. “The integration allows our customers to specify the protocol they want, and Auth0 handles all the details quickly.” 

More information on Auth0 and its AWS Security Competency designation can be found on the [AWS website](https://aws.amazon.com/partners/find/partnerdetails/?id=001E000000YKGRTIA5&did=pa_card&trk=pa_card). 

<include src="asides/AboutAuth0" />

### Media Contacts: 
Kaycie East<br>
Auth0 Global Communications<br>
[press@auth0.com](mailto:press@auth0.com)<br>
 
Hannah Carroll<br>
Matter for Auth0<br>
[auth0@matternow.com](mailto:auth0@matternow.com)<br>


Auth0 Achieves AWS Security Competency Status

auziros:mckenzie-mayer

Customer Identity (CIAM) Product Comms lead, driving collective storytelling across Okta and Auth0. Making technology accessible for everyone.

Customer Identity Product Comms Lead at Okta

McKenzie Mayer

IAM systems integrator enables digital transformation for Germany’s top companies


**LONDON – 7 January 2020 –** The [Auth0](https://auth0.com/) Identity Platform, a product unit within Okta, today announced a partnership with systems integrator [iC Consult Group](https://ic-consult.com/en/ic-consult-home/#services_img). The specialist in Identity and Access Management (IAM) is Auth0’s first partner covering the German market and works with 50% of major German companies on the DAX stock index. iC Consult Group also operates globally with 12 offices across the UK, Europe, America, and Asia.

The addition of iC Consult Group and [Auth0’s overall growth in DACH](https://auth0.com/blog/auth0-announces-growth-in-dach/) indicates demand for cloud-based identity management solutions that balance security and customer experience. According to a recent survey from Germany’s digital association Bitkom and KPMG, cloud is an important driver of [digital transformation](https://hub.kpmg.de/cloud-monitor-2019) with 73% of German companies using some form of cloud computing. iC Consult Group introduces a tremendous opportunity for Auth0 to help German customers increase their efficiency in managing user identities across digital apps and services.

“In the area of identity management, we’re seeing more of our customers deviate from on-premise to cloud-based alternatives. Auth0 addresses this need by providing a lightweight solution that is quick to implement and does not tie up unnecessary development resources. Because at the end of the day, it’s all about accelerating the digitization of services,” said Andre Priebe, Chief Technology Officer at iC Consult Group.

In addition to the classic enterprise IAM topics of governance, provisioning, Single Sign On (SSO) and identity federation, the systems integrator wants to focus more on consumer IAM, including social media logins like [Sign in with Apple](https://auth0.com/blog/learn-how-to-implement-sign-in-with-apple-easily/), and [Device Flow](https://auth0.com/blog/oauth-device-flow-no-hassle-authentication-as-seen-on-tv/) for the Internet of Things.

"We are thrilled to welcome iC Consult Group to our program. The move to the cloud requires a new approach and specific expertise. Combining Auth0's flexible and extensible identity platform with iC Consult Group's experience moving businesses into the cloud can be a true source of competitive advantage for our mutual customers,” said Bill Lapcevic, VP of business development at Auth0.

Expansion to Germany follows the recent [growth of Auth0’s global partner programme](https://auth0.com/blog/auth0-partner-program-accelerates-global-growth/) and brings the total number of European partners to 30. Learn more and join the [Auth0 Partner Program here](https://auth0.com/partners).

## About iC Consult Group

iC Consult Group and its companies – iC Consult, xdi360, IAM Worx, and Service Layers – specialize in Identity and Access Management (IAM). The services we provide include IAM Business Consulting, Architecture and Design, Implementation and Integration, Managed Services, and our Identity as a Service offering: Service Layers. With over 300 consultants, 30 IAM product partners, and more than 1000 successful projects, we have demonstrably achieved customer success.

For more than 20 years, we have been inspiring our renowned global customers from the automotive, logistics, pharmaceutical, and financial sectors – but not only with classic IAM. We are also at the forefront of innovative topics such as Customer IAM, Internet of Things, and API Management.

For more information, please visit [https://ic-consult.com](https://ic-consult.com).

<include src="asides/AboutAuth0" />

### Media Contacts:
Silvia Hänig<br>
[shaenig@wireside.com](mailto:shaenig@wireside.com)<br>
0173-3838572<br>
089-44848127<br>

Mark Fowler<br>
Racepoint Global for Auth0, EMEA<br>
[auth0@racepointglobal.com](mailto:auth0@racepointglobal.com)<br>
+44 (0) 77 1124 4113<br>


Auth0 Expands Partner Programme to Germany with iC Consult Group

jenny-obrien

I'm a former business journalist who's fascinated by the intersection of tech and business strategy — in particular how the right solution can transform an idea into reality. I specialize in ROI, data privacy, and identity.

Business Content Manager

Jenny O'Brien

How we helped a group of Girl Scouts get their cybersecurity badges (and become cyberheroes)!



![Auth0 Support Operations Manager Abigail Sanchez showing Scout Sign Salute with badges of Scout accomplishments](https://images.ctfassets.net/23aumh6u8s0i/5RlTmkCFXiRV2hHRMSyWEr/7768c98a93aa957bb351fd29115d66b8/auth0-girl-scout)

_Gold Girl Scout, Troop Leader, and Auth0 Support Operations Manager Abigail Sanchez displaying a few of her many scout accomplishments._

Girl Scouts can earn cybersecurity badges! After learning about some scouts who got theirs with the help of the [University of Alabama](https://www.uah.edu/news/campus/girl-scouts-get-head-start-on-cybersecurity-training-at-uah-s-ccre), we put out an all-call on Slack to see if anyone knew of a troop that might want some help from Auth0. Turns out that one of our own, Support Operations Manager Abigail Sanchez is not only a troop leader but also a Gold Girl Scout (the male equivalent would be an Eagle Scout) with 25 years of scouting experience.

## Girl Scouts as Tech Career Prep

Crediting Girl Scouts with helping her succeed in tech, Abigail agreed to bring in her troop and tell us about how her scouting experience laid the groundwork for her career.

“There's a lot of stuff that I feel like I sneakily learned through Girl Scouts,” says Abigail, noting that the project proposal like the one she wrote to become a Gold Scout is something she’s continued to prepare throughout her career. Scout gatherings similarly prepared her for her first professional conferences through familiarity, making her comfortable picking which sessions to attend, as well as being prepared for awful hotel food.

Alongside seeing examples of women running events for “hundreds” of scouts at all-girl events, the exposure made a difference. Scouts also took Abigail to various career events. “They would have sessions about being a scientist or working on computers. And those were right alongside being a teacher or a nurse or the stereotypical female careers. So again, it just never occurred to me that it was any different. It just kind of broke down that barrier, and that's what I'm really hoping to do with my girls.”

Scouts helped build self-confidence that withstood a 3-to-1 male-to-female ratio in schools and early career moments “when it seemed like my male counterparts were surprised when I did things correctly.”

Auth0 and Girl Scouts share similar values, says Abigail. “Girl Scouts is famous for not excluding any female. They are very clear about that and they stand by that. Any religion, any sexual orientation, or physical anatomy, whatever. If you identify as a woman, you are welcome in Girl Scouts. I feel like Auth0 is the same way, very inclusive We are heavily male, but we come from lots of different countries and, like Girl Scouts, we share the belief that that diversity is what makes us strong.”

Every day, Abigail thinks about the Girl Scout Promise (updated since her mother was a girl scout): “On my honor, I will try.” This idea of not giving up, of trying and experimenting, is also expressed daily at Auth0 along with the Scout value of responsibility, Abigail says. “You're going to try, and you might fail, and that's good, and you move on, but you're responsible for what you say and do. And you know, I think that goes with the Auth0 value of being transparent and being respectful with people.”

Working with Abigail’s Girl Scout troop, we had several goals given that we're catching these girls probably before they've ever created their own password. “I'm just hoping that we're going to instill some actual practical things that are going to keep them safe. But on a grander scheme, I want them to have that same kind of feeling that I did, that any of these jobs are possible for them. I'm hoping with both Girl Scouts and this specific experience of going to Auth0 to see those values in action.”

<include src="TweetQuote" quoteText="\"[Girl Scouts] would have sessions about being a scientist or working on computers…It just kind of broke down that barrier, and that's what I'm really hoping to do with my girls,\" says @auth0 @abdeansan"/>

### Want to run your own company?

![Auth0 CEO Eugenio Pace speaking to girl scouts on International Women’s Day](https://images.ctfassets.net/23aumh6u8s0i/5asttyjxGLpm8vxSEPmnn0/708999d164c7929189ce1c840d2b69ca/ceo-meeting)

_How would you define CEO?_

On International Women’s Day, Auth0 CEO and co-founder Eugenio Pace explained what we do here at Auth0 and led the girls through an exploration of how a CEO spends his or her time by guessing at the meaning of each letter in the acronym (our favorites: Caring Elf Operations and Community Emergency Octopus).

During the session, co-founder and CTO Matias Woloski dropped by to ask the girls if any of them wanted to start their own company as he and Eugenio did. Girl Scout Charlie explained that she did, but unlike Eugenio and Matias, she didn’t want to start it with a friend, she wanted to start a video game company with her father.

### ‘Cybersafe Camp’ lays the groundwork

![Auth0 Security Operations Manager Annybell Villarroel dialed into call for Cybersafe Camp](https://images.ctfassets.net/23aumh6u8s0i/5eFbPv73godgpAonShvYdN/968d4bf3e661c011f7ecfe70831f186c/annybell-villarroel-zoom)

_Security Operations Manager Annybell Villarroel logs on at 1:00AM Madrid time._

[Since 80% of people 18 and older reuse passwords](https://mashable.com/2017/02/28/passwords-reuse-study-keeper-security/#z8XBGqVc38qF), we figured making the idea of password hygiene concrete might be a good place to start. But first Security Operations Manager [Annybell Villarroel](https://auth0.com/blog/achieving-security-awareness-through-social-engineering-attacks/) signed on via Zoom from Madrid, Spain, giving the girls a feel for what it is like to work for a globally distributed company. Annybell’s “Cybersafe Camp” interactive presentation  inspired understanding with examples from [Ralph Breaks the Internet](https://www.imdb.com/title/tt5848272/) and tales of her own security heroes (like Google’s Security Princess Parisa Tabriz) as well as a detailed list of items the girls should protect like:

* Pictures
* Home Address
* Where you go to school
* Your hobbies and other activities
* Your parent’s name, phone number, credit card number

### Forming strong password habits with eggs

![Auth0 employee assists Scouts in the egg drop exercise](https://images.ctfassets.net/23aumh6u8s0i/4UA20F0vpgtXSyC5gxGoPK/a9799aca834232a7cd0b792e16e5d0f9/egg-drop)

_Adding the last layer of security._

As mentioned earlier, password habits are rough for adults, so we decided to make the risks concrete with some eggs, newspaper, bubble wrap, boxes, and gravity.

While Abigail explained the need to protect your secret password, the girls decorated eggs to represent their unique identity. They wrapped the eggs in bubble wrap and newspaper, then put them in takeout cartons, and sealed them with tape. We then very carefully moved to the kitchen to see if their unique identities would be properly protected against an attack by the hacker gravity.

“If the egg breaks, hackers get the information which is the egg yolk,” explained Girl Scout Natalie.

![Girl Scouts lined up for the egg drop exercise](https://images.ctfassets.net/23aumh6u8s0i/1TuWAcg9eW8fw3VKpY0Fzq/4942b3796e2058ef48bdb28bf6a15bfb/protected-eggs)

_Just before testing the strength of the egg passwords._

<include src="TweetQuote" quoteText="If the egg breaks, hackers get the information which is the egg yolk, explained Girl Scout Natalie (speaking about the Auth0 identity egg exercise)."/>

![Dropping the protected eggs afterwards photo](https://images.ctfassets.net/23aumh6u8s0i/7byrbUMb8OJbMeVNtM0R0g/c259d4eee638994f1ca387ddc6a9b5cd/testing-the-eggs)

_The passwords appear secure, but are they?_

Not every egg made it. Some Scouts lowered risk by not dropping at all — essentially avoiding the internet altogether. Eggs fall every day in the form of hack attacks and breaches. Choosing to avoid certain sites makes sense for safety, with precautions, the girls (and all of us) should be able to safely navigate the interwebs.

![Scouts showing off the eggs that were protected in egg drop exercise](https://images.ctfassets.net/23aumh6u8s0i/1zZ8KRpwqOn7jcz2t29rDN/07286c66005a89576a5c8249b66dd215/eggs-that-survived)

_But several egg passwords survived!_

![Scouts showing off more eggs that survived](https://images.ctfassets.net/23aumh6u8s0i/7JRea8AmdVjX2DxItfcghH/273167f9c764844b502f1085b8f0d6b7/more-protected-eggs)

_These egg passwords also held strong!_

### Hacker understanding achieved!

![Scouts playing telephone message-passing game](https://images.ctfassets.net/23aumh6u8s0i/13L1L7yF2FmYIoAGZLzIu1/35abeb6e4f2990cc478fe59bae10f2a1/telephone-game)

Maybe you remember the old game of telephone, where you try to whisper a message and keep it from changing as it gets passed around the room? Well, we played this game to show how computers are connected and demonstrate how the girls might recognize social engineering if the messages changed or started in unusual ways (Natalie usually sends a heart emoji to Charlie, but this time she sends a spider and Natalie doesn’t like spiders).

After a few rounds of playing computers passing along the message, the girls quickly realized how easy it was for the information to change by “hacking” it with a few words.

![Scout Troop leaders and the Troop doing Scout Sign, three-finger salute](https://images.ctfassets.net/23aumh6u8s0i/1IBJCnzZlqoT0TxbToOcYy/38f785e3703f229570978bc71cb84791/troop-leaders-and-group)

_Troop Leaders Candace Scairpon (left) and Abigail Sanchez (second from right) with the group!_

We wrapped the day with a photo opp. On the way home, the girls were overheard explaining the difference between malicious hackers and ethical hackers. Initial cybersecurity install successfully completed!

_Would you like Auth0 to help your Girl Scout troop get their cybersecurity badges? Please reach out to abigail.sanchez@auth0.com._

<include src="asides/AboutAuth0" />

---


Auth0 Cybersafe Camp

001c9ddc5ceb9829b6aaf24f5d28502a

I am software developer with a keen interest in open-source technologies, Linux, and native development. I've worked on many different platforms Android, iOS, Win32, Linux, FreeRTOS, the Web, and others. I've gone through the whole stack and I enjoy learning and using the latest technologies. I now work as a full-stack developer at Auth0.

Senior Engineer

Sebastian Peyrott

Embed Multi-Factor Authentication using push notifications, SMS, or TOTP anywhere, taking full control of the experience.



We are pleased to announce the availability of our [Multi-Factor Authentication API](https://auth0.com/docs/api-auth/tutorials/multifactor-resource-owner-password). Up to now, we have provided support for MFA through a simple switch in the Auth0 Dashboard, following our premise of *simplicity* and ease of use. However, we also believe in providing powerful *building blocks* for our users. For this reason we have developed a new API to perform the full MFA flow, even with multiple authenticators, in a flexible and convenient way. In this article we will take a look at the API and build a simple CLI app to demonstrate how to use it. Read on!

<include src="TweetQuote" quoteText="The MFA API is now available, learn how to embed MFA in your apps taking full control of the experience!"/>

> **Note**: for most MFA scenarios, we still recommend the use of [Universal Login](https://auth0.com/docs/hosted-pages/login) whenever possible. This new API is meant for advanced use cases where Universal Login is not flexible enough. [Universal Login is the best alternative](https://auth0.com/blog/authentication-provider-best-practices-centralized-login/) in most cases.

---

## Why?
Up to now, enabling MFA at Auth0 was simply a matter of flipping a switch and optionally selecting which application you wanted to enable MFA for. When MFA is enabled, hitting the `/authorize` endpoint or starting an authorization flow through one of our libraries was enough to trigger MFA. Simple, convenient.

![MFA Switch](https://images.ctfassets.net/23aumh6u8s0i/4Fk1xnLP6wm5Ay24YJLeex/c7047fc95a6712dfa7a92f5b7c5522e7/1-mfa-enable)

However, some of our customers have requested to have more control over the MFA process. For this reason, we have been working with [ATEA Norge](https://www.atea.no/) and other customers under a private BETA program to find the right implementation for this feature. The result: a new API for MFA to give back control to you when required. Let's check it out.

> **Note**: for most MFA scenarios, we still recommend the use of [Universal Login](https://auth0.com/docs/hosted-pages/login) whenever possible. This new API is meant for advanced use cases where Universal Login is not flexible enough. [Universal Login is the best alternative](https://auth0.com/blog/authentication-provider-best-practices-centralized-login/) in most cases.

## A Simple API
The API works by introducing some changes to how the `/token` endpoint behaves. Let's take a look.

<include src="TweetQuote" quoteText="The new MFA API is simple, it works on top of the existing /token endpoint."/>

The API works in four simple steps:

1. Access token request to `/token`.
2. Challenge request to `/challenge`.
3. Asking the user for a code (if necessary).
4. Final request to `/token`.

> This scenario assumes the user is already enrolled in MFA and has at least one authenticator enabled. There's also a [new API for enrollment](https://auth0.com/docs/multifactor-authentication/api/otp) to have full control over the enrollment process. This API also allows for obtaining a list of associated authenticators, useful for using multiple authenticator, as we will see in step 2 below.

### 1. Access Token Request to `/token`
When a request is made to the `/token` endpoint to get an access token, normally you either get an error, or you get an access token. However, when the MFA API is enabled, the `/token` endpoint may return a new error code: `mfa_required`.

```
POST /oauth/token HTTP/1.1
...

{
  "username": "...",
  "password": "...",
  "grant_type": "password"
  ...
}
```

Response:

```
HTTP/1.1 403 Forbidden
...

{
  "error": "mfa_required",
  "mfa_token": "..."
}
```

The `mfa_token` in the response value must be used in the following requests.

> MFA is also supported for the `refresh_token` [grant type](https://auth0.com/docs/applications/application-grant-types). This allows for use cases in which you want to require 2FA (TOTP, SMS, push notifications) when refreshing an access token, useful for extra security and step-up authentication.

### 2. Perform an MFA Challenge
When the `mfa_required` error is returned, the client must then perform a `challenge`. This is done by sending a request to the `/mfa/challenge` endpoint.

```
POST /mfa/challenge HTTP/1.1
...

{
  "mfa_token": "<from step 1>",
  "challenge_type": "otp oob",
  "authenticator_id": "optional, if known"
}
```

Response:

```
HTTP/1.1 200 OK
...

{
  "challenge_type": "oob",
  "binding_method": "prompt",
  "oob_code": "..."
}
```

The response tells the client which type of authenticator will be used (`challenge_type`) and also returns additional arguments relevant for that method. The `binding_method` parameter tells the client it should ask the user for a code.

The client may optionally request a specific authenticator through `authenticator_id`. This allows for multiple authenticators, even for the same resource.

> `OOB` means "out-of-band". All methods that are not [TOTP](https://auth0.com/blog/from-theory-to-practice-adding-two-factor-to-node-dot-js/) are OOB.

### 3. Prompt For Input (If Necessary)
If the `challenge_type` is `otp` or the `binding_method` parameter is set to `prompt`, the client should ask the user to input a code before continuing.

### 4. Get The Access Token
Finally, a new request to the `/token` endpoint is performed.

```
POST /oauth/token HTTP/1.1
...

{
  "mfa_token": "<from step 1>",
  "oob_code": "<from step 2, optional>",
  "binding_code": "<from step 3, if 'binding_method' === 'prompt'>",
  "otp": "<from step 3, if challenge_type === 'otp'>",
  "grant_type": "<one of two strings, see below>"
}
```

Grant type must be one of two values:
- For OTP: `http://auth0.com/oauth/grant-type/mfa-otp`
- For OOB: `http://auth0.com/oauth/grant-type/mfa-oob`

Response:

```
HTTP/1.1 200 OK
...

{
  "access_token": "...",
  "expires_in": "...",
  ...
}
```

Note that certain methods do not require the user to input anything (push notifications, for example). For those cases, this request must be performed repeatedly until an access token is returned or the authorization is denied. If the client is expected to repeat the request again in the future (after a certain amount of time) the response will be:

```
HTTP/1.1 400 Bad Request
...

{
  "error": "authorization_pending"
}
```

This means the user has not performed any actions yet and the client should wait a bit before trying again. The `error` can also be `slow_down` if the client is not waiting enough between requests.

That's it! If all went well, you now have an access token issued through MFA!

## Example: A CLI App with MFA
To give you a better understanding of how the API works we have developed a [simple CLI app that uses MFA](https://github.com/auth0-blog/oauth2-mfa-cli-example).

<video src="https://cdn.auth0.com/blog/oauth2-mfa-api/cli-demo-2.m4v" controls autoplay loop></video>

Take a look at the [full code in GitHub](https://github.com/auth0-blog/oauth2-mfa-cli-example). You will find the interesting bits in the `/token-endpoint.mjs` file, particularly in the `token` function.

To use the app, make sure that:
- You have created a new [Application](https://manage.auth0.com/#/applications) in the Auth0 Dashboard. Select the `Machine-to-Machine type`.
- The `token authentication method` is set to `none` in the Auth0 Application settings.
- You have enabled the `Password` and `MFA` grants in `Application -> Advanced Settings -> Grant Types`.
- You have MFA enabled. Go to [Multifactor Auth](https://manage.auth0.com/#/guardian) and enable SMS and push notifications for [Guardian](https://auth0.com/docs/multifactor-authentication/guardian/user-guide).
- You have set the right client ID (get this from the [application](https://manage.auth0.com/#/applications) settings area) in the MFA rule in the [Multifactor Auth](https://manage.auth0.com/#/guardian) section. Otherwise MFA will be enabled for all clients.

To use the app simply do:

```sh
git clone git@github.com:auth0-blog/oauth2-mfa-cli-example.git
cd oauth2-mfa-cli-example
npm install
node src/index.js login
```

The app supports some other commands. You can take a look at them by running it with no arguments.

## Other Use Cases
The sky is the limit! Here are some scenarios where using the new MFA API could make sense:

- Protect a VPN like OpenVPN (Pritnul) or Juniper with a second factor.
- Integrate with a PAM module to do second factor with SSH.
- Integrate with an LDAP service to provide a second factor.
- Step up authentication when refreshing an `access_token` (`refresh_token` grant).
- Trigger second factor from any backend process.

You are now free to build powerful MFA flows wherever you want!

## Conclusion
The MFA API brings flexibility to the use of MFA in your apps. One thing you may have noticed is that we are using the [OAuth 2.0 `/token` endpoint](https://tools.ietf.org/html/rfc6749#section-3.2). In fact, we designed this to be compatible with OAuth 2.0 right from the start. We have prepared two specification drafts, [one for MFA](https://github.com/jaredhanson/draft-oauth-mfa/blob/master/Draft-1.0.txt), [the other for authenticator association](https://github.com/jaredhanson/draft-oauth-mfa-assoc/blob/master/Draft-1.0.txt), to be sent to the [IETF OAuth 2.0 Working Group](https://tools.ietf.org/wg/oauth/). Other implementations of OAuth 2.0 can follow these specifications to implement MFA in a flexible, yet powerful way, while remaining compatible. We will have more information about this in an upcoming post.

We can't wait to see how you use this API to build powerful multi-factor flows! Let us know what you think in the comments.

<include src="TweetQuote" quoteText="We can't wait to see how you use this API to build powerful multi-factor flows!"/>


"group"