andrea-chiarelli

I have over 20 years of experience as a software engineer and technical author. Throughout my career, I've used several programming languages and technologies for the projects I was involved in, ranging from C# to JavaScript, ASP.NET to Node.js, Angular to React, SOAP to REST APIs, etc.

In the last few years, I've been focusing on simplifying the developer experience with Identity and related topics, especially in the .NET ecosystem.

Principal Developer Advocate

Andrea Chiarelli

Dive into the world of Non-Human Identities (NHIs). Learn how they differ from traditional machine identities, their role in AI, the top security challenges, and the best practices for securing your machine-to-machine interactions.

You’ve just pushed the latest feature and your Continuous Integration (CI) pipeline begins its operations. A build server spins up, fetches dependencies, runs a battery of tests, packages your application into a container, and pushes it to a registry. Then, a deployment service picks it up, authenticates to your cloud provider, and rolls out the new version to a Kubernetes cluster.

In this whole sequence, how many humans were involved? Zero. It was a coordinated dance of machines, services, and APIs talking to each other—a world of machine-to-machine (M2M) communication. Each one of these actors—the CI server, the deployment tool, the services running in your cluster—needs an identity. They need to prove who they are and what they’re allowed to do.

Welcome to the world of **Non-Human Identities (NHIs)**. If you're a developer building anything that talks to an API (so, basically, everyone), you're already dealing with them, whether you call them that or not. They are the invisible workforce of your applications, and failing to manage them properly is like leaving the front door of your digital office wide open.

In this article, we'll dive deep into the world of NHIs. We’ll cover what they are, how they differ from the old-school "machine identities," why they are the next frontier in the age of AI, and most importantly, how to manage them following the best practices.

## Aren't These Just Machine Identities?

If you’ve been around for a while, you might be thinking, “Isn’t this just a fancy new name for machine identities, service accounts, or application identities?” And you’re not wrong—they are all part of the same family. But the term "Non-Human Identity" highlights a crucial evolution in *context* and *risk*.

In the not-so-distant past of on-premise data centers, the world was simpler. The network was the castle, and a big firewall was its moat. Most identities inside the castle walls belonged to humans. Machine-to-machine communication was often trusted implicitly because it was all happening "inside." A service account was often just a static, long-lived credential saved in a properties file.

Then came the cloud, microservices, and Infrastructure as Code (IaC). The castle walls dissolved. Your "network" is now a dynamic, multi-cloud, multi-region environment where services, serverless functions, and third-party APIs constantly interact. In this new world, **identity is the new perimeter**.

This shift is what makes NHIs different. It’s not just about a script needing a password anymore. We're talking about a massive and intricate ecosystem of identities, including:

* **Microservices** using [OAuth 2.0 client credentials](https://auth0.com/docs/get-started/authentication-and-authorization-flow/client-credentials-flow) to call each other.  
* **IoT devices** on a factory floor authenticating with client certificates to stream telemetry data.  
* **Terraform scripts** using a cloud provider identity to provision infrastructure.  
* **GitHub Actions** needing a temporary identity to deploy code to a staging environment.

The sheer volume and ephemeral nature of these identities have exploded. We're moving from a world where we managed a handful of service accounts to one where we might manage hundreds of machine identities for a single application. This scale changes everything.

So, while the concept is rooted in machine identity, "Non-Human Identity" is the modern framing that acknowledges this new reality. It emphasizes a distinct and elevated risk profile that demands a dedicated and sophisticated management strategy.

## Non-Human Identities and the Rise of AI

Just as we’re starting to understand how to manage identities for microservices and CI/CD pipelines, a new player has entered the game: Artificial Intelligence. AI agents and models are rapidly becoming the most powerful and autonomous non-human actors in our systems. And every single one of them needs an identity.

Imagine an AI-powered customer support bot. To be useful, it needs to access customer data, check order statuses, and maybe even issue refunds. It can't do any of that without authenticating to various internal APIs. Or consider a developer-assisting AI tool that can write code, run tests, and fix bugs. To operate, it needs access to your source code repositories, your build environment, and your project management tools.

Giving AI agents identities is non-negotiable for three key reasons:

* **Security and Least Privilege**: An AI agent is just another piece of software. If it’s compromised, you need to contain the blast radius. Tying an AI agent to a specific, narrowly-scoped identity allows you to enforce the [Principle of Least Privilege](https://en.wikipedia.org/wiki/Principle_of_least_privilege) (PoLP). The support bot should only be able to *read* order information, not delete the entire database. The coding assistant should only have access to the specific repositories it's assigned to work on. Without a distinct identity, you're forced to grant it overly broad permissions, which is a recipe for disaster.  
* **Auditability and Accountability**: When an AI tool takes an action, you *must* have a record of it. If an AI agent autonomously decides to scale down a production database cluster because of a perceived anomaly, you need to know which agent did it, why, and on whose authority it was acting. An NHI provides that clear, immutable audit trail. It’s the difference between saying "a system did something" and "AI-agent-734, acting on behalf of the 'cost-optimization' policy, performed this action at 3:15 AM."  
* **Contextual Operation**: AI agents often act on behalf of a human user. For example, an AI assistant scheduling meetings for you needs temporary, delegated access to your calendar. This is a perfect use case for the [OAuth 2.0 framework](https://auth0.com/docs/authenticate/protocols/oauth), where the AI agent (the client) is given a token to access a resource (your calendar) with a limited scope (reading and writing) on your behalf. Its own identity is used to request this access, and the resulting token is bound to both its identity and your permissions.

In essence, **AI agents are the ultimate NHIs**. They are autonomous, powerful, and will soon outnumber every other type of machine identity in your organization. Building a solid foundation for NHI management is now a prerequisite for safely adopting and scaling AI.

## Top Security Challenges with NHIs

Because NHIs are so pervasive and powerful, they are a prime target for attackers. They are the keys to the kingdom, and unfortunately, we often leave them lying around. The [OWASP Foundation](https://owasp.org/) has identified this growing threat and created the [Non-Human Identities Top 10 project](https://owasp.org/www-project-non-human-identities-top-10/), which outlines the most critical risks. Let's break down some of the biggest challenges you'll face as a developer.

### Secret leakage

This is the original sin of NHI security. A developer, in a hurry, hardcodes an API key, a password, or a private certificate directly into the source code or a configuration file:

```javascript
// src/config/db.js  - PLEASE, NEVER DO THIS!
const dbConfig = {
  host: 'prod.database.server.com',
  user: 'admin',
  password: 'Password123!', // <-- This is a leaked secret
  database: 'main_db'
};
```

The code gets committed to a Git repository. Maybe the repository is private today, but what about tomorrow? What if it's accidentally made public? Or what if a disgruntled employee clones it before they leave? There are tools that scan public GitHub repositories and find thousands of hardcoded secrets every single day. Once a secret is in your Git history, you must consider it compromised. Forever.

### Over-privileges

The Principle of Least Privilege is simple: an identity should only have the absolute minimum permissions required to do its job. Yet, it is violated constantly, and we are all guilty of it.

It’s late, you’re debugging a permission issue, and for a "temporary" fix, you give a service account *admin* or *root* access. You promise yourself you’ll fix it later, but later never comes.

Imagine a microservice whose only job is to resize user-uploaded profile pictures. It needs to read the original image from a storage bucket and write the resized version back. That's it. But in a rush, it’s given full read, write, and *delete* permissions to the *entire* storage system. Now, a vulnerability in that single, simple image-resizing service can be exploited to wipe out all of your company's data. This is how minor bugs become catastrophic breaches.

### Improper offboarding

Humans have a clear lifecycle. When an employee leaves, a well-defined offboarding process kicks in: their laptop is returned, their accounts are disabled, their access is revoked.

What about NHIs? A developer spins up a virtual machine for a temporary project. They create a service account for it with a set of credentials. The project ends, and the VM is deleted, but nobody remembers to revoke the credentials for the service account. That identity, and its permissions, now exist in perpetuity—an "undead" identity waiting to be discovered and abused. This is especially dangerous for long-lived credentials like static API keys, which can remain active and forgotten for years.

### Unmanaged NHIs and identity sprawl

The ease of creating identities in cloud environments is a double-edged sword. A developer needs to test an API, so they generate a new API key. A new microservice is deployed, so it gets its own service account. A data science team needs access to a database, so a new set of credentials is created.

Multiply this across hundreds of developers and thousands of services, and you get NHI sprawl. You end up with a vast, untracked landscape of identities. Nobody knows who owns them, what they’re used for, whether they're still needed, or how powerful they are. They are the digital equivalent of a drawer full of unlabeled keys. You don't know which ones open the front door until a burglar tries them all.

## Best Practices for Managing Non-Human Identities

We've outlined the dangers that can affect Non-Human Identities. Now for the good part: How do we fix it? Managing NHIs effectively isn't about finding one magic tool; it's about adopting a security-first mindset and a set of robust practices.

### Centralize and automate credential management

First and foremost: **get secrets out of your code**. Hardcoding credentials is a non-starter. All secrets—API keys, database passwords, TLS certificates—must be stored and managed in a dedicated, secure system. So apply these two basic principles:

* **Use a secret vault**: Tools like HashiCorp Vault, AWS Secrets Manager, Google Secret Manager, or Azure Key Vault are designed for this. Your application should fetch its credentials from the vault at runtime. This way, the secret is never stored on disk or in your Git history.  
* **Embrace short-lived, dynamic secrets**: The best way to reduce the risk of a leaked credential is to make it useless as quickly as possible. Instead of static, long-lived passwords, use your vault to generate *dynamic* secrets. For example, when your application needs to connect to the database, it can request credentials from Vault that are unique, have the exact permissions needed, and automatically expire after, say, one hour. If the credential leaks, its window of utility for an attacker is tiny.

### Enforce the Principle of Least Privilege

This needs to be a core part of your development workflow, not an afterthought. An identity should only have the absolute minimum permissions required to do its job. The following practices help you apply the principle:

* **Prefer access tokens over static API keys**: A fundamental step in enforcing PoLP is to move away from traditional static API keys. These keys often act as a single, long-lived credential that grants all-or-nothing access, making granular control difficult. In contrast, [**OAuth 2.0 access tokens**](https://auth0.com/docs/secure/tokens/access-tokens) are far superior as they are designed to be **short-lived**, can be restricted to specific **audiences**, and can carry fine-grained permissions. This allows you to enforce PoLP on every single API request. Read [this article to learn more about access tokens vs. API keys](https://auth0.com/blog/why-migrate-from-api-keys-to-oauth2-access-tokens/) and [this one for specific risks in the AI context](https://auth0.com/blog/api-key-security-for-ai-agents/).  
* **Leverage OAuth 2.0 scopes**: When securing your APIs, don't just validate that a token is present. Define and enforce fine-grained scopes. A client requesting an access token should only ask for the [scopes](https://auth0.com/docs/get-started/apis/scopes) it absolutely needs. For example, a service that analyzes user data should request the `user:read` scope, not a generic `user` scope that implies write access. Your authorization server should enforce this, and your API should check the token's scope before executing an action. This article can help you understand [how to apply PoLP with OAuth 2.0 access tokens](https://auth0.com/blog/oauth2-access-tokens-and-principle-of-least-privilege/).  
* **Use IAM Roles and Policies**: In cloud environments, use Identity and Access Management (IAM) roles. Instead of assigning permissions directly to a resource (like a VM, a container, or a serverless function), you assign them a role. The resource can then assume this role to automatically receive temporary, short-lived credentials. This completely removes the need to manage and rotate long-lived secrets in your code.

### Implement strong, modern authentication mechanisms

Not all authentication methods are created equal. A static API key sent in a header is better than nothing, but it's essentially a bearer token that can be stolen and replayed. We can do much better:

* **Use Asymmetric Client Authentication**: Move away from shared secrets. Instead, use methods based on public-key cryptography.  
  * **Mutual TLS (mTLS)**: The client has its own TLS certificate and proves its identity by presenting it to the server during the TLS handshake. This provides strong, two-way authentication at the transport layer. Learn more [about mTLS here](https://auth0.com/docs/get-started/authentication-and-authorization-flow/authenticate-with-mtls).  
  * **Private Key JWTs**: When authenticating to an OAuth 2.0 token endpoint, the client creates a JWT, signs it with its own private key, and sends that as its assertion. The authorization server verifies the signature using the client's public key, proving the client's identity without ever sending a secret over the wire. Learn [how to authenticate with Private Key JWTs in Auth0](https://auth0.com/docs/get-started/authentication-and-authorization-flow/authenticate-with-private-key-jwt).  
* **Bind Tokens to the Sender**: A standard bearer access token is like cash: whoever holds it can use it. **Sender-constrained tokens** fix this. They cryptographically bind the access token to the specific client that requested it. Technologies like [Demonstrating Proof-of-Possession (DPoP)](https://auth0.com/blog/protect-your-access-tokens-with-dpop/) require the client to prove it possesses the private key on every API call, making a stolen token useless to an attacker.

### Automate the entire identity lifecycle

To solve the "undead" identity problem and eliminate sprawl, you must tie the lifecycle of an NHI to the lifecycle of the resource it serves.

* **Manage Identity as Code**: Use Infrastructure as Code (IaC) tools like Terraform or **Pulumi** not just to define your servers and databases, but also to define their identities, roles, and permissions.  
* **Automated Provisioning and Deprovisioning**: When a new microservice is defined in your Terraform code, the script should also create its service account, grant it the necessary IAM role, and configure it to fetch secrets from your vault. Crucially, when you tear down the service, the script should also **revoke its permissions and delete its identity**. This ensures no orphaned identities are left behind.

### ​Keep a human in the loop for high-stakes operations

Full automation is great, but some actions are too critical to be left entirely to machines. Deploying to production, deleting a database, or approving a large financial transaction are events where you want explicit, real-time human approval. This is where ["human-in-the-loop" protocols](https://auth0.com/blog/secure-human-in-the-loop-interactions-for-ai-agents/) become essential.

[Client Initiated Backchannel Authentication](https://auth0.com/docs/get-started/authentication-and-authorization-flow/client-initiated-backchannel-authentication-flow/user-authentication-with-ciba) (CIBA) is an OpenID Connect protocol that provides a secure and interoperable way for Non-Human Identities to request authorization from users.

Consider a CI/CD pipeline preparing for a production deployment. Instead of relying on a static, high-privilege secret, the pipeline initiates a CIBA flow. This action triggers a push notification to the on-call engineer's mobile device, prompting: "Approve deployment of v2.5.1 to production?" The engineer then verifies the request and authenticates using biometrics. Upon approval, the CIBA provider issues a short-lived, single-use token to the pipeline, enabling it to complete the deployment.

This approach significantly mitigates risk. The Non-Human Identity (the pipeline) never possesses a persistent high-privilege credential. Each critical action is gated by human approval, and a clear audit trail is established, linking the automated process directly to the approving individual. CIBA serves as a crucial safety net for your most critical automated workflows.

## The Future is Non-Human

The shift from human-centric to machine-centric interactions is one of the most significant transformations in modern technology. The number of non-human identities is already exploding, and with the rise of AI, this trend is only accelerating.

As developers, we are on the front lines. We are the ones creating these identities every day. Treating them as second-class citizens with static, overly-permissive, and forgotten credentials is no longer an option. It's a critical security failure waiting to happen.

By embracing practices like secrets management, least privilege, strong authentication, and lifecycle automation, we can tame this complexity. We can build systems that are not only powerful and efficient but also secure and resilient. The future of your applications depends on the invisible identities that run them. It’s time to bring them out of the shadows.

Here is a summary of the challenges posed by NHIs and best practices for managing them:

![A summary chart showing the top security challenges of non-human identities (secret leakage, over-privileges, improper offboarding, identity sprawl) and the best practices for managing them (centralized vaults, least privilege, strong authentication, and lifecycle automation).](https://images.ctfassets.net/23aumh6u8s0i/1i1S5VYiELX4m04i7r6eb1/6815e6bcb8cf849ea542c85bf8a54cd8/securing-non-human-identities.png)

Dealing With Non-Human Identities

eric wu

With over 7 years of experience in product marketing, I am passionate about creating and delivering impactful marketing strategies that drive customer value, business growth, and competitive differentiation. I have a strong background in launching new products, especially in Security, Generative AI and Cloud domains, where I have led several successful end-to-end product releases. I currently work as a Staff Product Marketing Manager at Okta, a leading identity and access management platform that empowers organizations to securely connect their people and technology.

Staff Product Marketing Manager, Auth0

Eric Wu

Edgar Chirivella

I'm an engineer who focuses on creating high-performance solutions to address real-world problems.

When I'm not coding, you can find me playing musical instruments or dancing.

Software Engineer II

Machine-to-Machine Access for Organizations reaches General Availability (GA), unlocking SaaS APIs for developers

Within Auth0 by Okta, the [Organizations](https://auth0.com/docs/manage-users/organizations) feature allows business-to-business (B2B) software-as-a-service (SaaS) providers to manage their partners and customers and to customize the ways that end users access their applications.

Through a programmatic toolset of APIs and SDKs or directly on the Auth0 dashboard, B2B SaaS providers can use Organizations to:

* Represent their business customers and partners in Auth0 and manage their membership
* Configure branded, federated login flows for each business
* Build administration capabilities into their products, using Organizations APIs, so that those businesses can manage their own organizations

Until now, Organizations was limited to *user*-based authentication in browser-based flows — but with the General Availability (GA) of Machine-to-Machine Access for Organizations, B2B SaaS providers can now define the Organization(s) that a given app can access on its own behalf, via the Client Credentials Flow, for each API. This change allows B2B SaaS providers to open up their APIs, enabling machine-to-machine (M2M) use cases while allowing access to sensitive data and operations of each Organization to be restricted to authorized parties.

## Leading Use Cases

Let’s start with a quick look at what’s going on behind the scenes when a customer wants to interact with a B2B SaaS API via Client Credentials Flow. As depicted in the figure below:

1. First, the customer application gets an access token; with Machine-to-Machine Access for Organizations, the token request communicates new context through the `organization` parameter, and the token itself includes the corresponding `org_id `and `org_name`
2. Next, the customer application calls your API
3. Your API server validates that the target Organization for the requests matches the `org_id/name` included in the access token

![alt_text](https://images.ctfassets.net/23aumh6u8s0i/7miaBmd81uEVLmiy2jshWR/22cd99d26b516d7f9564438ffb4341f5/01_saas.png)

Straightforward and familiar, right?

Indeed, by design, these are exactly the claims used in existing user-based Organizations login flows, allowing B2B SaaS providers to implement the same authorization logic for their APIs across both user and machine-to-machine access.

Now, let’s look at the two primary use cases that this additional context enables, using our fictitious [Travel0 company](https://auth0.com/docs/manage-users/organizations/organizations-overview#sample-scenario).

### Open up APIs to third-party applications

Using Auth0 Organizations and the Management API, Travel0 offers a self-service portal where customers can create and manage their own organizations.

Travel0 wants to make it easy for customers to build bots to help end users find and purchase adventures. Accordingly, as part of this portal, Travel0 allows customers to register their applications (e.g., the bots) to consume the Travel0 API on their own behalf.

In this use case, cross-organization access must be correctly controlled so that applications belonging to a particular organization can only access that organization’s data.

Machine-to-machine access for Organizations allows Travel0’s self-service portal to configure Client Credentials access for customer applications by associating them with a specific organization for each API.

<img src="https://images.ctfassets.net/23aumh6u8s0i/55EYuibQQxOqdyZTyPa2iZ/a0c8fe244c7529b84557c9630ec6c39f/02_saas.png" alt="SaaStart"  width="500" >

As a result, the applications of Travel0’s customer *Org X* can only access the Travel0 API within the scope of *Org X*.

![alt_text](https://images.ctfassets.net/23aumh6u8s0i/52X8GLuhURskYrc7ffrYCr/5189f8c7556abea89d01f86d3aae6de9/03_saas.png)

To accommodate aggregators, Travel0 could also configure access from a single application to several organizations.

### Isolation of organizations for internal applications

Travel0 also has internal processes and CLI tools that need to access the Travel0 API using the Client Credentials Flow. To apply a unified access control strategy on the API, Travel0 wants requests from its own applications to be scoped to a specific organization so that only the right data is accessed in each case.

![alt_text](https://images.ctfassets.net/23aumh6u8s0i/5iwaR7wLph96ViCMEH3Tz1/bb2dc31d783483e9d7a99f10198fd14b/04_saas.png)

Travel0’s services aren’t bound to an individual customer, and Machine-to-Machine Access for Organizations enables Travel0 to configure an application to access any organization for each API using the Client Credentials Flow.

## How Does It Work?

### Extending Client Grants

You may have noticed that the use cases outlined above rely on knowing which Organizations an application is authorized to access.

To support this, we’ve built on the existing concept of [Client Grants](https://auth0.com/docs/api/management/v2/client-grants/get-client-grants), which represent the APIs an application is authorized to access via the Client Credentials Flow. You can now use the Client Grants (1) to specify whether an application can or cannot access an API in the context of an Organization and (2) to control which Organizations the Application can access, with two options:

1. Allow an application to access one (or several) specific organizations. This is especially relevant for the first use case.
2. Allow an application to access all organizations. This is especially relevant for the second use case.

Let’s take a look at the details!

### Configuring Machine-to-Machine Access for Organizations

To get started, you'll need to create one or multiple APIs and Organizations. After that, the process consists of three steps for each Application:

1. Create an Application and enable it to use the Client Credentials flow. To learn more, read [Create Applications](https://auth0.com/docs/get-started/auth0-overview/create-applications) and [Update Grant Types](https://auth0.com/docs/get-started/applications/update-grant-types).
2. Create and configure one or more Client Grants establishing the APIs that can be accessed by the Application.
3. Associate each Client Grant with one or more Organizations.

To create a Client Grant between the Application and an API, simply enable the toggle that can be found in the `APIs` tab under Application details:

![alt_text](https://images.ctfassets.net/23aumh6u8s0i/7AuaxeC6y2TSIn6kVkiOPi/8b0b71bf6a1b209a9c0715a1fb8afebf/05_saas.png)

The Client Grant will now have two extra properties:

* **Organization Support: **Configures whether the Client Credentials requests will `deny`, `allow`, or `require` the `organization` parameter. When configuring the Client Grant using Management API, this field will be called `organization_usage`.
* **Allow Machine-to-Machine access to any organization:** Configures whether the Client Credentials requests will allow any Organization within the tenant. By default, access will have to be granted organization by organization. When configuring the Client Grant using Management API, this field will be called `allow_any_organization`.

The Client Grant can also be created and configured for Organization support using Management API:

```
curl -X POST --location 'https://{auth0Domain}/api/v2/client-grants' \
--header 'Content-Type: application/json' \
--header 'Authorization: ••••••' \
--data '{
    "client_id": "0aFYaz2svVw7a5wGuNvvmaiW0pa2Fpga",
    "audience": "https://example-api",
    "scope": ["create:posts", "read:posts", "update:posts", "delete:posts"],
    "organization_usage": "require",
    "allow_any_organization": false
}'
```

If `allow_any_organization` has been set to `true`, you’re all set — jump to [Getting a machine-to-machine token in the context of an Organization](#Getting-a-machine-to-machine-token-in-the-context-of-an-Organization) to discover the next steps. On the other hand, if you only want to allow access to specific organizations, please continue reading.

### Granting access to concrete Organizations

Once the Client Grant has been configured, it’s time to authorize it to access a specific Organization. To do so, navigate to the organization you would like to grant access to and go to the new `Machine to Machine Access` tab. Click on the `Add Access` button and follow the steps to select the application and the API to which your Organization will have access. This will create an Organization Client Grant, which enables this permission.

![alt_text](https://images.ctfassets.net/23aumh6u8s0i/5obFwj3Qrm6G1PO3NppmIn/4b095179337103291548d1a275a00aa3/06_saas.png)

The Organization Client Grants can also be created using Management API. Three new scopes control the access to this new resource:

* create: `organization_client_grants`
* read: `organization_client_grants`
* delete: `organization_client_grants`

This is an example request that will grant access to the  `org_Kpu9Q89v57IaZJVK` Organization for the Application and API defined in the `cgr_kapBApAJV3jYdfQq` Client Grant.

```
curl -X POST --location 'https://{auth0Domain}/api/v2/organizations/org_Kpu9Q89v57IaZJVK/client-grants' \
--header 'Content-Type: application/json' \
--header 'Authorization: ••••••' \
--data '{
    "grant_id": "cgr_kapBApAJV3jYdfQq"
}'
```

### Getting a machine-to-machine token in the context of an Organization

Now that everything has been configured, we’re all set to use the feature. Let’s make a Client Credentials request, passing an `organization` parameter:

```
curl --location 'https://{auth0Domain}/oauth/token' \
--header 'Content-Type: application/x-www-form-urlencoded' \
--data-urlencode 'grant_type=client_credentials' \
--data-urlencode 'client_id=0aFYaz2svVw7a5wGuNvvmaiW0pa2Fpga' \
--data-urlencode 'client_secret=••••••' \
--data-urlencode 'audience=https://example-api' \
--data-urlencode 'organization=org_Kpu9Q89v57IaZJVK'
```

The response received from Auth0 is as follows:

```
{
  "access_token": "eyJhbGciOi...XptRHPuRkw",
  "scope": "create:posts read:posts update:posts delete:posts",
  "expires_in": 86400,
  "token_type": "Bearer"
}
```

Let’s decode the `access_token` payload:

```
{
  "iss": "https://{auth0Domain}/",
  "sub": "0aFYaz2svVw7a5wGuNvvmaiW0pa2Fpga@clients",
  "aud": "https://example-api",
  "iat": 1730308095,
  "exp": 1730394495,
  "scope": "create:posts read:posts update:posts delete:posts",
  "org_id": "org_Kpu9Q89v57IaZJVK",
  "gty": "client-credentials",
  "azp": "0aFYaz2svVw7a5wGuNvvmaiW0pa2Fpga"
}
```

As you can see, the `access_token` now contains the Organization ID in the `org_id` claim.

### Default Organization

If you have any restrictions preventing you or your customers from sending an `organization` parameter in the Client Credentials request or want to use a standard OAuth library that does not support Auth0 Organizations, you can set a Default Organization in the corresponding Auth0 Application, which will be used in all the subsequent Client Credentials requests:

```
curl --location --request PATCH 'https://{auth0Domain}/api/v2/clients/0aFYaz2svVw7a5wGuNvvmaiW0pa2Fpga \
--header 'Content-Type: application/json' \
--header 'Authorization: ••••••' \
--data '{
  "default_organization": {
    "organization_id": "org_Kpu9Q89v57IaZJVK",
    "flows": ["client_credentials"]
  }
}'
```

## Additional Resources

Ready to use Machine-to-Machine Access for Organizations? Dive into our comprehensive [documentation](https://auth0.com/docs/manage-users/organizations/organizations-for-m2m-applications) for details.

Need a quick refresher on Auth0 Organizations? Watch our [demo video](https://www.okta.com/customer-identity/#organizations) and browse the [documentation](https://auth0.com/docs/manage-users/organizations).

Want a hands-on experience with essential Customer Identity functionalities in B2B SaaS apps? Check out our reference B2B SaaS app [SaaStart](https://auth0.com/blog/speed-up-your-customer-identity-journey-with-auth0-saastart/).

Your B2B SaaS App Just Got Better

alisa-duncan

Alisa Duncan is a Senior Developer Advocate at Okta, a full-stack developer, and a community builder who loves the thrill of learning new things. She is a Google Developer Expert in Angular and organizes coding workshops and community events locally and internationally. Her background is primarily working on enterprise software platforms, and she is a fan of all things TypeScript and JavaScript.

Senior Developer Advocate

Alisa Duncan

OAuth 2.0 provides a more secure model than API keys for machine-to-machine communication. Learn why.

Why You Should Migrate to OAuth 2.0 From API Keys

joyce-echessa

Guest Author

Joyce Echessa

Learn about the different APIs available in Google's ML Kit (mobile machine learning SDK). You will also learn how to create an application that uses one of its APIs.

A Look at Android ML Kit - the Machine Learning SDK

001c9ddc5ceb9829b6aaf24f5d28502a

I am software developer with a keen interest in open-source technologies, Linux, and native development. I've worked on many different platforms Android, iOS, Win32, Linux, FreeRTOS, the Web, and others. I've gone through the whole stack and I enjoy learning and using the latest technologies. I now work as a full-stack developer at Auth0.

Senior Engineer

Sebastian Peyrott

How to set up non-interactive apps using the client credentials grant and Auth0 to perform IoT device, CLI tool, and more machine to machine API authorization.



Many times, a secure, authorized communication channel between different parts of an autonomous system is required. Think of two backend services from different companies communicating through the internet. For these cases, OAuth 2.0 provides the [client credentials grant](https://tools.ietf.org/html/rfc6749#section-4.4) flow. In this post, we will take a look at how the client credentials grant from [OAuth 2.0](https://tools.ietf.org/html/rfc6749) can be used with Auth0 for [machine to machine (M2M) communications](https://auth0.com/machine-to-machine).

<include src="TweetQuote" quoteText="Learn to use machine to machine authorization with Auth0!"/>

[Get the code](https://github.com/auth0-samples/auth0-api-auth-samples) for the sample in this post.

---

<AmpContent>
<amp-youtube
    data-videoid="9ivMf15wl1A"
    layout="responsive"
    width="480" height="270">
</amp-youtube>
</AmpContent>
<NonAmpContent>
<div class='embed-container' style="position: relative; padding-bottom: 56.25%; height: 0; overflow: hidden; max-width: 100%;margin-bottom:40px;"><iframe style="position: absolute; top: 0; left: 0; width: 100%; height: 100%;" src='https://www.youtube.com/embed/9ivMf15wl1A' frameborder='0' allowfullscreen></iframe></div>
</NonAmpContent>

## Machine to Machine Communications
There are many parts of a system where machine to machine communications make sense: service to service, daemon to backend, CLI client to internal service, [IoT](https://auth0.com/blog/javascript-for-microcontrollers-and-iot-part-1/) tools. The key aspect of these communications lies on the fact that the element to establish trust in the system is the _client_. What does this mean? In contrast to usual systems where an authorization process attempts to establish trust by authorizing _a user_, in this case what must be authorized and trusted is the client. In other words, there is no need for a user to interact with the system to authenticate, rather the system must authenticate and authorize the _client_. To be clear, in this case, the client is simply an application, process or even an autonomous system. For these scenarios, typical authentication schemes like username + password, social logins, etc. don't make sense.

The [client credentials grant] from OAuth 2.0 attempts to fulfill the need for these scenarios. In the client credentials grant, the client holds two pieces of information: the client ID and the client secret. With this information, the client can request an access token for a protected resource.

![Client Credentials Grant](https://images.ctfassets.net/23aumh6u8s0i/3bJ99s5VK6bB85bS9eiBOf/26c0da9d6918894b66e44a87c9b5edf2/client-credentials-grant)

1. The client makes a request to the authorization server sending the `client ID`, the `client secret`, along with the `audience` and other claims claims.
2. The authorization server validates the request, and, if successful, sends a response with an access token.
3. The client can now use the access token to request the protected resource from the resource server.

Since the client must always hold the client secret, this grant is only meant to be used in _trusted_ clients. In other words, clients that hold the _client secret_ must always be used in places where there is no risk of that secret being misused. For example, while it may be a good idea to use the client credentials grant in an internal daemon that sends reports across the web to a different part of your system, it cannot be used for a public tool that any external user can download from GitHub.

## Client Credentials Grant
The client credentials grant is very simple to use. The following are the relevant HTTP requests:

```
POST https://<YOUR_AUTH0_DOMAIN>/oauth/token
Content-Type: application/json
{
  "audience": "<API_IDENTIFIER>",
  "grant_type": "client_credentials",
  "client_id": "<YOUR_CLIENT_ID>",
  "client_secret": "<YOUR_CLIENT_SECRET>"
}
```

A successful authorization request results in a response like the following:

```
HTTP/1.1 200 OK
Content-Type: application/json
{
  "access_token": "eyJz93a...k4laUWw",
  "token_type": "Bearer",
  "expires_in": 86400
}
```

In Auth0, to use the client credentials grant, you can [create a new "machine to machine" application from the dashboard:](https://auth0.com/docs/applications/machine-to-machine)

![Machine to Machine in the Auth0 Dashboard](https://images.ctfassets.net/23aumh6u8s0i/77BJOc4RrLIp07FLtdX5SV/491323d54c787864e5ce322c225bd6b8/2-create)

A machine to machine application requires the selection of at least one API. This is the API that gets selected through the `audience` claim in the HTTP request above.

![Select API in the Auth0 Dashboard](https://images.ctfassets.net/23aumh6u8s0i/4TEwKo6fti1umT59Ui5fHp/c4da3c10ee49b6c2784e731b9d25ea91/3-select-api)

You can create audiences for your APIs and protected resources in the [API](https://manage.auth0.com/#/apis) section of the Auth0 Dashboard. You can enable or disable these APIs in the `APIs` tab of your application.

### Granular Permissions in Auth0
Thanks to the use of [Hooks in Auth0](https://auth0.com/docs/hooks), it is very easy to have granular permissions for [machine to machine communications](https://auth0.com/machine-to-machine). Using Node.js code, you are able to customize the actions of Auth0 and extend the functionality of the Auth0 base platform.

<include src="TweetQuote" quoteText="With Auth0 Hooks, you can have powerful granular permissions even for machine to machine authorization!"/>

The Auth0 utility (auth0) is part of `wt-cli`. More information on `wt-cli` can be [found here](https://webtask.io/docs/wt-cli) and configuring the wt-cli for use can be [found here](https://manage.auth0.com/#/tenant/webtasks).

If you wanted to create a Hook, this is how the CLI process would go:

Scaffold the sample code from Auth0:

```bash
auth0 scaffold -t pre-user-registration > file.js
```

Then create the Hook:

```bash
auth0 create -t pre-user-registration --name my-extension-1 -p auth0-default file.js
```

Along with this process, the [Auth0 Management Dashboard](https://auth0.com/docs/hooks/dashboard) also provides an interface for managing your Hooks. This dashboard can do any of the CLI functions except for the "Identify and get log data from a Hook".

If you don't need the flexibility of Hooks, you can still achieve a level of granularity with scopes. These can be enabled on a per API and per application/client basis.

## Common Use Cases for M2M Communications
In this section, we will take a look at common scenarios where M2M communications might make sense.

### Backend-to-Backend (Services/Daemons)
This is one of the most common scenarios. Let's say you have different internal services that produce data in the form of logs. You are storing those logs locally in your own data warehouse. However, as part of your policies, you also want those logs to be stored offsite in a cold storage solution. You send those logs over the internet to the cold storage service in a different cloud provider. To authorize log storage from different services in your network, you use the client credentials grant, giving each client a client ID and a client secret.

![Machine to Machine Logging](https://images.ctfassets.net/23aumh6u8s0i/yAy6yj6lBIkpSajKLnNdM/3d9c1f1aeffc1c33e20a5a982dc43e7d/3-backend-to-backend)

What about other common services like job schedulers, daemons, continuous processes? These are also great scenarios where machine to machine authorization makes sense. Say you have a job scheduler that lives in your network but on a different cloud provider that offers a great deal for GPU processing. You only want your authorized clients to make use of the service. For this reason, you use the client credentials grant and only authorize those client IDs that you want to allow.

### Internet of Things Devices
The rise of [Internet of Things devices](https://auth0.com/blog/javascript-for-microcontrollers-and-iot-part-1/) makes a great case for machine to machine solutions. Many (if not most) of IoT devices are small, autonomous, specialized devices that collect and send data to a server. Let's say you have a fleet of small IoT devices that you use to collect data on the number of cars that are parked in your parking lot. You have many devices that are continuously reporting data to a central server. These devices communicate over WiFi. To avoid intrusions, and even though your WiFi network is password protected, you use the client credentials grant, giving each IoT device its own client ID and client secret. These devices are trusted: you set them up and no-one else can interact with them.

### CLI clients
When systems become big, automation starts to make more and more sense. Many tasks that are repetitive, but that still require an administrator to supervise them, start to become scripts. These scripts are run when administrators need to run them. Since these scripts interact with sensitive parts of a company's architecture, they usually have some sort of protection. In these cases, administrators may choose to create CLI apps that have the necessary rights to perform the actions, but that are only available in certain computers, like their own, or in mainframes. In these cases, the client credentials grant also makes sense. These CLI apps are trusted, but they also need access to sensitive parts of a system. Protecting access to sensitive parts of the system by requiring the client ID and client secret can be a solution.

## Code Example: Gift Deliveries App
If you are interested in seeing code that can apply to a real-world scenario, we have a sample app just for that purpose. The [Gift Deliveries app](https://github.com/auth0-samples/auth0-api-auth-samples/tree/master/machine-to-machine) shows how two backend services from the same company can interact securely with the use of the client credentials grant.

In this app, one service, the [World Mappers API](https://github.com/auth0-samples/auth0-api-auth-samples/tree/master/machine-to-machine/worldmappers-api-nodejs) exposes an API that can be used to find coordinates, addresses, and directions; while another service, the [Gift Deliveries Service](https://github.com/auth0-samples/auth0-api-auth-samples/tree/master/machine-to-machine/giftdeliveries-nodejs), uses the `World Mappers API` to get directions from one point to the destination address (to send a gift).

![Gift Deliveries App](https://images.ctfassets.net/23aumh6u8s0i/3cGGMA4TtCldPmX8vPe2j9/96f1aedf84c2eab44a86b783d5e74823/4-gift-deliveries-app)

Both of these services run in the internal network of an online shop, therefore, the `Gift Deliveries` client is a trusted client, which allows it to use the client credentials grant.

If you take a look at the `giftdeliveries-nodejs/index.js` file you will see the code that gets an access token using the client credentials grant:

```javascript
var getAccessToken = function(callback) {
  if (!env('AUTH0_DOMAIN')) {
    callback(new Error('The AUTH0_DOMAIN is required in order to get an access token (verify your configuration).'));
  }

  logger.debug('Fetching access token from https://' + env('AUTH0_DOMAIN') + '/oauth/token');

  var options = {
    method: 'POST',
    url: 'https://' + env('AUTH0_DOMAIN') + '/oauth/token',
    headers: {
      'cache-control': 'no-cache',
      'content-type': 'application/json'
    },
    body: {
      audience: env('RESOURCE_SERVER'),
      grant_type: 'client_credentials',
      client_id: env('AUTH0_CLIENT_ID'),
      client_secret: env('AUTH0_CLIENT_SECRET')
    },
    json: true
  };

  request(options, function(err, res, body) {
    if (err || res.statusCode < 200 || res.statusCode >= 300) {
      return callback(res && res.body || err);
    }

    callback(null, body.access_token);
  });
}
```

If you want to run this app, <a href="https://a0.to/blog_signup" data-amp-replace="CLIENT_ID" data-amp-addparams="anonId=CLIENT_ID(cid-scope-cookie-fallback-name)">sign up for a free Auth0 account</a>, clone the [repository](https://github.com/auth0-samples/auth0-api-auth-samples) and follow the [README](https://github.com/auth0-samples/auth0-api-auth-samples/blob/master/machine-to-machine/README.md).

<include src="SignupCTA" text="Try out the most powerful authentication platform for free." linkText="Get started →" />

## Conclusion

[Machine to machine communications](https://auth0.com/machine-to-machine) are part of almost any modern architecture. OAuth 2.0 and Auth0 provide the necessary building blocks to make its use in your architectures a breeze. From backend-to-backend, services, daemons, IoT devices, and even CLI tools, the client credentials grant remains a simple yet useful approach to the problem of authorization between autonomous and semi-autonomous system. This grant, augmented with the power of hooks, can cover all common use cases while remaining flexible for more granular security needs in the future. If you are using, or interested in using, machine to machine communications in your products, leave us a comment below. If you are unsure how any of this can apply to your architecture, [hit the "talk to sales" button in our homepage](https://auth0.com/), we can help you out!


Using Machine to Machine (M2M) Authorization

giridhar

I love programming, learning and building new things.  I can develop web applications using Javascript and software applications using Python. 

Creative Web Developer

Giridhar Talla

Learn to implement state pattern and finite state machines using Python.

[Design patterns](https://en.wikipedia.org/wiki/Software_design_pattern) are conventional solutions to common challenges in software development using [Object-oriented programming](https://en.wikipedia.org/wiki/Object-oriented_programming). One of the famous design patterns for developing scalable and flexible software is the state pattern. You'll learn about the state pattern and how to apply it to improve your software project in this article.

## Finite State Machine

Let's define a [finite state machine](https://en.wikipedia.org/wiki/Finite-state_machine) (FSM) before moving on to the state design pattern. It is well known that the concepts of state patterns and finite-state machines have a close relationship. An FSM is something that behaves differently depending on its internal state. In computer programming, the behavior of an object in an application varies depending on its state. A switch and a lightbulb are simple examples of FSM. "ON" and "OFF" are the two possible states of the light bulb. To change the state of the bulb 'ON' or 'OFF', simply flip the switch. Transition is the process of moving from one state to another. Transition is affected by several factors. In the case of the light bulb, it is dependent on the input from the switch. The state diagram, which is shown below, graphically depicts the states and transitions.

![light bulb state diagram](https://images.ctfassets.net/23aumh6u8s0i/6Y4Ljm8KBa45GF54np9a8i/b5bff5c1cf9b5a8ead644a110f9db059/01_bulb_state_diagram.png)

We can implement the state machine using any programming language. Depending on a few factors, our code behaves differently. You can implement the preceding light bulb example as follows:

```py
class LightBulb:
  _state = 'OFF'    # initial state of bulb
  
  def onOff(self, switch):
    if switch == 'ON':
        self._state = 'ON'
    elif switch == 'OFF':
        self._state = 'OFF'
    else:
        continue          # if we get wrong input

```

For small systems, such as the one described above, the code appears to be straightforward and simple. However, if there are many states and transitions, our code will get flabby with conditional statements. The code becomes more extensive, and it won't be easy to maintain the application. If you want to add additional states or transitions to the program, you'll have to change the entire code base. You can use the **State Design Pattern** in these cases.

## State Pattern

It is a behavioral design pattern. You can use the state pattern to implement state-specific behavior in which objects can change their functionality at runtime. You can use it to avoid using conditional statements when changing an object's behavior based on its state. In the state pattern, you should [encapsulate](https://en.wikipedia.org/wiki/Encapsulation_(computer_programming)) different states in separate `State` classes. The original class keeps a reference to a state object based on its current state rather than using conditional statements to implement state-dependent functionality.

## UML Diagram

![UML class diagram of state pattern](https://images.ctfassets.net/23aumh6u8s0i/7EXrJIISe60aDo65BUFXgW/caabc74e7fe1d13bc1150ce6baa98edb/02_UML_state_class.png)

1) **Context** - it is the original class of our application. It maintains a reference to one of the concrete states on which its behavior depends. It also has a method to modify the internal state.

2) **State interface** - All supported states share the same state interface. Only the state interface allows *Context* to communicate with state objects. *Context* can only communicate with state objects via the state interface.

3) **Concrete states** - For each state, these objects implement the 'State' interface. These are the main objects which contain the state-specific methods.

## How does it work?

![UML sequence diagram of state pattern](https://images.ctfassets.net/23aumh6u8s0i/9jQ2UH5r4b4amneAHwIxG/fa3b9affd7c467bc6513b64cd1362114/03_UML_state_sequence.png)

Assume the *Context* is configured with an initial state, `concreteStateA`.  It behaves according to its initial state. The *Context* now implements the `doSomething` method according to `concreteStateA`. The concrete states should contain a back reference to call back and change *Context's* current state object. If a state transition occurs, the *Context's* `setSate` method is invoked, referencing the new state, `concreteStateB`. The *Context* changed its internal state and behavior. Now, it uses the `concreteStateB` to implement the `doSomething` method. The basic idea is that the states can change the context's state automatically. As a developer, you can modify the states by using any number of instances of `setState`.

If you want to add another state, simply create a new concrete state object without changing the *Context* of the application.

## Implementation

Let's take a step-by-step look at implementing the state pattern.

1) Find an existing class that contains state-dependent code, or create a suitable context class. It should include a reference to a specific state as well as a method for switching between states.

```py
from __future__ import annotations
from abc import ABC, abstractmethod

# the context class contains a _state that references the concrete state and setState method to change between states.
class Context:

    _state = None

    def __init__(self, state: State) -> None:
        self.setState(state)

    def setState(self, state: State):

        print(f"Context: Transitioning to {type(state).__name__}")
        self._state = state
        self._state.context = self

    def doSomething(self):
        self._state.doSomething()

```

2) Create a common State interface for all concrete states. The State interface specifies all of the methods that all Concrete States must implement and a backreference to the *Context* object. States can change the *Context* to another state by using this backreference.

```py
class State(ABC):
    @property
    def context(self) -> Context:
        return self._context

    @context.setter
    def context(self, context: Context) -> None:
        self._context = context

    @abstractmethod
    def doSomething(self) -> None:
        pass

```

You should define the *Context* as a [protected parameter](https://www.geeksforgeeks.org/protected-variable-in-python/). Above, [`@property`](https://www.programiz.com/python-programming/property) decorator is used to make the `context()` method as property and `@context.setter` decorator to another overload of the `context()` method as property setter method. Now, `_context` is protected.

3) You can define the concrete states in the classes that implement the state interface. After the `doSomething` method is called, the state of the *Context* changes. You can also change the state by defining a specific method. The state transitions use the `setState` method of the *Context*.

```py
class ConcreteStateA(State):
    def doSomething(self) -> None:
        print("The context is in the state of ConcreteStateA.")
        print("ConcreteStateA now changes the state of the context.")
        self.context.setState(ConcreteStateB())


class ConcreteStateB(State):
    def doSomething(self) -> None:
        print("The context is in the state of ConcreteStateB.")
        print("ConcreteStateB wants to change the state of the context.")
        self.context.setState(ConcreteStateA()) 

```

4) You can now initiate your application with an initial state and execute the methods.

```py
# sample application
app = Context(ConcreteStateA())
app.doSomething()    # this method is executed as in state 1
app.doSomething()    # this method is executed as in state 2
```

The output of the above code looks something like this:

```
Context: Transitioning to ConcreteStateA
The context is in the state of ConcreteStateA.
ConcreteStateA now changes the state of the context.
Context: Transitioning to ConcreteStateB
The context is in the state of ConcreteStateB.
ConcreteStateB wants to change the state of the context.
Context: Transitioning to ConcreteStateA
```

## Example

Let's create a simple state machine that represents a real-world scenario. Consider an elevator system with buttons in the elevator cabin that allow you to go up or down. Consider that this lift only travels between two floors to keep things simple. There are primarily two possible states for the elevator: `1st floor` and `2nd floor`. The input from the two buttons determines the transition between states. The elevator performs different actions based on its state.

The following code is the implementation of the elevator example. Follow along with the comments for more descriptions about each method.

```py
from __future__ import annotations
from abc import ABC, abstractmethod

# The Elevator class is the context. It should be initiated with a default state.
class Elevator:

    _state = None

    def __init__(self, state: State) -> None:
        self.setElevator(state)

    # method to change the state of the object
    def setElevator(self, state: State):

        self._state = state
        self._state.elevator = self

    def presentState(self):
        print(f"Elevator is in {type(self._state).__name__}")

    # the methods for executing the elevator functionality. These depends on the current state of the object.
    def pushDownBtn(self):
        self._state.pushDownBtn()

    def pushUpBtn(self):
        self._state.pushUpBtn()

    # if both the buttons are pushed at a time, nothing should happen
    def pushUpAndDownBtns(self) -> None:
        print("Oops.. you should press one button at a time")

    # if no button was pushed, it should just wait open for guests
    def noBtnPushed(self) -> None:
        print("Press any button. Up or Down")


# The common state interface for all the states
class State(ABC):
    @property
    def elevator(self) -> Elevator:
        return self._elevator

    @elevator.setter
    def elevator(self, elevator: Elevator) -> None:
        self._elevator = elevator

    @abstractmethod
    def pushDownBtn(self) -> None:
        pass

    @abstractmethod
    def pushUpBtn(self) -> None:
        pass


# The concrete states
# We have two states of the elevator: when it is on the First floor and the Second floor
class firstFloor(State):

    # If the down button is pushed when it is already on the first floor, nothing should happen
    def pushDownBtn(self) -> None:
        print("Already in the bottom floor")

    # if up button is pushed, move upwards then it changes its state to second floor.
    def pushUpBtn(self) -> None:
        print("Elevator moving upward one floor.")
        self.elevator.setElevator(secondFloor())


class secondFloor(State):

    # if down button is pushed it should move one floor down and open the door
    def pushDownBtn(self) -> None:
        print("Elevator moving down a floor...")
        self.elevator.setElevator(firstFloor())

    # if up button is pushed nothing should happen
    def pushUpBtn(self) -> None:
        print("Already in the top floor")


if __name__ == "__main__":
    # The client code.

    myElevator = Elevator(firstFloor())
    myElevator.presentState()

    # Up button is pushed
    myElevator.pushUpBtn()

    myElevator.presentState()

```

The output of the above code looks like this:

```
Elevator is in firstFloor
Elevator moving upward one floor.
Elevator is in secondFloor
```
You can implement many buttons and states elevator like in real-life one for the floor. Try using the state pattern to implement the light bulb example from the Finite state machine.

## Advantages and Disadvantages

The state pattern, like any other programming concept, has a number of benefits as well as some drawbacks. You can avoid writing massive conditional blocks for switching between states by using the state pattern instead of hard-coding state-specific behavior. It allows you to develop a flexible and maintainable application. You can add new states and transitions to the *Context* without changing it.

It's a good idea to use the state pattern if the logic of each state is complex and the states change frequently. Otherwise, it complicates simple things by bringing a plethora of classes and objects. The state pattern adds another level of indirection by imposing clients to rely on a State object, and it extends the context class to allow State objects to change the state of the *Context*.

## Conclusion

In this article, you learned how to use the state pattern in Python programming to design state machines. Without using larger conditional blocks to implement state-specific behavior, the state pattern makes the development process a lot easier. You can also add new states that are not dependent on other states, giving your application more flexibility. The state pattern is very similar to the [strategy pattern](https://en.wikipedia.org/wiki/Strategy_pattern), which alters strategies based on user choices. The main distinction is that concrete states are aware of other states, whereas the strategies do not. Why do we say that states are aware of other states? because each state has to know to which state they should move. For example, the first-floor state knows that they should change to the second-floor state. Another important difference with strategy pattern is that in the case of Strategy pattern, it's the client, which provides a different strategy to Context, on State pattern, the state transition is managed by Context or State itself. Try to make use of the state pattern in your software to make the development process go more smoothly.

State Pattern in Python

pablo-casas

I am responsible for the creation of AI and machine learning models in different areas of Auth0, like Support, Marketing, and Anomaly Detection for Product. Learning and teaching about data is my passion! Recently, I published the open-source “Data Science Live Book”, which you can read at http://livebook.datascienceheroes.com. You can also find me teaching Data Science at Universidad Tecnológica Nacional de Argentina.

Sr. Data Scientist / AI

Pablo Casas

Learn how the Auth0 data team combines R and Python to leverage data engineering and machine learning solutions.



The Data team is responsible for crunching, reporting, and serving data. The team also does data integrations with other systems, creating machine learning, and deep learning models.

With this post, we intend to share our favorite tools, which are proven to run with thousands of millions of data. 
Scaling processes in real-world scenarios is a hot topic among new people coming to data.

## R or Python?

Well... both!

![R and Python logos](https://images.ctfassets.net/23aumh6u8s0i/32tvQ9ZJWzVodIJd3k6sMI/18dc59e9b71fda2d15edca0c83503cbd/r-python)

[R](https://www.r-project.org/about.html) is a GNU project, thought as a statistical data language originally developed at Bell Laboratories around 1996.

[Python](https://www.python.org/), developed in 1991 by Guido van Rossum, is a general-purpose language with a focus on code readability.

Both R and Python are highly extensible through packages.

We mainly use R for our data processes and ML projects, and Python to do the integrations and Deep Learning projects.

Our stack is R with [RStudio](https://rstudio.com), and Python 3 with [Jupyter](https://jupyter.org/) notebooks.

RStudio is an open-source and vast IDE capable of browsing data and objects created during the session, plots, debugging code, among many other options. It also provides an enterprise-ready solution.

Jupyter is also an open-source IDE aimed to interface Julia, Python, and R. Today's is widely used for data scientists to share their analysis. Recently Google creates "Colab", a Jupyter notebook environment capable of running in the google drive cloud.

## So is R Capable of Running on Production?

Yes. 

We run several heavy data preparations and predictive models every day, every hour, and every few minutes.

## How Do We Run R and Python Tasks on Production?

We use [Airflow](https://airflow.apache.org/) as an orchestrator, an open-source project created by Airbnb.

Airflow is an incredible and robust project which allows us to schedule processes, assign priorities, rules, detailed log, etc.

For development, we still use the form: `Rscript my_awesome_script.R`.

Airflow is a Python-based task scheduler that allows us to run chained processes, with many complex dependencies, monitoring the current state of all of them and firing alerts if anything goes wrong to Slack. This is ideal for running import jobs to populate the Data Warehouse with fresh data every day.

## Do We Have a Data Warehouse?

Yes, and it's huge! 

It's mounted on Amazon Redshift, a suitable option if scaling is a priority. Visit their [website](https://docs.aws.amazon.com/redshift/latest/mgmt/welcome.html) to learn more about it.

R connects directly to Amazon Redshift thanks to the [rauth0 package](https://github.com/auth0/rauth0), which uses the [redshiftTools](https://blog.datascienceheroes.com/redshifttools-v1-0-0-cran-release) package, developed by [Pablo Seibelt](https://auth0.com/blog/authors/pablo-seibelt/).

Generally, data is uploaded from R to Amazon Redshift using `redshiftTools`. This data can be either plain files or from data frames created during the R session.

We use Python to import and export unstructured data since R does not have useful libraries currently to handle it. 

We have experimented with JSON libraries in R but the result is much worse than using Python in this scenario. For example, using [RJSONIO](https://rdrr.io/cran/RJSONIO/man/fromJSON.html) the dataset is automatically transformed into an R Data Frame, with little control of how the transformation is done. This is only useful for very simple JSON data structures and is very difficult to manipulate in R, compared to Python where this is much easier and more natural.

<include src="TweetQuote" quoteText="Auth0 uses Python to import and export unstructured data."/>

### How do we deal with data preparation using R?

We have two scenarios, data preparation for data engineering, and data preparation for machine learning/AI. 

One of the biggest strengths of R is the [tidyverse](https://www.tidyverse.org/packages) package, which is a set of packages developed by lots of ninja developers, some of them working at RStudio Inc company. They provide a common API and a shared philosophy for working with data. We will cover an example in the next section.

The tidyverse, especially the [dplyr](https://dplyr.tidyverse.org) package, contains a set of functions that make the exploratory data analysis and data preparation quite comfortable.

For certain tasks in crunching data prep and visualization, we use the [funModeling](https://blog.datascienceheroes.com/exploratory-data-analysis-data-preparation-with-funmodeling/) package. It was the seed for an open-source book I published some time ago: [Data Science Live Book](http://livebook.datascienceheroes.com/). It contains some good practices we follow related to deploying models on production, dealing with missing data, handling outliers, and more.

<include src="TweetQuote" quoteText="One of the biggest strengths of R is the tidyverse package, which is a set of packages developed by lots of ninja developers."/>

## Does R Scale?

One of the key points of `dplyr` is it can be run on databases, thanks to another package with a pretty similar name: [dbplyr](https://dbplyr.tidyverse.org/). 

This way, we write R syntax (`dplyr`) and it is "automagically" converted to SQL syntax and it then runs on production.

There are some cases in which these conversions from R to SQL are not made automatically. For such cases, we are still able to do a mix of SQL syntax in R.

For example, following dplyr syntax:

```sql
flights %>%
  group_by(month, day) %>%
  summarise(delay = mean(dep_delay)) 
```

Generates:

```sql
SELECT `month`, `day`, AVG(`dep_delay`) AS `delay`
FROM `nycflights13::flights`
GROUP BY `month`, `day`
```

This way, `dbplyr` makes transparent for the R user working with objects in RAM or a foreign database.

Not many people know, but many key pieces of R are written in C++ (concretely, the [Rcpp](http://adv-r.had.co.nz/Rcpp.html) package).

### How do we share the results?

Mostly in [Tableau](https://www.tableau.com/). We have some integrations with [Salesforce](https://www.salesforce.com). 

In addition, we do have some reports deployed in [Shiny](https://shiny.rstudio.com). Especially the ones that need complex customer interaction.
Shiny allows custom reports to be built using simple R code without having to learn Javascript, Python or other frontend and backend languages. Through the use of a "reactive" interface, the user can input parameters that the Shiny application can use to react and redraw any reports. In contrast with tools like Tableau, Domo, PowerBI, etc. which are more "drag and drop", the programmatic nature of Shiny apps allow them to do almost anything the developer can conceive in their imagination, which might be more difficult or impossible in other tools.

For ad hoc reports (HTML), we use [R markdown](https://rmarkdown.rstudio.com) which shares some functionality with to jupyter notebooks. It allows a script to be created with an analysis that ends in a dashboard, PDF report, web-based reports, and also books!

## Machine Learning / AI

We use both R and Python. 

For Machine Learning projects, we use mainly the [`caret`](https://topepo.github.io/caret/index.html) package in R. It provides a high-level interface to many machine learning algorithms, as well as common tasks in data preparation, model evaluation, and hyper-tuning parameter.

For Deep Learning, we use Python, specifically the libraries [Keras](https://keras.io) with [TensorFlow](https://www.tensorflow.org/) as the backend. Keras is an API to build with just a bunch of lines of code, many of the most complex neural networks. It can easily scale by training them on the cloud, in services like AWS.

Nowadays we are also doing some experiments with the [fastai](https://www.fast.ai/) library for NLP problems. 

## Summing Up!

The open-source languages are leading the data path. R and Python have strong communities, and there are free and top-notch resources to learn.

Here we wanted to share the not-so-common approach of using R for data engineering tasks, what are our favorite and Python libraries, with a focus on sharing the results, explaining some of the practices we do every day.

We think the most important stages in a data project are the data analysis and data preparation. Choosing the right approach can save a lot of time and make the project to scale.

We hope this post encourages you to try some of the suggested technologies and rock your data projects!

<include src="asides/AboutAuth0" />

---


How the Auth0 Data Team Uses R and Python

332d7898dae6bc56031ac3507a0248ba

I'm a full-stack developer with a passion for technology and code. I love writing tutorials for developers to showcase a particular technology whilst building something useful at the same time. Right now  I can mostly be found developing for the front-end, playing around with Docker, or tinkering with Unreal Engine and electronics!

Developer Experience Engineer

Steve Hobbs

Learn how to transform your Windows 10 machine into a Linux powerhouse.



Imagine for a moment that you're stranded on a desert island. You're a software developer and have been using Linux systems or an Apple Mac ever since you were old enough to type on a keyboard. Yet the only things that you were able to bring with you to your desert island was a Windows machine, and enough tea and biscuits to last a lifetime. Luckily the island already has an internet connection — what do you do?

Okay, you _could_ just [download Ubuntu](https://www.ubuntu.com/#download) and install it onto a Virtual Machine, but there is another way. Which as it happens, also involves installing Ubuntu...

## <a class="toc-target" id="a-week-without-my-macbook"></a>A Week Without My Macbook

I was in a very similar situation recently, although instead of being stranded on a desert island I was forced to leave my MacBook with the Apple Store while they fixed a [weird issue with my touch bar](http://www.youtube.com/watch?v=bvU1FIJ0daU).

I had to find a way to keep working while my development machine was in the shop. I love using a Unix command line and tools such as [ZSH](http://www.zsh.org/) and [Oh-my-zsh!](https://ohmyz.sh/). In my day job, I have to use [Ruby](https://www.ruby-lang.org/en/) and [Node](https://nodejs.org/en/) on a regular basis, and I love using [iTerm2](https://www.iterm2.com/) as my main terminal emulator. I also primarily use desktop tools like [Visual Studio Code](https://code.visualstudio.com/), [Docker](https://www.docker.com/products/docker-desktop), and [Slack](https://slack.com/).

One option would be to simply install Docker and [set up a containerized development environment](https://auth0.com/blog/use-docker-to-create-a-node-development-environment/), but that would be _too easy_.

Could I continue using my normal development tools and my workflow without my MacBook? I set out to find out!

<include src="TweetQuote" quoteText="Learn how to install Windows Subsystem for Linux, turning your Windows 10 machine into a full-blown Linux powerhouse"/>

## <a class="toc-target" id="cross-platform-applications"></a>Cross-Platform Applications

Of course, a lot of the applications I just mentioned are available cross-platform, with many of them being HTML, CSS, and JavaScript applications wrapped up using [Electron](https://electronjs.org/). This covers apps like Visual Studio Code and Slack, which are the two main tools I use day-to-day.

I occasionally dip into using [Intellij](https://www.jetbrains.com/idea/) for [Scala development](https://auth0.com/blog/build-and-secure-a-scala-play-framework-api/) and again this runs cross-platform. So it looks like all the desktop applications I need are available, which is great!

For my main development and blog writing activities, I primarily use [Git](https://git-scm.com/), [Ruby](https://www.ruby-lang.org/en/) and [NodeJS](https://nodejs.org/en/). Fortunately, there are Windows installers for all of these that ultimately work, but they all feel a bit _Windows-y_. For example, the best way to use Git on Windows is to use [Git for Windows](https://gitforwindows.org/), which provides a Git Bash application that drops you into a terminal running Git. Or you can use a desktop application like [GitHub Desktop](https://git-scm.com/), or the built-in Git interface inside Visual Studio Code.

![Windows desktop running Visual Studio Code, GitHub Desktop and WSL](https://images.ctfassets.net/23aumh6u8s0i/7RERJuU7VNzU0C4YEr1c8/2bd1e3c69604cb4f7a61b026e149b10a/working-on-windows_desktop-01)

As for Ruby, I enjoy using [RVM](https://rvm.io/), which makes the installation and management of different Ruby versions very easy and relatively painless. Windows is supported using something like [Cygwin](https://cygwin.com/), but again it's not really a native solution and I ran into issues getting it to work the way I'm used to.

All of these are good solutions (if you can get them working) but seeing as the goal of this exercise is to figure out a way to work just like I have been doing on my MacBook, I wanted to explore further.

## <a class="toc-target" id="terminal-velocity"></a>Terminal Velocity

I really enjoy using the terminal for the speed and ability to get things done concisely and quickly. Using a terminal that supports features such as tabs, horizontal and vertical splitting, and Unix command utilities and features like piping and output redirection is very important to me.

Unfortunately, this is where Windows starts to break down. Windows has Command Prompt, which doesn't support any of those nice UI features that I like, and with me not being familiar with Windows shell script, I find it cumbersome. There is also Powershell and, as the name suggests, is very powerful but it's something new I'd have to learn. Ultimately, it would take time until I'm as productive as before. Interestingly for the Powershell users, [posh-git](https://github.com/dahlbyk/posh-git) gives you adornments in the terminal as the Git status of the current folder, which is one of the features I like about Oh-my-zsh.

![Screenshot of posh-git with Powershell on Windows](https://images.ctfassets.net/23aumh6u8s0i/5onDW4obFAGbOnqIhzlD05/256515dafffb5900bc9d9f2b674f2ad4/working-on-windows_posh-git)

I'm in love with [iTerm2](https://www.iterm2.com/) on the Mac for its ability to use tabs, split windows, profiles, and theming, so is there anything that gets me close?

[Hyper](https://hyper.is/) is a terminal emulator that supports at least the UI features of being able to use tabs and window splitting. It's based on Electron and so is cross-platform, and supports more advanced features like [themes](https://hyper.is/themes) and [plugins](https://hyper.is/plugins). I do like theming my applications so that they look more pleasing to the eye, but I was willing to forget about that for this short-lived exercise.

However, it's just an emulator and therefore is still just using Windows shell script. Something more fundamental under the hood would have to change.

## <a class="toc-target" id="enter-the-windows-subsystem-for-linux"></a>Enter the Windows Subsystem for Linux

[Windows Subsystem for Linux](https://docs.microsoft.com/en-us/windows/wsl/about) (WSL) is a way to run native Linux commands and tools alongside your existing Windows apps. It doesn't use a virtual machine and is as easy to access as opening a terminal window. To quote directly from the documentation:

> The Windows Subsystem for Linux lets developers run GNU/Linux environment -- including most command-line tools, utilities, and applications -- directly on Windows, unmodified, without the overhead of a virtual machine.

Sounds good, doesn't it? In theory, I should be able to use all the command-line tools that I'm used to without leaving my Windows desktop environment.

To install WSL, you need to be on the Windows 10 Fall Creator's Update (build 16215). Then, you can install the feature by using the "Turn Windows features on or off" facility and ticking "Windows Subsystem for Linux":

![Screenshot of the Add Windows Features dialog](https://images.ctfassets.net/23aumh6u8s0i/4RFI6W9FLq7l2eZps2IeIH/1effca5d6fb069c6941631d38128e9d5/working-on-windows_installing-wsl)

It can also be installed by running this Powershell command:

```powershell
# Run this inside Powershell to enable the WSL feature
Enable-WindowsOptionalFeature -Online -FeatureName Microsoft-Windows-Subsystem-Linux
```

> **Note**: The machine may need to be restarted once WSL is installed

One of the many [Linux distributions on the Windows Store](https://www.microsoft.com/en-gb/search/shop/apps?q=linux&devicetype=pc&Price=0) can then be installed as a Windows App. I chose [Ubuntu](https://www.microsoft.com/en-gb/p/ubuntu-1804-lts/9n9tngvndl3q?activetab=pivot:overviewtab) as it's the one I'm most familiar with. An Ubuntu app becomes available once it's installed, but the normal Windows Command Prompt app can be used in its place if you so wish.

Then, to enter a Linux terminal, open Command Prompt (or your terminal emulator of choice) and type `wsl` to get started. The next thing you will see is your Linux command prompt.

```bash
# My WSL command prompt inside the Command Prompt application
/c/Users/steve >
```

So what can be done from here? Supposedly anything that can normally be done from an Ubuntu terminal. Let's check what release of Ubuntu I'm using:

```bash
> lsb_release -a

No LSB modules are available.
Distributor ID: Ubuntu
Description:    Ubuntu 18.04.2 LTS
Release:        18.04
Codename:       bionic
```

Use `curl`?

```bash
> curl -i google.com

HTTP/1.1 301 Moved Permanently
Location: http://www.google.com/
Content-Type: text/html; charset=UTF-8
Date: Tue, 26 Feb 2019 10:42:51 GMT
Expires: Thu, 28 Mar 2019 10:42:51 GMT
Cache-Control: public, max-age=2592000
Server: gws
Content-Length: 219
X-XSS-Protection: 1; mode=block
X-Frame-Options: SAMEORIGIN

```

Install Vim?

```bash
> sudo apt-get install vim

Reading package lists... Done
Building dependency tree
Reading state information... Done
The following package was automatically installed and is no longer required:
  libfreetype6
Use 'sudo apt autoremove' to remove it.
0 upgraded, 0 newly installed, 1 reinstalled, 0 to remove and 3 not upgraded.
Need to get 1152 kB of archives.
After this operation, 0 B of additional disk space will be used.
Get:1 http://archive.ubuntu.com/ubuntu bionic/main amd64 vim amd64 2:8.0.1453-1ubuntu1 [1152 kB]
Fetched 1152 kB in 0s (2468 kB/s)
(Reading database ... 39405 files and directories currently installed.)
Preparing to unpack .../vim_2%3a8.0.1453-1ubuntu1_amd64.deb ...
Unpacking vim (2:8.0.1453-1ubuntu1) over (2:8.0.1453-1ubuntu1) ...
Setting up vim (2:8.0.1453-1ubuntu1) ...
```

As you can see, `apt-get` is available and can be used to install any software that would normally be available on a native instance of Ubuntu.

Can something like NVM be installed the same way as on a native Linux distribution?

> For the purposes of this recording and in the interest of time, I had already installed NVM on this machine, but not Node itself. Take a look and see what happens!

<AmpContent>
<amp-video controls
  layout="responsive"
  width="480" height="270">
  <source src="https://cdn.auth0.com/blog/working-on-windows:nvm-video.mp4"
    type="video/webm" />
</amp-video>

</AmpContent>

<NonAmpContent>

<video controls="controls">
  <source src="https://cdn.auth0.com/blog/working-on-windows:nvm-video.mp4">
   Your browser doesn't support HTML5 video. Here is a link to the <a href="https://cdn.auth0.com/blog/working-on-windows:nvm-video.mp4"> working on Windows nvm video</a> instead.
</video>

</NonAmpContent>

Thankfully, nothing unremarkable happens! I get Node 10 and NPM installed just as happily as I would have done on a native Ubuntu install. I can also confirm that I was able to install RVM perfectly well, by following [the installation instructions](https://rvm.io/) that I would have normally followed on Linux.

Furthermore, I was able to install ZSH and Oh-my-zsh without any issues, again using the instructions provided for Linux. With this in place, I'm already most of the way towards working the way I'm used to on my Macbook!

## <a class="toc-target" id="developers-developers-developers"></a>Developers, Developers, Developers

Now that I have the tools installed, what is the actual development experience like?

I can happily report that it is fairly unintrusive to the point where I almost forget I'm working on a Windows machine. Thanks to the fact that Windows drives are automatically mounted into your Linux environment, I still get access to my files and folders from within my Ubuntu environment. This means I can use Git and all the other command-line utilities that I'm used to, but still manipulate those files using whatever editor on the host Windows machine I want. By default, your host drives are available in the `/mnt` folder. So a Windows path of `D:\Development\auth0` would be available in your Linux environment as `/mnt/d/Development/auth0`.

At the moment, it's not possible to get access to the Linux filesystem from the Windows host, but [that will change in Windows 10 build 1903](https://blogs.msdn.microsoft.com/commandline/2019/02/15/whats-new-for-wsl-in-windows-10-version-1903/). In a nutshell, WSL will start a <a href="https://en.wikipedia.org/wiki/9P_(protocol)">9P file server</a> on bootup with Windows as the client, serving Linux files over an internal network protocol.

### Windows UI features

For me, the operating system shell is just as part a part of the development experience as the software I use to do my job. For example, I'm a heavy user of OSX's [Spotlight](https://support.apple.com/en-gb/HT204014) feature, and I regularly navigate through my operating system simply by using text search; it's very easy to press `Cmd+Space` and search for what I want.

Windows 10 supports just the same functionality and allows me to move around the operating system very easily, opening programs and manipulating windows simply by using the keyboard. Pressing `Windows Key` opens the Windows Start Menu, where I can just start typing what I want. Admittedly this is not obvious, as there is no focussed text box to indicate to the user that they're able to type a search term.

<AmpContent>
<amp-video controls
  layout="responsive"
  width="480" height="270">
  <source src="https://cdn.auth0.com/blog/working-on-windows:startmenu-video.mp4"
    type="video/webm" />
</amp-video>

</AmpContent>

<NonAmpContent>

<video controls="controls">
  <source src="https://cdn.auth0.com/blog/working-on-windows:startmenu-video.mp4">
   Your browser doesn't support HTML5 video. Here is a link to the <a href="https://cdn.auth0.com/blog/working-on-windows:startmenu-video.mp4"> working on Windows start video</a> instead.
</video>

</NonAmpContent>

Another feature of OSX that I often use is [multiple desktops](https://support.apple.com/en-gb/HT204100), or _Spaces_. This is part of the Mission Control feature that can partition applications into different Spaces, allowing you to easily swipe between them. I use this feature to organize my work better. As an example, with every instance of Visual Studio Code that I have open, I tend to have a corresponding instance of iTerm2 open at my working directory for the project I'm working on. Using multiple desktops, I can group these instances together so that I have different desktops set up for different projects. I can switch between different desktops using a trackpad gesture, or by using `Ctrl+Left/Right Arrow` to move between them.

Luckily for me, Windows 10 supports this exact feature! Just like on OSX, different desktops can be created that play host to different instances of running applications, and I can switch between them using simple keyboard commands. Pressing `Win Key+Tab` gives me a Mission Control-like overview of my available desktops and applications. I can even specify that an instance of an app is available across _all_ my desktops (it's handy to have my favorite music player available wherever I need it!).

![Screenshot of Windows' multiple desktops feature](https://images.ctfassets.net/23aumh6u8s0i/27p5Ty1oNdHUndxZFICkn/f843763eb99f42a17ab07e104773c3dd/working-on-windows_multi-desktops)

<include src="TweetQuote" quoteText="With WSL, I love that I have all the command-line tools that I'm used to available to me, as well as the ability to use multiple desktops, search, and use all my favorite desktop applications."/>

### A word about Docker

I wanted to touch on my experience using Docker with this setup. I already have [Docker Desktop](https://www.docker.com/products/docker-desktop) installed on my host Windows machine, and I was concerned that I may have had to uninstall that in order to get it working inside WSL. Either that, or I would have to live with having _two_ instances of Docker on my machine taking up valuable hard-drive space; one for the Windows host, and another inside WSL.

Thankfully, I didn't have to do either of those things and following [these instructions on setting Docker up](https://nickjanetakis.com/blog/setting-up-docker-for-windows-and-wsl-to-work-flawlessly) to work on WSL (flawlessly, as the article title puts it) was very easy and painless. The basic principle is that Docker running on the Windows host can also be used by the Docker client running inside WSL, as the two are interfaced by a REST API. The key piece of configuration is to tell the Docker client inside WSL where the host is. By default, it connects to a Docker instance running on the same machine, but in this case, we can point it to the instance running on the Windows host.

After having gone through the setup myself, I can confirm that Docker from inside WSL works as expected!

### SSH keys

As you might expect from reading through this post, generating SSH keys works exactly the same way as on any other Linux distro. I followed the [SSH key guide on GitHub.com](https://help.github.com/en/enterprise/2.14/user/articles/generating-a-new-ssh-key-and-adding-it-to-the-ssh-agent) and it just works. The caveat is that the SSH key will be generated for your WSL install, and so the key will need to be added to any services you use that require SSH keys.

This is fine for me, but if you already have an SSH key for your Windows profile then you can [symlink your `.ssh` folder into your WSL install](https://florianbrinkmann.com/en/3436/ssh-key-and-the-windows-subsystem-for-linux/) if you wish to use the same keys.

## <a class="toc-target" id="ive-now-sold-my-macbook"></a>I've Now Sold My Macbook!

I haven't actually sold my Macbook. However, given everything that I've experienced getting my development environment _pretty close_ to what I'm used to, I'm pretty certain that I would be able to live without it for a while longer. I love that I have all the command-line tools that I'm used to available to me, as well as the ability to use multiple desktops, search, and use all my favorite desktop applications.

So far I haven't found an instance where Windows Subsystem for Linux has provided an obstacle where I can't get working, although I admit that even the use-case I present here is probably quite simplistic compared to how some other people would like to use it.

Are you a WSL user? Have your experiences been good or bad? Tell us about it in the comments below!

<include src="asides/AboutAuth0" />


Convert Windows PC to Linux (Ubuntu)

956290?s=200

R&D Content Engineer

Luke Oliff

Streamline Travel API Authorization with Auth0



Travel is one of the world's fastest-growing sectors with demand reaching an all-time high, according to [Deloitte's 2018 Travel and Hospitality Industry Outlook](https://www2.deloitte.com/content/dam/Deloitte/us/Documents/consumer-business/us-cb-2018-travel-hospitality-industry-outlook.pdf). Directly or indirectly, economic contributions in [travel and tourism now account for 10.4% of global GDP](https://www.wttc.org/-/media/files/reports/economic-impact-research/regions-2018/world2018.pdf), reports the World Travel &amp; Tourism Council. Travel investment is set to reach $925B in 2018, and rise by an average of 4.3% over the next ten years to $1,408.3B by 2028.

According to a report by the [World Economic Forum](https://www.weforum.org/) from January 2017, there is widespread recognition among industry leaders that the role of technology is changing from being a driver of marginal efficiency to an enabler of fundamental innovation and disruption. The report states "Digitalization represents an exciting opportunity for the aviation, travel and tourism ecosystem, with the potential to unlock approximately $1 trillion of value for the industry and wider society over the next decade."

In this rapidly growing market, digital transformation is key to staying agile. Application Programming Interfaces (APIs) play a large role in digital transformation and are key tools that allow travel businesses to provide value to customers and, ultimately, compete better. From hotels and flights to cars and buses, [there is an API for virtually every area of travel](https://www.programmableweb.com/news/top-10-travel-apis-uber-tripadvisor-and-expedia/analysis/2015/04/24).

Even mega-giants like [Amadeus](https://amadeus.com/en), [Sabre](https://www.sabretravelnetwork.com/home/), and [Travelport](https://www.travelport.com/), who are the dominant players in the area of one-stop shop travel solutions, have their own [APIs for comprehensive booking and reservations services](https://www.altexsoft.com/blog/engineering/travel-and-booking-apis-for-online-travel-and-tourism-service-providers/). But they didn't start with APIs — they've been dominating this sector for much longer than APIs have been popular.

<include src="TweetQuote" quoteText="In the fiercely contested travel industry, digital transformation is key to staying agile. Auth0 streamlines API development."/>

## Digital Transformation in the Travel Industry Started in the 1950s

With the boom of general aviation in the 1950s, the travel industry was forced to scale quickly. Digital tools were developed to automate how airlines track and sell their inventory. This was the first digital transformation in travel, even before the beginning of the internet. From there, Sabre — or Semi Automated Business Research Environment — was born. The first global distribution system (GDS), Sabre was started in the 1960s with a collaborative effort by American Airlines and IBM. Travelport was developed by United Airlines in the 1970s and Amadeus soon followed, developed by a group of European airlines in the 1980s.

These [three major players still make up more than 90% of the global market](http://www.businesstravel-iq.com/article/2018/08/08/gds-market-share-second-quarter-2018) in airline bookings — and their dominance is down to digital transformation. This gave them the ability to streamline business processes and reach into more areas of the travel industry with relatively little friction.

![Graphic showing travel industry tech, applications, and advances](https://images.ctfassets.net/23aumh6u8s0i/68AtLA3SQx8RGsaWhbv1oE/96743115e80186204dd6203f2d7b3519/connected)

## The Plumbing of the B2B Travel Industry

Suppliers like hotel companies and airlines need to connect with distributors such as wholesalers and GDSs to reach as large an audience as possible for their products. In this scenario, without an API, the suppliers must upload their inventory to the GDS and similar companies that help connect partners and products to consumers, incurring a cost associated with the distribution. This increases ticket prices.

However, if a supplier has an API, it is easier for them to connect supply and demand directly, meaning less cost is passed on to the consumer. By building their own APIs, suppliers like the fictional "airline.com" are almost becoming direct-to-consumer distributors of their own products, offering their own sites or apps to book on, and possibly marketing through a metasearch engine.

Additionally, with APIs, "airline.com" can also sell ancillaries such as rental cars or even hotel rooms through the APIs offered by those ancillary services.

This means that suppliers have built APIs that help them sell more directly, market through metasearch, and integrate with a rental car or a hotel room providers' APIs as well to bolster their package or complementary travel offering.

As Sonja Woodman explained in [APIs – The Plumbing of the B2B Travel Industry](http://www.triometric.net/travel-analytics/apis-the-plumbing-of-the-b2b-travel-industry/), "The whole industry is underpinned by a complex layer of networks and APIs — the plumbing of the B2B travel industry — e.g. communication links and API connectors between merchandising platforms, central reservation systems, global distribution systems, industry transaction hubs and gateways, etc."

## Metasearch Simplifies the Consumer Search Process

Metasearch engines like [Skyscanner](https://www.skyscanner.com/) and [Trivago](https://www.trivago.com/) take data from airlines, travel agents, and global distribution systems and aggregate the results. By aggregating this data, they can provide a website and app that greatly improves customers' experience in finding the cheapest rates for flights (now including hotels and vehicles) and then linking the customer directly to the retailer to make their booking.

Metasearch engines ultimately aggregate prices and show the best options. Potentially, a simple search for flights could run through hundreds of sources of data all linked in a web of APIs, pulling data from different sources.

![Metasearch engine graphic showing flow of information to APIs connecting everything](https://images.ctfassets.net/23aumh6u8s0i/OFAooNM2xeb5nRRgBnnls/731d05d34f7a6a52f36505f53c301f77/meta-search-connects-to-everything)

## TripAdvisor Encourages Partners to Develop APIs

Online Travel Agents (OTAs) like [TripAdvisor](https://www.tripadvisor.com/), [Hotels.com](https://www.hotels.com/) and [Booking.com](https://www.booking.com/) offer hotel rooms, flight tickets, holiday packages, train tickets, and other tourism products directly to consumers by charging a commission.

The power of traditional OTAs usually comes from partners prepared to regularly upload their inventory. The partner bears the overhead of conforming with APIs and developing software to mass upload inventory. The effort of integrating with an API typically does not go the other way around. In other words, TripAdvisor would not spend time integrating with a retailer or hotel chain's APIs unless they were pretty big — think Hilton, Westin, or Four Seasons.

TripAdvisor's service, the TripAdvisor Self Implemented Partner program, is ready to integrate with any partner APIs, so long as those APIs have been built to TripAdvisor's specifications.

TripAdvisor and suppliers get the benefit of valuable live pricing by allowing TripAdvisor to pull prices on demand. This takes place in lieu of having to rely on daily uploads of inventory. With traditional inventory uploads, there is a risk that rooms can become unavailable between the upload and the customer trying to make a booking. In this new API-driven model, consumers gain access to great rates that don't disappear once they try to book them.

![Plane taking off - travel industry digital transformation](https://images.ctfassets.net/23aumh6u8s0i/4y8FIz8p0wWy9okW1CNHsF/1a0166b5aac8b4ee5fc82152560760e3/supercharge-api-development-with-auth0)

<include src="TweetQuote" quoteText="New APIs have the inevitable overhead of developing security, and dedicating resources to it has a cost. Secure your API with Auth0."/>

## Secure Your APIs with Auth0

Creating new APIs has the inevitable overhead of developing security. At a basic level, secure and authorized API integration is required for partners to communicate securely, to identify partner functionality and features, and to apply pricing and billing mechanisms. Dedicating engineering resources to areas such as authentication, identity, security, and compliance comes at a high opportunity cost but it can also represent a larger risk than relying on experts for the same.

In addition to supplying an identity and access management solution, Auth0 provides the necessary building blocks to secure your APIs much more quickly. We allow companies to focus on the core value-add capabilities of their product versus focusing time and effort on implementing capabilities that Auth0 provides out of the box.

Think of the tens, hundreds, or even thousands of API calls that could be triggered behind the scenes by a search for flights. Each one of those calls is made across the internet and secured each time by a layer of security and access management. Building this type of access management is time consuming, and can be substantially challenging to secure.

[APIs are helping to drive digital transformation right now](https://deloitte.wsj.com/cio/2016/06/27/apis-help-drive-digital-transformation/), with digitalization no longer a case of 'if' but 'when.' According to [MuleSoft's Connectivity Benchmark Report 2018](https://www.mulesoft.com/lp/reports/connectivity-benchmark), nearly three quarters of IT decision makers are currently carrying out digital transformation initiatives and nearly 60% claimed that APIs had increased productivity in business operations.

Add Auth0 to this API-centric shift in digital culture and benefit from faster development and more security than if you were to build it yourself. Auth0 provides a polished and reliable service, with tools that are easy to use and implement. In fact, enabling powerful features can be as easy as flipping a switch and hundreds of valuable development hours can go back to writing business logic. [Security is strengthened](https://auth0.com/security), with Auth0 shouldering the responsibility of adhering to security compliance policies and certifications. This means that lots of time dedicated to testing and security can be returned to core app work. Use Auth0 to secure your APIs to maintain your upward trajectory in the digitalization of the travel industry.

<include src="asides/AboutAuth0" />


Travel Digitalization to Unlock $1 Trillion in Value by 2025

brandon-redlinger

Brandon Redlinger

Learn various strategies on how to reach the right people through calculated account selection.



David Ogilvy was far ahead of this time. He was known as the King of Madison Avenue. Though often viewed by his peers as eccentric (and even bizarre – he was known to wear capes to board meetings), he got many things right. One particular quote that still stands out and is applicable in today’s B2B word is this:

> “Don’t count the people you reach; reach the people that count.”

Traditional demand gen has been about reaching more people. However, when taking an account based approach, being able to reach the right people is one of the core principles.
Selecting accounts is a combination of art and science, intuition and logic. Companies combine gut feel, historical performance, and sometimes predictive data science to develop an Ideal Customer Profile, tier their accounts, then allocate their resources properly to work said accounts.
Get this wrong, and you’ll be burning money. Get this right, and you’ll be printing money at will. That’s why this is the foundation for every good Account Based Marketing program. In fact, it goes beyond that – it’s the core of [Account Based Everything (ABE)](http://www.engagio.com/hello-account-based-everything-and-goodbye-account-based-marketing/).

> [Give your customers **enterprise identity integration**, frictionless SSO across your products and adaptive authentication with **MFA and Anomaly Detection**. All of this with a flip of a switch.](https://auth0.com/b2b-enterprise-identity-management)

## How Should You Select Your Target Accounts?

The process of choosing target accounts comes down to a specific definition (ICP) of companies that best match your goals. This definition includes the key dimensions that define high-value accounts that are most likely to buy, including things like:

* Firmographics
* Technographics
* Pain points
* Behaviors
* Intent data
* Strategy

One way to decide on your ICP is to reverse engineer your existing best customers to see what they have in common. Another is to analyze the best customers of your closest competitors: where are they winning and why?

Once you know the specific profile of an ideal account, it’s time to actually pick the accounts; to name the companies you’ll be targeting. On this front, there’s a [maturity spectrum](http://www.engagio.com/account-selection-maturity-model/), with increasing accuracy and sophistication as you move up.

![Maturity Spectrum](https://images.ctfassets.net/23aumh6u8s0i/2MOy2gXLGdPZo7wGFmo8Nc/710292ab5bf449bbe835046392b7e21d/abm-tiers)

The accuracy and completeness of your account selection improves as you move up the maturity spectrum. Do what you need to do – but be advised: time, money and effort spent on rigorous account selection will be repaid many times over in the number and quality of opportunities you generate.

“Data is a never ending problem. Prospectors have a clear idea of which companies should be a good t, and which shouldn’t.” - Aaron Ross, Predictable Revenue

## How Should You Tier Your Target Accounts?

Not all accounts are the same, so you'll also need to organize your target accounts into tiers, based on how valuable they might be (and how much research and personalization will go into each one.)
We take a tiered approach where Tier 1 is a classic ABE/ABM approach, Tier 2 is a lighter approach, and Tier 3 is a hybrid approach.

**Tier 1** – These accounts get the “full” Account Based Everything treatment – meaning each one gets deep research, a customized plan, personalized content, bespoke campaigns, and lots of one-to-one attention.  You map out each buying center, understand where there may be revenue potential, build out the organization chart and see which contacts you know and which you need to know, research key business priorities and individual motivations, and identify relationships and connections to the account.  You publish detailed account dossiers, maintain them quarterly, and even have internal chat groups or forums dedicated to each account.

**Tier 2** – These accounts also get individual research, but perhaps it’s limited to a few key talking points for each account. These accounts may not get completely personalized Plays and custom content, but they should still get highly relevant touches based on their industry and persona. Instead of one-to-one campaigns, these accounts get one-to-few campaigns. Instead of fully bespoke content, perhaps you take content written for their industry and customize it with their logo on the cover and a personalized first and last paragraph.

**Tier 3** – This style covers all the accounts that you want to target but don’t have the resources for personalization and customization. ITSMA calls this Programmatic ABM. It’s basically traditional marketing with account-level targeting. The key difference from demand gen is that instead of scoring leads, you track account-level engagement and wait until the account hits a sufficient threshold to label them a [Marketing Qualified Account (MQA)](http://www.engagio.com/what-is-a-marketing-qualified-account-mqa/).

## How Many Accounts Should You Have in Each Tier?

When determining who you’ll target in your Account Based Everything program, an important decision is how many accounts you should be targeting within each tier of your program.

![ABM Accounts Funnel](https://images.ctfassets.net/23aumh6u8s0i/6jbv7N3g72uKPXJAqlEQDF/bc088c3dfc117e16e1ebe8a622d6ae69/abm-accounts)

Like most decisions related to strategy, there is no one-size-fits-all answer. The number of accounts you choose to target for each Tier in your ABE program – and the number of accounts per AE and SDR – will depend on things like:

* Your expected deal sizes
* The length of the sales cycle
* Your available sales resources
* Your current level of engagement with major prospects
* The intensiveness of your account based strategy

## How Should You Allocate Your Resources?

We think the best way to select target accounts is by looking at how many resources you have to invest. This depends on how you handle the different tiers or styles of ABE.

A given enterprise Account Executive may only be handle a few Tier 1 accounts, but a corporate rep could probably handle a few hundred Tier 3 target accounts at a time. **The right number of accounts is the number that your team can handle in a tier-appropriate way**.

We know one company where management felt their reps could have 100 named accounts at a time – but they gave each one 150 accounts so the reps wouldn’t feel like their territories were too small.

Across a sample of Engagio customers, the median number of accounts per account owner is 50. Quite a few Engagio customers have a lower number, 20 to 30 accounts per account owner, and quite a few have 100 or more accounts per owner.

![Engagio Customer Sample](https://images.ctfassets.net/23aumh6u8s0i/4u0xzFNyWQB00kfCwWmiAn/129611a4505b391dcc511f63d116776d/engagio-customer-sample)

As you can see, there’s a lot that goes into establishing the base for your Account Based Everything program. We’ve just scratched the surface of the first step. To learn more about the WHO (and the WHAT and the WHERE) of Account Based Sales Development, download [The Clear & Complete Guide to Account Based Sales Development](http://www.engagio.com/clear-and-complete-guide-to-account-based-sales-development/).

How many accounts does your team manage, on average? How did you make this decision?

> Auth0 can help B2C companies to enrich the profile of their customers through an easy to use [Modern Customer Identity Management solution](https://auth0.com/b2c-customer-identity-management).

<div class="alert alert-info">
<strong>About Brandon Redlinger:</strong><br />
Brandon Redlinger is the Director of Growth at <a href="http://www.engagio.com/" target="_blank">Engagio</a>, the Account Based Everything platform that orchestrates human connections. He is passionate about the intersection between tech and psychology, especially as it applies to growing businesses. You can follow him on Twitter <a href="https://twitter.com/Brandon_Lee_09" target="_blank">@brandon_lee_09</a> or connect with him on <a href="https://www.linkedin.com/in/brandonredlinger" target="_blank">LinkedIn</a>.
</div>


Build The Ultimate Account Based Marketing Machine with Account Selection

Case study in R reviewing common concepts regarding how to validate, run and visualize a predictive model on production ranking the most suspicious cases.



### Overview

We're going to analyze data that contain cases flagged as abnormal. So we'll build a predictive model in order to spot cases that are not currently flagged as abnormal, but behaving like ones that are.

Topics are:

* Creating a predictive model (random forest)
* Introduction to ROC value (model performance)
* Understanding of label and score prediction
* Inspection of suspicious cases (audit)
* Prediction and dimension reduction (t-SNE)

### Let's start!

This post contains R code and some machine learning explanations, which can be extrapolated to other languages such as Python. The idea is to create a case study giving the reader the opportunity to recreate results. You will need the following:

* Download <a href="https://cloud.r-project.org/" target="blank">R engine</a>
* Download <a href="https://www.rstudio.com/products/rstudio/download/">RStudio IDE</a>


> Note: There are some points oversimplified in the analysis, but hopefully you'll become curious to learn more about this topic, in case you've never done a project like this.

First, install and load the packages (libraries) containing the functions we'll use in this project, and load the data.

```r
# delete these installation lines after 1st run
install.packages("caret")
install.packages("funModeling")
install.packages("Rtsne")
```

```r
library(caret)
library(funModeling)
library(Rtsne)

## download data from github, if you have any problem go directly to github: https://github.com/auth0/machine-learning-post-2-abnormal-behavior
url_git_data = "https://raw.github.com/auth0/machine-learning-post-2-abnormal-behavior/master/data_abnormal.txt"
download.file(url_git_data,"data_abnormal.txt")

## reading source data
data=read.delim("data_abnormal.txt", header = T, stringsAsFactors = F, sep = "\t")
```

The data contains the following columns:

```r
colnames(data)
```

```
##  [1] "id"       "abnormal" "var_1"    "var_2"    "var_3"    "var_4"   
##  [7] "var_5"    "var_6"    "var_7"    "var_8"
```

We are going to predict column `abnormal` based on `var_1`, `var_2` ... `var_8` variables.

Inspecting target variable:

```r
freq(data, "abnormal")
```

![Abnormal variable distribution](https://images.ctfassets.net/23aumh6u8s0i/15gffsr1ajQPqS4jUvdBtK/d13a8d23a33ff1c3336eb7be1ce4d497/target_distribution)

Almost 3 percent of cases are flagged as abnormal.

Next, we create the predictive model using **Random Forest**, doing the model parameter tuning with `caret` library using 4-fold cross-validation optimized for the ROC metric. We'll come back to this later.

_You can find the basics of random forest in the <a href="https://auth0.com/blog/machine-learning-for-everyone/" target="blank">first post</a> of this series._

```r
################################################  
## MODEL CREATION:
################################################
set.seed(999)
## Setting the validation metric: Cross-Validation 4-fold.
fitControl = trainControl(method = "cv",
                           number = 4,
                           classProbs = TRUE,
                           summaryFunction = twoClassSummary)

## Creating the model, given the cross-validation method.
fit_model = train(abnormal ~ var_1 + var_2 + var_3 + var_4 + var_5 + var_6 + var_7 + var_8,
                 data = data,
                 method = "rf",
                 trControl = fitControl,
                 verbose = FALSE,
                 metric = "ROC")
```

There are some important things to note about the last layout:

The `mtry` column indicates a parameter that is optimized by the library `caret`.

The selection is based on the ROC metric. This metric goes from 0.5 to 1 and indicates how well the model distiguishes between `True Positve` and `False Positive` rates. The higher the better.

### Choosing the "best" model

Predictive models have some parameters that can be tuned in order to improve predictions based on the input data. In the last example, `caret` chooses the **best model configuration** based on a desired accuracy metric---ROC, in this case.

Random forest does not have many parameters to tune compared with other similar gradient boosting machines. The parameter to tune was `mtry`.

`caret` tested 3 different values of `mtry`, and the value which maximizes the ROC value is `6`.

_Cross-validating results is really important; you can get more information in ref. [1]_

### What is the ROC value?

This is a long -long- topic, but here we try to introduce you to some aspects to start becoming familiar with it.

#### Some history

During World War II, radar detected if an airplane was coming or not, so they sent out the following alerts:

* `Hey, a plane was spotted!` (positive prediction)
* `Be easy, no plane is coming....` (negative prediction)


These outcomes can be `True` or `False`, so we have four possibilites:

1- If the detection of `Hey, a plane was spotted!` is `True`, it is called a `True Positive`.

2- On the other hand, if `Hey, a plane was spotted!` is `False`, the result is a `False Positive`, which implies that the radar (predictive model) _said_ a plane was coming but there isn't actually a plane out there.

3- The radar _says_ `Be easy, no plane is coming....` and the real result is **Positive**: It's a `True Negative`.

4- The radar _says_ `Be easy, no plane is coming....` and the real result is **Negative**: It's a `False Negative`.

#### Abnormal example data

In the data we used to build the model, we have:

* `Positive` is when abnormal=`yes`.
* `Negative` is when abnormal=`no`.

Normally we associate the positive value with the less representative value, which is the one we are trying to explain and the least common.

#### Analysis of possibilites

Points 1 and 3 imply the radar (or the predictive model) asserts the prediction.

With points 2 and 4, the model failed---it predicted one thing and it was actually the opposite.

The ROC value measures the trade-off between the `True Positive` and `True Negative` rates. This is because we need to be sure about what the model is saying when it detects a `Positive` outcome:

**Is this `Positive` prediction reliable or not?**

#### Usage in medicine

This accuracy metric is so powerful that it is used in other fields, such as **medicine**, to measure the accuracy of certain diagnoses:

_"The flu test for this patient was positive"_: if this result is confirmed after a while or a second test, we've got a true positve.

It is used in many tests in which the result is either `true` or `false`; it's very important to know if we can trust this result.

#### Usage in Auth0

We did some proof of concept to automatically spot the most suspicious login cases in order to boost current **anomaly detection** feature, and ROC curve was a good option to test the predictive model sensitivity.

_More info about current anomaly detection feature at ref. [2]_

#### Understanding the extremes

Knowing extreme ROC values is a good approach to better understanding it:

* An ROC value of `1` indicates all the `Positive` values returned by the model are correct. Perfect model.
* An ROC value of `0.5` indicates all the `Positive` values returned by the model have results similar to random guessing. This is the worst model.

_See more about ROC in ref. [3]_

### Going back to the predictive model

We talked about the predictive model output, which is something like: `positive / negative` or `yes / no`. But it's better to work with probabilities (also known as **score**) so the output of any predictive model (in binary or multi-label class prediction) should be the score.

_For a longer explanation, see ref. [4]_.

Once we get the score value, we can select all cases above a threshold and label them as `abnormal`.

We assign the probability of being `abnormal=yes` to each case:

```r
data$score=predict(fit_model$finalModel, type="prob")[,2]
```

We can kept with those cases with are actually `abnormal=no`:


```r
# filtering cases...
data_no_abnormal=subset(data, abnormal=="no")
```

We obtain the top 2% of cases with the highest score for being abnormal:


```r
# obtaining the score to filter top 2%
cutoff=quantile(data_no_abnormal$score, probs = c(0.98))

# filtering most suspicious cases
data_to_inspect=subset(data_no_abnormal, score>cutoff)
```

And here we've got in `data_to_inspect` ~ 60 cases which are actually no abnormal, but **they are showing a behavior of being suspicious**.

Displaying only the first 6 suspicious IDs to further inspect...


```r
head(data_to_inspect$id)
```

```
## [1]  59  94 105 107 224 259
```

**Is there a way to visualize how the predictive model "sees" data and assigns the probabilities?**

### Let's talk about projections

We've built a machine learning model in order to know the abnormal cases, using random forest.

Predictive models handle several variables **at the same time**, which is different from the classical reporting approach, in which you see two or three variables in one plot.

In the following example, you'll see how **eight variables are mapped in only two dimensions**. In this case there are eight, but it could be thousands. This is quite fancy since it is like a compression of the information.

You've probably already seen this "complex" technique: in geographical maps. They map three dimensions into two:

![Variable reduction](https://images.ctfassets.net/23aumh6u8s0i/5jPpERmUd8aipSneVX0pw9/4f1d9fcb38a6f77c22364191b6135555/map_projections)

There are several ways to do this with data; the most popular is probably Principal Component Analysis -aka PCA- (however, this doesn't lead to good visualizations). The one we used in this post is **t-Distributed Stochastic Neighbor Embedding**, which is also implemented in languages other than **R**. _More info at ref. [5]._

_Google did a live demo based on text data, see ref. [6]._


#### Hands on R!

First some data preparation--excluding id and score variables to create the t-SNE model. Also, converting all string variables into numeric ones since t-SNE doesn't support this type of variable (one-hot encoding or placeholder variables).

Actually, we're going to map 17 variables (not eight) because of this transformation.


```r
# excluding id column and score variable
data_2=data[,!(names(data) %in% c("id", "score"))]
d_dummy = dummyVars(" ~ .", data = data_2)
data_tsne = data.frame(predict(d_dummy, newdata = data))
```


Now we create the t-SNE model, adding it to the `score` variable we created before.


```r
set.seed(999)
tsne_model = Rtsne(as.matrix(data_tsne), check_duplicates=FALSE, pca=TRUE, perplexity=30, theta=0.5, dims=2)
d_tsne = as.data.frame(tsne_model$Y)
d_tsne$abnormal = as.factor(data$abnormal)
d_tsne$score=data$score
d_tsne = d_tsne[order(d_tsne$abnormal),]
```

**Now the magic!**  Plotting the resulting t-SNE model which maps 17 variables in two dimensions :)


```r
ggplot(d_tsne, aes(x=V1, y=V2, color=abnormal)) +
  geom_point(size=0.25) +
  guides(colour=guide_legend(override.aes=list(size=6))) +
  xlab("") + ylab("") +
  ggtitle("t-SNE on Abnormal Data") +
  theme_light(base_size=20) +
  theme(axis.text.x=element_blank(),
        axis.text.y=element_blank()) +
  geom_point(data=d_tsne[d_tsne$abnormal=="yes",], color="black", alpha=1,shape=21) +
  geom_point(data=d_tsne[d_tsne$abnormal=="no" & d_tsne$score>=cutoff,], color="blue", alpha=0.8,shape=5, aes(color=Class)) +
  scale_colour_brewer(palette = "Set2")
```

![tsne on abnormal data"](https://images.ctfassets.net/23aumh6u8s0i/6E69rDzF64Tr1UqGgJoO4v/c618fdcce942e2eaafaf5853b8dd1575/tsne_abnormal_data)

### But what are we seeing there? Analysis

* **Blue rhomboids** represent the cases which are actually not flagged as abnormal, but are flagged as "highly abnormal" by the predictive model (this is what was analyzed before).

* **Pink points** represent the cases which are actually flagged as abnormal.

* **Green points** are the cases which are not actually abnormal, having a low likelihood of being one of them.

**Similar cases tend to be closer in the plot.**

Pink cases are close to the blue ones. These are the cases predicted as **highly suspicious** and that share similar behavior with the ones actually flagged as abnormal.

That's why we left the `score` variable out of the t-SNE model creation. This model put closely together some cases that were actually `abnormal` and `not abrnormal`, and this makes sense since these cases were flagged by the random forest as suspicious ones.

Look at the biggest islands made of green points---there are no abnormal points, flagged or predicted, near them.

#### Conclusions

The cases flagged as abnormal, plus the top 2 percent of suspicious ones detected by the random forest, are mapped closer together away from the normal cases, because they behave differently. This is one way of uncovering the information in the data.

Time to play with your own data :)


### References

* [1] Why validate predictive models? <a href="http://livebook.datascienceheroes.com/model_performance/knowing_the_error.html" target="blank">Knowing the error</a>
* [2] <a href="https://auth0.com/docs/anomaly-detection" target="blank">Anomaly detection</a> feature at Auth0.
* [3] <a href="https://en.wikipedia.org/wiki/Receiver_operating_characteristic" target="blank">Wikipedia ROC Curve</a>
* [4] <a href="http://livebook.datascienceheroes.com/scoring/scoring.html" target="blank">Data Science Live Book - Data Scoring</a>
* [5] Original implementation <a href='https://lvdmaaten.github.io/tsne/'>t-Distributed Stochastic Neighbor Embedding</a>
* [6] <a href="https://research.googleblog.com/2016/12/open-sourcing-embedding-projector-tool.html">
Open sourcing the Embedding Projector: a tool for visualizing high dimensional data</a>

<a href="https://github.com/auth0/machine-learning-post-2-abnormal-behavior" target="blank">Link</a> to clone from Github (only R code).

> Are you building a product that takes advantage of machine learning? We at Auth0, can help you focus on what matters the most to you, the special features of your product. [Auth0](https://auth0.com/) can help you make your product secure with state-of-the-art features like [passwordless](https://auth0.com/passwordless), [breached password surveillance](https://auth0.com/breached-passwords), and [multifactor authentication](https://auth0.com/multifactor-authentication). [We offer a generous **free tier**](https://auth0.com/pricing) to get started with modern authentication.


Machine Learning for Everyone - Part 2: Spotting anomalous data

avatar

Sathyaish Chakravarthy

Learn how to create a simple application using Kotlin, a statically typed programming language that targets the Java Virtual Machine (JVM)

Create an Application in Kotlin and Secure It Using JWTs

Learn the basics of predictive modeling behind one of the most-used machine learning models



We all know that machine learning is about handling data, but it also can be seen as:

> The art of finding order in data by browsing its inner information.


### Some background on predictive models

There are several types of predictive models. These models usually have several input columns and one target or outcome column, which is the variable to be predicted.

![Predictive Model Table](https://images.ctfassets.net/23aumh6u8s0i/3lyx3cgPwFuhHkXXSbOXVX/4c7e01f051a02517a99c53ccd02d202c/predictive_model_table)

So basically, a **model performs mapping between inputs and an output**, finding-mysteriously, sometimes-the relationships between the input variables in order to predict any other variable.

As you may notice, it has some commonalities with a human being who `reads the environment => processes the information => and performs a certain action`.

## So what is this post about?

It's about becoming familiar with one of the most-used predictive models: **Random Forest** (<a href="https://www.stat.berkeley.edu/~breiman/RandomForests/cc_home.htm" target="blank">official algorithm site</a>), <a href="https://cran.r-project.org/web/packages/randomForest/randomForest.pdf" target="blank">implemented in R</a>, one of the most-used models due to its simplicity in tuning and robustness across many different types of data.

If you've never done a predictive model before and you want to, this may be a good starting point ;)
 
### Don't get lost in the forest!

![Random Forest Bear](https://images.ctfassets.net/23aumh6u8s0i/43M0l6bRqJkL0fLyDWUDVw/11a96f92dad15082295a8fbc98fb4eba/random_forest_bear)

The basic idea behind it is to build hundreds or even thousands of **simple and less-robust models** (aka <a href="https://en.wikipedia.org/wiki/Decision_tree_learning">decision trees</a>) in order to have a less-biased model.

**But how?**

Every 'tiny' branch of these decision tree models will see just part of the whole data to produce their humble predictions. So the final decision produced by the random forest model is the result of **voting by all the decision trees**. Just like democracy.

**And what is a decision tree?**

You're already familiar with **decision tree** outputs: they produce `IF-THEN` rules, such as, `If the user has more than five visits, he or she will probably use the app`.

![Decision Tree](https://images.ctfassets.net/23aumh6u8s0i/2RbnwqKvUNvFufTaXfD5FU/63528ea81a6206c3413384a4f7d5f057/decision-tree)

### Putting all together...

If a random forest has `three trees` (but normally 500-plus) and a **new customer arrives**, then the prediction whether said customer will buy a certain product will be 'yes' if 'two trees' predict 'yes'.

![Random Forest](https://images.ctfassets.net/23aumh6u8s0i/5jYXr1dfTjtAb8AYXVrype/a1f33cfd96abfaf9674899348a5c8509/random_forest)

> Having hundreds of opinions -_decision trees_- tends to produce a more accurate result on average -_random forest_-.

_But don't panic, all of the above is encapsulated in the data scientist._

With this model, you will not be able to easily know _how_ the model comes to assign a high or low probability to each input case. It acts more like a black box, similar to what is used for **deep learning** with neural networks, where every neuron contributes to the whole.

## Next post...

Will contain an example -based on real data- of how random forest **orders** the customers according to their likelihood of matching certain business condition. Also, it will **map around 20 variables into only two**, therefore, it can be seen by the analyst ;)

![Next Post](https://images.ctfassets.net/23aumh6u8s0i/54BiL6ZshSQ9smdj6MKCeh/326f1d049165fa861b3e2ea13717adac/next_post)


## What language is convenient for learning machine learning?

Auth0 mainly uses <a href="https://www.r-project.org/" target='blank'>R software</a> to create **predictive models** as well as other data processes; for example:

* Finding relationships between app features: which impacts the **engineering area**.
* Finding **anomalies** or abnormal behavior: which leads to the development of <a href='https://auth0.com/docs/anomaly-detection' target='blank'> anomaly detection </a> features.
* Improving web browsing <a href='https://auth0.com/docs' target='blank'>docs</a>: based on <a href='https://en.wikipedia.org/wiki/Markov_chain'>markov chains</a> (likelihood of visiting `Page B being on Page C`)
* Reducing times for answering **support tickets** using deep learning (not with R but with <a href="https://keras.io/" target='blank'>Keras</a>)

If you want to develop your own data science projects, you could start with **R**. It has a **enormous community** from which you can learn (and teach). It's not always just a matter of complex algorithms, but also about having support when things don't go as expected. And this occurs **often** when you're doing new things.

![R Logo](https://images.ctfassets.net/23aumh6u8s0i/1wFMe9GqIZXjaY1XKxC7ca/3c13cff3bf17654163e92cfdc5352898/R_logo)

### Finally, some numbers about community support

Despite the fact that R (and `Python` with `pandas` and `numpy`) has lots of packages, libraries, free books, and free courses, check these metrics: There are more than **160,000** questions in <a href="http://stackoverflow.com/questions/tagged/r">stackoverflow.com</a>, and another **~15,000** in <a href="http://stats.stackexchange.com/questions/tagged/r">stats.stackexchange.com</a> are tagged with **R**.


"machine"