Auth0 Overview
Accertify Account Protection adds a real-time risk decision to Auth0 logins and new account sign-ups. It uses the device and behavioral signals that the Accertify collector already gathers on your own pages.
- For each login, Accertify recommends allowing, challenging with MFA (step-up), or denying.
- For each sign-up, Accertify recommends approving or denying.
Setup requires a small code change on your side and a Marketplace install in Auth0.
How It Works
Account Protection uses two Auth0 Actions:
- A Post Login Action screens every login.
- A Pre User Registration Action screens new account sign-ups before the account is created.
Both work the same way, described here for login. Your login page keeps doing what it does today. The Accertify collector gathers device and behavioral signals and sends them directly to Accertify. When the user signs in, your page passes short ID references to Auth0, and the Accertify Action uses those IDs to request a risk decision before the login completes.
Only short ID references pass through Auth0. Full device and behavioral data travels on the collector's existing direct channel to Accertify.
What You Manage
- The Accertify collector on your own login and sign-up pages, as it runs today.
- Small changes to your login redirect and sign-up request so they pass the collector's IDs to Auth0.
What Accertify Provides
A Post Login Action and a Pre User Registration Action, installed from the Auth0 Marketplace, that call Accertify and enforce the decision. You never copy, paste, or maintain the Action code. Accertify keeps the Marketplace listing up to date.
Why the Collector Stays on Your Page
Auth0 Actions can't add browser JavaScript to your login page or to Auth0's hosted login page. This is an Auth0 platform limitation, so the collector always runs on a page you control.
Other Event Types
Your Account Protection contract may include other event types, such as account updates. These are integrated with Accertify directly, outside of Auth0. Accertify combines every event with your Auth0 logins and sign-ups, so you see a full picture of each user in the Account Protection portal.
See also:
Prerequisites for Auth0 and Account Protection[Prerequisites for Accertify Account Protection for Auth0]
Passing Device and Behavioral IDs to Auth0 at Login[Passing Device and Behavioral IDs to Auth0 at Login]
Account Protection Recommendations in Auth0[Account Protection Recommendations in Auth0]