Sign-Up Screening Coverage for Auth0
4 min
Before Auth0 creates a new account, the Pre User Registration Action sends the attempt to Accertify, which recommends approving or denying it. A denied sign-up is blocked and no account is created. Accertify never receives the user's password.
Which Sign-Ups Are Screened
- Auth0 runs the Pre User Registration trigger only for Database and Passwordless connections.
- Sign-ups through social or enterprise connections, such as Google, don't reach this Action. The Login Action screens those users on their first login instead.
- Sign-ups with an email address that already exists are stopped by Auth0 before the Action runs.
Device and Behavioral IDs at Sign-Up
- ext- parameters don't reach the sign-up trigger, so sign-ups pass the collector's IDs in the sign-up request's user_metadata.
- The IDs are optional. Sign-ups are still screened without them, but Accertify's decision is stronger with device and behavioral signals.
- Auth0's hosted sign-up page can't add user_metadata to the request. If you use it, sign-ups are screened without device and behavioral IDs.
Limits on user_metadata
- Send ID references only. The same rule as for login applies: no payload data. See Limits for ext- Parameters in the Auth0 Login Redirect[Limits for ext- Parameters in the Auth0 Login Redirect].
- The values in user_metadata are also saved to the new user's profile.
- If user_metadata exceeds 20,000 bytes, the Action skips all optional fields and sends only the core sign-up details.
See also:
Passing Device and Behavioral IDs at Sign-Up[Passing Device and Behavioral IDs at Sign-Up]
Adding the Account Protection Action to the Sign-Up Flow[Adding the Accertify Account Protection Action to the Sign-Up Flow]
Prerequisites for Auth0 and Account Protection[Prerequisites for Accertify Account Protection for Auth0]