---
title: Sign-Up Screening Coverage for Auth0
slug: public-apis/sign-up-screening-coverage-for-auth0
createdAt: 2026-11-02T15:08:19.751Z
---

::::ExpandableHeading
###

**Topic type: Constraint**

:::hint{type="warning"}
**Purpose**: Defines which Auth0 sign-ups Accertify Account Protection screens and the conditions that apply to sign-up data.

**Audience**: Engineers and administrators implementing sign-up screening.

**Applies to**: The Pre User Registration Action on Database and Passwordless connections.

**Does not apply to**: Login screening. Sign-ups through social or enterprise connections, which the Login Action screens on the user's first login.
:::
::::

Before Auth0 creates a new account, the Pre User Registration Action sends the attempt to Accertify, which recommends approving or denying it. A denied sign-up is blocked and no account is created. Accertify never receives the user's password.

## Which Sign-Ups Are Screened

- Auth0 runs the Pre User Registration trigger only for Database and Passwordless connections.
- Sign-ups through social or enterprise connections, such as Google, don't reach this Action. The Login Action screens those users on their first login instead.
- Sign-ups with an email address that already exists are stopped by Auth0 before the Action runs.

## Device and Behavioral IDs at Sign-Up

- `ext-` parameters don't reach the sign-up trigger, so sign-ups pass the collector's IDs in the sign-up request's `user_metadata`.
- The IDs are optional. Sign-ups are still screened without them, but Accertify's decision is stronger with device and behavioral signals.
- Auth0's hosted sign-up page can't add `user_metadata` to the request. If you use it, sign-ups are screened without device and behavioral IDs.

## Limits on user\_metadata

- Send ID references only. The same rule as for login applies: no payload data. See [Limits for ext- Parameters in the Auth0 Login Redirect](docId\:wPjzSjrRQySPva4cK8SsV).
- The values in `user_metadata` are also saved to the new user's profile.
- If `user_metadata` exceeds 20,000 bytes, the Action skips all optional fields and sends only the core sign-up details.



***

**See also**:

::::LinkArray{contentSource="CUSTOM"}
:::LinkArrayItem
[Passing Device and Behavioral IDs at Sign-Up](docId\:JgZtPuSeej4oFjJSsEPAD)
:::

:::LinkArrayItem
[Adding the Account Protection Action to the Sign-Up Flow](docId\:sWT_Gsqd57rKRvvASdftt)
:::

:::LinkArrayItem
[Prerequisites for Auth0 and Account Protection](docId\:eRzmVbOwVV2hPdcncE3tb)
:::
::::