DEV Community: Ana Cidre

May 2025 in Auth0: Async Auth, Real-Time Streams, and Custom Everything

Ana Cidre — Mon, 09 Jun 2025 08:18:39 +0000

May brought a wave of powerful new capabilities for you: async authentication flows with CIBA, fine-grained M2M quotas for secure API usage, expanded event streaming for automation, and even more control over the Universal Login experience, including WebAuthn and biometrics.

If you’re building with Auth0, this month’s releases give you more control over UX, security, and system integrations with less friction.

Let’s Dig In

Client-Initiated Backchannel Authentication (CIBA) – Now GA

The CIBA flow is now Generally Available, and it's a game changer for devs building across devices, services, and roles.

It enables asynchronous authentication where:

One device initiates the request (e.g., a smart TV, AI agent, CLI tool)
Another device authenticates the user (typically a mobile app with Guardian SDK)

Highlights:

Works great for headless UIs, customer service flows, or AI agents needing human approval
Built on Rich Authorization Requests (RFC 9396)
Auth can happen off-screen, out-of-band, or in-context

Explore CIBA in the docs.

Auth0 CLI: More UX Control, Better Testing, New Powers

The latest CLI update gives developers even more hands-on control over login, org testing, and tenant config.

New capabilities:

Customize Universal Login from the CLI
Block/unblock users programmatically
Use test login with Organizations
Better logs + user management commands
Bug fixes + smoother workflows

Check the CLI reference.

Event Streams for Extensibility – Now in Early Access

Already loved for user lifecycle events, Event Streams now support Extensibility Events. This means you can:

Subscribe to changes in users and organizations
Route real-time events to Webhooks or EventBridge
Build automation and observability into your dev workflow

Use this to sync downstream systems, trigger CI/CD pipelines, or log important changes without polling the Management API.

Set up your stream.

Universal Login: WebAuthn, Biometrics, and Logout – Now Customizable

The Advanced Customizations for Universal Login (ACUL) SDK just leveled up. You can now build client-rendered, pixel-perfect versions of:

MFA with WebAuthn (roaming + platform)
Biometric flows
Reset password screens
Logout states (completed, error, aborted)

Tooling support:

ACUL SDK
Auth0 CLI
Deploy CLI
Terraform Provider

No more default templates - your login experience, your UI, your rules.

More Cool Features We Have Shipped to Improve Your Experience

Universal Login Language Selector for End Users: Tired of relying on browser headers or ui_locales? You can now let users choose their preferred language directly on Universal Login pages using Custom Prompts.
Fine-Grained M2M Token Quotas (Now in Early Access): Allows you to set precise hourly and daily limits on machine-to-machine token issuance at the app or organization level. This helps prevent API abuse from misconfigured clients, returns automatic 429 responses when limits are hit, and provides full visibility through logs and response headers. No external rate limiting or token caching hacks required.
Native Sign-in with Google for Android: If you’re building native Android apps, you can now use the Android Credential Manager’s Sign in with Google to let users authenticate seamlessly using their existing Google sessions - no passwords, no extra prompts.

Community and Events

Where We Were in May

May took us around the world—from live webinars to some of the most exciting developer and API conferences.

Qiita Webinar with Twilio: Daizen Ikehara shared strategies for building scalable and secure SaaS apps tailored for the Japanese developer ecosystem.
Infobip Shift: Carla Urrea spoke about “Securing AI: A Journey Through Access Control Systems.”

API Days New York: Ramona Schwering talked about AI and security.
Dublin Tech Summit: Deepu Sasidharan talked about how OAuth and OpenFGA Can Keep Your AI Agents from Going Rogue!

Where We’ll Be in June

June is shaping up to be a big month for developer events, and we’re showing up in full force across frontend, AI, open source, and cloud communities.

If you’re attending any of these, come say hi, catch a talk, or grab some Auth0 swag!

dev_day (25) (June 18th): Auth for Agents is a one-day, free, virtual crash course on auth for AI agents and humans with Auth0. RSVP today to join us on June 18th.

Frontend Nation 2025 (June 3rd): Ramona Schwering will share tips on building secure, user-friendly frontends.
AI Engineering World's Fair (June 3rd): Exploring the future of AI-powered software and secure identity in agent workflows.
AWS Summit Hamburg (June 5th): Juan Cruz Martinez joins to discuss secure multi-tenant patterns for AWS builders.
RenderATL (June 11th): Ramona Schwering and Jessica Quick will be alongside Netlify at the booth, while Shawn Meyer will be on a panel on AI.
React Summit (June 13th): Ramona returns to the stage with a developer-first approach to modern identity in React apps.
VLCTechFest (June 14th): Carla Urrea joins the dev community in Valencia to connect on open source and identity.
Open Source Summit North America (June 23rd): Carla shares insights on securing community-led software.
AWS Summit Japan (June 25th): Daizen Ikehara will present best practices for large-scale identity in the public cloud.
Vercel Ship (June 25th): Juan Cruz Martinez will be on-site with a spotlight on edge-first auth patterns for AI apps.

Planning to attend? Reach out! We’d love to meet you and hear what you’re building.

Expect talks, demos, and plenty of real-world tips on building secure, AI-aware, and scalable identity experiences.

That’s It for May!

We’ll be back next month with more dev-first updates. Until then:

Stay secure.
Keep shipping.
We’re here if you need us.

April 2025 in Auth0: Auth That Works for Humans and AI

Ana Cidre — Fri, 02 May 2025 15:30:49 +0000

This month, Auth0 takes a big step toward the future of identity—one where AI agents, natural language interfaces, and human users coexist securely. April’s updates are centered on helping developers build for this new reality.

From Auth for GenAI, a developer-first identity solution purpose-built for AI agents and secure delegation, to the new MCP Server, which lets AI tools manage tenant configuration with natural language, this release is packed with tools that make complex auth feel simple, even in AI-first workflows.

Let’s take a look at what’s new, what’s in preview, and what you can start building with right now.

Updates You Don’t Want to Miss

Auth for GenAI – Developer Preview now available

Generative AI is transforming how apps interact with users and how users interact with data. But securing those interactions hasn’t always been easy. That’s why we built Auth for GenAI, now in Developer Preview.

This new solution brings together everything you need to securely build AI-powered applications, whether you're embedding AI agents, enabling human-in-the-loop workflows, or orchestrating actions across third-party APIs.

Highlights:

User Authentication for AI agents, with support for linking, impersonation, and delegation
Token Vault to securely manage and refresh access tokens for third-party APIs (e.g., Gmail, Slack, GitHub)
Async Authorization to support workflows that require delayed human approval
Fine-Grained Authorization (FGA) for document-level permissions in Retrieval-Augmented Generation (RAG)

Works with LangChain, LlamaIndex, GenKit, and Vercel’s AI SDK.

Get started with Auth for GenAI

Auth0 MCP Server – Natural language meets tenant management

The new Auth0 MCP Server brings the power of natural language interfaces directly to your Auth0 tenant.

Using the Model Context Protocol (MCP), you can now authorize AI tools like Claude Desktop, Cursor, or Windsurf to safely interact with your tenant—whether that's updating configurations, deploying Actions, or managing APIs—all through secure, context-aware requests.

Highlights:

Secure login via OAuth 2.0 Device Flow
Credential storage via system keychain
Rich management APIs, including support for tenant logs, app configuration, and more
Built-in access controls, so AI agents only do what they’re allowed to.

If you want to learn more about Auth0 MCP Server, you can read the announcement here.

Token Vault – Secure access to external APIs (Early Access)

Managing API access on behalf of users can be tricky—especially when it comes to storing and refreshing third-party tokens securely. Enter Token Vault, now in Early Access for Public Cloud tenants.

Token Vault allows your applications and AI agents to call external APIs—like Google Calendar, GitHub, or Microsoft Graph—on behalf of the user, without you having to build and maintain complex refresh workflows or custom integrations.

Why it matters:

Delegated API Access – Securely call downstream APIs on the user’s behalf using short-lived access tokens.
No Refresh Token Handling – Auth0 manages token storage and refresh cycles for you.
Supports Top Providers – Integrates with popular identity providers like Google, GitHub, and Microsoft.
AI-Ready – Designed to work seamlessly with Auth for GenAI, enabling AI agents to act on behalf of users across different services.

Learn more in the Token Vault documentation .

Or see how it works with GenAI apps: Call APIs on User’s Behalf.

Note:
Token Vault is currently available only for Public Cloud tenants. Contact your Technical Account Manager to enable Early Access.

More cool features we have shipped to improve your experience:

Real-Time logs for Actions – Now Generally Available

Debugging just got a whole lot easier. Real-Time Logs for Actions, Custom Database Scripts, and Custom Social Connections is now GA. Developers can now see console outputs (like console.log) in real-time directly from the Auth0 Dashboard. Find it under Dashboard > Monitoring > Action Logs

Mobile Driver’s License verification – Limited Early Access

We’re excited to introduce the Mobile Driver’s License (mDL) Verification Service, now in Limited Early Access. This new capability enables businesses and platforms to enrich user profiles during sign-up or login using trusted, government-issued identity data. Whether embedded in your authorization flows via our Forms widget or triggered on-demand, mDL verification unlocks a seamless, secure identity experience.

New US Public Cloud Region – prod-us-5 Now Live

Auth0 is growing with you. We’ve launched a new US Public Cloud environment: prod-us-5. This expansion increases regional capacity and performance for onboarding new Auth0 Public Cloud customers—while maintaining full support for Auth0’s Authentication and Management capabilities.

Community and Events

We’ve been on the road sharing ideas, best practices, and demos around the future of identity and AI.

Where were we in April

VoxxedDays Amsterdam (Apr 3): Deepu shared AI authorization strategies for LangChain and OpenFGA
Apidays Singapore (Apr 15–16): Daizen covered scaling SaaS platforms for enterprise readiness
AWS Summit Amsterdam (Apr 16)
React Miami (Apr 17–18)
PyCon DE (Apr 23–25): Juan Cruz Martinez presented on secure human-in-the-loop AI interactions
CityJS London (Apr 23–25)
Vue.js Global Summit ‘25 – AI Edition (Apr 29–30): Ramona Schwering’s talk: Developer’s Guide to Not Summoning Skynet
AWS Summit London (Apr 30)

Thanks to everyone who stopped by — we loved connecting with builders across the world.

Where we’ll be in May

Looking ahead to May, you’ll find us at a variety of developer and tech-forward events across the globe. Come chat identity, APIs, AI, and all things dev with the Auth0 team:

**ADC Conference (5-7 May): **Ramona will be giving a talk, “The AI Developer's Guide to Not Accidentally Summoning Skynet.”
**Infobip Shift (May 6) – **Carla will be talking about “Securing AI: A Journey Through Access Control Systems.”
**API Days New York - Generation AI (May 14) – **Ramona will be talking about security and AI
Dublin Tech Summit (28-29 May) – Two days of tech talks, networking, and developer energy

Planning to attend? Let us know—we’d love to meet up!

That’s a Wrap for April

As AI becomes more integrated into the software we build, so does the need for thoughtful, secure identity design. With Auth for GenAI, Token Vault, the MCP Server, and new features like mDL Verification and Real-Time Logs, we’re here to help you ship smarter, safer, and more scalable apps.

Stay secure.
Keep shipping.
We’re here if you need us.

5 things I learned about online events as a speaker

Ana Cidre — Mon, 14 Dec 2020 12:03:08 +0000

I can’t emphasize how much I miss in-person events. The smell of coffee while you’re walking into the lobby in the mornings, the gathering of developers each with their favourite dev t-shirt, the talks by amazing speakers who always give their best at conferences, the knowledge sharing, the networking, the after conference events... I could go on for a while, but I’ll stop here.

Now everything is online and it was so sudden that we were all thrown into this pool without really knowing how to swim. After 7 months of learning, I want to share my thoughts with you.

External camera = focus

I am putting this one first because it has helped me so much! I invested in an external webcam instead of just my laptop's standard webcam, mainly to have a better video quality while giving talks, hosting videos and creating content.

To my surprise, it helped me most to improve my focus. I noticed that when I gave a talk at a virtual conference, I would easily be distracted and start looking elsewhere, maybe at the wall behind my laptop, or maybe at a different screen. This was because I wasn’t receiving the feedback from the audience that I’m used to from in-person events. I just didn’t know where to look. An external webcam helped me to look straight at the camera and concentrate on what I was talking about.

From an audience perspective, this is great because it feels like the speaker is speaking directly to you. It has been a HUGE change for me and I feel like I’m delivering better quality talks because I am speaking to an audience and I can fully concentrate on what I’m talking about!

Practice just as much or more

Giving talks online is hard. You cannot use your body language as much, you do not get the energy or feedback from your audience and you’re limited to a small space. That is why practice is SO important.

When you practice you should not just practice your talk, there are so many more factors involved. The way you look at the camera, the way you move your arms and hands, and - most importantly - your facial expressions. Your facial expressions are suddenly much more important than they would be on stage. You don’t have to exaggerate too much but you have to make sure that they are in line with what you are saying. Your face is the only part of your body that your audience can see.

Also, speak clearly! Everything becomes more muffled online so make sure you decrease your talking speed and pronounce all the words.

All of this should be coordinated and you can only make sure that this is possible through practice.

Ways to keep the audience engaged

Pause. Seriously, take a breath, your audience needs it just as much as you do. When going online, I noticed that I speed up on my talks because I’m not seeing the audience react. After saying something important, interesting or hard to understand, take a moment for your audience to soak it in. Something like “Phew, that was a lot, let’s take a breather”, or even “let’s take a pause and go over what we just saw” and then summarising in bullet points might help the audience to understand everything you just said.

Be unique! Do something unexpected. It could be bringing props onto the scene, showing something unexpected, or maybe just doing a joke or adding something to your slides. We’re constantly online nowadays and we need something to keep our attention or bring it back.

Invest in good equipment

I know that this isn’t alway a possibility but if you can, get yourself an external camera (as mentioned above) and a good microphone. They really do make all the difference! The webcam gives a clearer view of the speaker and also a better image, and the microphone helps to have a clearer voice!

Here’s my setup:

Logitech BRIO 4k
Rode podcaster (be careful because there is also the procaster :D )
Fully standup desk (I just can’t give talks while sitting down)

Ask for feedback

This is something I normally ask the organisers of the event for. I ask them if there is any feedback for me, also while giving my talks I ask people to reach out to me on Twitter to give me any feedback they might have for me! I can only improve if I know which areas I need to work on.

If you do provide feedback please ALWAYS make sure it’s constructive feedback! It’s the only type of feedback speakers can really work with.

Well, that’s it folks! If you have any questions please feel free to reach out at any time, the best place is on Twitter. Also remember that speakers put a lot of time and effort into creating a talk and presenting it, so please be kind.

5 things I learned about online events as an organiser

Ana Cidre — Wed, 07 Oct 2020 11:11:46 +0000

Since the start of the pandemic, we have all had to make significant changes to our lives. Here in Spain, things went crazy around mid-March. I had just started my new job as a Senior Developer Advocate at Auth0 in February. When the lockdown started, we needed to find a solution to go online - and fast.

That’s when Avocado Labs was born: An online meetup space for online talks and community hours. It started as an experiment - We wanted to have a platform where amazing speakers could still give their talks, as due to the pandemic many conferences were being cancelled or postponed. As an alternative, we wanted to deliver this amazing content to the comfort and safety of your homes.

When we started Avocado Labs, not just the pandemic was on our minds, but also the fact that there are many, many people in the world that just cannot attend in-person events, for whatever reason that may be. We wanted to make it possible for more people in the entire world to access the great content that is normally shared at conferences.

After the first 6 months of running Avocado Labs, I want to share with you some things that I have learned so far:

Experiment! There is no one-fits-all solution.

One of our main priorities is to create a safe and welcoming environment for both speakers and attendees. So, when we first started Avocado Labs, we decided to use a tool we knew and that we were used to: Zoom. We had heard about “Zoombombing” so we decided to make it a Zoom webinar, which allows for only panelists to share their screens. We thought it would be the right option.

We also opted for Meetup as a central event organisation platform, again because it’s a tool we already knew and lots of communities already use it.

In the first episode, we had some chat bombers, which wasn’t very nice. After this we decided to disable chat for attendees. This obviously wasn’t the community vibe we wanted, and it was a very “cold” experience, although we still had the Q&A option open. We knew we had to change.

That’s when we decided to ask our community what they wanted, and I’ll go more into detail about this in my second learning. Long story short, we decided to move away from Zoom, as it turned out not to be what we were looking for. Through our own experiences as speakers at other virtual events, we found an awesome tool called Streamyard, which allows us to stream to both YouTube and Twitch simultaneously.

Streamyard also made it a lot easier to invite speakers, as we only had to share a link with them! We now have this link in the calendar invite and then we hit “Go live” when we are all ready, without the necessity of recording additional tech checks. Streamyard also has a cool feature to add comments to the screen so that both the audience and the speaker can read the questions that we select during Q&A sessions. You can also personalize the live stream with banners, logos and graphics, in order to add branding to your videos.

Streamyard is still the tool we use for streaming today. For testing purposes, we stopped using Meetup for a while somewhere in between, but we went back to it, because it turned out that it was helping us reach our audience. But the moral of this story is that you need to find what’s right for you and your community and it’s OK to try new things or go back to your old ways.

Starting with our next episode, we will be streaming only to Twitch, as we’ve seen a huge decline on the YouTube live stream and a rise in Twitch, but we will still be posting our videos on YouTube later.

Get your audience involved.

There are many ways you can get your audience involved. I actually don’t like the word audience because I believe that Avocado Labs is much more than that. We’re a community and at the end of the day a community is a group of people that share or have certain attitudes and interests in common. In our case it’s all things tech.

We involve our community before and after events by asking them what they want to see on Avocado Labs. During our events with a Q&A session and live chats, we keep a close eye on the comments to block/report/ban anyone who doesn’t follow our Code of Conduct.

We also involve the community in other ways such as helping us decide what tools they’d like to see us using. When we figured out that Zoom wasn’t working for us, we reached out to the community on Twitter and ran a poll to see where they’d like to see us stream to:

// Detect dark theme var iframe = document.getElementById('tweet-1275017924223393792-740'); if (document.body.className.includes('dark-theme')) { iframe.src = "https://platform.twitter.com/embed/Tweet.html?id=1275017924223393792&theme=dark" }
(Click on the tweet to see the results!)

We have also reached out to see what event format the community preferred - whether they wanted 1 talk per episode or 2 shorter talks. We asked this because we noticed a decline in our viewers after a certain amount of time. Remember to look at your stats on the platform you’re using because you can learn a lot about what your community wants!

// Detect dark theme var iframe = document.getElementById('tweet-1297926859733303297-476'); if (document.body.className.includes('dark-theme')) { iframe.src = "https://platform.twitter.com/embed/Tweet.html?id=1297926859733303297&theme=dark" }
(Click on the tweet to see the results!)

Figure out what topics your audience wants.

You can figure out what topics your audience wants by doing the two above: Experimenting and asking your community. But also by looking at which episodes attract more attendees than others. I personally feel that events that have more interaction have a higher chance of people attending.

Online talks can always be watched on YouTube later, but having the chance to ask your questions, speak to the speaker or other ways of interacting is more unique and will attract people to actually turn up.

Our community hours, which are 40min episodes where people can bring their questions on the related topic always have a good audience! We’ve hosted episodes on how to get into tech, how to create a product in 2 weeks and even a more Auth0 specific one where people could come and ask their developer support questions.

Also assess the situation: If there’s already a good online event on something you want to share, for example “How to train a puppy”, maybe find something that will differentiate you from the rest!

Report, report!

Trust me, I really don’t enjoy reporting, but I still do it. What do I mean by reporting? Well, putting down in a document how the episode went and why I think it went well or failed miserably. I also add numbers in there, because after a while they can be tricky to find. Those numbers include the amount of live attendees, chat questions, etc. You need to figure out what’s important for you.

Then you can look back at the reports whenever you need to and figure out what worked and what didn’t! Another useful thing is to create a spreadsheet and throw in numbers from each episode and get some graphs. This will make things a lot more visual and also easier to understand.

Tools, just enough but not too many.

Tools are nice to have and we tend to always want the newest fanciest one that has just arrived. It just adds on to our to-do list, so be wary of this! Also, sometimes we think that we might need a tool when actually we might just need a simple spreadsheet.

What do I mean by adds on to our to-do list? That it’s just another thing that we will have to check off our checklist for each episode and trust me, those checklists start off by already being very long.

We use the minimum:

Twitch: https://www.twitch.tv/auth0
Meetup: https://www.meetup.com/avocado-labs-talks/
YouTube: https://www.youtube.com/playlist?list=PLZ14qQz3cfJLVoaRUdk5JOzOpTvV3BYE4
Our own Website: http://avocadolabs.dev/
Google Docs/sheets

Overall there isn’t a one solution that will fit every online event, you do you and make it unique. Just remember that your community will show you what they want and need, so you just need to listen and adapt. Just make sure to create a safe and welcoming environment for everyone.