Protocol practice· Customer IAM (CIAM) Members
Auth0: customer sign-in, set up without the usual mistakes
Objective: Lumen Notes is moving its customer sign-in to Auth0. Register the app, send customers through Auth0’s sign-in page, get a token your API can check, put the customer’s plan in it, and keep them signed in safely.
5 steps15 concepts 12 min
What Auth0 runs for youNot sure? Which protocol?
Sign-inWho is this?
AccessWhat may this app do?
OAuthAuth0 runs this
AccountsDoes the account exist?
What you’ll do
- 1Register the app. Lumen Notes is a React single-page app: it runs entirely in the customer’s browser.
- 2Tell Auth0 where customers may return. Customers sign in on Auth0’s Universal Login page, not in your app, and are sent back afterwards.
- 3Get a token your API can check. Lumen Notes’ API is registered in Auth0 with the identifier https://api.notes.example, with offline access turned on.
- 4Put the customer’s plan in the token. The API serves extra features to customers on the Pro plan.
- 5Keep customers signed in, safely. A single-page app keeps its refresh token in the browser, where malware or a malicious extension can take it.