Auth0 Pocket Book — Uplatz
70+ deep-dive flashcards • Authentication & Authorization • OAuth2 & OIDC • JWT • Security • Multi-Tenant SaaS • Interview Q&A
Cheat-friendly snippets • RBAC • Integrations • Enterprise SSO • Production-ready best practices
1) What is Auth0?
A flexible identity platform for authentication, authorization, and secure access. It supports OAuth2, OIDC, SAML, social logins, and enterprise identity providers.
2) Core Benefits
✔️ Centralized identity
✔️ Secure authentication
✔️ Passwordless options
✔️ RBAC & ABAC
✔️ Extensible with Rules & Actions.
3) Authentication vs Authorization
Authentication = Who you are
Authorization = What you can do.
4) Standards
Auth0 is compliant with OAuth2.0, OpenID Connect, SAML 2.0, SCIM, and more.
5) JSON Web Tokens (JWT)
Auth0 issues JWTs as identity & access tokens. They are signed, optionally encrypted, and stateless.
6) Registering an App
1. Go to Auth0 Dashboard
2. Applications → Create Application
3. Select type (SPA, Native, M2M, Regular Web)
4. Get Client ID & Secret7) Universal Login
Default hosted login page with username/password, social login, MFA.
8) SDKs
Auth0 provides SDKs: auth0-spa-js, auth0-react, auth0-angular, express-openid-connect, etc.
9) Example — SPA Login
import { Auth0Client } from "@auth0/auth0-spa-js";
const auth0 = new Auth0Client({
domain: "dev-xyz.us.auth0.com",
client_id: "CLIENT_ID",
redirect_uri: window.location.origin
});
await auth0.loginWithRedirect();10) Example — Express.js API
import { auth } from "express-openid-connect";
app.use(auth({
authRequired: false,
issuerBaseURL: "https://dev-xyz.us.auth0.com",
baseURL: "http://localhost:3000",
clientID: "CLIENT_ID",
secret: "LONG_RANDOM_STRING"
}));
11) OAuth2 Grant Types
✔ Authorization Code
✔ PKCE
✔ Client Credentials
✔ Implicit (legacy)
✔ Device Code.
12) OpenID Connect (OIDC)
OIDC extends OAuth2 with identity layer. Adds id_token with user profile claims.
13) ID Token vs Access Token
ID Token proves identity to client.
Access Token authorizes API calls.
14) Refresh Tokens
Long-lived tokens for renewing sessions. Secure storage required.
15) Example Token Payload
{
"sub": "auth0|123456",
"name": "Alice",
"email": "alice@example.com",
"iat": 16999999,
"exp": 17009999,
"aud": "myapi"
}
16) MFA Options
✔ TOTP (Google Authenticator)
✔ SMS OTP
✔ Push Notifications
✔ WebAuthn (FIDO2).
17) Rules vs Actions
Rules: Legacy JavaScript functions executed at login.
Actions: New event-driven extensibility with lifecycle hooks.
18) Breached Password Detection
Auth0 flags logins with compromised credentials and can block or alert users.
19) Passwordless Login
Email magic links or SMS codes instead of passwords.
20) Attack Protection
Brute-force detection, suspicious IP blocking, anomaly detection built-in.
21) Enterprise Connections
✔ SAML 2.0
✔ Azure AD
✔ Google Workspace
✔ Okta
✔ Ping Identity.
22) RBAC
Role-based access control with roles, permissions, and scopes in tokens.
23) Multi-Tenant SaaS
Each tenant can have its own connection, branding, and RBAC policies.
24) Branding
Customize login pages, emails, error pages, and tenant logos.
25) Marketplace
Auth0 Marketplace offers prebuilt integrations: logging, analytics, security, and monitoring.
26) Logs
Every login, API call, error is logged. Stream logs to Splunk, Datadog, ELK.
27) CLI
Auth0 CLI manages tenants, apps, users, and roles directly from terminal.
28) Terraform Provider
Infrastructure-as-code for Auth0 configuration.
29) Deploy CLI
Promotes configurations between environments (dev, staging, prod).
30) Rate Limits
Auth0 APIs have rate limits: 2 requests/sec per endpoint by default.
31) Q: Auth0 vs Firebase Auth?
Answer: Firebase Auth is lightweight and Google ecosystem-focused. Auth0 is enterprise-ready, extensible, and supports more identity protocols.
32) Q: How does PKCE improve security?
Answer: PKCE prevents stolen auth codes from being exchanged without the client secret, protecting SPAs & mobile apps.
33) Q: How are JWTs validated?
Answer: Using the Auth0 JSON Web Key Set (JWKS). Client verifies the signature, expiry, issuer, and audience.
34) Q: Can Auth0 integrate with APIs?
Answer: Yes. Define APIs in Auth0 Dashboard → Assign scopes → APIs validate access tokens.
35) Q: How do you migrate users to Auth0?
Answer: Bulk import hashed passwords, or use “lazy migration” where users reauthenticate and are moved gradually.
36) Q: Session vs Token-based auth?
Answer: Sessions store state on server. Tokens are stateless and scalable across APIs/microservices.
37) Q: Best practices for securing refresh tokens?
Answer: Store in secure storage (Keychain, EncryptedStorage), rotate frequently, use Refresh Token Rotation in Auth0.
38) Q: Does Auth0 support passwordless?
Answer: Yes, via email magic links or SMS one-time codes.
39) Q: What is the difference between Rules and Actions?
Answer: Rules are legacy JS functions, Actions are modern event-driven flows with better tooling.
40) Q: How do you handle multi-tenant SaaS auth with Auth0?
Answer: Each tenant maps to a connection or organization. RBAC + branding ensures tenant isolation.