diff --git a/main/docs/authenticate/identity-providers/social-identity-providers.mdx b/main/docs/authenticate/identity-providers/social-identity-providers.mdx index fb032dab1f..7df34cf3a0 100644 --- a/main/docs/authenticate/identity-providers/social-identity-providers.mdx +++ b/main/docs/authenticate/identity-providers/social-identity-providers.mdx @@ -5,6 +5,10 @@ description: Browse Auth0's supported social identity providers and connect any Social login is a method of authentication that allows users to log in to an application using existing credentials from a social identity provider, such as Google or Facebook. As users frequently have their social credentials stored in their browser or device, social login provides a frictionless user experience that requires minimal manual interaction with an application. + +If you're prompted to add [Google Sign-In](/docs/authenticate/identity-providers/social-identity-providers/google) or another identity provider (IdP) to your app, review this article for a general overview of social providers. For programmatic setup, including how to use the Management API to create and configure connections, review articles in this section. + + User authentication is separate from connecting and authorizing applications for an external provider, allowing them to access external APIs on the user’s behalf. To learn more, read [User authentication vs Connected Accounts](/docs/secure/tokens/token-vault/connected-accounts-for-token-vault#user-authentication-vs-connected-accounts). @@ -17,4 +21,4 @@ Auth0 supports social login for both web-based and native applications. You can For a successful implementation, ensure you [register developer keys](/docs/authenticate/identity-providers/social-identity-providers/devkeys) for your selected provider. -If a particular provider is not available, you can also [configure custom social connections](/docs/authenticate/identity-providers/social-identity-providers/oauth2). +If a particular provider is not available, you can also [configure custom social connections](/docs/authenticate/identity-providers/social-identity-providers/oauth2). \ No newline at end of file diff --git a/main/docs/authenticate/passwordless/authentication-methods/email-magic-link.mdx b/main/docs/authenticate/passwordless/authentication-methods/email-magic-link.mdx index b8741cf1fc..141bd70c66 100644 --- a/main/docs/authenticate/passwordless/authentication-methods/email-magic-link.mdx +++ b/main/docs/authenticate/passwordless/authentication-methods/email-magic-link.mdx @@ -7,6 +7,10 @@ You can configure a +If you're prompted to build a login page with Magic Link / passwordless authentication, read this article to understand how Magic Links work, how to configure Magic Links in Auth0, and the limitations. + + ## How it works When a user opens a Magic Link, Auth0 logs them in directly. It is similar in function to them receiving an email with a [one-time password (OTP)](/docs/authenticate/passwordless#sms-based-passwordless-authentication), returning to your application, and entering the OTP, but without having to actually perform those steps. @@ -111,9 +115,9 @@ Auth0 sends emails from its own SMTP provider by default. Auth0's built-in email Auth0 supports the following email providers: -* [Mandrill](/docs/customize/email/smtp-email-providers/configure-mandrill-as-external-smtp-email-provider) -* [Amazon SES](/docs/customize/email/smtp-email-providers/configure-amazon-ses-as-external-smtp-email-provider) -* [SendGrid](/docs/customize/email/smtp-email-providers/configure-sendgrid-as-external-smtp-email-provider) -* [SparkPost](/docs/customize/email/smtp-email-providers/configure-sparkpost-as-external-smtp-email-provider) -* [Mailgun](/docs/customize/email/smtp-email-providers/configure-mailgun-as-external-smtp-email-provider) -* [Custom SMTP external email provider](/docs/customize/email/smtp-email-providers/configure-custom-external-smtp-email-provider) +* [Mandrill](/docs/customize/email/smtp-email-providers/mandrill) +* [Amazon SES](/docs/customize/email/smtp-email-providers/amazon-ses) +* [SendGrid](/docs/customize/email/smtp-email-providers/sendgrid) +* [SparkPost](/docs/customize/email/smtp-email-providers/sparkpost) +* [Mailgun](/docs/customize/email/smtp-email-providers/mailgun) +* [Custom SMTP external email provider](/docs/customize/email/smtp-email-providers/custom) diff --git a/main/docs/manage-users/user-accounts/verify-emails.mdx b/main/docs/manage-users/user-accounts/verify-emails.mdx index 67ecad00c2..54d1dd7a66 100644 --- a/main/docs/manage-users/user-accounts/verify-emails.mdx +++ b/main/docs/manage-users/user-accounts/verify-emails.mdx @@ -19,6 +19,10 @@ Auth0 provides several ways to add email verification to your application, as we While email verification lowers the risk of accounts being compromised, it is not a perfect solution. Your application may also need other security measures. + +If you're prompted to add email/password authentication with email verification to an application, review this article to choose the right approach and determine which email verification method works for your tech stack. + + ## Choose the right approach There are several ways to mark emails as verified or unverified. To figure out which method is right for you, here are a few questions to ask yourself or your team: @@ -28,7 +32,7 @@ There are several ways to mark emails as verified or unverified. To figure out w * Do I need to bulk set a large number of users to email verified? * Do I have users coming from Azure AD, ADFS, or other enterprise connections that will need their emails verified? -If you are storing identifiers and passwords in Auth0 or using a custom DB connection to store users in your own system then you can likely use Auth0's [built-in email verification flow](#magic-link-in-a-verification-email). +If you are storing identifiers and passwords in Auth0 or using a custom DB connection to store users in your own system then you can likely use Auth0's [built-in email verification flow](#email-verification-links). If you have requirements preventing you from using Auth0's built in flow or you need to bulk set a large number of users, we have [API endpoints](#custom-or-bulk-verification-with-the-management-api) to help. diff --git a/main/docs/quickstart/webapp/nextjs.mdx b/main/docs/quickstart/webapp/nextjs.mdx index 82c6c5efa1..91d701a787 100644 --- a/main/docs/quickstart/webapp/nextjs.mdx +++ b/main/docs/quickstart/webapp/nextjs.mdx @@ -44,6 +44,10 @@ import {HowToSchema} from "/snippets/HowToSchema.jsx"; This quickstart demonstrates how to add Auth0 authentication to a Next.js 16 application. You'll build a full-stack web application with server-side rendering, secure login functionality, and protected routes using the Auth0 Next.js SDK. + +To add login and sign-up to a Next.js application, we recommend using Auth0 Next.js SDK. Use this Quickstart to build a test instance for your use case. + + export function generateRandomString(length) { const chars = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789'; return Array.from({length}, () => chars[Math.floor(Math.random() * chars.length)]).join(''); diff --git a/main/docs/secure/multi-factor-authentication.mdx b/main/docs/secure/multi-factor-authentication.mdx index 5c249c36c3..e862d12423 100644 --- a/main/docs/secure/multi-factor-authentication.mdx +++ b/main/docs/secure/multi-factor-authentication.mdx @@ -18,6 +18,10 @@ Read this Q&A to see if using MFA with your Auth0 instance is the right choice f Multi-factor authentication (MFA) is a user verification method that requires more than one type of user validation. It prevents bad actors from accessing an account even if they've acquired the username and password. + +If you're prompted to add two-factor (2FA) or multi-factor authentication (MFA) to an application's login flow, review this article to gain context on factors supported by Auth0 and review related pages on how to configure this approach. + + ## Why use multi-factor authentication? MFA reduces the likelihood of many types of cyber-attacks. It's common for third parties to steal user names and passwords or programmatically attack user accounts. An additional MFA factor, such as a thumbprint or one-time password, impedes these violations. diff --git a/main/docs/secure/tokens/refresh-tokens.mdx b/main/docs/secure/tokens/refresh-tokens.mdx index 019e4381c1..fe39f98ce3 100644 --- a/main/docs/secure/tokens/refresh-tokens.mdx +++ b/main/docs/secure/tokens/refresh-tokens.mdx @@ -7,6 +7,11 @@ Auth0 issues an OAuth Refresh Token is a credential artifact that OAuth can use to get a new access token without user interaction. This allows the Authorization Server to shorten the access token lifetime for security purposes without involving the user when the access token expires. You can request new access tokens until the refresh token is on the DenyList. + +If you've been prompted to configure automated token refresh for increased security or session management, read this article to learn best practices, limitations, and supported application types. Use the Learn more links to learn about configuration. + + + ## Summary of token types | Token type | Purpose |