Setting up Auth0 for API authentication and authorization

Setting up Auth0 for API authentication and authorization.

To follow along with this tutorial, you'll need to create an account on https://auth0.com. Go with the free tier. You won't need paid features for most applications.

Login, user registration, managing sessions, issuing access tokens... these are some of the most complex things when building a new web service or an API.

For junior developers, it's a rite of passage - spending months stuck building the login when creating a web application for the first time.

Organizations don't do any better. Throughout my career, I've seen tons of organizations waste countless hours and developer resources building and managing their own authorization services.

The problem with auth services isn't the amount of time required to build their features. It's what you don't know that you need to do to make them secure. Because the auth service is the fundamental security tenet of your platform. If the auth service goes wrong, everything else falls apart immediately.

That's why "Friends don't let friends roll out their own auth service".

When penetration testers and hackers hear that you rolled out your own auth service, that's the first thing they'll go after.

That's why we use identity providers like Auth0 our auth service. Auth0 takes care of user registration, login, and issuing secure access tokens for our APIs. It also contains and manages our user database securely.

In this video, I show you how to set up Auth0 for API authentication and authorization. In upcoming videos, I'll show you how to integrate Python code with Auth0 to do the registration and login, and to validate access tokens.

There are alternatives to Auth0 like Active Directory (now Entra), FusionAuth, and AWS Cognito, among others. These are all popular choices and I'll make videos for all of them.

Identity providers typically implement OAuth flows and OpenID Connect standards to handle authentication and authorization. I explain it all in the video and will publish more detailed videos on these topics in the future.

Let's do this!

00:00 Introduction
02:13 Creating an Auth0 tenant
04:44 Creating an API
07:07 Configuring the API (RBAC, offline access)
08:27 Configuring API permissions
09:13 Creating an API client (regular web application - authorization code flow)
11:11 Configuring the API client (callback URLs, refresh token rotation)
14:32 Creating a machine-to-machine client (client credentials flow)
15:24 Creating an admin role
16:23 Wrapup


#auth0 #oauth #apisecurity

.