# Best practice for migrating user ids

**URL:** <https://community.auth0.com/t/best-practice-for-migrating-user-ids/58044>\
**Category:** Get Help\
**Tags:** auth0\
**Created:** [February 17, 2021, 7:16pm UTC](https://community.auth0.com/t/best-practice-for-migrating-user-ids/58044 "2021-02-17T19:16:55Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![victoryun](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/victoryun/32/27672_2.png) [@victoryun](https://community.auth0.com/u/victoryun)\
**Post date:** [February 17, 2021, 7:16pm UTC](https://community.auth0.com/t/best-practice-for-migrating-user-ids/58044/1 "2021-02-17T19:16:55Z")

</div>

Hello,

We were wondering what the best practice is for migrating user ids. Currently, we are using a system of randomly generated user ids (~20 characters). I know that auth0 generates an identifier that looks like this 102437854499766869014 (21 characters).

In terms of security, we looked into uuidv4 which looks like ad076419-fde7-4940-b18c-1d86607491f0 and we weren’t sure what the best practices are for migrating these ids.

Should we migrate the current ids (~20 characters) into auth0 and use auth0’s generated ids in the future or keep our own set of ids?

Thanks!

---

<div class="post-metadata">

**Author:** ![stephanie.chamblee](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/stephanie.chamblee/32/26087_2.png) [@stephanie.chamblee](https://community.auth0.com/u/stephanie.chamblee)\
**Post date:** [February 18, 2021, 8:33pm UTC](https://community.auth0.com/t/best-practice-for-migrating-user-ids/58044/3 "2021-02-18T20:33:46Z")

</div>

Hi @victoryun,

Thanks for joining the Community!

Auth0 stores user IDs as `{identity provider id}|{unique id in the provider}` or `facebook|1234567890`. This way within a tenant, a user’s ID will be unique.

If you plan to use a [Custom Database](https://auth0.com/docs/connections/database/custom-db) , then the most important thing would be to structure the ID in a way that the IDs will not collide, for example:

```auto
function login (email, password, callback) {
  var user = getUserFromDB(email);
  var profile = {
    user_id: 'MyConnection|' + user.id,
    email: user.email,
    [...]
  };
  callback(null, profile);
}

```

> **[Identify Users](https://auth0.com/docs/manage-users/user-accounts/identify-users)**
>
> Learn how to uniquely identify users.

If you’re interested in how you might use a UUID in user metadata in order to identify users in a universally unique way (not just unique within a tenant), you can take a look at the answer in this topic: [Using another user identifier (UUID) than the user\_id - #2 by jmangelo](https://community.auth0.com/t/using-another-user-identifier-uuid-than-the-user-id/6077/2)

Please let me know if that is the info you’re looking for. Thanks!

---

<div class="post-metadata">

**Author:** ![victoryun](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/victoryun/32/27672_2.png) [@victoryun](https://community.auth0.com/u/victoryun)\
**Post date:** [February 18, 2021, 9:19pm UTC](https://community.auth0.com/t/best-practice-for-migrating-user-ids/58044/4 "2021-02-18T21:19:27Z")

</div>

Thank you, I was wondering if I were to store a uuid (that I use in my DB) in app\_metadata, is that feasible and secure?

---

<div class="post-metadata">

**Author:** ![stephanie.chamblee](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/stephanie.chamblee/32/26087_2.png) [@stephanie.chamblee](https://community.auth0.com/u/stephanie.chamblee)\
**Post date:** [February 19, 2021, 11:13am UTC](https://community.auth0.com/t/best-practice-for-migrating-user-ids/58044/5 "2021-02-19T11:13:41Z")

</div>

Yes, you can use `app_metadata` to store external IDs associated with the user. It is recommended as one of the uses in the docs: [Understand How Metadata Works in User Profiles](https://auth0.com/docs/users/metadata)

The app metadata is not automatically exposed to the application in an ID Token, but you can return it to the app by adding a custom claim: [How to get user\_metadata and app\_metadata in id\_token - #3 by James.Morrison](https://community.auth0.com/t/how-to-get-user-metadata-and-app-metadata-in-id-token/20898/3)

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/auth0/original/3X/b/5/b560f266932fcce5d57f09a6595bd50518cae3f3.jpeg) [@system](https://community.auth0.com/u/system)\
**Post date:** [March 6, 2021, 11:14am UTC](https://community.auth0.com/t/best-practice-for-migrating-user-ids/58044/6 "2021-03-06T11:14:08Z")

</div>

This topic was automatically closed 15 days after the last reply. New replies are no longer allowed.