We are woring on a migration project for a portfolio management company that has custom signup process (similar to ID proofing). App first collects the user details and unit holder number to validate against a registry system before letting user create an account.
We would like to move this signup process to Auth0 for a better attack protection by building a similar signup form that can validate the collected details against an API. Upon successful validation navigate the user to set a username and password, verify mobile and email attributes.
After thorougly going through the documentation we understood that Auht0 can’t render Forms for pre-user-registration trigger. The approach we are thinking is,
- Customize the signup form by inserting custom fields
- Create an action to call downstream API
What we really don’t want herte is collecting the username/email address attributes in the same form until the backend validation is successful. Also we are currently doing a lazy migration which requires dedup checks against another backend API.
Any advise on how these type of usecases can be handled with Auth0?
Hello @karuissobusy,
Welcome back to the Auth0 Community!
The standard, out-of-the-box approach for capturing extra user information during an Auth0 registration is to inject custom fields directly into the Universal Login widget. You can review the official Auth0 documentation for this method in this guide - Configure Additional Signup Fields on the Universal Login Page.
While this is the standard solution for simple data collection, it conflicts with your requirement to separate the identity proofing phase from the credential creation one. Auth0’s native Universal Login widget strictly requires the user to input their email and password on the exact same screen as any custom fields. Because of this limitation, the widget will attempt to create the user profile in the Auth0 database the moment the form is submitted. This makes it impossible to prevent the creation of a partial user account if your downstream API validation or lazy migration deduplication checks fail.
To satisfy your security and user experience requirements, you must use a workaround solution by decoupling the registry validation from the Auth0 credential setup.
This means you will not use Auth0’s Universal Login for the registration process. Instead, your application will host the signup interface, and Auth0 will only be invoked via a backend API call at the end of the flow to act as your secure identity store. Auth0 Universal Login will then be used exclusively for subsequent user logins.
Here is how the recommended multi-step signup flow could be implemented:
-
Step 1: Your frontend application presents a custom initial screen that collects only the required user details and the unit holder number, purposely excluding any password or email credential fields to prevent premature account creation.
-
Step 2: Your application backend securely transmits this data to your downstream API to validate the user against the registry system and perform the required lazy migration deduplication checks against your legacy database.
-
Step 3: Upon successful validation, your application transitions the user to a secondary custom screen to safely collect their desired email, mobile number, and password.
-
Step 4: Your backend then securely calls the Auth0 Management API to officially provision the user profile, handing off the responsibility for email verification, mobile MFA, and all future authentications to Auth0 Universal Login.
I hope this helps!
Best regards,
Remus