Securing a backend API with Post User Registration

[dan.woda]

And I’ll try to make my answer clearer

In the context of this transaction, the rule/action is an M2M app. You can think of it as a serverless function that needs to authenticate with your backend, that just so happens to be hosted by Auth0, and just so happens to be run during a user authentication request from your SPA. But it requires a separate auth transaction between two machines.

In this case, your Auth0 Tenant is the auth server that issues the token, the rule/action is the M2M app that is requesting the token, and your backend is the resource server that will validate the token.

@simonboland

I can add an API key in the backend that only Auth0 knows about. My question is whether there’s a better way?

The better way is to use M2M/Client credentials. The drawback; there is a cost associated with M2M tokens and Actions doesn’t have a caching mechanism at the moment, which means you will need one M2M token per call (rules does, but they will become a legacy feature).

Here is an FAQ I wrote about the topic of authenticating an API call from a rule (the same principles apply whether or not you are using an Action, Rule, or Hook etc.):

How do I call my API from a rule?

Question: How do I call my API from a rule? Answer: To do this, you will need to configure your rule to make an API call. You can add Machine 2 Machine (M2M) authorization between your the rule and the your target API, just like you would between any two non-interactive clients, protecting the transaction with Auth0. First, register your API. This can be done via the Dashboard or the Management API. In the Dashboard, navigate to APIs → + Create API. Here you can set up your API, register you…