
```ui/vidyard-video__8
```


```ui/message-banner__9
```

Ensure that you are still logged in to the Auth0 Dashboard and follow these steps:

- Visit the Auth0 Marketplace to access the [pre-built **"Country-based Access"** Action](https://marketplace.auth0.com/integrations/country-based-access).

- Click the **"Add Integration"** button from the **"Country-based Access"** page, which is right below the Auth0 logo.

- The **"Select a Tenant"** page loads up.

- Select the Auth0 tenant you created or any existing ones.

- A page loads with a list of the permissions (or access requirements) that the Country-based Access Action needs to fully integrate with your tenant. Click the **"Continue"** button.

<details>

<summary>

What are these Action permissions about?

</summary>

The **"Country-based Access"** Action asks for the following permissions:

- Read and share user profile information.
- Accept login requests from Country-based Access.
- Receive and store user identities.
- Receive and update users.
- Deny login requests.
- Update user profile information.

Rest assured that these are the minimal permissions that this Action (built by Auth0) needs to provide you with its functionality.

</details>

- The **"Configuration"** page loads up where you can set up your Action by providing the following input:

  - **"Country Codes To Block"**: Enter the code for the country from where you are connecting to the internet:
    - 🇦🇺 Australia: `AU`
    - 🏴󠁧󠁢󠁥󠁮󠁧󠁿 England: `GB`
    - 🇩🇪 Germany: `DE`
    - 🇺🇸 United States: `US`
  - **"Apply US Export Controls"**: Use the default value, "No".
  - **"Custom Error Description"**: Use the default value, "Access denied from your location".

- With all set up, click the **"Create"** button.

- The **"Library"** page loads up, where you can manage your Auth0 actions and configuration.

```ui/message-banner__10
```

```ui/message-banner__11
```

```ui/message-banner__12
```



Configure a Pre-Built Action



```ui/vidyard-video__13
```

Follow these steps to integrate the pre-built Action with your Login Flow:

- Locate your **"Country-based Access"** Action under the **"Installed"** tab of the Actions library.
- Click the **"..."** button at the end of the Action block.
- Select **"Add to flow"** from the options.
- Drag and drop the **"Country-based Access"** block between the **"Start"** and **"Complete"** event icons on the Flow board, which is located to the left.

```ui/message-banner__14
```

- Click the **"Apply"** button to make this Login pipeline effective.

```ui/message-banner__15
```

### How does this Action work?

Once this Action integration is in effect, it inspects the geolocation of all login traffic. It denies access to end-users from one of the blocked countries or regions. When denying access, this integration will redirect back to the application with these attributes:

- `error` is set to `access_denied`.
- `error_description` is set to **"Access denied from your location"** or to any custom message you specified.

### Caveats

If Auth0 can't resolve any geolocation information for an IP address, the Action won't be able to block the login attempt.

Additionally, Auth0 keeps its geolocation database up-to-date; however, geolocation information can be inaccurate for a short time after IP range allocations are updated.



Integrate a Pre-Built Action



```ui/vidyard-video__1
```

```ui/goal-banner__2
```

In this lab, you will:

- Configure a no-code Auth0 Action from the Auth0 Marketplace.
- Integrate a no-code Auth0 Action with your Login flow.
- Test access restrictions based on user location.



Introduction



```ui/vidyard-video__5
```

### Create an Auth0 Account

If you already have an Auth0 account, you can log in to your tenant and continue to the next step.

Otherwise, <a href="https://auth0.com/signup/?utm_source=devcenter&utm_medium=auth0&utm_campaign=devn_signup" data-amp-replace="CLIENT_ID" data-amp-addparams="anonId=CLIENT_ID(cid-scope-cookie-fallback-name)">sign up for a free Auth0 account</a>.

```ui/signup-ad__6
```

During the sign-up process, you create something called an [Auth0 Tenant](https://auth0.com/docs/get-started/auth0-overview/create-tenants), representing the product or service to which you are adding authentication.

```ui/message-banner__7
```



Lab Setup


You have learned how to reduce the likelihood of someone logging in from a country based on the user's IP address. Remember that this is a lightweight mitigation layer that a VPN can easily bypass. However, this is still a good example of the no-code solutions available for developers to integrate key business functionality into their applications with just a few clicks.

Explore many other pre-built Actions available in the [Auth0 Marketplace](https://marketplace.auth0.com/features/actions). You can find integrations that cover uses cases related to consent management, identity proofing, decentralized identity, and much more.

Recap



```ui/vidyard-video__16
```

### Use the Auth0 Dashboard to log in

#### Instructions

- Visit the [Auth0 Dashboard](https://manage.auth0.com/) home page.
- Locate the **"Try your Login box"** under the **"Next Steps"** section.
- Click the **"Try it out"** link.
- Log in using any of the available login options.

#### Expected results

- Auth0 redirects you to a callback page, `/tester/callback`, where you see an error message on the screen: **"Bummer! Something failed"**.
- The page displays a JSON object with the details of the error:

```lang/json__1
{
  "error": "access_denied",
  "error_description": "Access denied from your location"
}
```



Test the Country-Based Access Control



```ui/vidyard-video__3
```

There are different reasons you may need to implement country-based access controls to your applications. For example, your organization may need to comply with unique restrictions based on its business locations.

You can define countries from which you are required to restrict persons and entities from logging in to your applications using an **Auth0 Action**.

**Actions are functions that execute at certain points during the Auth0 runtime, such as when a user signs up or logs in**. For country-based access control, your Action can define a list of restricted countries based on your business needs, and Auth0 will automatically block logins that originate from IP addresses in those countries.


```ui/message-banner__4
```

You should see this Action-based strategy as a tool to **_help you reduce the likelihood_** of someone accessing your applications from countries where your services should not be accessed. However, your organization will need to explore other tools and strategies to provide more comprehensive access control, which is beyond the scope of this lab.

Nonetheless, this Action is a solid example of how to quickly provide business value with a no-code solution from Auth0.



Why Use Country-Based Access Control?

Enrich User Profiles

Country-Based Access Control


Are you ready to take action on the user login experience? Join us as we go beyond the login box with [Auth0 Actions](https://auth0.com/docs/customize/actions), adding extensions to their login journey, and more.

### Legal Disclosure

_This document and any recommendations within is not legal, privacy, security, compliance, or business advice. This document is intended for general informational purposes only and may not reflect the most current security, privacy, and legal developments nor all relevant issues. You are responsible for obtaining legal, security, privacy, compliance, or business advice from your own lawyer or other professional advisor and should not rely on the recommendations herein. Okta is not liable to you for any loss or damages that may result from your implementation of any recommendations in this document. Okta makes no representations, warranties, or other assurances regarding the content of this document. Information regarding Okta's contractual assurances to its customers can be found at [okta.com/agreements](https://www.okta.com/agreements/)._

Do More With Auth0 Actions



```ui/message-banner__4
```

You can add Actions to a Flow from the [Auth0 Marketplace](https://marketplace.auth0.com/features/actions) as seen in the [**"Country-Based Access"** Actions lab](/resources/labs/actions/country-based-access-control). You can also build them with custom code to extend the default Auth0 behavior. Let's do that!

Ensure that you are still logged in to the Auth0 Dashboard and follow these steps:

- Head to the [Auth0 Dashboard](https://manage.auth0.com/dashboard).
- Click the **"Actions"** tab on the left-hand menu.
- Click the **"Flows"** option.

```ui/message-banner__5
```

- Click on the **"Login"** flow.
- Locate the **"Add Action**" panel on the right-hand side and click the **"+"** button.
- Click the **"Build Custom"** option from the flyout menu.
- The **"Create Action"** modal comes up with a form that you need to fill out as follows:
  - **Name**: `Profile Enrichment`
  - **Trigger**: Login / Post Login (default option).
  - **Runtime**: Node 18 ([recommended default option](https://auth0.com/blog/node-18-now-available-for-actions-rules-and-hooks/)).
- Click the **"Create"** button to complete this process.

### Build a custom Action with Node.js

The Actions Code Editor loads up, where you need to replace the uncommented code, 

```config/javascript__1
exports.onExecutePostLogin = async (event, api) => {
};
```

with the following code:

```config/javascript__2
exports.onExecutePostLogin = async (event, api) => {
  const cityName = event.request.geoip.cityName;
  const countryName = event.request.geoip.countryName;
  const timeZone = event.request.geoip.timeZone;

  api.user.setUserMetadata("city", cityName);
  api.user.setUserMetadata("country", countryName);
  api.user.setUserMetadata("timezone", timeZone);
};
```

In the Post-Login Action code above, the [`event` object](https://auth0.com/docs/customize/actions/flows-and-triggers/login-flow/event-object) for the post-login Actions trigger provides contextual information about a single user who is logging in via Auth0.

The `event.request` property is an object with details about the request that initiated the login transaction. These details include the `geoip` object, which in turn includes the `cityName`, `countryName`, and `timeZone` values.

You can then use the [`api` object](https://auth0.com/docs/customize/actions/flows-and-triggers/login-flow/api-object) to access helper methods that can modify artifacts of the login transaction such as user profile information, ID tokens, and access tokens.

In this case, you access the `api.user` to make application-specific changes to the metadata associated with the user logging in, the `user_metadata` object.

<details>

<summary>

What can developers do with Auth0 metadata?

</summary>

Auth0 provides a comprehensive system for [storing metadata in the Auth0 user profile](https://auth0.com/docs/manage-users/user-accounts/metadata). You can use metadata to store [three types of information](https://auth0.com/docs/manage-users/user-accounts/metadata#metadata-types):

- **User information**: Stores user attributes such as preferences that do not impact a user's core functionality. This information shows up under the `user_metadata` section of a user profile in the Auth0 Dashboard.
- **Access information**: Stores information such as permissions, Auth0 plan, and external IDs that can impact user access to features. This information shows up under the `app_metadata` section of a user profile in the Auth0 Dashboard.
- **Application information**: Stores information about an application, which OpenID Connect (OIDC) and OAuth 2.0  refer to as the client. This information is present in the `event.client.metadata` object of a Post-Login Action.

</details>

In your Post-Login Action, you use the `api.user.setUserMetadata()` method to set location metadata for the user logging in. After a user logs in, that location information will show up in the `user_metadata` section of the user profile in the Auth0 Dashboard as follows:

```lang/json__3
{
  "city": "cityName",
  "country": "countryName",
  "timezone": "timeZone"
}
```

You'll test that out shortly. For now, click the **"Save Draft"** button to save your changes, and then click the **"Deploy**" button.



Create a Post-Login Action



Follow these steps to integrate the Post-Login Action with your Login Flow:

- Head to the Login Flow panel by clicking the **"Back to flow"** button on the top-left corner.
- Click the **"Custom"** tab under the **"Add Action"** panel. 
- Drag and drop the **"Profile Enrichment"** block between the **"Start"** and **"Complete"** event icons on the Flow board, which is located to the left.

```ui/message-banner__6
```

- Click the **"Apply"** button to make this Login pipeline effective.

```ui/message-banner__7
```



Integrate a Post-Login Action



```ui/goal-banner__1
```

In this lab, you will:

- Create, integrate, and update a Post-Login Auth0 Action.
- Enrich a user profile with geolocation data at login.
- Inspect an ID token to verify user profile information.





### Create an Auth0 Account

If you already have an Auth0 account, you can log in to your tenant and continue to the next step.

Otherwise, <a href="https://auth0.com/signup/?utm_source=devcenter&utm_medium=auth0&utm_campaign=devn_signup" data-amp-replace="CLIENT_ID" data-amp-addparams="anonId=CLIENT_ID(cid-scope-cookie-fallback-name)">sign up for a free Auth0 account</a>.

```ui/signup-ad__2
```

During the sign-up process, you create something called an [Auth0 Tenant](https://auth0.com/docs/get-started/auth0-overview/create-tenants), representing the product or service to which you are adding authentication.

```ui/message-banner__3
```




You have seen in practice how to use Auth0 Actions to integrate data not provided directly by users with their profiles. As a next step, you can try fetching external data from your Post-Login Action. You can use `axios` to [make requests within your Auth0 Action as seen in this example](https://auth0.com/blog/adding-custom-claims-to-id-token-with-auth0-actions/#Implementing-The-Assign-Random-Dog-Action).

### Explore progressive profiling

You can also use Actions to implement progressive profiling in your applications. [Progressive profiling](https://auth0.com/docs/manage-users/user-accounts/user-profiles/progressive-profiling) is the process of gathering additional user information over time as your users engage with your application. You can gather detailed user information only when relevant to a user's activities. Progressive profiling speeds up the sign-up process by asking fewer questions upfront, leading to higher conversion rates.

For example: When users sign up using a social connection such as Google, you get their name, verified email address, and other basic information from their Google profile. However, you could ask your users for their job title and company name the next time they log in.

Profile enrichment and progressive profiling help you avoid asking users for the information you may already have.



### Use the Auth0 Dashboard to log in

#### Instructions

- Visit the [Auth0 Dashboard](https://manage.auth0.com/) home page.
- Locate the **"Try your Login box"** under the **"Next Steps"** section.
- Click the **"Try it out"** link.
- Log in using any of the available login options.
- Auth0 redirects you to a callback page, `/tester/callback`, where you see a box with the user information present in your decoded ID token.

#### Expected results

Verify that the location data is present in the decoded ID token:

```lang/json__6
{
  "https://example.com/location": {
    "cityName": "YOUR-CURRENT-CITY",
    "countryName": "YOUR-CURRENT-COUNTRY",
    "timeZone": "YOUR-CURRENT-TIMEZONE"
  },
  // Other claims...
}
```

The location values in the `https://example.com/location` custom claim must match 100% of the location values on the `user_metadata` of your Auth0 user profile. You can verify that if you'd like.



Test the ID Token Storage



### Use the Auth0 Dashboard to log in

#### Instructions

- Visit the [Auth0 Dashboard](https://manage.auth0.com/) home page.
- Locate the **"Try your Login box"** under the **"Next Steps"** section.
- Click the **"Try it out"** link.
- Log in using any of the available login options.

#### Expected results

Verify that the location data is, in fact, in the user metadata by following these steps:

- Head to the [Auth0 Dashboard](https://manage.auth0.com/dashboard).
- Click the **"User Management"** tab on the left-hand menu and then select the **"Users"** option.
- In the list of users that comes up, click the name of the user you used to log in. The Auth0 user profile page will load up.
- Under the **"Details"** tab, locate the **"Metadata"** section. Then, within that section, locate the `user_metadata` sub-section.
- Verify that the `user_metadata` matches the following structure:

```lang/json__4
{
  "city": "cityName",
  "country": "countryName",
  "timezone": "timeZone"
}
```

The accuracy of the location information from where you logged in will depend on your device's privacy settings and whether or not you are using a VPN, 

In your applications, you can build a form using the Management API that will allow your users to edit that user metadata to provide the correct values if needed. But if the information were correct, your users would not need to spend any time filling out forms.



Test the Profile Enrichment



After every successful login, Auth0 sends an ID token to your application with user profile information. You can update your Post-Login Action to add custom data to that ID token. Doing so will allow you to share the location information present in the scope of your Post-Login Action with your client application.

Follow these steps to access the Post-Login Action that you've created:

- Head to the [Auth0 Dashboard](https://manage.auth0.com/dashboard).
- Click the **"Actions"** tab on the left-hand menu and then select the **"Library"** option.
  - The page that loads up helps you manage your actions and configuration.
- Click the **"Custom"** tab.
- Select your **"Profile Enrichment"** Post-Login Action.

Update your Action code as follows:

```config/javascript__5
exports.onExecutePostLogin = async (event, api) => {
  const cityName = event.request.geoip.cityName;
  const countryName = event.request.geoip.countryName;
  const timeZone = event.request.geoip.timeZone;

  api.user.setUserMetadata("city", cityName);
  api.user.setUserMetadata("country", countryName);
  api.user.setUserMetadata("timezone", timeZone);

  if (event.authorization) {
    const namespace = "https://example.com";

    api.idToken.setCustomClaim(`${namespace}/location`, {
      cityName,
      countryName,
      timeZone,
    });
  }
};
```

#### What's new on this Action?

- The `event.authorization` object contains information describing the authorization granted to the user logging in.
- You verify that the `event.authorization` object is defined as that represents a successful login transaction.
  - You won't have access to the ID token if the user cannot log in.
- Auth0 recommends using a namespace whenever you need to add custom data to an ID token. In this case, you use `https://example.com` as the namespace value.
  - Auth0 recommends using a fully-qualified URL as the value of a namespace. 
  - Read the ["Create Custom Claims"](https://auth0.com/docs/secure/tokens/json-web-tokens/create-custom-claims) document for more details and recommendations on enriching the data of tokens.
- The `api.idToken` object has methods that help you request changes to the ID token that Auth0 is issuing to the client application that initiated the login transaction.
- You use the `api.idToken.setCustomClaim()` method to set a custom claim on that ID token.
  - This method takes two arguments: `name`, the key for the custom claim, and `value`, the value of the custom claim.
- You set the value of your `${namespace}/location` custom claim as a JSON object with all the location data. 

Now that you have updated your Post-Login Action code click the **"Deploy"** button to apply this change to your login flow.

```ui/message-banner__8
```



Update a Post-Login Action



You may need more user information to carry out business operations than what your users can provide immediately during the sign-up or login process. How should you get that information? Asking for repetitive information every time a user logs in will hurt the user experience. Additionally, nobody in your organization should manually look up pieces of information to add to every user profile either.

You can augment user profile information from your own data sources. You can also obtain a great deal of user information from external services. This practice is known as [profile enrichment](https://auth0.com/blog/how-profile-enrichment-and-progressive-profiling-can-boost-your-marketing/#Profile-enrichment): you _**automatically**_ grab information, which may be publicly available, and add it to a user's profile. An easy way to enrich user profiles is by using Auth0 Actions.

![Profile enrichment in action](https://images.ctfassets.net/23aumh6u8s0i/4QLyxXCCZVqCrkR6sUP4g8/8dc592f919af025c8467cc723809d526/03body)

**Actions are functions that execute at certain points during the Auth0 runtime, such as when a user signs up or logs in**. For profile enrichment, your Action could call an API to grab some data and then put any relevant information into the profile that every user gets when they sign up through Auth0. You could also integrate that data with the profile of existing users who are logging in but are missing that information.

For simplicity, this lab will integrate location data provided by the Auth0 Authorization API with the user profile. After completing this lab, you should be in good shape to integrate any external or internal API with your Auth0 login flow using Actions.



What Is Profile Enrichment?

Sync Stripe Customers and Auth0 Users



```ui/message-banner__4
```

Ensure that you are still logged in to the Auth0 Dashboard and follow these steps:

- Head to the [Auth0 Dashboard](https://manage.auth0.com/dashboard) and click the **"Actions"** tab on the left-hand menu.
- Click the **"Flows"** option.

```ui/message-banner__5
```

- Click on the **"Login"** flow.
- Locate the **"Add Action**" panel on the right-hand side and click the **"+"** button.
- Click the **"Build Custom"** option from the flyout menu.
- The **"Create Action"** modal comes up with a form that you need to fill out as follows:
  - **Name**: `Stripe Integration`
  - **Trigger**: Login / Post Login (default option).
  - **Runtime**: Node 18 ([recommended default option](https://auth0.com/blog/node-18-now-available-for-actions-rules-and-hooks/)).
- Click the **"Create"** button to complete this process.

### Build a custom Action with Node.js

The Actions Code Editor loads up, where you need to replace the uncommented code, 

#### Add package dependencies for an Action

Actions allow you to use packages from the `npm` registry. Using the Actions Code Editor, you can install and manage dependencies for your Actions.

For this Stripe integration, you'll need the [`stripe` Node.js library](https://www.npmjs.com/package/stripe) that provides convenient access to the Stripe API from applications written in server-side JavaScript.

Follow these steps to add the dependency:

- Click the box icon on the left-hand side of the Actions Code Editor.
- Once the **"Dependencies"** panel opens, click the **" Add Dependency"** button.
- In the **"Add Dependency"**, enter `stripe` in the **"Name"** field. Leave the **"Version"** field blank to use the latest package version.
- Click the **"Create"** button.

You'll see that **"Dependencies"** panel now lists the `stripe@latest` package for your Action.

Now, let's write some code.

#### Create the Action template

Replace the uncommented code from the Actions Code Editor,

```config/javascript__1
exports.onExecutePostLogin = async (event, api) => {
};
```

with the following code template:

```config/javascript__2
exports.onExecutePostLogin = async (event, api) => {
  try {
    /**
     * Check if new Auth0 user
     */
    
    
    
    /**
     * Check for data integrity
     */
    
    
    
    /**
     * Initialize Stripe library
     */
    
    
    
    /**
     * Check if existing Stripe Customer
     */
    
    
    
    /**
     * Create Stripe Customer
     */
    
    
    
    /**
     * Add Stripe Customer ID to app_metadata
     */
    
    
  } catch (error) {
    console.error(error.message);

    api.access.deny(
      "We could not create your account.\n" +
        "Please contact support for assistance."
    );
  }
};

```

This template outlines the business logic of this Action at a high level. You'll build out these sections next. However, notice that you are wrapping them in a `try/catch` block. The Stripe library can throw errors as you use any of its methods. These errors could be related to incorrect method arguments or network issues.

The ["Auth0 Action Coding Guidelines"](https://auth0.com/docs/customize/actions/action-coding-guidelines) specify that Actions should never intentionally throw an error. If you need to stop a process because of an error or condition, you should use the appropriate `api` method like `api.access.deny()`.

You'll follow that recommendation in a simple way by wrapping the whole Action function body in a `try/catch` block. If any method within the function body throws an error, you'll deny access to the application. You may use different error handling strategies in your own applications that fit your use case better.

The [`api.access`](https://auth0.com/docs/customize/actions/flows-and-triggers/login-flow/api-object) object has methods that modify the access of the user that is logging in, such as rejecting the login attempt. You use the `api.access.deny(reason)` method to mark the current login attempt as denied, which prevents the end-user from completing the login flow. In turn, the login flow will immediately stop following the completion of this Action, and Auth0 won't execute any further Actions.

You'll learn in more detail how `api.access.deny()` works later. Let's build up this Auth0 Action section by section!

#### Check if new Auth0 user

Add the following code under the `Check if new Auth0 user` section:


```config/javascript__3
/**
 * Check if new Auth0 user
 */

if (event.stats.logins_count !== 1) {
  return;
}

```

The [`event` object](https://auth0.com/docs/customize/actions/flows-and-triggers/login-flow/event-object) for the post-login Actions trigger provides contextual information about a single user logging in via Auth0.

The `event.stats` object has login statistics for the current user. Its `event.stats.logins_count` is the number of times the user has logged in. `event.stats.logins_count` is equal to `1` when the user is **accessing your application for the first time**.

The **"Actions Coding Guidelines"** also recommend that developers adopt a [defensive coding](https://auth0.com/docs/customize/actions/action-coding-guidelines#defensive-coding) mindset when building Actions. You should use guard clauses and return early if the Action processing should not continue.

In this case, you exit the Action if the user logging in has a `logins_count` different from `1` as you only want to execute this Action for new users.

#### Check for data integrity

Add the following code under the `Check for data integrity` section:


```config/javascript__4
/**
 * Check for data integrity
 */

if (event.user.app_metadata.stripe_customer_id) {
  const error = `app_metadata for new user already has stripe_customer_id property.`;

  console.error(error);

  api.access.deny(
    "We could not create your account.\n" +
      "Please contact support for assistance."
  );

  return;
}

```

This code defines another defensive guard within your Action. A new user typically has an empty `app_metadata` object, `{}`. However, if other Actions ran before the current one, those Actions could have updated the `app_metadata` object to include new properties. As such, it's a good idea to check that `app_metadata` does not have a `stripe_customer_id` value, representing the Stripe Customer ID in the Auth0 layer.

If `app_metadata.stripe_customer_id` is defined, a data or logic error may have happened, which calls for an investigation. In that event, you stop the login flow and deny the user access to your application.
 

#### Initialize the Stripe library

Add the following code under the `Initialize Stripe library` section to initialize the `stripe` library using a Stripe API key:

```config/javascript__5
/**
 * Initialize Stripe library
 */

const stripe = require("stripe")(event.secrets.STRIPE_SECRET_KEY);

```

Where is `STRIPE_SECRET_KEY` coming from? You'll learn how to get a Stripe API key in the next section and how to use it securely within your Auth0 Action at runtime. For now, let's talk about how Stripe manages customer records to continue building up this Action.

#### Check if the user is an existing Stripe Customer

Stripe uses objects to represent your customers. The customer object has an `id` property which serves as a **unique identifier for the object**. The customer object also has other properties such as `address`, `description`, `name`, `phone`, and `email` that further identify and describe the customer. However, Stripe does not require these other values to be unique. One or more customer objects can have the same `email` value.

Depending on your business model, you may need to enforce uniqueness in properties other than the `id`. Treating the `email` value as a unique identifier would be ideal if you sell products online. You could then track orders and payments that belong to the same customer using their email address.

You are assuming the abovementioned business model for this lab. As the next step in your Action, you need to verify if a customer with the same email address as the user logging in already exists on the Stripe layer. If so, you'll stop the login flow and deny access to your application to the user logging in.

Add the following code under the `Check if existing Stripe Customer` section to do just that:

```config/javascript__6
/**
 * Check if existing Stripe Customer
 */

const stripeCustomerMatchesByEmail = await stripe.customers.list({
  email: event.user.email,
});

if (stripeCustomerMatchesByEmail.data.length > 0) {
  const error = `Stripe Customer with email ${event.user.email} already exists.`;

  console.error(error);

  api.access.deny(
    "We could not create your account.\n" +
      "Please contact support for assistance."
  );

  return;
}

```

You use the [`stripe.customers.list()`](https://stripe.com/docs/api/customers/list?lang=node) method to get a list of your Stripe customers who have an `email` value that matches the email of the user logging in with Auth0.

You are expecting email uniqueness for this lab. If there are more than `0` customers at Stripe using the same email address, you prevent the user logging in from creating an account.

Recall that the `api.access.deny(reason)` method marks the current login attempt as denied, which immediately stops the login flow following the completion of this Action. Auth0 won't execute any further Actions either.

It's important to note that denying access does not cancel other user-related side effects within the Action, such as making Auth0 metadata changes. Keep that in mind, as you may want to deny access before you modify any user or app metadata at Auth0 or externally.

In a real-world scenario, you may need to investigate why two customers may want to use the same email and find a solution for the issue. The same customer may be creating an account with the same email address but using a different identity connection. For example, the customer may have created an account using their Google account a year ago. They may have forgotten they already have an account and attempted to register again using a username and password. Remember to exercise great care in scenarios like this, as automatically linking both accounts could lead to a malicious account takeover.

#### Log data in actions

Notice that you log the `error` object using `console.error()`. Where does that log go?

You can use the Auth0 Dashboard to [view all the events](https://auth0.com/docs/deploy-monitor/logs/view-log-events) that occur in your tenants related to user authentication and administrative activities, such as adding and updating applications, connections, and Actions.

Suppose that your Actions denies access to a user logging in. You can find details on this failed login attempt as follows:

- Head to the [Auth0 Dashboard](https://manage.auth0.com/dashboard).
- Click the **"Monitoring"** tab on the left-hand menu and then select the **"Logs"** option.
- You would select an event of the **"Failed Login**" type.

A page will load details about the failed login event with a section showing **"Action Details"**. The Action event log object would have a `response.logs` property with any string you have printed within your Action using `console.log()` or `console.error()`.

#### Create a Stripe customer

Add the following code under the `Create Stripe Customer` section:

```config/javascript__7
/**
 * Create Stripe Customer
 */

const newStripeCustomer = await stripe.customers.create({
  email: event.user.email,
  description: "Automatically generated by an Auth0 Action",
  metadata: { auth0_user_id: event.user.user_id },
});

```

You create a customer in Stripe using the [`stripe.customers.create()`](https://stripe.com/docs/api/customers/create?lang=node) method. You can pass to that method an object with optional parameters:

- [`email`](https://stripe.com/docs/api/customers/create?lang=node#create_customer-email): This is the customer's email address. 
  - You want it to be unique and the same as the email address of the user logging in.
  - This value is useful for searching and tracking customers in Stripe.
  - The email can be up to 512 characters long.
- [`description`](https://stripe.com/docs/api/customers/create?lang=node#create_customer-description): This is an arbitrary string that you can attach to a customer object.
  - This value can give you some helpful hints about the customer.
- [`metadata`](https://stripe.com/docs/api/customers/create?lang=node#create_customer-metadata): This is a set of [key-value pairs](https://stripe.com/docs/api/metadata) that you can attach to a customer object
  - This object is useful for storing additional information about the customer object in a structured format.
  - This is the best place to store the Auth0 user ID in Stripe using the `auth0_user_id` key.

The `stripe.customers.create()` returns the customer object upon success. The method [throws an error](https://stripe.com/docs/api/errors?lang=node) if any of its parameters are invalid.

#### Add the Stripe Customer ID to Auth0 app metadata

Finally, add the following code under the `Add Stripe Customer ID to app_metadata` section:

```config/javascript__8
/**
 * Add Stripe Customer ID to app_metadata
 */

api.user.setAppMetadata("stripe_customer_id", newStripeCustomer.id);

```

You can then use the `newStripeCustomer.id` to add the `stripe_customer_id` property to the Auth0 `app_metadata` using the `api.user.setAppMetadata(name, value)` method.

The `api.user` object from the Action context has methods to make application-specific changes to the metadata of the user logging in.

The `api.user.setAppMetadata(name, value)` method sets **application metadata** for the user logging in. The data you store within `app_metadata` is not visible or editable by the user. The `name` argument is the name of the metadata property. The `value` argument is its value.

> **Tip**: You can set an `app_metadata` value to `null` to remove the metadata property.

#### Action _almost_ complete

You have created the body of your Stripe integration action. You are almost ready to deploy it, but you still need to set up the `STRIPE_SECRET_KEY`, which you'll do in the next section.

However, before moving on, please click the **"Save Draft"** button in the Actions Code Editor to save your progress. Here's the code of the complete Action as well:

```config/javascript__9
exports.onExecutePostLogin = async (event, api) => {
  try {
    /**
     * Check if new Auth0 user
     */
    if (event.stats.logins_count !== 1) {
      return;
    }

    /**
     * Check for data integrity
     */

    if (event.user.app_metadata.stripe_customer_id) {
      const error = `app_metadata for new user already has stripe_customer_id property.`;

      console.error(error);

      api.access.deny(
        "We could not create your account.\n" +
          "Please contact support for assistance."
      );

      return;
    }

    /**
     * Initialize Stripe library
     */

    const stripe = require("stripe")(event.secrets.STRIPE_SECRET_KEY);

    /**
     * Check if existing Stripe Customer
     */

    const stripeCustomerMatchesByEmail = await stripe.customers.list({
      email: event.user.email,
    });

    if (stripeCustomerMatchesByEmail.data.length > 0) {
      const error = `Stripe Customer with email ${event.user.email} already exists.`;

      console.error(error);

      api.access.deny(
        "We could not create your account.\n" +
          "Please contact support for assistance."
      );

      return;
    }

    /**
     * Create Stripe Customer
     */

    const newStripeCustomer = await stripe.customers.create({
      email: event.user.email,
      description: "Automatically generated by an Auth0 Action",
      metadata: { auth0_user_id: event.user.user_id },
    });

    /**
     * Add Stripe Customer ID to app_metadata
     */

    api.user.setAppMetadata("stripe_customer_id", newStripeCustomer.id);
  } catch (error) {
    console.error(error.message);

    api.access.deny(
      "We could not create your account.\n" +
        "Please contact support for assistance."
    );
  }
};

```





Follow these steps to integrate the Post-Login Action with your Login Flow:

- Head to the Login Flow panel by clicking the **"Back to flow"** button on the top-left corner.
- Click the **"Custom"** tab under the **"Add Action"** panel. 
- Drag and drop the **"Stripe Integration"** block between the **"Start"** and **"Complete"** event icons on the Flow board, which is located to the left.

```ui/message-banner__6
```

- Click the **"Apply"** button to make this Login pipeline effective.

```ui/message-banner__7
```

You are now ready to test this integration of Auth0 with Stripe.





```ui/goal-banner__1
```

In this lab, you will:

- Create and set up a Stripe developer account.
- Create and integrate a Post-Login Auth0 Action. 
- Link user data between Auth0 and Stripe.





### Auth0 and Stripe Integration

The way that Auth0 and Stripe will integrate will resemble a relay race.

It all starts with a new user signing up for your application. That is the process when anonymous visitors are willing to share personal information with you to identify themselves, becoming users or customers. Auth0 takes care of the sign-up process entirely. You can use different authentication strategies to allow your users to create credentials to access their accounts on your application quickly. The most popular authentication methods involve **creating a username/password combination or using a social identity provider, such as Google, to sign-up and log in**.

Once a visitor signs up for your application, Auth0 creates a profile for them in the Auth0 Dashboard. At that point, you should also create a record for that new user in Stripe so that you can create recurring charges and track payments for them.

As such, it's important to sync the user stores of both Auth0 and Stripe. The same natural person should have the same digital identity in both systems. 

You could create a database to link an Auth0 identifier with the Stripe customer ID. However, you can get Auth0 to communicate directly with Stripe to create a Stripe Customer ID for each new user. Stripe will then share that Customer ID with Auth0. In turn, Auth0 can share that Stripe Customer ID and any other user profile information with your applications using ID tokens and access tokens.

You can do all the above tasks using an Auth0 Action.

### Lab Constraints

The following assumptions define the scope of this practical exercise:

#### 🚨 Only create a new Stripe Customer for every new Auth0 user that signs up.

If there is any indication that the user is not new, you must stop the sign-up or login flow. You can determine if users are new by looking at their login count, it should be... `1`! Why not `0`? Auth0 counts the first login as the sign-up attempt. 

#### 🚨 Expect visitors to sign up using a username/password combination or a social identity provider, such as Google.

**This constraint is important to understand**. It makes sense for you to create the new Stripe customer based on a new Auth0 user when the visitor signs up with Auth0. You could execute an Action within the [Pre User Registration Flow](https://auth0.com/docs/customize/actions/flows-and-triggers/pre-user-registration-flow) to create the new Stripe customer and save the corresponding Stripe customer ID in the Auth0 user profile. You could then use an Action within the [Post User Registration Flow
](https://auth0.com/docs/customize/actions/flows-and-triggers/post-user-registration-flow) to save the Auth0 `user_id` in the Stripe customer profile. A Stripe and an Auth0 record would then reference each other, effectively allowing you to synchronize user data between the platforms easily.

But, here's the deal: The sign-up and login flows are the same for any users accessing your application for the first time using a **social connection**. You read that right! Only users who access your application for the first time using a **database connection** (username/password) or **passwordless connection** (email) trigger the Auth0 user registration flows.

Hence, you'd need to create an Action within the [Login Flow](https://auth0.com/docs/customize/actions/flows-and-triggers/login-flow) to cover all connections. The Login Flow runs when a user logs in to any application in an Auth0 tenant. You may be thinking: but the users are signing up, not logging in! That's fine. Recall from above that we can easily determine when a user is signing up, regardless of connection, by checking if their login count is `1`.

#### 🚨 Every Stripe customer has a unique email address.

You'll assume a business model where customers must have a unique email address. Some real-world businesses use email as the primary communication method with customers. Customers receive order confirmations, payment updates, and subscription status, all through email.

As such, a business may connect and track a lot of data with the email address. Suppose you allowed multiple customers to have the same email address. In that case, you'd need to ask your customers for a unique account number or ID number when they call support, for example, to ensure that you are dealing with the right account holder. **You must do so to [protect customers from account takeover](https://community.auth0.com/t/account-takeover-using-log-in-with-google/48208)**.

Let's see all this in action.



Lab Guidelines



### Create a Stripe Account

If you already have a Stripe account, feel free to use it. Otherwise, you can visit the [Stripe registration page](https://dashboard.stripe.com/register) to create a new account.

You'll need to verify your email address with Stripe before you can proceed to access their platform.

### Create an Auth0 Account

If you already have an Auth0 account, you can log in to your tenant and continue to the next step.

Otherwise, <a href="https://auth0.com/signup/?utm_source=devcenter&utm_medium=auth0&utm_campaign=devn_signup" data-amp-replace="CLIENT_ID" data-amp-addparams="anonId=CLIENT_ID(cid-scope-cookie-fallback-name)">sign up for a free Auth0 account</a>.

```ui/signup-ad__2
```

During the sign-up process, you create something called an [Auth0 Tenant](https://auth0.com/docs/get-started/auth0-overview/create-tenants), representing the product or service to which you are adding authentication.

```ui/message-banner__3
```




You have used Auth0 Actions to link Auth0 profile data with Stripe customer data, which includes user email addresses.

When using an email address supplied by a user, it is important to [verify the user has access to that email](https://auth0.com/docs/manage-users/user-accounts/verify-emails). This practice is critical anytime you send an email to a user or use email as an index for search, as you do in this lab. **Auth0 does not recommend using an email address to validate that a user is who they say they are**.

Consequently, it would be ideal only to create Stripe customers for users with verified email addresses. As an exercise after this lab, you could create another Auth0 Action that redirects users to a **"Verify Email Address"** page if they have not yet verified their email address. This practice is known as [progressive profiling](https://auth0.com/blog/progressive-profiling/), which is the process of gradually collecting additional information about your users as they engage with your website or application.

Your **"Verify Email"** Action could be another [Post-Login Action](https://auth0.com/docs/manage-users/user-accounts/user-profiles/progressive-profiling#use-action-triggers) that runs before your **"Stripe Integration"** Action.

Recap and Insights



Head to the [Stripe Dashboard](https://dashboard.stripe.com/) and look at the top-right corner of the page to verify that you are accessing the dashboard in "test mode": the toggle button should be yellow. Depending on the size of your browser window, you may also see the label **"Test mode"**. If you hover on the toggle button, you'll get a message asking you to **"Please activate your account to access live data"**. You won't need to do that for this lab.

Stripe recommends using test mode while prototyping and building your application so that you don't disrupt your production data and services. While in test mode, Stripe API calls return simulated account, payment, customer, charge, refund, transfer, balance, and subscription information.

Open the Stripe Developers Dashboard to access details about your Stripe integration. Click the **"Developers"** button on the left side of the test-mode toggle button.

### Access Stripe API keys

Next, click the **"API keys"** tab on the left-hand sidebar. The **"API keys"** page loads up where you can view Stripe test API keys.

On this page, you'll find the **"Standard keys"** that allow you to authenticate API requests.

Stripe offers you a total of four keys: a publishable and secret key pair for **test mode** and **live mode**. Publishable keys are publicly-accessible keys that your client-side applications can use to have limited access to API services. Secret keys must be secret, and you must store them securely in your server-side code, such as in an environment variable or credential management system.

Under these keys, you have the **Secret key**, which is a **credential** that [Stripe APIs use to authenticate requests](https://stripe.com/docs/keys#obtain-api-keys) coming from your server. Never give out your Stripe secret key to anyone or expose it to the public.

**By default, you can use your Stripe secret keys to perform any API request without restriction**. For this lab, and even in some production scenarios, you don't need such unlimited access.

### Create a restricted Stripe API key

For greater security, you can create restricted Stripe API keys that limit access and permissions to different areas of your Stripe account data. A restricted API key allows only the minimum level of access that you specify. Restricted keys cannot interact with some Stripe APIs, so they are useful when you need to reduce risk when using or building microservices or cloud functions, such as an Auth0 Action.

Your Auth0 Action only needs to create a Stripe customer. As such, create a restricted key that only grants write access to Customers data in Stripe:

- Locate the **"Restricted keys"** section in the Stripe Developers Dashboard.
- Click the **"Create restricted key"** button.
- Enter `Auth0 Action` as the value of the **"Key name"** field.
- Locate the **"Resource type"** > **"All core resources"** > **"Customers"** section.
- Select **Write** in the **"Permissions"** field of the **Customers** resource.
- Scroll down the page and click the **"Create key"** button.

You are back to the Stripe "API keys" page. Let's make use of your Stripe API key next.

### Use Your Stripe API key

Notice that you now have an **"Auth0 Action"** entry under the **"Restricted keys"** section. Click the **"Reveal test key"** button to display its value.

Click the key value to copy it, and head to the page where your Auth0 Action editor is open.

The Auth0 Actions editor allows you to securely define secret or privileged values that your running code can access as properties of the `event.secrets` object.

You can add secret values by clicking the key icon on the left-hand side of the editor. Once the **"Secrets"** panel opens, click the **"Add Secret"** button.

Fill the form in the **"Define Secret "** modal with your Stripe information as follows:

- **Key**: This is the name of the property that you can access using the `event.secrets` object. Use `STRIPE_SECRET_KEY` here.
- **Value**: This is the value of the property. Paste the value of your restricted API key from Stripe.

Finally, click the **"Create"** button.

As the last step, click the **"Deploy"** button if needed.



Set Up a Stripe API Key



### Use the Auth0 Dashboard to log in

#### Instructions

- Visit the [Auth0 Dashboard](https://manage.auth0.com/) home page.
- Locate the **"Try your Login box"** under the **"Next Steps"** section.
- Click the **"Try it out"** link.
- Click the **"Sign up"** link under the **"Continue"** button.
- Sign up using any of the available options.

#### Expected results

Verify that the Stripe Customer ID value is, in fact, in the app metadata at Auth0 by following these steps:

- Head to the [Auth0 Dashboard](https://manage.auth0.com/dashboard).
- Click the **"User Management"** tab on the left-hand menu and then select the **"Users"** option.
- In the list of users that comes up, click the name of the user you used to log in. The Auth0 user profile page will load up.
- Under the **"Details"** tab, locate the **"Metadata"** section. Then, within that section, locate the `app_metadata` sub-section.
- Verify that the `stripe_customer_id` is defined.

```lang/json__10
{
  "stripe_customer_id": "ID_VALUE"
}
```

#### Validate the Auth0 and Stripe Connection

You should verify that the Stripe Customer ID value in the `app_metadata` matches the Customer data on Stripe. You should also verify that the Auth0 user ID is present in the Customer's metadata on Stripe.

Perform that validation visit the ["Stripe Customers Dashboard](https://dashboard.stripe.com/test/customers). Once there, click the record with the email of the user that logged in.

The Stripe Customer profile loads up.

In the **" Details "** section, you should see the email of the Auth0 user who logged in and the same Stripe Customer ID present in that user's `app_metadata`.

In the **"Metadata"** section, you should see an `auth0_user_id` property with a value that matches the `user_id` value on the Auth0 user profile page.



Test the Stripe Integration



If you are selling products online, your retail or e-commerce site needs to support at least the following business operations:

- **User management**: Create and maintain accounts for each customer so you can identify them in your systems.
- **Secure account access**: Provide customers with a secure way to access and modify their private and sensitive information, such as order history, billing information, and user profile data.
- **Product catalog**: Provide customers with a complete list or view of your products or services that allow them to purchase them.
- **Payment processing**: Provide customers with a robust yet simple way to use billing information to pay you.

![User accessing an application with strong security](https://images.ctfassets.net/23aumh6u8s0i/3DuYOoznWG10geDOeYwBVm/02b5dbc23075eebf4d984f22dbaaec76/Passwordless-Authentication-sep2.jpg)

Auth0 and Stripe are two platforms that can help you accomplish the abovementioned tasks and much more. Let's learn why.

[Stripe](https://support.stripe.com/questions/what-is-stripe) is a software platform that handles hundreds of billions of dollars of payments from millions of companies worldwide, such as Amazon and Google. A Stripe account gives you access to [hundreds of features](https://stripe.com/payments/features) that help you quickly implement everything from accepting payments to managing subscriptions and verifying identities.

**Stripe is the payment processing platform for the internet.**

[Auth0](https://auth0.com/) is a flexible drop-in solution to add authentication and authorization services to your applications. Your team and organization can avoid the cost, time, and risk that come with building your own solution to authenticate and authorize users. Auth0 offers tons of guidance and SDKs for you to get started and integrate Auth0 into your stack easily.

**Auth0 is the identity platform for the internet.**

In combination, Auth0 and Stripe can help developers build secure e-commerce applications in record time.



Why Use Stripe and Auth0

Learn how to use Auth0 Actions to customize the login user experience beyond the login box.


## Introduction

Are you ready to take action on the user login experience? Join us as we go beyond the login box with [Auth0 Actions](https://auth0.com/docs/customize/actions), adding extensions to their login journey, and more.

### Legal Disclosure

_This document and any recommendations within is not legal, privacy, security, compliance, or business advice. This document is intended for general informational purposes only and may not reflect the most current security, privacy, and legal developments nor all relevant issues. You are responsible for obtaining legal, security, privacy, compliance, or business advice from your own lawyer or other professional advisor and should not rely on the recommendations herein. Okta is not liable to you for any loss or damages that may result from your implementation of any recommendations in this document. Okta makes no representations, warranties, or other assurances regarding the content of this document. Information regarding Okta's contractual assurances to its customers can be found at [okta.com/agreements](https://www.okta.com/agreements/)._
