AuthLabX
Log in

Auth0 proofs of concept

Identity features,
taken apart and
put back together.

Every AuthLabX POC ships three things: a working demo inside a real profile area, the exact HTTP calls it makes, and an engineer-grade write-up of how and why.

Read POC-001Try it live →
profile/security · developer mode
POST/me/v1/authentication-methods201
{ "type": "passkey" }
WEBnavigator.credentials.create()✓
Touch ID
POST/me/v1/authentication-methods/{id}/verify200
{ "auth_session", "authn_response" }
GET/me/v1/authentication-methods200
3 methods

/pocs

The lab bench

All POCs →
POC-001live

Self-service MFA & passkeys with the My Account API

Let signed-in users enroll, rename and remove passkeys, authenticator apps, security keys, SMS, email and recovery codes from your own profile page, using Auth0's user-scoped /me/v1 API through a Next.js backend-for-frontend.

My Account APIMFAPasskeysWebAuthn
Intermediate · 22 min readOpen →
POC-002planned

Step-up authentication for sensitive actions

Require a fresh MFA challenge before high-risk operations, and enforce it server-side with acr/amr and scopes.

MFAActionsacr_values
POC-003planned

Connected accounts & Token Vault

Link third-party accounts (Google, GitHub…) with the My Account API and call their APIs on the user's behalf.

My Account APIToken Vault

Anatomy of a POC

01

Docs sub-page

Architecture, tenant setup, sequence diagrams, every endpoint and the pitfalls. Lives at /pocs/<slug>.

02

Live demo in /profile

The feature running where it would in a real product: Profile → Data or Profile → Security.

03

Developer mode

Toggle it on to see each request and response the backend makes to Auth0, tokens redacted.