OAuth 2.0 with Auth0

AirDeck started with a traditional login system of its own. That works for the web app, but it breaks down as soon as a third-party integration needs access. An application such as the Outlook plugin has to reach a user's protected resources on their behalf, and a custom login cannot give it that safely.

The experience mattered too. OAuth 2.0 gives people one shared login session, so they do not have to sign in again in every place they use the product.

I proposed moving to OAuth 2.0 and my architect agreed. For the provider, I suggested Auth0 instead of building the flow ourselves. Several providers could have done the job, but Auth0 was the right fit at the time:

• Pricing suited us.
• Customizability: we replaced the whole login page with our own HTML.
• Hooks: Auth0 lets you run your own code before and after login, written in Node.js, which was convenient for us.
• Database connection: Auth0 can call our existing user database.

Existing users were not migrated. Our users already had protected passwords, so Auth0 checks them against the existing database. New users get the latest hashing technique, and older users keep the one they already had. The two are told apart by the salt, so each person is checked the way their password was stored.

I reworked every authentication page: sign in, sign up, reset and the rest.

Other providers were available, and I did not compare them in detail. Auth0 fit our needs for pricing, customization, hooks and the database connection.

Implemented OAuth 2.0 authorization using Auth0 to enable external applications to securely access AirDeck resources on behalf of authenticated users.

The authorization flow supported integrations such as the AirDeck Outlook plugin, allowing external tools to interact with protected application APIs while maintaining controlled user authorization.

• Vendor lock-in. We now depend on Auth0. The redirects are hard to manage, and moving to a different tool later would be tricky.
• Less control over the login screens and the flow than with a login we build ourselves, even though we could customize the page.
• It took a long time. Planning and execution were long compared with other tasks: about 4 to 5 weeks to build and about 2 weeks of testing.

Third-party applications such as the Outlook plugin can now access protected AirDeck resources on behalf of signed-in users, and people sign in once.

It also made other integrations simpler. Any external tool can connect the same way, and a Gmail integration is planned. With the Outlook plugin, a person signs in with their AirDeck account, sees their deck information, and clicks to add the deck's link with its picture and description (Open Graph metadata) filled in automatically, so nothing has to be written by hand.