--- title: 'Secure Your .NET App with Auth0 (Free for 25K Users)' source: 'https://youtube.com/watch?v=jB-9dF1TXyI' video_id: 'jB-9dF1TXyI' date: 2026-08-08 duration_sec: 671 --- # Secure Your .NET App with Auth0 (Free for 25K Users) > Source: [Secure Your .NET App with Auth0 (Free for 25K Users)](https://youtube.com/watch?v=jB-9dF1TXyI) ## Summary This video introduces Auth0 as a popular identity provider for .NET applications, highlighting its generous free plan of up to 25,000 monthly active users. The presenter demonstrates how to configure Auth0 in the portal and integrate it into a .NET application for authentication and authorization, using Swagger UI as the client. ### Key Points - **Introduction to Auth0** [00:01] — Auth0 is a popular identity provider used by many applications worldwide, offering user management, multi-factor authentication, and easy integration with .NET. - **Free Plan Benefits** [00:57] — Auth0's free plan supports up to 25,000 monthly active users, includes passwordless authentication, custom branding, and custom domains. - **Creating a Tenant** [01:25] — Upon login, users create a tenant and choose a data region (e.g., EU). The dashboard provides options for application setup. - **Application Types** [01:51] — Auth0 offers application types: native (mobile/desktop/CLI), single-page web (JS/Angular/React), regular web (API), and machine-to-machine (server-to-server). - **Demo Setup with Swagger UI** [02:18] — The demo uses a single-page web application type for Swagger UI integration, noting differences in authorization flows. - **Key Credentials** [03:00] — Important credentials include Auth0 domain (issuer), client ID, and client secret, which are used for token validation and authorization requests. - **Advanced Settings** [03:42] — Settings include token lifetime, refresh token lifetime, OAuth settings, and grant types. The recommended flow is authorization code with PKCE. - **OAuth Endpoints** [04:26] — The authorize and token endpoints are crucial for OAuth flows. The OpenID configuration provides these endpoints and JSON keys for token validation. - **Configuring Callback URLs** [05:07] — Allowed callback URLs and web origins must be set for Swagger UI to receive callbacks from Auth0 login. - **Creating an API** [05:22] — An API (e.g., Auth0 demo API) is created to represent the back-end application, with permissions granted to the OAuth client. - **.NET Integration Setup** [06:03] — Environment variables are set for token URL, metadata address, valid issuer, and audience. The JWT Bearer library is used for authentication. - **Adding Authentication Services** [06:29] — Services are added using AddAuthentication and AddJwtBearer, configuring audience, metadata address, and token validation parameters. - **Middleware Order** [07:40] — UseAuthentication must be called before UseAuthorization in the middleware pipeline. - **Swagger OAuth Configuration** [08:06] — Swagger UI is configured with OAuth flow (authorization code), specifying authorization URL, token URL, and scopes. - **Testing the Integration** [09:10] — After starting the app, unauthorized requests return 401. Authorizing with client ID/secret redirects to Auth0, and the access token is validated. - **Token Validation Process** [10:16] — The back end fetches OpenID configuration and JSON web keys to validate the token signature, caching the configuration for efficiency. ### Conclusion Auth0 provides a robust, free identity solution for .NET apps, with straightforward integration and a generous free tier. The video effectively demonstrates the entire setup, from portal configuration to token validation. ## Transcript security as a .NET developer, you'll probably explore adding some sort of identity provider into your system. And in this video, I want to introduce you to Auth0, which is a very popular identity provider. I'm going to show you why it's interesting, how many users you can get on the free plan, and how to integrate it for authentication purposes into your .NET applications. As I said, Auth0 is a very popular identity provider. It's being used by many applications worldwide. It also has a .NET integration that we're going to discuss a bit later. And for B2C integrations, it comes with everything user management, multi-factor authentication, and it's also easy to integrate into our .NET applications, which is what we are concerned with. really going to range between what your needs are and how many users you have. But, what I think it's appealing to at least consider is because it has a very generous free plan that allows you up to 25,000 monthly active users. So, if you have less users than this or up to 25,000 users, then the free plan is It also comes with passwordless authentication. You can customize it to your brand. You can add a custom domain, and really manage everything you need for your authentication and authorization purposes. Now, let's head into the Auth0 portal. When you log in, you will be prompted to create your first tenant, and also choose the region where your data is going to be stored. I created a tenant with its data stored in the EU region, and this is the dashboard that you're going to see after you create your tenant. Now, from here, you have a couple of options. And obviously, the main call to action here is to that. And here, you have to decide your application type. Now, if you're familiar with other identity providers, this is very similar to the concept of a client, from my understanding. And our options here are having a native client, which is something like a mobile, a desktop app, or a CLI, a single page web application. This is suitable for JS applications or things like Angular or React, a regular web application, which is more akin to an API, and then you've got a machine-to-machine application, and these are more appropriate for your with each other and aren't exposed to the public. Now, what I'm going to do for this demo is integrate Auth0 with my Swagger UI client. So, I'm going to choose a single page web application. And the main difference here is how this flows that we have access to. So, I'm going to call this the Swagger Auth0 So, from here, you're going to get an option to choose which technology you're going to give you a very quick integration guide. So, let's say I'm using just plain old JavaScript, and you even get an AI prompt that you can pass in to your agent to let it integrate Auth0 for you. Now, there's also a quick getting started guide that you can follow to see what's required to have everything up and running, and I want to actually show you the interesting parts. have access to a couple of important going to need to know your Auth0 domain. This is going to be your issuer and your auth 3 when we want to validate our access tokens later. Then we've got our client ID, and as I said, applications in Auth0 are essentially OAuth clients. And we also have a client secret that we will have to specify when sending an authorization request. Now, if we keep scrolling down, there are some other here. So, among other things, you can change the application type, and this is access to. Then we're going to have things like application URIs and important for implementing the authorization flows. And if I keep couple more settings. So, here we can see settings for token lifetime, refresh token lifetime, and if we go all the the down, I want to show you the advanced metadata, configure device settings. We can also configure our OAuth settings. And when it comes to grant types, this is actually which authorization flows you're allowed to use with this OAuth client. And considering this is a UI implicit authorization code and refresh token flows. Client credentials is more scenarios, and the password flow really isn't recommended today as the gold standard is using authorization code flow with proof key for code exchange or endpoints, and this is where you can find your OAuth endpoints. And it's what to have everything integrate nicely into the OAuth flow. So, here is the authorize endpoint and then the token endpoint, which are going to be the most getting the OpenID configuration, and our back end will know how to use it to extract the JSON keys automatically from this response. Just to show you, I'm going to copy this URL and I'm going to open it in another browser window. And authorization endpoint, your token endpoint, and these all integrate nicely into our JSON web token authorization flow on the back end. So, let me go back to our application, and here I want to configure a couple of things. So, we're going to configure the allowed callback URLs, and here I'm going to add a URL for our Swagger UI to allow a callback from the Auth0 login screen. And we're set it as one of the allowed web origins. Let's click save, and this gets persisted. And then we're going to click under applications and APIs, and we're going to create another API. So, I'm going to call this the Auth0 demo API, and I'm also going to use the same name as the identifier. And this is going to JSON web token that we're going to create. I'm going to leave all the other going to create this. And once we have our API configured, I'm going to go back to the applications, open up our Swagger OAuth client, and we're going to go into APIs, and we want to add access to the Auth0 demo API that we just created. Now, this API essentially represents our back-end application, and we want to allow our OAuth client to have access to the permissions, and I'm going to allow it user access, and then we're going to click save. So, now I can close this down, and it's time to move into our .NET application. So, right now, I don't have any authentication or authorization stopped out the required environment variables that we have to set. So, these the token URL, the metadata address, the valid issuer, and our audience. We already discussed some of these as I was introducing you to Auth0. So, we're going to set these values later, but first, let's add the required services, and I'm noting that I already installed the JSON Web Token library, which is going to allow us to validate JSON Web Tokens that Auth0 is going to issue for Microsoft.AspNetCore.Authentication.JwtBearer. So, I'm going to say builder.Services. Add authorization. Then, I'm going to say builder.Services.AddAuthentication, scheme. So, we're going to say JwtBearerDefaults and access the authentication scheme, and this just has a constant value of AddJwtBearer, and this allows us to configure how we're going to validate incoming JWT tokens. So, I'm going to say options.Audience, and we're going to set this to a value configuration section. So, we're going to first match our audience. Then, I want to set the metadata address, and let me update my setting value to target null-forgiving operator. And lastly, I just need to set a new value for the token validation parameters, and here, I want to configure the valid issuer. So, let me also copy this, and we're going to use the value of issuer. So, that's it as far as our authentication and authorization services are concerned. We middleware. So, we're going to say app.use authentication and then we're going to say app.use authorization. The order of these is important, so keep that in mind. We already have our protected endpoint that we're going to call to test out if all of this is working as expected. And then when setting up the Swagger UI, I'm going to configure the options here to say OAuth additional query string parameters. This is because we need to send an additional query parameter to set the audience value in our authorization request so that we get back the correct JSON web token. Now, this value has to match the API audience that we just created and this is going to be our Auth0 demo API. Of course, we can also pull this value from builder.configuration and then the respective values inside of our appsettings.json. So, we already know the audience and the value is Auth0 demo API. Our valid issuer is just going to be the base address of our tenant. And then we can just pull the values for the metadata address, the token URL, and the authorization URL from the endpoint section of our client. Now, one more thing I added behind the scenes is some code for my Swagger configuration to implement an OAuth flow, to be more specific, the authorization code flow. And here we have to specify our authorization URL, the token URL, and any scopes we may want to pass to this request. So, with this I'm going to start my application. Now, if we open up the Swagger UI and I try to call our single endpoint, we're going to get back a 401 unauthorized response. If I click authorize, you can see our OAuth flow is correctly set pointing to our two endpoints and we have to input our client ID and client secret. We can get both of these values from our Auth0 client. So, here is the client ID. I'm going to copy it and paste it into the client ID field and I'm also going to drop in the client secret. I'll select both scopes and I'm also going to open up dev tools side by side and I will now click authorize. This is going to redirect us to Auth0, where we can give our client access to our APIs. I'm going to click accept, and this will now where we are going to send a token request with our custom audience, and we will get back an access token response. So, if we copy the contents of this access token, and we go over to jwt.io get rid of the quotes, we should see a valid access token and all of its claims. You can see our custom audience here, the issuer, and we can now use this to authenticate with our back end. So, if I close this and send a request to our endpoint, you'll see that we get a 200 OK response, and I'm just going to list out the claims available on this token in the response body. And this is all because of how OAuth works behind the scenes. If we take a look at our API request, you can see that other than calling our API inside of this additional requests. So, this one here is targeting our OpenID configuration on our Auth0 tenant, and it's going to pull back the configuration values, which it's going to use to access the JSON web keys, and this is how it knows to validate the JSON web token signature. Now, this is going to be cached, so it's requests, but I just wanted to give you a full picture of how we are able to validate the JSON web token. Now, if you're looking for a free and open source identity provider, then I think you should watch this video next to see how you can integrate Keycloak into your .NET applications. If you enjoyed this video, consider gently tapping the like button to let me know. Thanks a lot for watching, and until next time, stay awesome.