Overview

Use CLEAR within Auth0 to add biometric identity verification to high-risk authentication moments — login, password reset, and account recovery — for any user population, including customers, employees, contractors, partners, and privileged users.

With CLEAR + Auth0, organizations can require a verified identity check the moment credentials alone aren't enough. Whether a user is signing into an Auth0-hosted account or trying to recover a forgotten password, Auth0 hands off to CLEAR to confirm the person is who they claim to be — beyond the device, beyond the credential.

Verifying with CLEAR is easy: over 42 million existing CLEAR members verify instantly with a selfie, while new users complete a quick, one-time enrollment so future verifications take only seconds. With 60+ verification checks — including liveness detection and source corroboration — organizations can tailor the solution to their business and compliance needs.

CLEAR ships as two separate Auth0 Marketplace integrations, each targeting a different Auth0 trigger:

• CLEAR1 – Login (marketplace listing) — Runs on Auth0's post-login trigger. After a user successfully signs into their Auth0-hosted account, they're prompted to verify with CLEAR before the session continues.
• CLEAR1 – Account Recovery (marketplace listing) — Runs on Auth0's password-reset-post-challenge trigger. During password reset or account recovery, the user is routed to CLEAR to verify identity before the reset completes.

Both integrations use the same underlying CLEAR platform, the same CLEAR1 Client ID + Secret, and the same Auth0 Machine-to-Machine application for blocked-user and blocked-IP checks. The only difference is which Auth0 trigger the Action is installed on.

How the Integration Works

CLEAR operates within the Auth0 authentication or account recovery transaction through Auth0 Actions. Your application continues to use Auth0 through its existing OAuth 2.0 / OpenID Connect Integration.

For a login flow:

1. The application sends the user to Auth0 for authentication
2. Auth0 authenticates the user.
3. Auth0 invokes the post-login Actions flow before completing the authentication transaction
4. The CLEAR Action determines whether identity verification is required
5. If required, Auth0 redirects the user to CLEAR.
6. CLEAR performs identity verification.
7. After verification, the user returns to Auth0 through the tenant's /continue endpoint.
8. Auth0 resumes the suspended authentication transaction.
9. If verification succeeds, Auth0 completes authentication and returns the user to the application.

For account recovery, CLEAR runs on the password-reset-post-challenge trigger. This occurs after Auth0's initial recovery challenge has completed and before the password is reset.

Integration boundaries

Where does CLEAR fit?

Auth0 manages authentication, user sessions, the OAuth/OIDC transaction, and token issuance. CLEAR adds identity verification within that Auth0-controlled flow. When verification is required, the Auth0 Action redirects the user to CLEAR and resumes the Auth0 transaction after verification is complete.

CLEAR does not replace Auth0 or change how your application integrates with Auth0 using OAuth 2.0 or OpenID Connect.

When does CLEAR run?

The Auth0 trigger determines where CLEAR can participate in the flow:

• Login: post-login
• Account Recovery: password-reset-post-challenge

The Action can then determine whether CLEAR verification is required for a specific transaction. This allows CLEAR to be required for every applicable transaction or used conditionally as step-up identity verification when additional assurance is needed.

Use Cases

CLEAR + Auth0 protects the two moments in an authentication flow where identity assurance matters most:

Login (post-login trigger)

Add a biometric identity check after a successful Auth0 sign-in. Use this when a stolen credential or compromised device isn't enough to gain access — the user must also prove they are the physical person on the account.

• New customer onboarding requiring KYC-grade proofing
• Step-up authentication for high-value transactions
• Employee or contractor access to privileged systems
• Compliance-driven identity assurance for regulated industries

Account Recovery (password-reset-post-challenge trigger)

Replace knowledge-based recovery — security questions, one-time passcodes, and help desk transfers — with biometric verification. Use this to shut down account-takeover attacks that exploit weak recovery paths.

• Self-service password reset
• Account unlock after lockout
• MFA reset when a device is lost
• Help desk cost reduction — recover in seconds instead of a 5–10 minute call

The password-reset-post-challenge Action executes after Auth0's initial recovery challenge is completed and before the password is reset. This allows CLEAR verification to act as an additional identity assurance step before Auth0 permits the user to establish a new password.

Both integrations expose the same 60+ verification checks (liveness detection, source corroboration, blocked-user/blocked-IP enforcement) and the same biographic matching options (First Name + Last Name, +Email, +Phone).

How To Use

Both integrations follow the same three-part setup. Navigate to the Installation tab for the specific integration you're deploying — CLEAR1 – Login or CLEAR1 – Account Recovery — for the full step-by-step guide.

1. Set up your CLEAR1 project. A CLEAR System Engineer helps you stand up your CLEAR1 organization. In the CLEAR1 Dashboard, you create a project, generate an OpenID Connect Client ID + Secret from the Integrations tab (the Secret is shown only once — save it immediately), and add your Auth0 tenant URIs to the allow list. From the IDV Builder, configure your verification checks and user population.

2. Create an Auth0 Machine-to-Machine application. This is required for blocked-user and blocked-IP checks. From the Auth0 Dashboard → Applications, create a Machine-to-Machine app authorized against the Auth0 Management API with all permissions granted. Save the Domain, Client ID, and Client Secret — you'll paste these into the CLEAR integration's configuration panel. An existing M2M app can be reused across both CLEAR integrations.

3. Install the CLEAR Action on the correct Auth0 trigger. Navigate to Auth0 Dashboard → Actions → Triggers, select the trigger for your use case (post-login for CLEAR1 – Login, password-reset-post-challenge for CLEAR1 – Account Recovery), and add the CLEAR Action from the Marketplace. Fill in the configuration panel with your CLEAR1 Client ID + Secret, your Auth0 M2M credentials, your redirect URI, biographic matching option, and blocked-user/blocked-IP behavior. Drag the Action into place in the flow and click Apply Changes.

Test before you activate. Once deployed, the Action executes whenever its configured Auth0 trigger runs. if the Action redirects unconditionally, CLEAR verification can occur on every applicable transaction. If CLEAR should only run under specific conditions, implement and test the appropriate conditional logic before activating the integration in production.

Configuration reference — shared between both integrations

Verification Checklist

Before testing the integration, confirm the following configuration is complete:

• CLEAR1 project and environment are configured.
• CLEAR1 Client ID and Secret are configured in the Auth0 integration.
• Auth0 tenant /continue URI is included in the CLEAR allow list.
• Auth0 M2M application has the required Management API permissions.
• The correct CLEAR Marketplace Action is installed on the intended Auth0 trigger.
• The selected biographic matching option corresponds to attributes populated in the Auth0 user profile.
• Blocked-user and blocked-IP handling is configured in the CLEAR Marketplace Action according to your security policy.
• The CLEAR Action has been added to the Auth0 flow and Apply Changes has been selected.
• Any conditional logic controlling when CLEAR runs has been validated.

Testing

After the configuration is complete, verify the integration with the following tests:

• Complete an Auth0 login for a test user. Confirm CLEAR verification is presented and, after successful verification, the user returns to the application. (End-to-end)

• Fail or cancel CLEAR verification during login. Confirm the protected Auth0 login does not complete. (End-to-end)

• Initiate account recovery for a test user. Confirm CLEAR verification is presented and, after successful verification, the user can continue the recovery flow. (End-to-end)

• Fail or cancel CLEAR verification during account recovery. Confirm the protected recovery flow does not complete. (End-to-end)

Resources

• Auth0 Marketplace — CLEAR1 – Login: https://marketplace.auth0.com/integrations/clear-verified
• Auth0 Marketplace — CLEAR1 – Account Recovery: https://marketplace.auth0.com/integrations/clear-verified-recovery
• CLEAR1 Dashboard: Where you create projects, generate OIDC credentials, and configure the IDV Builder
• Auth0 Actions & Triggers documentation: https://auth0.com/docs/customize/actions
• Supported Auth0 features: Universal Login, Single Sign On, Multifactor Authentication, Breached Passwords, User Management, Passwordless, Machine to Machine
• Supported solution types: For your Customers · For your Business Partners · For your Employees