Overview

Use CLEAR within Auth0 to add biometric identity verification to high-risk authentication moments — login, password reset, and account recovery — for any user population, including customers, employees, contractors, partners, and privileged users.

With CLEAR + Auth0, organizations can require a verified identity check the moment credentials alone aren't enough. Whether a user is signing into an Auth0-hosted account or trying to recover a forgotten password, Auth0 hands off to CLEAR to confirm the person is who they claim to be — beyond the device, beyond the credential.

Verifying with CLEAR is easy: over 30 million existing CLEAR members verify instantly with a selfie, while new users complete a quick, one-time enrollment so future verifications take only seconds. With 60+ verification checks — including liveness detection and source corroboration — organizations can tailor the solution to their business and compliance needs.

CLEAR ships as two separate Auth0 Marketplace integrations, each targeting a different Auth0 trigger:

• CLEAR1 – Login (marketplace listing) — Runs on Auth0's post-login trigger. After a user successfully signs into their Auth0-hosted account, they're prompted to verify with CLEAR before the session continues.
• CLEAR1 – Account Recovery (marketplace listing) — Runs on Auth0's password-reset-post-challenge trigger. During password reset or account recovery, the user is routed to CLEAR to verify identity before the reset completes.

Both integrations use the same underlying CLEAR platform, the same CLEAR1 Client ID + Secret, and the same Auth0 Machine-to-Machine application for blocked-user and blocked-IP checks. The only difference is which Auth0 trigger the Action is installed on.

Use Cases

CLEAR + Auth0 protects the two moments in an authentication flow where identity assurance matters most:

Login (post-login trigger)

Add a biometric identity check after a successful Auth0 sign-in. Use this when a stolen credential or compromised device isn't enough to gain access — the user must also prove they are the physical person on the account.

• New customer onboarding requiring KYC-grade proofing
• Step-up authentication for high-value transactions
• Employee or contractor access to privileged systems
• Compliance-driven identity assurance for regulated industries

Account Recovery (password-reset-post-challenge trigger)

Replace knowledge-based recovery — security questions, one-time passcodes, and help desk transfers — with biometric verification. Use this to shut down account-takeover attacks that exploit weak recovery paths.

• Self-service password reset
• Account unlock after lockout
• MFA reset when a device is lost
• Help desk cost reduction — recover in seconds instead of a 5–10 minute call

Both integrations expose the same 60+ verification checks (liveness detection, source corroboration, blocked-user/blocked-IP enforcement) and the same biographic matching options (First Name + Last Name, +Email, +Phone, +DOB).

How To Use

Both integrations follow the same three-part setup. Navigate to the Installation tab for the specific integration you're deploying — CLEAR1 – Login or CLEAR1 – Account Recovery — for the full step-by-step guide.

1. CLEAR1 project setup — A CLEAR System Engineer helps you stand up your CLEAR1 organization. In the CLEAR1 Dashboard, you create a project, generate an OpenID Connect Client ID + Secret from the Integrations tab (the Secret is shown only once — save it immediately), and add your Auth0 tenant URIs to the allow list. From the IDV Builder, configure your verification checks and user population.

2. Auth0 Machine-to-Machine application — Required for blocked-user and blocked-IP checks. From the Auth0 Dashboard → Applications, create a Machine-to-Machine app authorized against the Auth0 Management API with all permissions granted. Save the Domain, Client ID, and Client Secret — you'll paste these into the CLEAR integration's configuration panel. An existing M2M app can be reused across both CLEAR integrations.

3. Install the CLEAR Action on the correct Auth0 trigger — Navigate to Auth0 Dashboard → Actions → Triggers, select the trigger for your use case (post-login for CLEAR1 – Login, password-reset-post-challenge for CLEAR1 – Account Recovery), and add the CLEAR Action from the Marketplace. Fill in the configuration panel with your CLEAR1 Client ID + Secret, your Auth0 M2M credentials, your redirect URI, biographic matching option, and blocked-user/blocked-IP behavior. Drag the Action into place in the flow and click Apply Changes.

Test before you activate. Once deployed, the Action processes every request that hits its trigger. Install and validate on a test tenant before activating in production.

Configuration reference — shared between both integrations

Resources

• Auth0 Marketplace — CLEAR1 – Login: https://marketplace.auth0.com/integrations/clear-verified
• Auth0 Marketplace — CLEAR1 – Account Recovery: https://marketplace.auth0.com/integrations/clear-verified-recovery
• CLEAR1 Dashboard: Where you create projects, generate OIDC credentials, and configure the IDV Builder
• Auth0 Actions & Triggers documentation: https://auth0.com/docs/customize/actions
• Supported Auth0 features: Universal Login, Single Sign On, Multifactor Authentication, Breached Passwords, User Management, Passwordless, Machine to Machine
• Supported solution types: For your Customers · For your Business Partners · For your Employees