Auth0 CIAM Scenarios

Seven ways identity disappears into the background.

Prospect demos I built to show Auth0 features doing real work. Each one runs on its own with no live tenant behind it, so you can click through all of it.

PR
Commerce

Peeling Retail

The cart that doesn't wait for her to come back.

The full retail story. A shopper builds a cart with no account, returns days later to find it intact, and signs up with a passkey. Includes an ROI model that runs your own numbers, and what an AI shopping agent would need to act for her before she has ever signed in.

Anonymous SessionsPasskeysToken VaultCIBA
Open demo
AB
Banking

Anchor Bank

One bank. Two self-service portals.

A Personal and Business toggle switches between a consumer portal and an organization portal. Customers manage their own passkeys, MFA, and profile, and business admins run their own team and SSO, all through Auth0 Universal Portals instead of screens the bank had to build.

Universal PortalsMy AccountPasskeysSSO
Open demo
AT
Travel

Atlas

An AI travel agent that only ever acts with permission.

Three chapters: an agent books a flight through Token Vault, answers policy questions through retrieval secured by FGA, then pauses for human approval on a costly booking via CIBA.

Token VaultFGACIBA
Open demo
WP
Aviation

Waypoint

Let the customer wire up their own SSO.

An org admin at Northwind Aviation configures their own SAML/OIDC connection inside the app. Passwordless covers the fallback, and Organizations routes every user home automatically.

SSOPasswordlessOrganizations
Open demo
TR
Banking

Trellis

A wire transfer that gets suspicious, and responds accordingly.

Passkey login, a risk flag from Attack Protection on a large transfer, and a step up handled through session transfer from native to web, since the app has no existing web session.

PasskeysAttack ProtectionStep up
Open demo
WD
SRE

Warden

An agent that inherits the responder's authority, and no more.

Ridgeline incident response. An SRE agent reaches production tooling through Auth for MCP, acts as a principal in its own right, and exchanges tokens On-Behalf-Of the engineer so every action stays attributable.

Auth for MCPAgent as PrincipalOn-Behalf-OfXAA
Open demo
SB
Retail

Sable

The short version. A cart that survives without an account.

The same idea stripped to the mechanic. A guest cart with no account, surviving a return visit and merging into her profile at signup. Shorter than Peeling Retail and focused purely on how the session behaves.

Anonymous SessionsAccount Merge
Open demo