Auth0 Action

Repo location

integrations/auth0/predax-post-login-action.js

Configure one Auth0 secret: PREDAX_API_KEY (your prdx_... key). The optional PREDAX_BASE_URL secret already defaults to https://predax.io, so set it only if you are pointing the Action at your own instance.

When to use it

• Require MFA for risky logins (recommended)
• Block only critical risk (Tor / very high score)
• Tag users for review or add metadata to the session

Setup steps

1. Auth0 Dashboard → Actions → Library → Create Action (Post Login)
2. Paste the code from integrations/auth0/predax-post-login-action.js
3. Configure the secret PREDAX_API_KEY; optionally PREDAX_BASE_URL = https://predax.io (required — do not rely on the template default)
4. Attach the Action to your Login flow

Policy example

Typical policy: fail-open on Predax errors (a login flow must never break because a risk lookup timed out), require MFA for risk ≥ 70, deny only when risk ≥ 90. Denying at a lower score will lock out real users on VPNs; step-up MFA is the safer response for the ambiguous middle.

// Pseudocode inside Auth0 Action
const ip = event.request.ip;
const res = await fetch(`${event.secrets.PREDAX_BASE_URL}/api/v1/check/ip`, {
  method: "POST",
  headers: { "Content-Type": "application/json", "X-API-Key": event.secrets.PREDAX_API_KEY },
  body: JSON.stringify({ ip, user_id: event.user.user_id }),
});
if (!res.ok) return; // fail open
const data = await res.json();
const score = data?.classification?.risk_score ?? 0;
const c = data?.classification ?? {};

if (score >= 90 || c.is_tor) api.access.deny("Access denied");
else if (score >= 70) api.multifactor.enable("any");

Passing user_id lets Predax correlate the login with prior traffic from the same account, which feeds the residential-proxy suspicion signal.