Authentication

Three authentication models for establishing customer identity: OAuth 2.0 consent, Auth0 SSO, and unauthenticated access.

The right model depends on how customer identity is established in your system.

Cover Genius configures authentication during onboarding. Partners provide credentials and endpoints — no authentication code runs on the partner side.

OAuth 2.0 consent

Use this model when the journey needs to access customer data from your system.

How it works:

What you provide during onboarding:

• OAuth authorization URL — the URL where customers log in and grant consent
• OAuth scopes — the permissions the Cover Genius backend requests
• Client credentials — client ID and secret for the token exchange
• API endpoint — the URL where the Cover Genius backend fetches customer data using the token

The token exchange and data retrieval happen server-to-server. No PII passes through the browser or URL parameters.

SSO via Auth0

Use this model when customers arrive at the journey already authenticated through your identity provider.

How it works:

What you provide during onboarding:

• Identity provider details — SAML or OIDC configuration for federation
• User attribute mapping — which identity claims map to customer fields
• Data API endpoint — the URL where the Cover Genius backend fetches customer data

Cover Genius provisions the Auth0 integration during onboarding. No code changes are required on the partner side. Customer data is retrieved server-to-server — no PII passes through the browser.

Unauthenticated

Use this model when no customer login is required. The journey collects customer information directly through forms.

How it works:

This model is common for regulated partners (e.g., banks) where customer data cannot be passed through embedded widgets and must be collected within the Cover Genius-hosted experience.

Summary

Model	Customer login?	Partner provides	Best for
OAuth 2.0 consent	Yes, on partner's platform	OAuth credentials + API endpoint	Accessing partner-held customer data
SSO via Auth0	Transparent (existing session)	Identity provider config	Pre-authenticated customers
Unauthenticated	No	Nothing (for auth)	Open access, regulated partners