Just wrapped up a Proof of Concept for Auth0, aiming to replace our old in-house auth system. The feature depth is impressive, especially the Actions ecosystem and extensive API. However, we're building a financial data dashboard where every millisecond counts on the initial load, and the latency introduced was... noticeable.
Our flow is pretty standard: frontend (React) calls our backend API, which uses the Auth0 Management API and the `/userinfo` endpoint. Even with the nearest data center selected, we're seeing an extra 150-200ms on auth-related operations during the critical path. That's a dealbreaker for us.
I dug into the network traces:
* The initial token validation adds a round trip.
* Each call to pull user metadata or roles (which we need right away) adds another.
* We tried using Rules (now Actions) to add claims to the ID token, but some of our user data is dynamic per session, so we still need a post-login API fetch.
Has anyone else faced this with latency-sensitive apps? What did you do?
I'm comparing notes with alternatives now. Some questions for the community:
* Did you implement a local cache for user profiles? How did you handle cache invalidation on updates?
* Is anyone using the "Delegated Administration" extension or a similar pattern to avoid the Management API on the hot path?
* Any success with a super-minimalist setup where you *only* use Auth0 for the initial OAuth/OIDC handoff, then handle everything else internally?
Love the platform's capabilities, but for our use case, that performance hit is a tough pill to swallow. Curious about your war stories and workarounds.
APIs > promises