title: Auth0 embedded login flow
body: <p>We are trying to implement Auth0 in our next+fastify based application. The login page is custom and we want to integrate the login using the <a href="https://auth0.com/docs/login/embedded-login" rel="nofollow noreferrer">embedded</a> login from the fastify server.
  I am naive to oAuth and Auth0, I have a few doubts around it:</p>
  <ol>
  <li><p>How do we verify the token? Do we verify the JWT and maintain the token on or fastify server or should we always the validate the token on Auth0 endpoint? I tried calling the <a href="https://auth0.com/docs/api/authentication#get-user-info" rel="nofollow noreferrer">userinfo</a> endpoint which resulted in rate limiting. So, I interpret if we just verify the JWT on server instead of sending to Auth0 server. Also we send and maintain the JWT in cookies to validate the client always. Is the understading correct?</p>
  </li>
  <li><p>Is embedded login safe enough to be used in production? Are there any risk associated around it?</p>
  </li>
  <li><p>Is the approach correct? Is there any alternative way to implement the login flow? We also need to integrate reset password and rest of the functionality. I have read the SDK docs and it seems to have support for all.</p>
  </li>
  </ol>
  <p>Thanks a lot in advance</p>