ReadonlyappReadonlyerror$Emits errors that occur during login, or when checking for an active session on startup.
ReadonlyidEmits ID token claims when authenticated, or null if not authenticated.
ReadonlyisEmits boolean values indicating the authentication state of the user. If true, it means a user has authenticated.
This depends on the value of isLoading$, so there is no need to manually check the loading state of the SDK.
ReadonlyisEmits boolean values indicating the loading state of the SDK.
ReadonlymfaProvides MFA (Multi-Factor Authentication) operations as Observables.
These methods are available after getAccessTokenSilently throws an MfaRequiredError.
Use the mfa_token from the error to call these methods.
ReadonlymyProvides MyAccount API operations as Observables.
Allows the authenticated user to list, enroll, update, and delete their
authentication methods. Requires an access token with the appropriate
read/create/update/delete:me:authentication-methods scopes.
ReadonlypasskeyProvides Passkey (WebAuthn) authentication as Observables.
Both methods handle the full WebAuthn challenge-response flow internally. After a successful call, this updates the authentication state to ensure consistency with the standard authentication flows.
Readonlyuser$Emits details about the authenticated user, or null if not authenticated.
connectAccountWithRedirect({
connection: 'google-oauth2',
scopes: ['openid', 'profile', 'email', 'https://www.googleapis.com/auth/drive.readonly'],
authorization_params: {
// additional authorization params to forward to the authorization server
}
});
Redirects to the /connect URL using the parameters
provided as arguments. This then redirects to the connection's login page
where the user can authenticate and authorize the account to be connected.
If connecting the account is successful, handleRedirectCallback will be called
with the details of the connected account.
The connect account options
const fetcher = createFetcher(config);
Creates a custom fetcher instance that can be used to make authenticated HTTP requests. The fetcher automatically handles token refresh and can be configured with custom request/response handling.
Optionalconfig: FetcherConfig<TOutput>
Optional configuration for the fetcher
A Fetcher instance configured with the Auth0 client.
generateDpopProof(params).subscribe(proof => ...)
Generates a DPoP (Demonstrating Proof-of-Possession) proof JWT. This proof is used to bind access tokens to a specific client, providing an additional layer of security for token usage.
Configuration for generating the DPoP proof
The access token to bind to the proof
The HTTP method (e.g., 'GET', 'POST')
Optionalnonce?: stringOptional DPoP nonce from the authorization server
The URL of the resource server endpoint
An Observable that emits the generated DPoP proof as a JWT string.
Fetches a new access token and returns the response from the /oauth/token endpoint, omitting the refresh token.
The options for configuring the token fetch.
Fetches a new access token and returns it.
Optionaloptions: GetTokenSilentlyOptions
The options for configuring the token fetch.
getTokenWithPopup(options).subscribe(token => ...)
Get an access token interactively.
Opens a popup with the /authorize URL using the parameters
provided as arguments. Random and secure state and nonce
parameters will be auto-generated. If the response is successful,
results will be valid according to their expiration times.
Optionaloptions: GetTokenWithPopupOptionsgetDpopNonce(id).subscribe(nonce => ...)
Gets the DPoP nonce for the specified domain or the default domain. The nonce is used in DPoP proof generation for token binding.
Optionalid: string
Optional identifier for the domain. If not provided, uses the default domain.
An Observable that emits the DPoP nonce string or undefined if not available.
handleRedirectCallback(url).subscribe(result => ...)
After the browser redirects back to the callback page,
call handleRedirectCallback to handle success and error
responses from Auth0. If the response is successful, results
will be valid according to their expiration times.
Calling this method also refreshes the authentication and user states.
Optionalurl: string
The URL to that should be used to retrieve the state and code values. Defaults to window.location.href if not given.
loginWithCustomTokenExchange(options).subscribe(tokenResponse => ...)
Exchanges an external subject token for Auth0 tokens and establishes an authenticated session.
This method implements the token exchange grant as specified in RFC 8693.
It performs a token exchange by sending a request to the /oauth/token endpoint
with the external token and returns Auth0 tokens (access token, ID token, etc.).
The request includes the following parameters:
grant_type: Hard-coded to "urn:ietf:params:oauth:grant-type:token-exchange"subject_token: The external token to be exchangedsubject_token_type: A namespaced URI identifying the token type (must be under your organization's control)audience: The target audience (falls back to the SDK's default audience if not provided)scope: Space-separated list of scopes (merged with the SDK's default scopes)After a successful token exchange, this method updates the authentication state to ensure consistency with the standard authentication flows.
The options required to perform the token exchange
An Observable that emits the token endpoint response containing Auth0 tokens
await loginWithPopup(options);
Opens a popup with the /authorize URL using the parameters
provided as arguments. Random and secure state and nonce
parameters will be auto-generated. If the response is successful,
results will be valid according to their expiration times.
IMPORTANT: This method has to be called from an event handler that was started by the user like a button click, for example, otherwise the popup will be blocked in most browsers.
Optionaloptions: PopupLoginOptions
The login options
Optionalconfig: PopupConfigOptions
Configuration for the popup window
loginWithRedirect(options);
Performs a redirect to /authorize using the parameters
provided as arguments. Random and secure state and nonce
parameters will be auto-generated.
Optionaloptions: RedirectLoginOptions<TAppState>
The login options
logout();
Clears the application session and performs a redirect to /v2/logout, using
the parameters provided as arguments, to clear the Auth0 session.
If the federated option is specified it also clears the Identity Provider session.
If the openUrl option is set to false, it only clears the application session.
It is invalid to set both the federated to true and openUrl to false,
and an error will be thrown if you do.
Read more about how Logout works at Auth0.
Optionaloptions: LogoutOptions
The logout options
Called when the service is destroyed
setDpopNonce(nonce, id).subscribe(() => ...)
Sets the DPoP nonce for the specified domain or the default domain. This is typically used after receiving a new nonce from the authorization server.
The DPoP nonce value to set.
Optionalid: string
Optional identifier for the domain. If not provided, uses the default domain.
An Observable that completes when the nonce is set.
Emits the value (if any) that was passed to the
loginWithRedirectmethod call but only afterhandleRedirectCallbackis first called