Readonly mfaMFA API client for multi-factor authentication operations.
Provides methods for:
Protected _assertawait auth0.checkSession();
Check if the user is logged in using getTokenSilently. The difference
with getTokenSilently is that this doesn't return a token, but it will
pre-fill the token cache.
This method also heeds the auth0.{clientId}.is.authenticated cookie, as an optimization
to prevent calling Auth0 unnecessarily. If the cookie is not present because
there was no previous login (or it has expired) then tokens will not be refreshed.
It should be used for silently logging in the user when you instantiate the
Auth0Client constructor. You should not need this if you are using the
createAuth0Client factory.
Note: the cookie may not be present if running an app using a private tab, as some
browsers clear JS cookie data and local storage when the tab or page is closed, or on page reload. This effectively
means that checkSession could silently return without authenticating the user on page refresh when
using a private tab, despite having previously logged in. As a workaround, use getTokenSilently instead
and handle the possible login_required error as shown in the readme.
Optional options: GetTokenSilentlyOptionsInitiates a redirect to connect the user's account with a specified connection. This method generates PKCE parameters, creates a transaction, and redirects to the /connect endpoint.
You must enable Offline Access from the Connection Permissions settings to be able to use the connection with Connected Accounts.
Options for the connect account redirect flow.
Resolves when the redirect is initiated.
If the connect request to the My Account API fails.
Returns a new Fetcher class that will contain a fetchWithAuth() method.
This is a drop-in replacement for the Fetch API's fetch() method, but will
handle certain authentication logic for you, like building the proper auth
headers or managing DPoP nonces and retries automatically.
Check the EXAMPLES.md file for a deeper look into this method.
The options required to perform the token exchange.
A promise that resolves to the token endpoint response.
Example:
// Instead of:
const tokens = await auth0.exchangeToken(options);
// Use:
const tokens = await auth0.loginWithCustomTokenExchange(options);
Use loginWithCustomTokenExchange() instead. This method will be removed in the next major version.
Exchanges an external subject token for Auth0 tokens.
Returns a string to be used to demonstrate possession of the private key used to cryptographically bind access tokens with DPoP.
It requires enabling the Auth0ClientOptions.useDpop option.
Optional nonce?: stringReturns a readonly copy of the initialization configuration.
An object containing domain and clientId
const auth0 = new Auth0Client({
domain: 'tenant.auth0.com',
clientId: 'abc123'
});
const config = auth0.getConfiguration();
// { domain: 'tenant.auth0.com', clientId: 'abc123' }
Returns the current DPoP nonce used for making requests to Auth0.
It can return undefined because when starting fresh it will not
be populated until after the first response from the server.
It requires enabling the Auth0ClientOptions.useDpop option.
Optional id: stringThe identifier of a nonce: if absent, it will get the nonce used for requests to Auth0. Otherwise, it will be used to select a specific non-Auth0 nonce.
Fetches a new access token and returns the response from the /oauth/token endpoint, omitting the refresh token.
Fetches a new access token and returns it.
Optional options: GetTokenSilentlyOptionsconst token = await auth0.getTokenWithPopup(options);
Opens a popup with the /authorize URL using the parameters
provided as arguments. Random and secure state and nonce
parameters will be auto-generated. If the response is successful,
results will be valid according to their expiration times.
After the browser redirects back to the callback page,
call handleRedirectCallback to handle success and error
responses from Auth0. If the response is successful, results
will be valid according to their expiration times.
await auth0.loginWithCustomTokenExchange(options);
Exchanges an external subject token for Auth0 tokens and logs the user in. This method implements the Custom Token Exchange grant as specified in RFC 8693.
The exchanged tokens are automatically cached, establishing an authenticated session.
After calling this method, you can use getUser(), getIdTokenClaims(), and
getTokenSilently() to access the user's information and tokens.
The options required to perform the token exchange.
A promise that resolves to the token endpoint response, which contains the issued Auth0 tokens (access_token, id_token, etc.).
The request includes the following parameters:
grant_type: "urn:ietf:params:oauth:grant-type:token-exchange"subject_token: The external token to exchangesubject_token_type: The type identifier of the external tokenscope: Merged scopes from the request and SDK defaultsaudience: Target audience (defaults to SDK configuration)organization: Optional organization ID/name for org-scoped authenticationExample Usage:
const options = {
subject_token: 'eyJhbGciOiJIUzI1NiIsInR5cCI6Ikp...',
subject_token_type: 'urn:acme:legacy-system-token',
scope: 'openid profile email',
audience: 'https://api.example.com',
organization: 'org_12345'
};
try {
const tokenResponse = await auth0.loginWithCustomTokenExchange(options);
console.log('Access token:', tokenResponse.access_token);
// User is now logged in - access user info
const user = await auth0.getUser();
console.log('Logged in user:', user);
} catch (error) {
console.error('Token exchange failed:', error);
}
try {
await auth0.loginWithPopup(options);
} catch(e) {
if (e instanceof PopupCancelledError) {
// Popup was closed before login completed
}
}
Opens a popup with the /authorize URL using the parameters
provided as arguments. Random and secure state and nonce
parameters will be auto-generated. If the response is successful,
results will be valid according to their expiration times.
IMPORTANT: This method has to be called from an event handler that was started by the user like a button click, for example, otherwise the popup will be blocked in most browsers.
Optional options: PopupLoginOptionsOptional config: PopupConfigOptionsawait auth0.loginWithRedirect(options);
Performs a redirect to /authorize using the parameters
provided as arguments. Random and secure state and nonce
parameters will be auto-generated.
await auth0.logout(options);
Clears the application session and performs a redirect to /v2/logout, using
the parameters provided as arguments, to clear the Auth0 session.
If the federated option is specified it also clears the Identity Provider session.
Read more about how Logout works at Auth0.
Sets the current DPoP nonce used for making requests to Auth0.
It requires enabling the Auth0ClientOptions.useDpop option.
The nonce value.
Optional id: stringThe identifier of a nonce: if absent, it will set the nonce used for requests to Auth0. Otherwise, it will be used to select a specific non-Auth0 nonce.
Auth0 SDK for Single Page Applications using Authorization Code Grant Flow with PKCE.