StaticcreateStaticcreate- Gets and sets configuration for the internal Auth0 client. This - can be used to provide configuration outside of using - AuthModule.forRoot, i.e. from a factory provided by - APP_INITIALIZER. -
-// app.module.ts
// ---------------------------
import { AuthModule, AuthClientConfig } from '@auth0/auth0-angular';
// Provide an initializer function that returns a Promise
function configInitializer(
http: HttpClient,
config: AuthClientConfig
) {
return () =>
http
.get('/config')
.toPromise()
.then((loadedConfig: any) => config.set(loadedConfig)); // Set the config that was loaded asynchronously here
}
// Provide APP_INITIALIZER with this function. Note that there is no config passed to AuthModule.forRoot
imports: [
// other imports..
HttpClientModule,
AuthModule.forRoot(), //<- don't pass any config here
],
providers: [
{
provide: APP_INITIALIZER,
useFactory: configInitializer, // <- pass your initializer function here
deps: [HttpClient, AuthClientConfig],
multi: true,
},
],
+AuthClientConfig | @auth0/auth0-angular
+
+
+
+
+
+Class AuthClientConfig
+
+Gets and sets configuration for the internal Auth0 client. This can be
+used to provide configuration outside of using AuthModule.forRoot, i.e. from
+a factory provided by APP_INITIALIZER.
+
+
+
+Usage
// app.module.ts
// ---------------------------
import { AuthModule, AuthClientConfig } from '@auth0/auth0-angular';
// Provide an initializer function that returns a Promise
function configInitializer(
http: HttpClient,
config: AuthClientConfig
) {
return () =>
http
.get('/config')
.toPromise()
.then((loadedConfig: any) => config.set(loadedConfig)); // Set the config that was loaded asynchronously here
}
// Provide APP_INITIALIZER with this function. Note that there is no config passed to AuthModule.forRoot
imports: [
// other imports..
HttpClientModule,
AuthModule.forRoot(), //<- don't pass any config here
],
providers: [
{
provide: APP_INITIALIZER,
useFactory: configInitializer, // <- pass your initializer function here
deps: [HttpClient, AuthClientConfig],
multi: true,
},
],
-
-
-
-
-
-
-
-
-
- Index
-
-
-
-
- Constructors
-
-
- constructor
-
-
-
-
- Methods
-
-
-
-
-
-
-
-
-
-
-
- Constructors
-
-
-
-
-
- constructor
-
-
- -
-
-
-
-
Parameters
-
- -
-
Optionalconfig:
- AuthConfig
-
-
-
-
- Returns
- AuthClientConfig
-
-
-
-
-
-
-
-
-
-
-
-
- Methods
-
-
-
-
-
- get
-
-
- -
-
-
-
-
- Gets the config that has been set by other consumers of
- the service
-
-
-
- Returns
- AuthConfig
-
-
-
-
-
-
-
-
- set
-
-
- -
-
-
-
-
- Sets configuration to be read by other consumers of the
- service (see usage notes)
-
-
-
- Parameters
-
- -
- config:
- AuthConfig
-
-
The configuration to set
-
-
-
-
-
- Returns void
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
+
+Optionalconfig: AuthConfigGets the config that has been set by other consumers of the service
+Sets configuration to be read by other consumers of the service (see usage notes)
+The configuration to set
+Identifies and handles a given HTTP request.
-The outgoing request object to handle.
-- The next interceptor in the chain, or the backend - if no interceptors remain in the chain. -
-An observable of the event stream.
- -Identifies and handles a given HTTP request.
+The outgoing request object to handle.
+The next interceptor in the chain, or the backend +if no interceptors remain in the chain.
+An observable of the event stream.
+Staticfor- Initialize the authentication module system. - Configuration can either be specified here, or by - calling AuthClientConfig.set (perhaps from an - APP_INITIALIZER factory function). -
-Optionalconfig:
- AuthConfig
- The optional configuration for the SDK.
-StaticforInitialize the authentication module system. Configuration can either be specified here, +or by calling AuthClientConfig.set (perhaps from an APP_INITIALIZER factory function).
+Optionalconfig: AuthConfig
+The optional configuration for the SDK.
+Readonlyapp
- Emits the value (if any) that was passed to the
- loginWithRedirect method call but only
- after handleRedirectCallback is
- first called
-
Readonlyerror$
- - Emits errors that occur during login, or when checking for an - active session on startup. -
-Readonlyid- Emits ID token claims when authenticated, or null if not - authenticated. -
-Readonlyis
- Emits boolean values indicating the authentication state of
- the user. If true, it means a user has
- authenticated. This depends on the value of
- isLoading$, so there is no need to manually check
- the loading state of the SDK.
-
Readonlyis- Emits boolean values indicating the loading state of the SDK. -
-Readonlymfa
- - Provides MFA (Multi-Factor Authentication) operations as - Observables. -
-
- These methods are available after
- getAccessTokenSilently throws an
- MfaRequiredError. Use the
- mfa_token from the error to call these methods.
-
ReadonlymyProvides MyAccount API operations as Observables.
-
- Allows the authenticated user to list, enroll, update, and
- delete their authentication methods. Requires an access token
- with the appropriate
- read/create/update/delete:me:authentication-methods
- scopes.
-
Readonlypasskey
- - Provides Passkey (WebAuthn) authentication as Observables. -
-- Both methods handle the full WebAuthn challenge-response flow - internally. After a successful call, this updates the - authentication state to ensure consistency with the standard - authentication flows. -
-Readonlyuser$
- - Emits details about the authenticated user, or null if not - authenticated. -
-connectAccountWithRedirect({
connection: 'google-oauth2',
scopes: ['openid', 'profile', 'email', 'https://www.googleapis.com/auth/drive.readonly'],
authorization_params: {
// additional authorization params to forward to the authorization server
}
});
+AuthService | @auth0/auth0-angular
+
+
+
+
+
+Class AuthService<TAppState>
+
+Type Parameters
+
+
+Implements
+
+- OnDestroy
+
+
+
+
+Constructors
+
+
+constructor
+
+-
+new AuthService<TAppState extends AppState = AppState>(
auth0Client: Auth0Client,
configFactory: AuthClientConfig,
navigator: AbstractNavigator,
authState: AuthState,
): AuthService<TAppState>
+
+
+Type Parameters
+
+
+Parameters
+
+- auth0Client: Auth0Client
+- configFactory: AuthClientConfig
+- navigator: AbstractNavigator
+- authState: AuthState
+Returns AuthService<TAppState>
+
+Properties
+
+
+Readonlyapp
+
+Emits the value (if any) that was passed to the loginWithRedirect method call
+but only after handleRedirectCallback is first called
+
+
+Readonlyerror$
+error$: Observable<Error> = ...
+Emits errors that occur during login, or when checking for an active session on startup.
+
+
+Readonlyid
+
+Emits ID token claims when authenticated, or null if not authenticated.
+
+
+Readonlyis
+isAuthenticated$: Observable<boolean> = ...
+Emits boolean values indicating the authentication state of the user. If true, it means a user has authenticated.
+This depends on the value of isLoading$, so there is no need to manually check the loading state of the SDK.
+
+
+Readonlyis
+isLoading$: Observable<boolean> = ...
+Emits boolean values indicating the loading state of the SDK.
+
+
+Readonlymfa
+
+Provides MFA (Multi-Factor Authentication) operations as Observables.
+These methods are available after getAccessTokenSilently throws an MfaRequiredError.
+Use the mfa_token from the error to call these methods.
+
+
+Readonlymy
+
+Provides MyAccount API operations as Observables.
+Allows the authenticated user to list, enroll, update, and delete their
+authentication methods. Requires an access token with the appropriate
+read/create/update/delete:me:authentication-methods scopes.
+
+
+Readonlypasskey
+
+Provides Passkey (WebAuthn) authentication as Observables.
+Both methods handle the full WebAuthn challenge-response flow internally.
+After a successful call, this updates the authentication state to ensure
+consistency with the standard authentication flows.
+
+
+Readonlyuser$
+
+Emits details about the authenticated user, or null if not authenticated.
+
+
+Methods
+
+
+connect
+
+-
+
+
+
connectAccountWithRedirect({
connection: 'google-oauth2',
scopes: ['openid', 'profile', 'email', 'https://www.googleapis.com/auth/drive.readonly'],
authorization_params: {
// additional authorization params to forward to the authorization server
}
});
-
- Redirects to the /connect URL using the
- parameters provided as arguments. This then redirects to
- the connection's login page where the user can
- authenticate and authorize the account to be connected.
-
-
- If connecting the account is successful,
- handleRedirectCallback will be called with
- the details of the connected account.
-
-
-
- Parameters
-
- -
- options:
- RedirectConnectAccountOptions<TAppState>
-
-
The connect account options
-
-
-
-
-
- Returns Observable<void>
-
-
-
-
-
-
-
-
- create
-
- -
-
- createFetcher<TOutput
- extends
- CustomFetchMinimalOutput
- =
- Response>(
config?:
- FetcherConfig<TOutput>,
):
- Fetcher<TOutput>
-
-
-
- const fetcher = createFetcher(config);
+Redirects to the /connect URL using the parameters
+provided as arguments. This then redirects to the connection's login page
+where the user can authenticate and authorize the account to be connected.
+If connecting the account is successful, handleRedirectCallback will be called
+with the details of the connected account.
+
+
+Parameters
+
+- options: RedirectConnectAccountOptions<TAppState>
+
The connect account options
+
+Returns Observable<void>
+
+create
+
+-
+createFetcher<TOutput extends CustomFetchMinimalOutput = Response>(
config?: FetcherConfig<TOutput>,
): Fetcher<TOutput>
+
+const fetcher = createFetcher(config);
-
- Creates a custom fetcher instance that can be used to
- make authenticated HTTP requests. The fetcher
- automatically handles token refresh and can be
- configured with custom request/response handling.
-
-
-
- Type Parameters
-
- -
- TOutput
- extends
- CustomFetchMinimalOutput
- =
- Response
-
-
-
-
- Parameters
-
- -
-
Optionalconfig:
- FetcherConfig<TOutput>
-
- Optional configuration for the fetcher
-
-
-
-
-
- Returns
- Fetcher<TOutput>
-
- A Fetcher instance configured with the Auth0 client.
-
-
-
-
-
-
-
- generate
-
- -
-
- generateDpopProof(
params:
- {
accessToken:
- string;
method:
- string;
nonce?:
- string;
url:
- string;
},
):
- Observable<string>
-
-
-
- generateDpopProof(params).subscribe(proof => ...)
+Creates a custom fetcher instance that can be used to make authenticated
+HTTP requests. The fetcher automatically handles token refresh and can
+be configured with custom request/response handling.
+
+
+Type Parameters
+
+- TOutput extends CustomFetchMinimalOutput = Response
+
+Parameters
+
+Optionalconfig: FetcherConfig<TOutput>
+Optional configuration for the fetcher
+
+Returns Fetcher<TOutput>
A Fetcher instance configured with the Auth0 client.
+
+
+generate
+
+-
+generateDpopProof(
params: {
accessToken: string;
method: string;
nonce?: string;
url: string;
},
): Observable<string>
+
+generateDpopProof(params).subscribe(proof => ...)
-
- Generates a DPoP (Demonstrating Proof-of-Possession)
- proof JWT. This proof is used to bind access tokens to a
- specific client, providing an additional layer of
- security for token usage.
-
-
-
- Parameters
-
- -
- params:
- {
- accessToken:
- string;
- method:
- string;
- nonce?:
- string;
- url:
- string
- }
-
-
Configuration for generating the DPoP proof
-
-
- -
-
- accessToken: string
-
-
- The access token to bind to the proof
-
-
- -
-
- method: string
-
-
- The HTTP method (e.g., 'GET', 'POST')
-
-
- -
-
- Optionalnonce?: string
-
-
-
- Optional DPoP nonce from the authorization
- server
-
-
-
- -
-
- url: string
-
-
- The URL of the resource server endpoint
-
-
-
-
-
-
-
- Returns Observable<string>
-
-
- An Observable that emits the generated DPoP proof as a JWT
- string.
-
-
-
-
-
-
-
-
- get
-
- -
-
- getAccessTokenSilently(
options:
- GetTokenSilentlyOptions
- &
- {
- detailedResponse:
- true
- },
):
- Observable<GetTokenSilentlyVerboseResponse
- |
- undefined>
-
-
-
-
- Fetches a new access token and returns the response from
- the /oauth/token endpoint, omitting the refresh token.
-
-
-
- Parameters
-
- -
- options:
- GetTokenSilentlyOptions
- &
- {
- detailedResponse:
- true
- }
-
-
The options for configuring the token fetch.
-
-
-
-
-
- Returns Observable<GetTokenSilentlyVerboseResponse
- |
- undefined>
-
-
-
-
- -
-
- getAccessTokenSilently(
options?:
- GetTokenSilentlyOptions,
):
- Observable<string
- |
- undefined>
-
-
-
- Fetches a new access token and returns it.
-
-
- Parameters
-
- -
-
Optionaloptions:
- GetTokenSilentlyOptions
-
- The options for configuring the token fetch.
-
-
-
-
-
- Returns Observable<string
- |
- undefined>
-
-
-
-
-
-
-
-
- get
-
- -
-
- getAccessTokenWithPopup(
options?:
- GetTokenWithPopupOptions,
):
- Observable<string
- |
- undefined>
-
-
-
- getTokenWithPopup(options).subscribe(token => ...)
+Generates a DPoP (Demonstrating Proof-of-Possession) proof JWT.
+This proof is used to bind access tokens to a specific client, providing
+an additional layer of security for token usage.
+
+
+Parameters
+
+- params: { accessToken: string; method: string; nonce?: string; url: string }
+
Configuration for generating the DPoP proof
+
+
+-
+
accessToken: string
+The access token to bind to the proof
+
+-
+
method: string
+The HTTP method (e.g., 'GET', 'POST')
+
+-
+
Optionalnonce?: string
+Optional DPoP nonce from the authorization server
+
+-
+
url: string
+The URL of the resource server endpoint
+
+Returns Observable<string>
An Observable that emits the generated DPoP proof as a JWT string.
+
+
+get
+
+-
+getAccessTokenSilently(
options: GetTokenSilentlyOptions & { detailedResponse: true },
): Observable<GetTokenSilentlyVerboseResponse | undefined>
+
+Fetches a new access token and returns the response from the /oauth/token endpoint, omitting the refresh token.
+
+
+Parameters
+
+- options: GetTokenSilentlyOptions & { detailedResponse: true }
+
The options for configuring the token fetch.
+
+Returns Observable<GetTokenSilentlyVerboseResponse | undefined>
+-
+
+
+
Fetches a new access token and returns it.
+
+
+Parameters
+
+Optionaloptions: GetTokenSilentlyOptions
+The options for configuring the token fetch.
+
+Returns Observable<string | undefined>
+
+get
+
+-
+
+
+
getTokenWithPopup(options).subscribe(token => ...)
- Get an access token interactively.
-
- Opens a popup with the /authorize URL using
- the parameters provided as arguments. Random and secure
- state and nonce parameters
- will be auto-generated. If the response is successful,
- results will be valid according to their expiration
- times.
-
-
-
- Parameters
-
- -
-
Optionaloptions:
- GetTokenWithPopupOptions
-
-
-
-
- Returns Observable<string
- |
- undefined>
-
-
-
-
-
-
-
-
- get
-
- -
-
-
-
-
getDpopNonce(id).subscribe(nonce => ...)
+Get an access token interactively.
+Opens a popup with the /authorize URL using the parameters
+provided as arguments. Random and secure state and nonce
+parameters will be auto-generated. If the response is successful,
+results will be valid according to their expiration times.
+
+
+Parameters
+
+Optionaloptions: GetTokenWithPopupOptions
+Returns Observable<string | undefined>
+
+get
+
+-
+
+
+
getDpopNonce(id).subscribe(nonce => ...)
-
- Gets the DPoP nonce for the specified domain or the
- default domain. The nonce is used in DPoP proof
- generation for token binding.
-
-
-
- Parameters
-
- -
-
Optionalid:
- string
-
-
- Optional identifier for the domain. If not
- provided, uses the default domain.
-
-
-
-
-
-
- Returns Observable<string
- |
- undefined>
-
-
- An Observable that emits the DPoP nonce string or
- undefined if not available.
-
-
-
-
-
-
-
-
- handle
-
- -
-
- handleRedirectCallback(
url?:
- string,
):
- Observable<
RedirectLoginResult<TAppState>
|
- ConnectAccountRedirectResult<TAppState>,
>
-
-
-
- handleRedirectCallback(url).subscribe(result => ...)
+Gets the DPoP nonce for the specified domain or the default domain.
+The nonce is used in DPoP proof generation for token binding.
+
+
+Parameters
+
+Optionalid: string
+Optional identifier for the domain. If not provided, uses the default domain.
+
+Returns Observable<string | undefined>
An Observable that emits the DPoP nonce string or undefined if not available.
+
+
+handle
+
+-
+handleRedirectCallback(
url?: string,
): Observable<
RedirectLoginResult<TAppState>
| ConnectAccountRedirectResult<TAppState>,
>
+
+handleRedirectCallback(url).subscribe(result => ...)
-
- After the browser redirects back to the callback page,
- call handleRedirectCallback to handle
- success and error responses from Auth0. If the response
- is successful, results will be valid according to their
- expiration times.
-
-
- Calling this method also refreshes the authentication
- and user states.
-
-
-
- Parameters
-
- -
-
Optionalurl:
- string
-
-
- The URL to that should be used to retrieve the
- state and code values.
- Defaults to window.location.href if
- not given.
-
-
-
-
-
-
- Returns Observable<
RedirectLoginResult<TAppState>
|
- ConnectAccountRedirectResult<TAppState>,
>
-
-
-
-
-
-
-
-
- login
-
- -
-
- loginWithCustomTokenExchange(
options:
- CustomTokenExchangeOptions,
):
- Observable<TokenEndpointResponse>
-
-
-
- loginWithCustomTokenExchange(options).subscribe(tokenResponse => ...)
+After the browser redirects back to the callback page,
+call handleRedirectCallback to handle success and error
+responses from Auth0. If the response is successful, results
+will be valid according to their expiration times.
+Calling this method also refreshes the authentication and user states.
+
+
+Parameters
+
+Optionalurl: string
+The URL to that should be used to retrieve the state and code values. Defaults to window.location.href if not given.
+
+Returns Observable<
RedirectLoginResult<TAppState>
| ConnectAccountRedirectResult<TAppState>,
>
+
+login
+
+-
+loginWithCustomTokenExchange(
options: CustomTokenExchangeOptions,
): Observable<TokenEndpointResponse>
+
+loginWithCustomTokenExchange(options).subscribe(tokenResponse => ...)
-
- Exchanges an external subject token for Auth0 tokens and
- establishes an authenticated session.
-
-
- This method implements the token exchange grant as
- specified in RFC 8693. It performs a token exchange by
- sending a request to the
- /oauth/token endpoint with the external
- token and returns Auth0 tokens (access token, ID token,
- etc.).
-
- The request includes the following parameters:
-
- -
-
grant_type: Hard-coded to
- "urn:ietf:params:oauth:grant-type:token-exchange"
-
- -
-
subject_token: The external token to be
- exchanged
-
- -
-
subject_token_type: A namespaced URI
- identifying the token type (must be under your
- organization's control)
-
- -
-
audience: The target audience (falls back
- to the SDK's default audience if not provided)
-
- -
-
scope: Space-separated list of scopes
- (merged with the SDK's default scopes)
-
-
-
- After a successful token exchange, this method updates
- the authentication state to ensure consistency with the
- standard authentication flows.
-
-
-
- Parameters
-
- -
- options:
- CustomTokenExchangeOptions
-
-
- The options required to perform the token exchange
-
-
-
-
-
-
- Returns Observable<TokenEndpointResponse>
-
-
- An Observable that emits the token endpoint response
- containing Auth0 tokens
-
-
-
-
-
-
-
-
- login
-
- -
-
- loginWithPopup(
options?:
- PopupLoginOptions,
config?:
- PopupConfigOptions,
):
- Observable<void>
-
-
-
- await loginWithPopup(options);
+Exchanges an external subject token for Auth0 tokens and establishes an authenticated session.
+This method implements the token exchange grant as specified in RFC 8693.
+It performs a token exchange by sending a request to the /oauth/token endpoint
+with the external token and returns Auth0 tokens (access token, ID token, etc.).
+The request includes the following parameters:
+
+grant_type: Hard-coded to "urn:ietf:params:oauth:grant-type:token-exchange"subject_token: The external token to be exchangedsubject_token_type: A namespaced URI identifying the token type (must be under your organization's control)audience: The target audience (falls back to the SDK's default audience if not provided)scope: Space-separated list of scopes (merged with the SDK's default scopes)
+After a successful token exchange, this method updates the authentication state
+to ensure consistency with the standard authentication flows.
+
+
+Parameters
+
+- options: CustomTokenExchangeOptions
+
The options required to perform the token exchange
+
+Returns Observable<TokenEndpointResponse>
An Observable that emits the token endpoint response containing Auth0 tokens
+
+
+login
+
+-
+
+
+
await loginWithPopup(options);
-
- Opens a popup with the /authorize URL using
- the parameters provided as arguments. Random and secure
- state and nonce parameters
- will be auto-generated. If the response is successful,
- results will be valid according to their expiration
- times.
-
-
- IMPORTANT: This method has to be called from an event
- handler that was started by the user like a button
- click, for example, otherwise the popup will be blocked
- in most browsers.
-
-
-
- Parameters
-
- -
-
Optionaloptions:
- PopupLoginOptions
-
- The login options
-
-
- -
-
Optionalconfig:
- PopupConfigOptions
-
- Configuration for the popup window
-
-
-
-
-
- Returns Observable<void>
-
-
-
-
-
-
-
-
- login
-
- -
-
-
-
-
loginWithRedirect(options);
+Opens a popup with the /authorize URL using the parameters
+provided as arguments. Random and secure state and nonce
+parameters will be auto-generated. If the response is successful,
+results will be valid according to their expiration times.
+IMPORTANT: This method has to be called from an event handler
+that was started by the user like a button click, for example,
+otherwise the popup will be blocked in most browsers.
+
+
+Parameters
+
+Optionaloptions: PopupLoginOptions
+The login options
+Optionalconfig: PopupConfigOptions
+Configuration for the popup window
+
+Returns Observable<void>
+
+login
+
+-
+
+
+
loginWithRedirect(options);
-
- Performs a redirect to /authorize using the
- parameters provided as arguments. Random and secure
- state and nonce parameters
- will be auto-generated.
-
-
-
- Parameters
-
- -
-
Optionaloptions:
- RedirectLoginOptions<TAppState>
-
- The login options
-
-
-
-
-
- Returns Observable<void>
-
-
-
-
-
-
-
-
- logout
-
-
- -
-
-
-
-
logout();
+Performs a redirect to /authorize using the parameters
+provided as arguments. Random and secure state and nonce
+parameters will be auto-generated.
+
+
+Parameters
+
+Optionaloptions: RedirectLoginOptions<TAppState>
+The login options
+
+Returns Observable<void>
+
+logout
+
+-
+
+
+
logout();
-
- Clears the application session and performs a redirect
- to /v2/logout, using the parameters
- provided as arguments, to clear the Auth0 session. If
- the federated option is specified it also
- clears the Identity Provider session. If the
- openUrl option is set to false, it only
- clears the application session. It is invalid to set
- both the federated to true and
- openUrl to false, and an error
- will be thrown if you do.
- Read more about how Logout works at Auth0.
-
-
-
- Parameters
-
- -
-
Optionaloptions:
- LogoutOptions
-
- The logout options
-
-
-
-
-
- Returns Observable<void>
-
-
-
-
-
-
-
-
- ng
-
- -
-
-
-
-
Called when the service is destroyed
-
-
- Returns void
-
-
-
-
-
-
-
-
- set
-
- -
-
-
-
-
setDpopNonce(nonce, id).subscribe(() => ...)
+Clears the application session and performs a redirect to /v2/logout, using
+the parameters provided as arguments, to clear the Auth0 session.
+If the federated option is specified it also clears the Identity Provider session.
+If the openUrl option is set to false, it only clears the application session.
+It is invalid to set both the federated to true and openUrl to false,
+and an error will be thrown if you do.
+Read more about how Logout works at Auth0.
+
+
+Parameters
+
+Optionaloptions: LogoutOptions
+The logout options
+
+Returns Observable<void>
+
+ng
+
+-
+
+
+
Called when the service is destroyed
+
+Returns void
+
+set
+
+-
+
+
+
setDpopNonce(nonce, id).subscribe(() => ...)
-
- Sets the DPoP nonce for the specified domain or the
- default domain. This is typically used after receiving a
- new nonce from the authorization server.
-
-
-
- Parameters
-
- -
- nonce:
- string
-
-
The DPoP nonce value to set.
-
-
- -
-
Optionalid:
- string
-
-
- Optional identifier for the domain. If not
- provided, uses the default domain.
-
-
-
-
-
-
- Returns Observable<void>
-
- An Observable that completes when the nonce is set.
-
-
-
-
-
-
-
-
-
-
-
-
-
-
+Sets the DPoP nonce for the specified domain or the default domain.
+This is typically used after receiving a new nonce from the authorization server.
+The DPoP nonce value to set.
+Optionalid: string
+Optional identifier for the domain. If not provided, uses the default domain.
+An Observable that completes when the nonce is set.
+Tracks the Authentication State for the SDK
-Readonlyerror$
- - Emits errors that occur during login, or when checking for an - active session on startup. -
-Readonlyid- Emits ID token claims when authenticated, or null if not - authenticated. -
-Readonlyis
- Emits boolean values indicating the authentication state of
- the user. If true, it means a user has
- authenticated. This depends on the value of
- isLoading$, so there is no need to manually check
- the loading state of the SDK.
-
Readonlyis- Emits boolean values indicating the loading state of the SDK. -
-Readonlyuser$
- - Emits details about the authenticated user, or null if not - authenticated. -
-
- Refresh the state to ensure the
- isAuthenticated, user$ and
- idTokenClaims$ reflect the most up-to-date
- values from Auth0Client.
-
- Update the access token, doing so will also refresh the - state. -
-The new Access Token
-
- Emits the error in the error$ observable.
-
The new error
-Update the isLoading state using the provided value
-The new value for isLoading
-Tracks the Authentication State for the SDK
+Readonlyerror$Emits errors that occur during login, or when checking for an active session on startup.
+ReadonlyidEmits ID token claims when authenticated, or null if not authenticated.
+ReadonlyisEmits boolean values indicating the authentication state of the user. If true, it means a user has authenticated.
+This depends on the value of isLoading$, so there is no need to manually check the loading state of the SDK.
ReadonlyisEmits boolean values indicating the loading state of the SDK.
+Readonlyuser$Emits details about the authenticated user, or null if not authenticated.
+Refresh the state to ensure the isAuthenticated, user$ and idTokenClaims$
+reflect the most up-to-date values from Auth0Client.
Update the access token, doing so will also refresh the state.
+The new Access Token
+Emits the error in the error$ observable.
The new error
+Update the isLoading state using the provided value
+The new value for isLoading
+- Thrown when handling the redirect callback fails, will be one of - Auth0's Authentication API's Standard Error Responses: - https://auth0.com/docs/api/authentication?javascript#standard-error-responses -
-OptionalappState:
- any
- OptionaloriginalOriginal stack trace with no modifications
-Optionalstack
- Optionalzone- Stack trace where extra frames have been removed and zone - names added. -
-StaticfromThrown when handling the redirect callback fails, will be one of Auth0's +Authentication API's Standard Error Responses: https://auth0.com/docs/api/authentication?javascript#standard-error-responses
+OptionalappState: anyOptionaloriginalOriginal stack trace with no modifications
+OptionalstackOptionalzoneStack trace where extra frames have been removed and zone names added.
+Staticfrom- Thrown when handling the redirect callback for the connect flow - fails, will be one of Auth0's Authentication API's Standard Error - Responses: - https://auth0.com/docs/api/authentication?javascript#standard-error-responses -
-OptionalappState:
- any
- OptionaloriginalOriginal stack trace with no modifications
-Optionalstack
- Optionalzone- Stack trace where extra frames have been removed and zone - names added. -
-StaticfromThrown when handling the redirect callback for the connect flow fails, will be one of Auth0's +Authentication API's Standard Error Responses: https://auth0.com/docs/api/authentication?javascript#standard-error-responses
+OptionalappState: anyOptionaloriginalOriginal stack trace with no modifications
+OptionalstackOptionalzoneStack trace where extra frames have been removed and zone names added.
+StaticfromProtected
- Readonlyconfig
- Protected
- Readonlyhooks
- ProtectedbuildProtectedbuildProtectedextractProtectedgetProtectedgetProtectedhandleProtectedhasProtectedinternalProtectedisProtectedprepareOptionalauthParams:
- AuthParams
- ProtectedsetProtectedsetProtectedbuildProtectedbuildProtectedextractProtectedgetProtectedgetProtectedhandleProtectedhasProtectedinternalProtectedisProtectedprepareOptionalauthParams: AuthParamsProtectedsetOptionaltokenType: stringProtectedsetThrown when network requests to the Auth server fail.
-OptionaloriginalOriginal stack trace with no modifications
-Optionalstack
- Optionalzone- Stack trace where extra frames have been removed and zone - names added. -
-StaticfromThrown when network requests to the Auth server fail.
+OptionaloriginalOriginal stack trace with no modifications
+OptionalstackOptionalzoneStack trace where extra frames have been removed and zone names added.
+Staticfrom
- Thrown at construction time for an invalid option combination
- (e.g. refreshTokenMode: 'online' without
- useDpop: true). The suggestion names the
- fix.
-
OptionaloriginalOriginal stack trace with no modifications
-Optionalstack
- Optionalzone- Stack trace where extra frames have been removed and zone - names added. -
-StaticfromThrown at construction time for an invalid option combination (e.g.
+refreshTokenMode: 'online' without useDpop: true). The suggestion names the fix.
OptionaloriginalOriginal stack trace with no modifications
+OptionalstackOptionalzoneStack trace where extra frames have been removed and zone names added.
+StaticfromError thrown when initiating an MFA challenge fails.
-try {
const challenge = await mfa.challenge({
mfaToken: mfaToken,
challengeType: 'otp',
authenticatorId: 'otp|dev_123'
});
} catch (error) {
if (error instanceof MfaChallengeError) {
console.log(error.error); // 'too_many_attempts'
console.log(error.error_description); // 'Rate limit exceeded'
}
}
+MfaChallengeError | @auth0/auth0-angular
+
+
+
+
+
+Class MfaChallengeError
+
+Error thrown when initiating an MFA challenge fails.
+
+
+
+Example
try {
const challenge = await mfa.challenge({
mfaToken: mfaToken,
challengeType: 'otp',
authenticatorId: 'otp|dev_123'
});
} catch (error) {
if (error instanceof MfaChallengeError) {
console.log(error.error); // 'too_many_attempts'
console.log(error.error_description); // 'Rate limit exceeded'
}
}
-
-
-
-
-
- Hierarchy (View Summary)
-
-
- -
- MfaError
-
- -
- MfaChallengeError
-
-
-
-
-
-
-
-
-
-
-
- Index
-
-
-
-
- Constructors
-
-
- constructor
-
-
-
-
- Properties
-
-
-
-
-
- Methods
-
-
- from
-
-
-
-
-
-
-
-
- Constructors
-
-
-
-
-
- constructor
-
-
- -
-
-
-
-
Parameters
-
- -
- error:
- string
-
- -
- error_description:
- string
-
-
-
-
- Returns
- MfaChallengeError
-
-
-
-
-
-
-
-
-
-
-
-
- Properties
-
-
-
-
-
- error
-
-
- error:
- string
-
-
-
-
-
- error_
-
- error_description:
- string
-
-
-
-
-
- message
-
-
- message:
- string
-
-
-
-
-
- name
-
-
- name:
- string
-
-
-
-
-
- Optionaloriginal
-
- originalStack?:
- string
-
-
- Original stack trace with no modifications
-
-
-
-
-
- Optionalstack
-
-
- stack?:
- string
-
-
-
-
-
- Optionalzone
-
- zoneAwareStack?:
- string
-
-
-
- Stack trace where extra frames have been removed and zone
- names added.
-
-
-
-
-
-
-
-
-
-
-
-
-
-
+
+OptionaloriginalOriginal stack trace with no modifications
+OptionalstackOptionalzoneStack trace where extra frames have been removed and zone names added.
+Error thrown when enrolling an MFA authenticator fails.
-try {
const enrollment = await mfa.enroll({
authenticator_types: ['otp']
});
} catch (error) {
if (error instanceof MfaEnrollmentError) {
console.log(error.error); // 'invalid_phone_number'
console.log(error.error_description); // 'Invalid phone number format'
}
}
+MfaEnrollmentError | @auth0/auth0-angular
+
+
+
+
+
+Class MfaEnrollmentError
+
+Error thrown when enrolling an MFA authenticator fails.
+
+
-
-
-
- Hierarchy (View Summary)
-
-
- -
- MfaError
-
- -
- MfaEnrollmentError
-
-
-
-
-
-
-
-
-
-
-
- Index
-
-
-
-
- Constructors
-
-
- constructor
-
-
-
-
- Properties
-
-
-
-
-
- Methods
-
-
- from
-
-
-
-
-
-
-
-
- Constructors
-
-
-
-
-
- constructor
-
-
- -
-
-
-
-
Parameters
-
- -
- error:
- string
-
- -
- error_description:
- string
-
-
-
-
- Returns
- MfaEnrollmentError
-
-
-
-
-
-
-
-
-
-
-
-
- Properties
-
-
-
-
-
- error
-
-
- error:
- string
-
-
-
-
-
- error_
-
- error_description:
- string
-
-
-
-
-
- message
-
-
- message:
- string
-
-
-
-
-
- name
-
-
- name:
- string
-
-
-
-
-
- Optionaloriginal
-
- originalStack?:
- string
-
-
- Original stack trace with no modifications
-
-
-
-
-
- Optionalstack
-
-
- stack?:
- string
-
-
-
-
-
- Optionalzone
-
- zoneAwareStack?:
- string
-
-
-
- Stack trace where extra frames have been removed and zone
- names added.
-
-
-
-
-
-
-
-
-
-
-
-
-
-
+
+OptionaloriginalOriginal stack trace with no modifications
+OptionalstackOptionalzoneStack trace where extra frames have been removed and zone names added.
+Error thrown when getting enrollment factors fails.
-try {
const factors = await mfa.getEnrollmentFactors(mfaToken);
} catch (error) {
if (error instanceof MfaEnrollmentFactorsError) {
console.log(error.error); // 'mfa_context_not_found'
console.log(error.error_description); // 'MFA context not found...'
}
}
+MfaEnrollmentFactorsError | @auth0/auth0-angular
+
+
+
+
+
+Class MfaEnrollmentFactorsError
+
+Error thrown when getting enrollment factors fails.
+
+
-
-
-
- Hierarchy (View Summary)
-
-
- -
- MfaError
-
- -
- MfaEnrollmentFactorsError
-
-
-
-
-
-
-
-
-
-
-
- Index
-
-
-
-
- Constructors
-
-
- constructor
-
-
-
-
- Properties
-
-
-
-
-
- Methods
-
-
- from
-
-
-
-
-
-
-
-
- Constructors
-
-
-
-
-
- constructor
-
-
- -
-
- new
- MfaEnrollmentFactorsError(
error:
- string,
error_description:
- string,
):
- MfaEnrollmentFactorsError
-
-
-
- Parameters
-
- -
- error:
- string
-
- -
- error_description:
- string
-
-
-
-
- Returns
- MfaEnrollmentFactorsError
-
-
-
-
-
-
-
-
-
-
-
-
- Properties
-
-
-
-
-
- error
-
-
- error:
- string
-
-
-
-
-
- error_
-
- error_description:
- string
-
-
-
-
-
- message
-
-
- message:
- string
-
-
-
-
-
- name
-
-
- name:
- string
-
-
-
-
-
- Optionaloriginal
-
- originalStack?:
- string
-
-
- Original stack trace with no modifications
-
-
-
-
-
- Optionalstack
-
-
- stack?:
- string
-
-
-
-
-
- Optionalzone
-
- zoneAwareStack?:
- string
-
-
-
- Stack trace where extra frames have been removed and zone
- names added.
-
-
-
-
-
-
-
-
-
-
-
-
-
-
+
+OptionaloriginalOriginal stack trace with no modifications
+OptionalstackOptionalzoneStack trace where extra frames have been removed and zone names added.
+- Base class for MFA-related errors in auth0-spa-js. Extends - GenericError for unified error hierarchy across the SDK. -
-OptionaloriginalOriginal stack trace with no modifications
-Optionalstack
- Optionalzone- Stack trace where extra frames have been removed and zone - names added. -
-Base class for MFA-related errors in auth0-spa-js. +Extends GenericError for unified error hierarchy across the SDK.
+OptionaloriginalOriginal stack trace with no modifications
+OptionalstackOptionalzoneStack trace where extra frames have been removed and zone names added.
+Error thrown when listing MFA authenticators fails.
-try {
const authenticators = await mfa.getAuthenticators();
} catch (error) {
if (error instanceof MfaListAuthenticatorsError) {
console.log(error.error); // 'access_denied'
console.log(error.error_description); // 'Unauthorized'
}
}
+MfaListAuthenticatorsError | @auth0/auth0-angular
+
+
+
+
+
+Class MfaListAuthenticatorsError
+
+Error thrown when listing MFA authenticators fails.
+
+
-
-
-
- Hierarchy (View Summary)
-
-
- -
- MfaError
-
- -
- MfaListAuthenticatorsError
-
-
-
-
-
-
-
-
-
-
-
- Index
-
-
-
-
- Constructors
-
-
- constructor
-
-
-
-
- Properties
-
-
-
-
-
- Methods
-
-
- from
-
-
-
-
-
-
-
-
- Constructors
-
-
-
-
-
- constructor
-
-
- -
-
- new
- MfaListAuthenticatorsError(
error:
- string,
error_description:
- string,
):
- MfaListAuthenticatorsError
-
-
-
- Parameters
-
- -
- error:
- string
-
- -
- error_description:
- string
-
-
-
-
- Returns
- MfaListAuthenticatorsError
-
-
-
-
-
-
-
-
-
-
-
-
- Properties
-
-
-
-
-
- error
-
-
- error:
- string
-
-
-
-
-
- error_
-
- error_description:
- string
-
-
-
-
-
- message
-
-
- message:
- string
-
-
-
-
-
- name
-
-
- name:
- string
-
-
-
-
-
- Optionaloriginal
-
- originalStack?:
- string
-
-
- Original stack trace with no modifications
-
-
-
-
-
- Optionalstack
-
-
- stack?:
- string
-
-
-
-
-
- Optionalzone
-
- zoneAwareStack?:
- string
-
-
-
- Stack trace where extra frames have been removed and zone
- names added.
-
-
-
-
-
-
-
-
-
-
-
-
-
-
+
+OptionaloriginalOriginal stack trace with no modifications
+OptionalstackOptionalzoneStack trace where extra frames have been removed and zone names added.
+
- Error thrown when the token exchange results in a
- mfa_required error
-
OptionaloriginalOriginal stack trace with no modifications
-Optionalstack
- Optionalzone- Stack trace where extra frames have been removed and zone - names added. -
-StaticfromError thrown when the token exchange results in a mfa_required error
OptionaloriginalOriginal stack trace with no modifications
+OptionalstackOptionalzoneStack trace where extra frames have been removed and zone names added.
+StaticfromError thrown when verifying an MFA challenge fails.
-try {
const tokens = await mfa.verify({
mfaToken: mfaToken,
grant_type: 'http://auth0.com/oauth/grant-type/mfa-otp',
otp: '123456'
});
} catch (error) {
if (error instanceof MfaVerifyError) {
console.log(error.error); // 'invalid_otp' or 'context_not_found'
console.log(error.error_description); // Error details
}
}
+MfaVerifyError | @auth0/auth0-angular
+
+
+
+
+
+Class MfaVerifyError
+
+Error thrown when verifying an MFA challenge fails.
+
+
+
+Example
try {
const tokens = await mfa.verify({
mfaToken: mfaToken,
grant_type: 'http://auth0.com/oauth/grant-type/mfa-otp',
otp: '123456'
});
} catch (error) {
if (error instanceof MfaVerifyError) {
console.log(error.error); // 'invalid_otp' or 'context_not_found'
console.log(error.error_description); // Error details
}
}
-
-
-
-
-
- Hierarchy (View Summary)
-
-
- -
- MfaError
-
- -
- MfaVerifyError
-
-
-
-
-
-
-
-
-
-
-
- Index
-
-
-
-
- Constructors
-
-
- constructor
-
-
-
-
- Properties
-
-
-
-
-
- Methods
-
-
- from
-
-
-
-
-
-
-
-
- Constructors
-
-
-
-
-
- constructor
-
-
- -
-
-
-
-
Parameters
-
- -
- error:
- string
-
- -
- error_description:
- string
-
-
-
-
- Returns
- MfaVerifyError
-
-
-
-
-
-
-
-
-
-
-
-
- Properties
-
-
-
-
-
- error
-
-
- error:
- string
-
-
-
-
-
- error_
-
- error_description:
- string
-
-
-
-
-
- message
-
-
- message:
- string
-
-
-
-
-
- name
-
-
- name:
- string
-
-
-
-
-
- Optionaloriginal
-
- originalStack?:
- string
-
-
- Original stack trace with no modifications
-
-
-
-
-
- Optionalstack
-
-
- stack?:
- string
-
-
-
-
-
- Optionalzone
-
- zoneAwareStack?:
- string
-
-
-
- Stack trace where extra frames have been removed and zone
- names added.
-
-
-
-
-
-
-
-
-
-
-
-
-
-
+
+OptionaloriginalOriginal stack trace with no modifications
+OptionalstackOptionalzoneStack trace where extra frames have been removed and zone names added.
+Error thrown when there is no refresh token to use
-OptionaloriginalOriginal stack trace with no modifications
-Optionalstack
- Optionalzone- Stack trace where extra frames have been removed and zone - names added. -
-StaticfromError thrown when there is no refresh token to use
+OptionaloriginalOriginal stack trace with no modifications
+OptionalstackOptionalzoneStack trace where extra frames have been removed and zone names added.
+Staticfrom- Error thrown when there are missing scopes after refreshing a - token -
-OptionaloriginalOriginal stack trace with no modifications
-Optionalstack
- Optionalzone- Stack trace where extra frames have been removed and zone - names added. -
-StaticfromError thrown when there are missing scopes after refreshing a token
+OptionaloriginalOriginal stack trace with no modifications
+OptionalstackOptionalzoneStack trace where extra frames have been removed and zone names added.
+Staticfrom- Error thrown when the MyAccount API returns a non-2xx response. -
-try {
await myAccount.getAuthenticationMethods();
} catch (err) {
if (err instanceof MyAccountApiError) {
console.error(err.status, err.title, err.detail);
}
}
+MyAccountApiError | @auth0/auth0-angular
+
+
+
+
+
+Class MyAccountApiError
+
+Error thrown when the MyAccount API returns a non-2xx response.
+
+
-
-
- Hierarchy
-
- -
- Error
-
- -
- MyAccountApiError
-
-
-
-
-
-
-
-
-
-
-
- Index
-
-
-
-
- Constructors
-
-
- constructor
-
-
-
-
- Properties
-
-
- detail
- message
- name
- original
-
-
-
-
-
-
-
-
- Constructors
-
-
-
-
-
- constructor
-
-
- -
-
-
-
-
Parameters
-
- -
- __namedParameters:
- ErrorResponse
-
-
-
-
- Returns
- MyAccountApiError
-
-
-
-
-
-
-
-
-
-
-
-
- Properties
-
-
-
-
-
- Readonlydetail
-
-
- detail:
- string
-
-
- Human-readable explanation specific to this occurrence
-
-
-
-
-
- message
-
-
- message:
- string
-
-
-
-
-
- name
-
-
- name:
- string
-
-
-
-
-
- Optionaloriginal
-
- originalStack?:
- string
-
-
- Original stack trace with no modifications
-
-
-
-
-
- Optionalstack
-
-
- stack?:
- string
-
-
-
-
-
- Readonlystatus
-
-
- status:
- number
-
-
- HTTP status code
-
-
-
-
-
- Readonlytitle
-
-
- title:
- string
-
-
- Short human-readable summary of the error
-
-
-
-
-
- Readonlytype
-
-
- type:
- string
-
-
- RFC 7807 error type identifier
-
-
-
-
-
- Optional
- Readonlyvalidation_
-
- validation_errors?:
- {
detail:
- string;
field?:
- string;
pointer?:
- string;
source?:
- string;
}[]
-
-
- Field-level validation errors, if present
-
-
-
-
-
- Optionalzone
-
- zoneAwareStack?:
- string
-
-
-
- Stack trace where extra frames have been removed and zone
- names added.
-
-
-
-
-
-
-
-
-
-
-
-
-
+
+ReadonlydetailHuman-readable explanation specific to this occurrence
+OptionaloriginalOriginal stack trace with no modifications
+OptionalstackReadonlystatusHTTP status code
+ReadonlytitleShort human-readable summary of the error
+ReadonlytypeRFC 7807 error type identifier
+Optional Readonlyvalidation_Field-level validation errors, if present
+OptionalzoneStack trace where extra frames have been removed and zone names added.
+Error thrown when requesting a passkey login challenge fails.
-Optionalcause:
- PasskeyApiErrorResponse
- Optionalbody
- Raw response body text, when available.
-Optionalcause
- Optionalheaders
-
- Response headers from the error response, when available.
- Native Fetch Headers.
-
OptionaloriginalOriginal stack trace with no modifications
-Optionalstack
- OptionalstatusHTTP status code from the error response, when available.
-Optionalzone- Stack trace where extra frames have been removed and zone - names added. -
-Error thrown when requesting a passkey login challenge fails.
+Optionalcause: PasskeyApiErrorResponseOptionalbodyRaw response body text, when available.
+OptionalcauseOptionalheadersResponse headers from the error response, when available. Native Fetch Headers.
OptionaloriginalOriginal stack trace with no modifications
+OptionalstackOptionalstatusHTTP status code from the error response, when available.
+OptionalzoneStack trace where extra frames have been removed and zone names added.
+Optionalcause:
- PasskeyErrorResponse
- Optional
- Readonlycause
- Readonlycode
- OptionaloriginalOriginal stack trace with no modifications
-Optionalstack
- Optionalzone- Stack trace where extra frames have been removed and zone - names added. -
-Optionalcause: PasskeyErrorResponseOptional ReadonlycauseReadonlycodeOptionaloriginalOriginal stack trace with no modifications
+OptionalstackOptionalzoneStack trace where extra frames have been removed and zone names added.
+- Error thrown when exchanging a passkey credential for tokens - fails. -
-
- Unlike the challenge errors, this carries mfa_token /
- mfa_requirements on its cause when the
- server responds with mfa_required.
-
Optionalcause:
- PasskeyGetTokenApiErrorResponse
- Optionalbody
- Raw response body text, when available.
-Optionalcause
- Optionalheaders
-
- Response headers from the error response, when available.
- Native Fetch Headers.
-
OptionaloriginalOriginal stack trace with no modifications
-Optionalstack
- OptionalstatusHTTP status code from the error response, when available.
-Optionalzone- Stack trace where extra frames have been removed and zone - names added. -
-Error thrown when exchanging a passkey credential for tokens fails.
+Unlike the challenge errors, this carries mfa_token / mfa_requirements on
+its cause when the server responds with mfa_required.
Optionalcause: PasskeyGetTokenApiErrorResponseOptionalbodyRaw response body text, when available.
+OptionalcauseOptionalheadersResponse headers from the error response, when available. Native Fetch Headers.
OptionaloriginalOriginal stack trace with no modifications
+OptionalstackOptionalstatusHTTP status code from the error response, when available.
+OptionalzoneStack trace where extra frames have been removed and zone names added.
+- Error thrown when requesting a passkey register challenge fails. -
-Optionalcause:
- PasskeyApiErrorResponse
- Optionalbody
- Raw response body text, when available.
-Optionalcause
- Optionalheaders
-
- Response headers from the error response, when available.
- Native Fetch Headers.
-
OptionaloriginalOriginal stack trace with no modifications
-Optionalstack
- OptionalstatusHTTP status code from the error response, when available.
-Optionalzone- Stack trace where extra frames have been removed and zone - names added. -
-Error thrown when requesting a passkey register challenge fails.
+Optionalcause: PasskeyApiErrorResponseOptionalbodyRaw response body text, when available.
+OptionalcauseOptionalheadersResponse headers from the error response, when available. Native Fetch Headers.
OptionaloriginalOriginal stack trace with no modifications
+OptionalstackOptionalstatusHTTP status code from the error response, when available.
+OptionalzoneStack trace where extra frames have been removed and zone names added.
+Thrown when network requests to the Auth server fail.
-OptionaloriginalOriginal stack trace with no modifications
-Optionalstack
- Optionalzone- Stack trace where extra frames have been removed and zone - names added. -
-StaticfromThrown when network requests to the Auth server fail.
+OptionaloriginalOriginal stack trace with no modifications
+OptionalstackOptionalzoneStack trace where extra frames have been removed and zone names added.
+StaticfromThrown when network requests to the Auth server fail.
-OptionaloriginalOriginal stack trace with no modifications
-Optionalstack
- Optionalzone- Stack trace where extra frames have been removed and zone - names added. -
-StaticfromThrown when network requests to the Auth server fail.
+OptionaloriginalOriginal stack trace with no modifications
+OptionalstackOptionalzoneStack trace where extra frames have been removed and zone names added.
+Staticfrom- Error thrown when the login popup times out (if the user does not - complete auth) -
-OptionaloriginalOriginal stack trace with no modifications
-Optionalstack
- Optionalzone- Stack trace where extra frames have been removed and zone - names added. -
-StaticfromError thrown when the login popup times out (if the user does not complete auth)
+OptionaloriginalOriginal stack trace with no modifications
+OptionalstackOptionalzoneStack trace where extra frames have been removed and zone names added.
+Staticfrom- Thrown when silent auth times out (usually due to a configuration - issue) or when network requests to the Auth server timeout. -
-OptionaloriginalOriginal stack trace with no modifications
-Optionalstack
- Optionalzone- Stack trace where extra frames have been removed and zone - names added. -
-StaticfromThrown when silent auth times out (usually due to a configuration issue) or +when network requests to the Auth server timeout.
+OptionaloriginalOriginal stack trace with no modifications
+OptionalstackOptionalzoneStack trace where extra frames have been removed and zone names added.
+Staticfrom- Error thrown when the wrong DPoP nonce is used and a potential - subsequent retry wasn't able to fix it. -
-OptionaloriginalOriginal stack trace with no modifications
-Optionalstack
- Optionalzone- Stack trace where extra frames have been removed and zone - names added. -
-StaticfromError thrown when the wrong DPoP nonce is used and a potential subsequent retry wasn't able to fix it.
+OptionaloriginalOriginal stack trace with no modifications
+OptionalstackOptionalzoneStack trace where extra frames have been removed and zone names added.
+StaticfromOptionalact
- Optionaladdress
- Optionalbirthdate
- Optionalemail
- Optionalemail_Optionalfamily_Optionalgender
- Optionalgiven_Optionallocale
- Optionalmiddle_Optionalname
- Optionalnickname
- Optionalphone_Optionalphone_Optionalpicture
- Optionalpreferred_Optionalprofile
- Optionalsub
- Optionalupdated_Optionalwebsite
- Optionalzoneinfo
- OptionalactOptionaladdressOptionalbirthdateOptionalemailOptionalemail_Optionalfamily_OptionalgenderOptionalgiven_OptionallocaleOptionalmiddle_OptionalnameOptionalnicknameOptionalphone_Optionalphone_OptionalpictureOptionalpreferred_OptionalprofileOptionalsubOptionalupdated_OptionalwebsiteOptionalzoneinfoConstDefines a common set of HTTP methods.
-ConstDefines a common set of HTTP methods.
+- The types of responses expected from the authorization server. -
-code: used for the standard login flow.connect_code: used for the connect account flow.
- The types of responses expected from the authorization server.
+code: used for the standard login flow.connect_code: used for the connect account flow.- Functional AuthGuard to ensure routes can only be accessed - when authenticated. -
-Note: Should only be used as of Angular 15
-- Contains the information about a route associated with - a component loaded in an outlet at a particular moment - in time. -
-- Represents the state of the router at a moment in - time. -
-- An Observable, indicating if the route can be accessed or not -
- -Functional AuthGuard to ensure routes can only be accessed when authenticated.
+Note: Should only be used as of Angular 15
+Contains the information about a route associated with a component loaded in an outlet at a particular moment in time.
+Represents the state of the router at a moment in time.
+An Observable, indicating if the route can be accessed or not
+- Functional AuthHttpInterceptor to include the access token - in matching requests. -
-Note: Should only be used as of Angular 15
-- An outgoing HTTP request with an optional typed body. -
-- Represents the next interceptor in an interceptor - chain, or the real backend if there are no further - interceptors. -
-An Observable representing the intercepted HttpRequest
- -Functional AuthHttpInterceptor to include the access token in matching requests.
+Note: Should only be used as of Angular 15
+An outgoing HTTP request with an optional typed body.
+Represents the next interceptor in an interceptor chain, or the real backend if there are no +further interceptors.
+An Observable representing the intercepted HttpRequest
+- Checks whether an email domain is managed for enterprise SSO - on the given Auth0 tenant. Wraps the auth-js primitive to - inject spa-js telemetry by default. -
-- Tenant domain, e.g. 'tenant.auth0.com'. A leading 'https://' or 'http://' is stripped - automatically. -
-- The email domain to check, e.g. 'acme.com'. -
-Optionaloptions:
- IsFederatedDomainOptions
- Checks whether an email domain is managed for enterprise SSO on the given Auth0 tenant. +Wraps the auth-js primitive to inject spa-js telemetry by default.
+Tenant domain, e.g. 'tenant.auth0.com'. A leading 'https://' or 'http://' is stripped automatically.
+The email domain to check, e.g. 'acme.com'.
+Optionaloptions: IsFederatedDomainOptions- A custom type guard to help identify route definitions that - are actually HttpInterceptorRouteConfig types. -
-The route definition type
-A custom type guard to help identify route definitions that are actually HttpInterceptorRouteConfig types.
+The route definition type
+- Initialize the authentication system. Configuration can - either be specified here, or by calling AuthClientConfig.set - (perhaps from an APP_INITIALIZER factory function). -
-
- Note: Should only be used as of Angular 15. This function
- returns EnvironmentProviders which ensures it
- can only be used at the application/environment level and
- cannot be added to a component's providers array (this will
- result in a compile-time error).
-
Optionalconfig:
- AuthConfig
- The optional configuration for the SDK.
-bootstrapApplication(AppComponent, {
providers: [
provideAuth0(),
],
});
+provideAuth0 | @auth0/auth0-angular
+
+
+
+
+
+Function provideAuth0
+
+
+-
+
+
+
Initialize the authentication system. Configuration can either be specified here,
+or by calling AuthClientConfig.set (perhaps from an APP_INITIALIZER factory function).
+Note: Should only be used as of Angular 15. This function returns EnvironmentProviders
+which ensures it can only be used at the application/environment level and cannot be
+added to a component's providers array (this will result in a compile-time error).
+
+
+Parameters
+
+Optionalconfig: AuthConfig
+The optional configuration for the SDK.
+
+Returns EnvironmentProviders
+
-
-
-
-
-
-
-
-
-
-
-
-
+
+By default the application will ask Auth0 to redirect back to the root URL of your application after authentication. This can be configured by setting the redirectUri option.
++Experiment Center support via SDKs is currently in Early Access. To request access to this feature, contact your Auth0 representative.
+You can also force a specific Experiment Center variant per login by passing experiment_id, variation_id, and the optional segment_id in authorizationParams - see the Experiment Center example.
For more code samples on how to integrate the auth0-angular SDK in your Angular application, including how to use our standalone and function APIs, have a look at the examples.
Explore public API's available in auth0-angular.
@@ -148,7 +153,8 @@- Angular specific state to be stored before redirect and any - account that the user may have connected to. -
-Any custom parameter to be stored in appState
-Optionalconnected- The connected account information when the user has completed - a connect account flow. -
-Optionalresponse_- The response type returned from the authentication server. -
-Optionaltarget
- - Target path the app gets routed to after handling the callback - from Auth0 (defaults to '/') -
-Angular specific state to be stored before redirect +and any account that the user may have connected to.
+Any custom parameter to be stored in appState
+OptionalconnectedThe connected account information when the user has completed +a connect account flow.
+Optionalresponse_The response type returned from the authentication server.
+OptionaltargetTarget path the app gets routed to after +handling the callback from Auth0 (defaults to '/')
+Configuration for the authentication service
-Optional
- Internalauth0- Internal property to send information about the client to the - authorization server. -
-Optionalauthorization- URL parameters that will be sent back to the Authorization - Server. This can be known parameters defined by Auth0 or - custom parameters that you define. -
-Optionalauthorize- A maximum number of seconds to wait before declaring - background calls to /authorize as failed for timeout Defaults - to 60s. -
-Optionalcache
-
- Specify a custom cache implementation to use for token storage
- and retrieval. This setting takes precedence over
- cacheLocation if they are both specified.
-
Optionalcache
- The location to use when storing cache data. Valid values are
- memory or localstorage. The default
- setting is memory.
-
- Read more about - changing storage options in the Auth0 docs -
-The Client ID found on your Application settings page
-Optionalcookie- The domain the cookie is accessible from. If not set, the - cookie is scoped to the current domain, including the - subdomain. -
-- Note: setting this incorrectly may cause silent authentication - to stop working on page load. -
-
- To keep a user logged in across multiple subdomains set this
- to your top-level domain and prefixed with a
- . (eg: .example.com).
-
- Your Auth0 account domain such as
- 'example.auth0.com',
- 'example.eu.auth0.com' or ,
- 'example.mycompany.com' (when using
- custom domains)
-
Optionalenterprise
- Set to true when this client drives an Enterprise
- Connect login (enterprise SSO resolved from the email domain
- via
- isFederatedDomain
- and login_hint).
-
- Enterprise Connect issues no refresh token and resolves the
- organization from Home Realm Discovery at login. When enabled,
- the SDK warns at initialization if the configuration
- contradicts that: useRefreshTokens: true or
- offline_access in scope (no refresh
- token is issued) or a static organization (HRD
- resolves it, and a static value breaks multi-customer setups).
-
- This is a routing/telemetry flag only; it does not by itself - change the login flow. -
-Default: false
Optionalerror
- Path in your application to redirect to when the Authorization
- server returns an error. Defaults to /
-
Optionalhttp- Configuration for the built-in Http Interceptor, used for - automatically attaching access tokens. -
-Optionalhttp
- Specify the timeout for HTTP calls using fetch.
- The default is 10 seconds.
-
Optionalinteractive- Configures automatic handling of interactive authentication - errors. -
-
- When set, the SDK intercepts mfa_required errors
- from getTokenSilently() and handles them
- automatically instead of throwing to the caller.
-
'popup': Opens Universal Login in a popup to
- complete MFA. The original
- authorizationParams (audience, scope) are
- preserved. On success, the token is returned. On failure,
- popup errors are thrown.
-
- This option only affects getTokenSilently().
- Other methods are not affected.
-
undefined (MFA errors are thrown to the caller)
+AuthConfig | @auth0/auth0-angular
+
+
+
+
+
+Interface AuthConfig
+
+Configuration for the authentication service
+
+interface AuthConfig {
anonymousSessionsCacheMode?: "localStorage" | "memory";
auth0Client?: {
env?: { [key: string]: string };
name: string;
version: string;
};
authorizationParams?: ClientAuthorizationParams;
authorizeTimeoutInSeconds?: number;
cache?: ICache;
cacheLocation?: CacheLocation;
clientId: string;
cookieDomain?: string;
createAnonymousSessionOnFailedSilentAuth?: boolean;
domain: string;
enterpriseConnect?: boolean;
errorPath?: string;
httpInterceptor?: HttpInterceptorConfig;
httpTimeoutInSeconds?: number;
interactiveErrorHandler?: "popup";
issuer?: string;
leeway?: number;
legacySameSiteCookie?: boolean;
nowProvider?: () => number | Promise<number>;
refreshTokenMode?: RefreshTokenMode;
sessionCheckExpiryDays?: number;
sessionTransferTokenQueryParamName?: string;
skipRedirectCallback?: boolean;
useCookiesForTransactions?: boolean;
useDpop?: boolean;
useFormData?: boolean;
useMrrt?: boolean;
useRefreshTokens?: boolean;
useRefreshTokensFallback?: boolean;
workerUrl?: string;
}
+
+Hierarchy
+
+- Auth0ClientOptions
+
+- AuthConfig
+
+
+
+Index
+
+
+Properties
+anonymous
+
+Properties
+
+
+Optionalanonymous
+anonymousSessionsCacheMode?: "localStorage" | "memory"
+Where to store the anonymous session token.
+
+'localStorage' (default): the session token survives page reloads. Suitable for most SPAs.'memory': the session token lives only for the current page load. Use this if you do not
+want anonymous session data written to disk.
+
+
-
-
-
-
- Optionalissuer
-
-
- issuer?:
- string
-
-
-
- The issuer to be used for validation of JWTs, optionally
- defaults to the domain above
-
-
-
-
-
-
- Optionalleeway
-
-
- leeway?:
- number
-
-
-
- The value in seconds used to account for clock skew in JWT
- expirations. Typically, this value is no more than a minute or
- two at maximum. Defaults to 60s.
-
-
-
-
-
-
- Optionallegacy
-
- legacySameSiteCookie?:
- boolean
-
-
-
- Sets an additional cookie with no SameSite attribute to
- support legacy browsers that are not compatible with the
- latest SameSite changes. This will log a warning on modern
- browsers, you can disable the warning by setting this to false
- but be aware that some older useragents will not work, See
- https://www.chromium.org/updates/same-site/incompatible-clients
- Defaults to true
-
-
-
-
-
-
- Optionalnow
-
- nowProvider?:
- ()
- =>
- number
- |
- Promise<number>
-
-
-
- Modify the value used as the current time during the token
- validation.
-
-
- Note: Using this improperly can potentially
- compromise the token validation.
-
-
-
-
-
-
- Optionalrefresh
-
-
-
- Selects the refresh-token variant used when
- useRefreshTokens: true. Defaults to
- RefreshTokenMode.Offline.
-
-
- -
- RefreshTokenMode.Offline
- (default): rotating offline refresh tokens
- (
offline_access).
-
- -
- RefreshTokenMode.Online: non-rotating, session-bound Online Refresh Tokens
- (
online_access).
-
-
-
- Online mode requires useRefreshTokens: true and
- useDpop: true. The online_access and
- offline_access scopes are mutually exclusive.
-
-
-
-
-
-
- Optionalsession
-
- sessionCheckExpiryDays?:
- number
-
-
-
- Number of days until the cookie
- auth0.is.authenticated will expire Defaults to 1.
-
-
-
-
-
-
- Optionalsession
-
- sessionTransferTokenQueryParamName?:
- string
-
-
-
- Query parameter name to extract the session transfer token
- from for Native to Web SSO.
-
-
- When set, the SDK automatically extracts the token from the
- specified URL query parameter and includes it as
- session_transfer_token in authorization requests.
- This enables seamless single sign-on when users transition
- from a native mobile application to a web application.
-
-
- After extraction, the token is automatically removed from the
- URL using window.history.replaceState() to
- prevent accidental reuse on subsequent authentication
- requests.
-
-
- Default: undefined (feature
- disabled)
-
- Common values:
-
- -
-
'session_transfer_token' - Standard parameter
- name
-
- 'stt' - Shortened version- Custom parameter name of your choice
-
-
- Set to undefined to disable automatic extraction
- if you prefer to handle session transfer tokens manually.
-
-
-
+
+Optional Internalauth0
+auth0Client?: { env?: { [key: string]: string }; name: string; version: string }
+Internal property to send information about the client to the authorization server.
+
+
+Optionalauthorization
+authorizationParams?: ClientAuthorizationParams
+URL parameters that will be sent back to the Authorization Server. This can be known parameters
+defined by Auth0 or custom parameters that you define.
+
+
+Optionalauthorize
+authorizeTimeoutInSeconds?: number
+A maximum number of seconds to wait before declaring background calls to /authorize as failed for timeout
+Defaults to 60s.
+
+
+Optionalcache
+
+Specify a custom cache implementation to use for token storage and retrieval. This setting takes precedence over cacheLocation if they are both specified.
+
+
+Optionalcache
+cacheLocation?: CacheLocation
+The location to use when storing cache data. Valid values are memory or localstorage.
+The default setting is memory.
+Read more about changing storage options in the Auth0 docs
+
+
+client
+clientId: string
+The Client ID found on your Application settings page
+
+
+Optionalcookie
+cookieDomain?: string
+The domain the cookie is accessible from. If not set, the cookie is scoped to
+the current domain, including the subdomain.
+Note: setting this incorrectly may cause silent authentication to stop working
+on page load.
+To keep a user logged in across multiple subdomains set this to your
+top-level domain and prefixed with a . (eg: .example.com).
+
+
+Optionalcreate
+createAnonymousSessionOnFailedSilentAuth?: boolean
+When true, checkSession() automatically creates (or restores) an anonymous
+session when the user is not authenticated. This does not affect standalone
+getTokenSilently() calls. checkSession() does not throw in this case.
+Metadata limitation: the session is created without metadata. If you need
+to attach metadata to the anonymous identity, do not use this option. Call
+auth0.anonymous.createSession({ metadata }) explicitly instead.
+
+
+
+domain
+domain: string
+Your Auth0 account domain such as 'example.auth0.com',
+'example.eu.auth0.com' or , 'example.mycompany.com'
+(when using custom domains)
+
+
+Optionalenterprise
+enterpriseConnect?: boolean
+Set to true when this client drives an Enterprise Connect login (enterprise
+SSO resolved from the email domain via isFederatedDomain and login_hint).
+Enterprise Connect issues no refresh token and resolves the organization from
+Home Realm Discovery at login. When enabled, the SDK warns at initialization if
+the configuration contradicts that: useRefreshTokens: true or offline_access
+in scope (no refresh token is issued) or a static organization (HRD resolves
+it, and a static value breaks multi-customer setups).
+This is a routing/telemetry flag only; it does not by itself change the login flow.
+Default: false
+
+
+Optionalerror
+errorPath?: string
+Path in your application to redirect to when the Authorization server
+returns an error. Defaults to /
+
+
+Optionalhttp
+
+Configuration for the built-in Http Interceptor, used for
+automatically attaching access tokens.
+
+
+Optionalhttp
+httpTimeoutInSeconds?: number
+Specify the timeout for HTTP calls using fetch. The default is 10 seconds.
+
+
+Optionalinteractive
+interactiveErrorHandler?: "popup"
+Configures automatic handling of interactive authentication errors.
+When set, the SDK intercepts mfa_required errors from getTokenSilently()
+and handles them automatically instead of throwing to the caller.
+
+'popup': Opens Universal Login in a popup to complete MFA.
+The original authorizationParams (audience, scope) are preserved.
+On success, the token is returned. On failure, popup errors are thrown.
+This option only affects getTokenSilently(). Other methods are not affected.
+
+
+
-
-
- See
-
-
- https://auth0.com/docs/authenticate/single-sign-on/native-to-web
-
-
-
-
-
-
-
- Optionalskip
-
- skipRedirectCallback?:
- boolean
-
-
-
- By default, if the page URL has code and state parameters, the
- SDK will assume they are for an Auth0 application and attempt
- to exchange the code for a token. In some cases the code might
- be for something else (e.g. another OAuth SDK). In these
- instances you can instruct the client to ignore them by
- setting skipRedirectCallback.
-
- AuthModule.forRoot({
skipRedirectCallback: window.location.pathname === '/other-callback'
})
+
+
+
+Optionalissuer
+issuer?: string
+The issuer to be used for validation of JWTs, optionally defaults to the domain above
+
+
+Optionalleeway
+leeway?: number
+The value in seconds used to account for clock skew in JWT expirations.
+Typically, this value is no more than a minute or two at maximum.
+Defaults to 60s.
+
+
+Optionallegacy
+legacySameSiteCookie?: boolean
+Sets an additional cookie with no SameSite attribute to support legacy browsers
+that are not compatible with the latest SameSite changes.
+This will log a warning on modern browsers, you can disable the warning by setting
+this to false but be aware that some older useragents will not work,
+See https://www.chromium.org/updates/same-site/incompatible-clients
+Defaults to true
+
+
+Optionalnow
+nowProvider?: () => number | Promise<number>
+Modify the value used as the current time during the token validation.
+Note: Using this improperly can potentially compromise the token validation.
+
+
+Optionalrefresh
+
+Selects the refresh-token variant used when useRefreshTokens: true.
+Defaults to RefreshTokenMode.Offline.
+
+- RefreshTokenMode.Offline (default): rotating offline refresh tokens (
offline_access).
+- RefreshTokenMode.Online: non-rotating, session-bound Online Refresh Tokens (
online_access).
+
+Online mode requires useRefreshTokens: true and useDpop: true. The
+online_access and offline_access scopes are mutually exclusive.
+
+
+Optionalsession
+sessionCheckExpiryDays?: number
+Number of days until the cookie auth0.is.authenticated will expire
+Defaults to 1.
+
+
+Optionalsession
+sessionTransferTokenQueryParamName?: string
+Query parameter name to extract the session transfer token from for Native to Web SSO.
+When set, the SDK automatically extracts the token from the specified URL query
+parameter and includes it as session_transfer_token in authorization requests.
+This enables seamless single sign-on when users transition from a native mobile
+application to a web application.
+After extraction, the token is automatically removed from the URL using
+window.history.replaceState() to prevent accidental reuse on subsequent
+authentication requests.
+Default: undefined (feature disabled)
+Common values:
+
+'session_transfer_token' - Standard parameter name'stt' - Shortened version- Custom parameter name of your choice
+
+Set to undefined to disable automatic extraction if you prefer to handle
+session transfer tokens manually.
+
+
+
+Example
const auth0 = await createAuth0Client({
domain: '<AUTH0_DOMAIN>',
clientId: '<AUTH0_CLIENT_ID>',
sessionTransferTokenQueryParamName: 'session_transfer_token'
});
-
- Note: In the above example,
- /other-callback is an existing route that will be
- called by any other OAuth provider with a
- code (or error in case when
- something went wrong) and state.
-
-
-
-
-
-
- Optionaluse
-
- useCookiesForTransactions?:
- boolean
-
-
-
- If true, the SDK will use a cookie when storing
- information about the auth transaction while the user is going
- through the authentication flow on the authorization server.
-
-
- The default is false, in which case the SDK will
- use session storage.
-
-
-
-
-
-
-
- Optionaluse
-
- useDpop?:
- boolean
-
-
-
- If true, DPoP (OAuth 2.0 Demonstrating Proof of
- Possession, RFC9449) will be used to cryptographically bind
- tokens to this specific browser so they can't be used from a
- different device in case of a leak.
-
- The default setting is false.
-
-
-
-
-
- Optionaluse
-
- useFormData?:
- boolean
-
-
-
- If true, data to the token endpoint is transmitted as
- x-www-form-urlencoded data, if false it will be transmitted as
- JSON. The default setting is true.
-
-
- Note: Setting this to false may
- affect you if you use Auth0 Rules and are sending custom,
- non-primitive data. If you disable this, please verify that
- your Auth0 Rules continue to work as intended.
-
-
-
-
-
-
- Optionaluse
-
- useMrrt?:
- boolean
-
-
-
- If true, the SDK will allow the refreshing of
- tokens using MRRT
-
-
-
-
-
-
- Optionaluse
-
- useRefreshTokens?:
- boolean
-
-
-
- If true, refresh tokens are used to fetch new access tokens
- from the Auth0 server. If false, the standard technique of
- using a hidden iframe and the
- authorization_code grant with
- prompt=none is used. The default setting is
- false.
-
-
- Standard technique relies on cookies. Because browsers
- increasingly block third-party cookies, it requires a Custom
- Domain to function reliably. Refresh tokens serve as a
- fallback for environments where third-party cookies are
- blocked. Using a Custom Domain with this set to
- false is the most secure and recommended
- approach.
-
-
- Note: Use of refresh tokens must be enabled
- by an administrator on your Auth0 client application.
-
-
-
-
-
-
- Optionaluse
-
- useRefreshTokensFallback?:
- boolean
-
-
-
- If true, fallback to the technique of using a hidden iframe
- and the authorization_code grant with
- prompt=none when unable to use refresh tokens. If
- false, the iframe fallback is not used and errors relating to
- a failed refresh_token grant should be handled
- appropriately. The default setting is false.
-
-
- Note: There might be situations where doing
- silent auth with a Web Message response from an iframe is not
- possible, like when you're serving your application from the
- file system or a custom protocol (like in a Desktop or Native
- app). In situations like this you can disable the iframe
- fallback and handle the failed
- refresh_token grant and prompt the user to login
- interactively with loginWithRedirect or
- loginWithPopup."
-
-
- E.g. Using the file: protocol in an Electron
- application does not support that legacy technique.
-
-
-
+
+Optionalskip
+skipRedirectCallback?: boolean
+By default, if the page URL has code and state parameters, the SDK will assume they are for
+an Auth0 application and attempt to exchange the code for a token.
+In some cases the code might be for something else (e.g. another OAuth SDK). In these
+instances you can instruct the client to ignore them by setting skipRedirectCallback.
+AuthModule.forRoot({
skipRedirectCallback: window.location.pathname === '/other-callback'
})
-
-
-
-
-
-
- Optionalworker
-
- workerUrl?:
- string
-
-
-
- If provided, the SDK will load the token worker from this URL
- instead of the integrated blob. An example of
- when this is useful is if you have strict
- Content-Security-Policy (CSP) and wish to avoid needing to set
- worker-src: blob:. We recommend either serving
- the worker, which you can find in the module at
- <module_path>/dist/auth0-spa-js.worker.production.js, from the same host as your application or using the Auth0
- CDN
- https://cdn.auth0.com/js/auth0-spa-js/<version>/auth0-spa-js.worker.production.js.
-
-
- Note: The worker is only used when
- useRefreshTokens: true,
- cacheLocation: 'memory', and the
- cache is not custom.
-
-
-
-
-
-
-
-
- Note: In the above example, /other-callback is an existing route that will be called
+by any other OAuth provider with a code (or error in case when something went wrong) and state.
OptionaluseIf true, the SDK will use a cookie when storing information about the auth transaction while
+the user is going through the authentication flow on the authorization server.
The default is false, in which case the SDK will use session storage.
OptionaluseIf true, DPoP (OAuth 2.0 Demonstrating Proof of Possession, RFC9449)
+will be used to cryptographically bind tokens to this specific browser
+so they can't be used from a different device in case of a leak.
The default setting is false.
OptionaluseIf true, data to the token endpoint is transmitted as x-www-form-urlencoded data, if false it will be transmitted as JSON. The default setting is true.
Note: Setting this to false may affect you if you use Auth0 Rules and are sending custom, non-primitive data. If you disable this,
+please verify that your Auth0 Rules continue to work as intended.
OptionaluseIf true, the SDK will allow the refreshing of tokens using MRRT
OptionaluseIf true, refresh tokens are used to fetch new access tokens from the Auth0 server. If false, the standard technique of using a hidden iframe and the authorization_code grant with prompt=none is used.
+The default setting is false.
Standard technique relies on cookies. Because browsers increasingly block third-party cookies, it requires a Custom Domain to function reliably. Refresh tokens serve as a fallback for environments where third-party cookies are blocked.
+Using a Custom Domain with this set to false is the most secure and recommended approach.
Note: Use of refresh tokens must be enabled by an administrator on your Auth0 client application.
+OptionaluseIf true, fallback to the technique of using a hidden iframe and the authorization_code grant with prompt=none when unable to use refresh tokens. If false, the iframe fallback is not used and
+errors relating to a failed refresh_token grant should be handled appropriately. The default setting is false.
Note: There might be situations where doing silent auth with a Web Message response from an iframe is not possible,
+like when you're serving your application from the file system or a custom protocol (like in a Desktop or Native app).
+In situations like this you can disable the iframe fallback and handle the failed refresh_token grant and prompt the user to login interactively with loginWithRedirect or loginWithPopup."
E.g. Using the file: protocol in an Electron application does not support that legacy technique.
OptionalworkerIf provided, the SDK will load the token worker from this URL instead of the integrated blob. An example of when this is useful is if you have strict
+Content-Security-Policy (CSP) and wish to avoid needing to set worker-src: blob:. We recommend either serving the worker, which you can find in the module
+at <module_path>/dist/auth0-spa-js.worker.production.js, from the same host as your application or using the Auth0 CDN
+https://cdn.auth0.com/js/auth0-spa-js/<version>/auth0-spa-js.worker.production.js.
Note: The worker is only used when useRefreshTokens: true, cacheLocation: 'memory', and the cache is not custom.
Optionalexperiment_Forces a specific Experiment Center variant for this /authorize request
+instead of letting Auth0 assign one via its hash. Use together with
+variation_id.
Pass per-call (on loginWithRedirect/loginWithPopup) rather than at
+client construction time so the override does not bleed into silent
+prompt=none token-renewal calls, where Experiment Center does not run.
Testing: drive from test automation (e.g. Cypress/Playwright) with IDs +from a CI environment variable against a staging tenant. Do not hard-code +this in shipped app code.
+Production: pass the variant decision from a feature-flag tool +(e.g. LaunchDarkly) that has already decided which variant the user should +see for this request.
+Optionalid_Previously issued ID Token.
@@ -171,6 +192,14 @@Optional
Defined in node_modules/@auth0/auth0-spa-js/dist/typings/global.d.ts:58
+Optionalsegment_
+segment_id?: string
+An optional segment identifier to pass alongside experiment_id and
+variation_id when forcing a variant.
+
+
Optionalsession_
session_transfer_token?: string
Session transfer token from a native application for Native to Web SSO.
@@ -190,7 +219,17 @@
Optional'fr-CA fr en'.
Optionalvariation_The variation to force within the experiment identified by experiment_id.
+Auth0 uses this value instead of computing an assignment for the current
+request. The override applies to this request only; the next login without
+these params reverts to normal server-side assignment.
- Navigates to the specified url. The router will be used - if one is available, otherwise it falls back to -
-window.history.replaceState. -