@auth0/auth0-spa-js

constructor

constructor(options: Auth0ClientOptions);

property mfa

readonly mfa: MfaApiClient;

• MFA API client for multi-factor authentication operations.

  Provides methods for: - Listing enrolled authenticators - Enrolling new authenticators (OTP, SMS, Voice, Push, Email) - Initiating MFA challenges - Verifying MFA challenges

method checkSession

checkSession: (options?: GetTokenSilentlyOptions) => Promise<void>;

• await auth0.checkSession();

  Check if the user is logged in using getTokenSilently. The difference with getTokenSilently is that this doesn't return a token, but it will pre-fill the token cache.

  This method also heeds the auth0.{clientId}.is.authenticated cookie, as an optimization to prevent calling Auth0 unnecessarily. If the cookie is not present because there was no previous login (or it has expired) then tokens will not be refreshed.

  It should be used for silently logging in the user when you instantiate the Auth0Client constructor. You should not need this if you are using the createAuth0Client factory.

  **Note:** the cookie **may not** be present if running an app using a private tab, as some browsers clear JS cookie data and local storage when the tab or page is closed, or on page reload. This effectively means that checkSession could silently return without authenticating the user on page refresh when using a private tab, despite having previously logged in. As a workaround, use getTokenSilently instead and handle the possible login_required error [as shown in the readme](https://github.com/auth0/auth0-spa-js#creating-the-client).

  Parameter options

method connectAccountWithRedirect

connectAccountWithRedirect: <TAppState = any>(
    options: RedirectConnectAccountOptions<TAppState>
) => Promise<void>;

• Initiates a redirect to connect the user's account with a specified connection. This method generates PKCE parameters, creates a transaction, and redirects to the /connect endpoint.

  You must enable Offline Access from the Connection Permissions settings to be able to use the connection with Connected Accounts.

  TAppState - The application state to persist through the transaction.

  Parameter options

  Options for the connect account redirect flow.

  Parameter

  {string} options.connection - The name of the connection to link (e.g. 'google-oauth2').

  Parameter

  {string[]} [options.scopes] - Array of scopes to request from the Identity Provider during the connect account flow.

  Parameter

  {AuthorizationParams} [options.authorization_params] - Additional authorization parameters for the request to the upstream IdP.

  Parameter

  {string} [options.redirectUri] - The URI to redirect back to after connecting the account.

  Parameter

  {TAppState} [options.appState] - Application state to persist through the transaction.

  Parameter

  {(url: string) => Promise} [options.openUrl] - Custom function to open the URL.

  Returns

  {Promise} Resolves when the redirect is initiated.

  Throws

  {MyAccountApiError} If the connect request to the My Account API fails.

method createFetcher

createFetcher: <TOutput extends CustomFetchMinimalOutput = Response>(
    config?: FetcherConfig<TOutput>
) => Fetcher<TOutput>;

• Returns a new Fetcher class that will contain a fetchWithAuth() method. This is a drop-in replacement for the Fetch API's fetch() method, but will handle certain authentication logic for you, like building the proper auth headers or managing DPoP nonces and retries automatically.

  Check the EXAMPLES.md file for a deeper look into this method.

method exchangeToken

exchangeToken: (
    options: CustomTokenExchangeOptions
) => Promise<TokenEndpointResponse>;

• Exchanges an external subject token for an Auth0 token via a token exchange request.

  Parameter options

  The options required to perform the token exchange.

  Returns

  {Promise} A promise that resolves to the token endpoint response, which contains the issued Auth0 tokens.

  This method implements the token exchange grant as specified in RFC 8693 by first validating the provided subject token type and then constructing a token request to the /oauth/token endpoint. The request includes the following parameters:

  - grant_type: Hard-coded to "urn:ietf:params:oauth:grant-type:token-exchange". - subject_token: The external token provided via the options. - subject_token_type: The type of the external token (validated by this function). - scope: A unique set of scopes, generated by merging the scopes supplied in the options with the SDK’s default scopes. - audience: The target audience from the options, with fallback to the SDK's authorization configuration. - organization: Optional organization ID or name for authenticating the user in an organization context. When provided, the organization ID will be present in the access token payload.

  **Example Usage:**

  // Define the token exchange options
  const options: CustomTokenExchangeOptions = {
    subject_token: 'eyJhbGciOiJIUzI1NiIsInR5cCI6Ikp...',
    subject_token_type: 'urn:acme:legacy-system-token',
    scope: "openid profile",
    organization: "org_12345"
  };
  
  // Exchange the external token for Auth0 tokens
  try {
    const tokenResponse = await instance.exchangeToken(options);
    // Use tokenResponse.access_token, tokenResponse.id_token, etc.
    // The organization ID will be present in the access token payload
  } catch (error) {
    // Handle token exchange error
  }

method generateDpopProof

generateDpopProof: (params: {
    url: string;
    method: string;
    nonce?: string;
    accessToken: string;
}) => Promise<string>;

• Returns a string to be used to demonstrate possession of the private key used to cryptographically bind access tokens with DPoP.

  It requires enabling the Auth0ClientOptions.useDpop option.

method getConfiguration

getConfiguration: () => Readonly<ClientConfiguration>;

• Returns a readonly copy of the initialization configuration.

  Returns

  An object containing domain and clientId

  Example 1

  const auth0 = new Auth0Client({
    domain: 'tenant.auth0.com',
    clientId: 'abc123'
  });
  
  const config = auth0.getConfiguration();
  // { domain: 'tenant.auth0.com', clientId: 'abc123' }

method getDpopNonce

getDpopNonce: (id?: string) => Promise<string | undefined>;

• Returns the current DPoP nonce used for making requests to Auth0.

  It can return undefined because when starting fresh it will not be populated until after the first response from the server.

  It requires enabling the Auth0ClientOptions.useDpop option.

  Parameter nonce

  The nonce value.

  Parameter id

  The identifier of a nonce: if absent, it will get the nonce used for requests to Auth0. Otherwise, it will be used to select a specific non-Auth0 nonce.

method getIdTokenClaims

getIdTokenClaims: () => Promise<IdToken | undefined>;

• const claims = await auth0.getIdTokenClaims();

  Returns all claims from the id_token if available.

method getTokenSilently

getTokenSilently: {
    (
        options: GetTokenSilentlyOptions & { detailedResponse: true }
    ): Promise<GetTokenSilentlyVerboseResponse>;
    (options?: GetTokenSilentlyOptions): Promise<string>;
};

• Fetches a new access token and returns the response from the /oauth/token endpoint, omitting the refresh token.

  Parameter options

• Fetches a new access token and returns it.

  Parameter options

method getTokenWithPopup

getTokenWithPopup: (
    options?: GetTokenWithPopupOptions,
    config?: PopupConfigOptions
) => Promise<string | undefined>;

• const token = await auth0.getTokenWithPopup(options);

  Opens a popup with the /authorize URL using the parameters provided as arguments. Random and secure state and nonce parameters will be auto-generated. If the response is successful, results will be valid according to their expiration times.

  Parameter options

  Parameter config

method getUser

getUser: <TUser extends User>() => Promise<TUser | undefined>;

• const user = await auth0.getUser();

  Returns the user information if available (decoded from the id_token).

method handleRedirectCallback

handleRedirectCallback: <TAppState = any>(
    url?: string
) => Promise<
    RedirectLoginResult<TAppState> | ConnectAccountRedirectResult<TAppState>
>;

• After the browser redirects back to the callback page, call handleRedirectCallback to handle success and error responses from Auth0. If the response is successful, results will be valid according to their expiration times.

method isAuthenticated

isAuthenticated: () => Promise<boolean>;

• const isAuthenticated = await auth0.isAuthenticated();

  Returns true if there's valid information stored, otherwise returns false.

method loginWithPopup

loginWithPopup: (
    options?: PopupLoginOptions,
    config?: PopupConfigOptions
) => Promise<void>;

• try {
   await auth0.loginWithPopup(options);
  } catch(e) {
   if (e instanceof PopupCancelledError) {
     // Popup was closed before login completed
   }
  }

  Opens a popup with the /authorize URL using the parameters provided as arguments. Random and secure state and nonce parameters will be auto-generated. If the response is successful, results will be valid according to their expiration times.

  IMPORTANT: This method has to be called from an event handler that was started by the user like a button click, for example, otherwise the popup will be blocked in most browsers.

  Parameter options

  Parameter config

method loginWithRedirect

loginWithRedirect: <TAppState = any>(
    options?: RedirectLoginOptions<TAppState>
) => Promise<void>;

• await auth0.loginWithRedirect(options);

  Performs a redirect to /authorize using the parameters provided as arguments. Random and secure state and nonce parameters will be auto-generated.

  Parameter options

method logout

logout: (options?: LogoutOptions) => Promise<void>;

• await auth0.logout(options);

  Clears the application session and performs a redirect to /v2/logout, using the parameters provided as arguments, to clear the Auth0 session.

  If the federated option is specified it also clears the Identity Provider session. [Read more about how Logout works at Auth0](https://auth0.com/docs/logout).

  Parameter options

method setDpopNonce

setDpopNonce: (nonce: string, id?: string) => Promise<void>;

• Sets the current DPoP nonce used for making requests to Auth0.

  It requires enabling the Auth0ClientOptions.useDpop option.

  Parameter nonce

  The nonce value.

  Parameter id

  The identifier of a nonce: if absent, it will set the nonce used for requests to Auth0. Otherwise, it will be used to select a specific non-Auth0 nonce.

constructor

constructor(
    error: string,
    error_description: string,
    state: string,
    appState?: any
);

property appState

appState: any;

property state

state: string;

constructor

constructor(data: CacheKeyData, prefix?: string, suffix?: string);

property audience

audience?: string;

property clientId

clientId: string;

property prefix

prefix: string;

property scope

scope?: string;

property suffix

suffix?: string;

method fromCacheEntry

static fromCacheEntry: (entry: CacheEntry) => CacheKey;

• Utility function to build a CacheKey instance from a cache entry

  Parameter entry

  The entry

  Returns

  An instance of CacheKey

method fromKey

static fromKey: (key: string) => CacheKey;

• Converts a cache key string into a CacheKey instance.

  Parameter key

  The key to convert

  Returns

  An instance of CacheKey

method toKey

toKey: () => string;

• Converts this CacheKey instance into a string for use in a cache

  Returns

  A string representation of the key

constructor

constructor(
    error: string,
    error_description: string,
    connection: string,
    state: string,
    appState?: any
);

property appState

appState: any;

property connection

connection: string;

property state

state: string;

constructor

constructor(config: FetcherConfig<TOutput>, hooks: FetcherHooks);

property config

protected readonly config: Omit<FetcherConfig<TOutput>, 'fetch'> &
    Required<Pick<FetcherConfig<TOutput>, 'fetch'>>;

property hooks

protected readonly hooks: FetcherHooks;

method buildBaseRequest

protected buildBaseRequest: (
    info: RequestInfo | URL,
    init: RequestInit | undefined
) => Request;

method buildUrl

protected buildUrl: (
    baseUrl: string | undefined,
    url: string | undefined
) => string;

method extractUrl

protected extractUrl: (info: RequestInfo | URL) => string;

method fetchWithAuth

fetchWithAuth: (
    info: RequestInfo | URL,
    init?: RequestInit,
    authParams?: AuthParams
) => Promise<TOutput>;

method getAccessToken

protected getAccessToken: (
    authParams?: AuthParams
) => Promise<string | GetTokenSilentlyVerboseResponse>;

method getHeader

protected getHeader: (headers: ResponseHeaders, name: string) => string;

method handleResponse

protected handleResponse: (
    response: TOutput,
    callbacks: FetchWithAuthCallbacks<TOutput>
) => Promise<TOutput>;

method hasUseDpopNonceError

protected hasUseDpopNonceError: (response: TOutput) => boolean;

method internalFetchWithAuth

protected internalFetchWithAuth: (
    info: RequestInfo | URL,
    init: RequestInit | undefined,
    callbacks: FetchWithAuthCallbacks<TOutput>,
    authParams?: AuthParams
) => Promise<TOutput>;

method isAbsoluteUrl

protected isAbsoluteUrl: (url: string) => boolean;

method prepareRequest

protected prepareRequest: (
    request: Request,
    authParams?: AuthParams
) => Promise<void>;

method setAuthorizationHeader

protected setAuthorizationHeader: (
    request: Request,
    accessToken: string,
    tokenType?: string
) => void;

method setDpopProofHeader

protected setDpopProofHeader: (
    request: Request,
    accessToken: string
) => Promise<void>;

constructor

constructor(error: string, error_description: string);

property error

error: string;

property error_description

error_description: string;

method fromPayload

static fromPayload: ({
    error,
    error_description,
}: {
    error: string;
    error_description: string;
}) => GenericError;

property enclosedCache

enclosedCache: ICache;

method allKeys

allKeys: () => string[];

method get

get: <T = Cacheable>(key: string) => MaybePromise<T | undefined>;

method remove

remove: (key: string) => void;

method set

set: <T = Cacheable>(key: string, entry: T) => void;

method challenge

challenge: (params: ChallengeAuthenticatorParams) => Promise<ChallengeResponse>;

• Initiates an MFA challenge

  Sends OTP via SMS, initiates push notification, or prepares for OTP entry

  Parameter params

  Challenge parameters including mfaToken

  Returns

  Challenge response with oobCode if applicable

  Throws

  {MfaChallengeError} If challenge initiation fails

  Example 1

  OTP challenge

  const challenge = await mfa.challenge({
    mfaToken: mfaTokenFromLogin,
    challengeType: 'otp',
    authenticatorId: 'otp|dev_xxx'
  });
  // User enters OTP from their authenticator app

  Example 2

  SMS challenge

  const challenge = await mfa.challenge({
    mfaToken: mfaTokenFromLogin,
    challengeType: 'oob',
    authenticatorId: 'sms|dev_xxx'
  });
  console.log(challenge.oobCode); // Use for verification

method enroll

enroll: (params: EnrollParams) => Promise<EnrollmentResponse>;

• Enrolls a new MFA authenticator

  Requires MFA access token with 'enroll' scope

  Parameter params

  Enrollment parameters including mfaToken and factorType

  Returns

  Enrollment response with authenticator details

  Throws

  {MfaEnrollmentError} If enrollment fails

  Example 1

  OTP enrollment

  const enrollment = await mfa.enroll({
    mfaToken: mfaToken,
    factorType: 'otp'
  });
  console.log(enrollment.secret); // Base32 secret
  console.log(enrollment.barcodeUri); // QR code URI

  Example 2

  SMS enrollment

  const enrollment = await mfa.enroll({
    mfaToken: mfaToken,
    factorType: 'sms',
    phoneNumber: '+12025551234'
  });

method getAuthenticators

getAuthenticators: (mfaToken: string) => Promise<Authenticator[]>;

• Gets enrolled MFA authenticators filtered by challenge types from context.

  Challenge types are automatically resolved from the stored MFA context (set when mfa_required error occurred).

  Parameter mfaToken

  MFA token from mfa_required error

  Returns

  Array of enrolled authenticators matching the challenge types

  Throws

  {MfaListAuthenticatorsError} If the request fails or context not found

  Example 1

  Basic usage

  try {
    await auth0.getTokenSilently();
  } catch (e) {
    if (e instanceof MfaRequiredError) {
      // SDK automatically uses challenge types from error context
      const authenticators = await auth0.mfa.getAuthenticators(e.mfa_token);
    }
  }

method getEnrollmentFactors

getEnrollmentFactors: (mfaToken: string) => Promise<EnrollmentFactor[]>;

• Gets available MFA enrollment factors from the stored context.

  This method exposes the enrollment options from the mfa_required error's mfaRequirements.enroll array, eliminating the need for manual parsing.

  Parameter mfaToken

  MFA token from mfa_required error

  Returns

  Array of enrollment factors available for the user (empty array if no enrollment required)

  Throws

  {MfaEnrollmentFactorsError} If MFA context not found

  Example 1

  Basic usage

  try {
    await auth0.getTokenSilently();
  } catch (error) {
    if (error.error === 'mfa_required') {
      // Get enrollment options from SDK
      const enrollOptions = await auth0.mfa.getEnrollmentFactors(error.mfa_token);
      // [{ type: 'otp' }, { type: 'phone' }, { type: 'push-notification' }]
  
      showEnrollmentOptions(enrollOptions);
    }
  }

  Example 2

  Check if enrollment is required

  try {
    const factors = await auth0.mfa.getEnrollmentFactors(mfaToken);
    if (factors.length > 0) {
      // User needs to enroll in MFA
      renderEnrollmentUI(factors);
    } else {
      // No enrollment required, proceed with challenge
    }
  } catch (error) {
    if (error instanceof MfaEnrollmentFactorsError) {
      console.error('Context not found:', error.error_description);
    }
  }

method verify

verify: (params: VerifyParams) => Promise<TokenEndpointResponse>;

• Verifies an MFA challenge and completes authentication

  The scope and audience are retrieved from the stored context (set when the mfa_required error occurred). The grant_type is automatically inferred from which verification field is provided (otp, oobCode, or recoveryCode).

  Parameter params

  Verification parameters with OTP, OOB code, or recovery code

  Returns

  Token response with access_token, id_token, refresh_token

  Throws

  {MfaVerifyError} If verification fails (invalid code, expired, rate limited)

  Throws

  {MfaVerifyError} If MFA context not found

  Throws

  {MfaVerifyError} If grant_type cannot be inferred

  Rate limits: - 10 verification attempts allowed - Refreshes at 1 attempt per 6 minutes

  Example 1

  OTP verification (grant_type inferred from otp field)

  const tokens = await mfa.verify({
    mfaToken: mfaTokenFromLogin,
    otp: '123456'
  });
  console.log(tokens.access_token);

  Example 2

  OOB verification (grant_type inferred from oobCode field)

  const tokens = await mfa.verify({
    mfaToken: mfaTokenFromLogin,
    oobCode: challenge.oobCode,
    bindingCode: '123456' // Code user received via SMS
  });

  Example 3

  Recovery code verification (grant_type inferred from recoveryCode field)

  const tokens = await mfa.verify({
    mfaToken: mfaTokenFromLogin,
    recoveryCode: 'XXXX-XXXX-XXXX'
  });

constructor

constructor(error: string, error_description: string);

constructor

constructor(error: string, error_description: string);

constructor

constructor(error: string, error_description: string);

constructor

constructor(error: string, error_description: string);

method fromPayload

static fromPayload: ({
    error,
    error_description,
}: {
    error: string;
    error_description: string;
}) => MfaError;

constructor

constructor(error: string, error_description: string);

constructor

constructor(
    error: string,
    error_description: string,
    mfa_token: string,
    mfa_requirements: MfaRequirements
);

property mfa_requirements

mfa_requirements: MfaRequirements;

property mfa_token

mfa_token: string;

constructor

constructor(error: string, error_description: string);

constructor

constructor(audience: string, scope: string);

property audience

audience: string;

property scope

scope: string;

constructor

constructor({ type, status, title, detail, validation_errors }: ErrorResponse);

property detail

readonly detail: string;

property status

readonly status: number;

property title

readonly title: string;

property type

readonly type: string;

property validation_errors

readonly validation_errors?: {
    detail: string;
    field?: string;
    pointer?: string;
    source?: string;
}[];

constructor

constructor(popup: Window);

property popup

popup: Window;

constructor

constructor();

constructor

constructor(popup: Window);

property popup

popup: Window;

constructor

constructor();

constructor

constructor(newDpopNonce: string);

property newDpopNonce

newDpopNonce: string;

property address

address?: string;

property birthdate

birthdate?: string;

property email

email?: string;

property email_verified

email_verified?: boolean;

property family_name

family_name?: string;

property gender

gender?: string;

property given_name

given_name?: string;

property locale

locale?: string;

property middle_name

middle_name?: string;

property name

name?: string;

property nickname

nickname?: string;

property phone_number

phone_number?: string;

property phone_number_verified

phone_number_verified?: boolean;

property picture

picture?: string;

property preferred_username

preferred_username?: string;

property profile

profile?: string;

property sub

sub?: string;

property updated_at

updated_at?: string;

property website

website?: string;

property zoneinfo

zoneinfo?: string;

property authorizationParams

authorizationParams?: ClientAuthorizationParams;

• URL parameters that will be sent back to the Authorization Server. This can be known parameters defined by Auth0 or custom parameters that you define.

property authorizeTimeoutInSeconds

authorizeTimeoutInSeconds?: number;

• A maximum number of seconds to wait before declaring background calls to /authorize as failed for timeout Defaults to 60s.

property cache

cache?: ICache;

• Specify a custom cache implementation to use for token storage and retrieval. This setting takes precedence over cacheLocation if they are both specified.

property cacheLocation

cacheLocation?: CacheLocation;

• The location to use when storing cache data. Valid values are memory or localstorage. The default setting is memory.

  Read more about [changing storage options in the Auth0 docs](https://auth0.com/docs/libraries/auth0-single-page-app-sdk#change-storage-options)

property clientId

clientId: string;

• The Client ID found on your Application settings page

property cookieDomain

cookieDomain?: string;

• The domain the cookie is accessible from. If not set, the cookie is scoped to the current domain, including the subdomain.

  Note: setting this incorrectly may cause silent authentication to stop working on page load.

  To keep a user logged in across multiple subdomains set this to your top-level domain and prefixed with a . (eg: .example.com).

property domain

domain: string;

• Your Auth0 account domain such as 'example.auth0.com', 'example.eu.auth0.com' or , 'example.mycompany.com' (when using [custom domains](https://auth0.com/docs/custom-domains))

property httpTimeoutInSeconds

httpTimeoutInSeconds?: number;

• Specify the timeout for HTTP calls using fetch. The default is 10 seconds.

property issuer

issuer?: string;

• The issuer to be used for validation of JWTs, optionally defaults to the domain above

property leeway

leeway?: number;

• The value in seconds used to account for clock skew in JWT expirations. Typically, this value is no more than a minute or two at maximum. Defaults to 60s.

property legacySameSiteCookie

legacySameSiteCookie?: boolean;

• Sets an additional cookie with no SameSite attribute to support legacy browsers that are not compatible with the latest SameSite changes. This will log a warning on modern browsers, you can disable the warning by setting this to false but be aware that some older useragents will not work, See https://www.chromium.org/updates/same-site/incompatible-clients Defaults to true

property nowProvider

nowProvider?: () => Promise<number> | number;

• Modify the value used as the current time during the token validation.

  **Note**: Using this improperly can potentially compromise the token validation.

property sessionCheckExpiryDays

sessionCheckExpiryDays?: number;

• Number of days until the cookie auth0.is.authenticated will expire Defaults to 1.

property useCookiesForTransactions

useCookiesForTransactions?: boolean;

• If true, the SDK will use a cookie when storing information about the auth transaction while the user is going through the authentication flow on the authorization server.

  The default is false, in which case the SDK will use session storage.

  You might want to enable this if you rely on your users being able to authenticate using flows that may end up spanning across multiple tabs (e.g. magic links) or you cannot otherwise rely on session storage being available.

property useDpop

useDpop?: boolean;

• If true, DPoP (OAuth 2.0 Demonstrating Proof of Possession, RFC9449) will be used to cryptographically bind tokens to this specific browser so they can't be used from a different device in case of a leak.

  The default setting is false.

property useFormData

useFormData?: boolean;

• If true, data to the token endpoint is transmitted as x-www-form-urlencoded data, if false it will be transmitted as JSON. The default setting is true.

  **Note:** Setting this to false may affect you if you use Auth0 Rules and are sending custom, non-primitive data. If you disable this, please verify that your Auth0 Rules continue to work as intended.

property useMrrt

useMrrt?: boolean;

• If true, the SDK will allow the refreshing of tokens using MRRT

property useRefreshTokens

useRefreshTokens?: boolean;

• If true, refresh tokens are used to fetch new access tokens from the Auth0 server. If false, the standard technique of using a hidden iframe and the authorization_code grant with prompt=none is used. The default setting is false.

  Standard technique relies on cookies. Because browsers increasingly block third-party cookies, it requires a Custom Domain to function reliably. Refresh tokens serve as a fallback for environments where third-party cookies are blocked. Using a Custom Domain with this set to false is the most secure and recommended approach.

  **Note**: Use of refresh tokens must be enabled by an administrator on your Auth0 client application.

property useRefreshTokensFallback

useRefreshTokensFallback?: boolean;

• If true, fallback to the technique of using a hidden iframe and the authorization_code grant with prompt=none when unable to use refresh tokens. If false, the iframe fallback is not used and errors relating to a failed refresh_token grant should be handled appropriately. The default setting is false.

  **Note**: There might be situations where doing silent auth with a Web Message response from an iframe is not possible, like when you're serving your application from the file system or a custom protocol (like in a Desktop or Native app). In situations like this you can disable the iframe fallback and handle the failed refresh_token grant and prompt the user to login interactively with loginWithRedirect or loginWithPopup."

  E.g. Using the file: protocol in an Electron application does not support that legacy technique.

  Example 1

  let token: string; try { token = await auth0.getTokenSilently(); } catch (e) { if (e.error === 'missing_refresh_token' || e.error === 'invalid_grant') { auth0.loginWithRedirect(); } }

property workerUrl

workerUrl?: string;

• If provided, the SDK will load the token worker from this URL instead of the integrated blob. An example of when this is useful is if you have strict Content-Security-Policy (CSP) and wish to avoid needing to set worker-src: blob:. We recommend either serving the worker, which you can find in the module at <module_path>/dist/auth0-spa-js.worker.production.js, from the same host as your application or using the Auth0 CDN https://cdn.auth0.com/js/auth0-spa-js/<version>/auth0-spa-js.worker.production.js.

  **Note**: The worker is only used when useRefreshTokens: true, cacheLocation: 'memory', and the cache is not custom.

property code

code?: string;

property connect_code

connect_code?: string;

• This is for the redirect from the connect account flow.

property error

error?: string;

property error_description

error_description?: string;

property state

state: string;

property active

active: boolean;

• Whether the authenticator is active

property authenticatorType

authenticatorType: AuthenticatorType;

• Type of authenticator

property createdAt

createdAt?: string;

• ISO 8601 timestamp when created

property id

id: string;

• Unique identifier for the authenticator

property lastAuth

lastAuth?: string;

• ISO 8601 timestamp of last authentication

property name

name?: string;

• Optional friendly name

property type

type?: string;

• Types of MFA challenges

property acr_values

acr_values?: string;

property audience

audience?: string;

• The default audience to be used for requesting API access.

property connection

connection?: string;

• The name of the connection configured for your application. If null, it will redirect to the Auth0 Login Page and show the Login Widget.

property display

display?: 'page' | 'popup' | 'touch' | 'wap';

• - 'page': displays the UI with a full page view - 'popup': displays the UI with a popup window - 'touch': displays the UI in a way that leverages a touch interface - 'wap': displays the UI with a "feature phone" type interface

property id_token_hint

id_token_hint?: string;

• Previously issued ID Token.

property invitation

invitation?: string;

• The Id of an invitation to accept. This is available from the user invitation URL that is given when participating in a user invitation flow.

property login_hint

login_hint?: string;

• The user's email address or other identifier. When your app knows which user is trying to authenticate, you can provide this parameter to pre-fill the email box or select the right session for sign-in.

  This currently only affects the classic Lock experience.

property max_age

max_age?: string | number;

• Maximum allowable elapsed time (in seconds) since authentication. If the last time the user authenticated is greater than this value, the user must be reauthenticated.

property organization

organization?: string;

• The organization to log in to.

  This will specify an organization parameter in your user's login request.

  - If you provide an Organization ID (a string with the prefix org_), it will be validated against the org_id claim of your user's ID Token. The validation is case-sensitive. - If you provide an Organization Name (a string *without* the prefix org_), it will be validated against the org_name claim of your user's ID Token. The validation is case-insensitive. To use an Organization Name you must have "Allow Organization Names in Authentication API" switched on in your Auth0 settings dashboard. More information is available on the [Auth0 documentation portal](https://auth0.com/docs/manage-users/organizations/configure-organizations/use-org-name-authentication-api)

property prompt

prompt?: 'none' | 'login' | 'consent' | 'select_account';

• - 'none': do not prompt user for login or consent on reauthentication - 'login': prompt user for reauthentication - 'consent': prompt user for consent before processing request - 'select_account': prompt user to select an account

property redirect_uri

redirect_uri?: string;

• The default URL where Auth0 will redirect your browser to with the authentication result. It must be whitelisted in the "Allowed Callback URLs" field in your Auth0 Application's settings. If not provided here, it should be provided in the other methods that provide authentication.

property scope

scope?: string;