Hi @steve227,
Welcome to the Auth0 Community!
I have replicated the issue and tested the code you’ve provided.
The api.validation.error() method will display a message above the email input field to warn you that the credentials have not been validated.
The api.access.deny() method will display the message on the password input field as if the password inputed is wrong.
The reason it’s only doing half of what is expected of it is that the moment you call either function, the code execution stops. Only the first one will be executed.
As for why it’s not showing any message on the Universal Login form, make sure no settings that would trigger the Classic Login Experience are turned on, such as Customize Login Page.
If you have any other questions feel free to ask.
Have a good one,
Vlad