# Auth0 forcing response\_type=code instead of token/id\_token (Google Apps Script SPA)

**URL:** <https://community.auth0.com/t/auth0-forcing-response-type-code-instead-of-token-id-token-google-apps-script-spa/194138>\
**Category:** Dev to Dev Hub\
**Tags:** login-experience, new-universal-login-experience\
**Created:** [November 6, 2025, 1:14pm UTC](https://community.auth0.com/t/auth0-forcing-response-type-code-instead-of-token-id-token-google-apps-script-spa/194138 "2025-11-06T13:14:35Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![futurehomeinspection](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/futurehomeinspection/32/76322_2.png) [@futurehomeinspection](https://community.auth0.com/u/futurehomeinspection)\
**Post date:** [November 6, 2025, 1:14pm UTC](https://community.auth0.com/t/auth0-forcing-response-type-code-instead-of-token-id-token-google-apps-script-spa/194138/1 "2025-11-06T13:14:35Z")

</div>

I’m integrating Auth0 with a Google Apps Script web app (front-end only, no backend).

Even though my script calls /authorize with:  
response\_type=token id\_token  
response\_mode=fragment

Auth0 keeps forcing:  
response\_type=code  
response\_mode=form\_post  
which causes “Callback URL mismatch.”

My deployed URL:

> **[Redirecting to Reports…](https://script.google.com/macros/s/AKfycbxEzloMnfYSiFzpv8L9SWg6hUXr4vX48695PvcRpakmRc_ah86XQREMGQXTGqeKWr1f/exec?view=callback)**

I suspect this happens because my Auth0 app is currently set as a “Regular Web Application,” but Google Apps Script is actually a Single Page Application (SPA).

Can someone confirm if changing the app type to “Single Page Application” (SPA) or enabling implicit flow is the correct fix?

Thank you!

---

<div class="post-metadata">

**Author:** ![nik.baleca](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/nik.baleca/32/68749_2.png) [@nik.baleca](https://community.auth0.com/u/nik.baleca)\
**Post date:** [December 2, 2025, 6:55pm UTC](https://community.auth0.com/t/auth0-forcing-response-type-code-instead-of-token-id-token-google-apps-script-spa/194138/2 "2025-12-02T18:55:31Z")

</div>

Hi @futurehomeinspection

I am sorry about the delayed reply to your post!

Most likely, the issue can be caused by the application type mismatch in the Auth0 Dashboard which might force specific authorization flows. Do you still experience difficulties on the matter or have you found the root cause?

Kind Regards,  
Nik