# Blocked by CORS policy : mfa/authenticators

**URL:** <https://community.auth0.com/t/blocked-by-cors-policy-mfa-authenticators/195585>\
**Category:** Get Help\
**Tags:** mfa-api, mfa\
**Created:** [December 17, 2025, 10:54am UTC](https://community.auth0.com/t/blocked-by-cors-policy-mfa-authenticators/195585 "2025-12-17T10:54:05Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![khushbu](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/khushbu/32/76815_2.png) [@khushbu](https://community.auth0.com/u/khushbu)\
**Post date:** [December 17, 2025, 10:54am UTC](https://community.auth0.com/t/blocked-by-cors-policy-mfa-authenticators/195585/1 "2025-12-17T10:54:05Z")

</div>

Hi team,

We are calling the list all authenticators api and facing the following error:

> Access to fetch at ‘[https://highbeam-staging.us.auth0.com/mfa/authenticators](https://highbeam-staging.us.auth0.com/mfa/authenticators)’ from origin ‘[http://localhost:3000](http://localhost:3000/)’ has been blocked by CORS policy: No ‘Access-Control-Allow-Origin’ header is present on the requested resource.

 ![Screenshot 2025-12-17 at 4.21.31 PM](https://global.discourse-cdn.com/auth0/original/3X/0/8/08ebaead41d42a82e0914fef28dddce83942d7af.jpeg)

```auto
listAuthenticators: {
  queryKey: ["listAuthenticators"],
  queryFn: async () => {
    const mfaToken = await getMfaToken();
    return auth0Api
      .get<AuthenticatorRep[]>("mfa/authenticators", {
        headers: {
          Authorization: `Bearer ${mfaToken}`,
        },
      })
      .json();
  },
},

```

The code has correct mfa token as well.

The same was working earlier from the frontend. We are wondering if anything changed in last one month at auth0’s end?

How can we get it to work again from FE?

---

<div class="post-metadata">

**Author:** ![khushbu](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/khushbu/32/76815_2.png) [@khushbu](https://community.auth0.com/u/khushbu)\
**Post date:** [December 19, 2025, 4:46pm UTC](https://community.auth0.com/t/blocked-by-cors-policy-mfa-authenticators/195585/3 "2025-12-19T16:46:55Z")

</div>

We took the above mentioned api to BE and it worked. But now we are getting stuck in the mfa/associate api.

```auto
curl --location 'https://client-domain/mfa/associate' \
--header 'content-type: application/json' \
--header 'authorization: Bearer ---------' \
--data '{ "authenticator_types": ["otp"] }'

```

We end up getting the ‘Invalid audience error‘. The token sent in this api is the mfa token generated after doing a mfa authentication with an existing method for the user.

```auto
{
  "https://highbeam.co/user": {
    "firstName": "Khushbu",
    "guid": "xyz",
    "lastName": "Goyal"
  },
  "iss": "https://custom-domain/",
  "sub": "auth0|689d6b2e53877189833abb57",
  "aud": [
    "https://client-domain/mfa/",
    "https://client-domain/userinfo"
  ],
  "iat": 1766154335,
  "exp": 1766154935,
  "scope": "openid profile email enroll read:authenticators remove:authenticators",
  "azp": "evZM4OfzLsyDcdg1rJPrsFMogCAP0NLl"
}

```

This is what the auth token looks like.

Can you please help with what we might be doing wrong ? Or how associate api can be called using Universal flow and without ROPG?

---

<div class="post-metadata">

**Author:** ![khushbu](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/khushbu/32/76815_2.png) [@khushbu](https://community.auth0.com/u/khushbu)\
**Post date:** [December 19, 2025, 6:08pm UTC](https://community.auth0.com/t/blocked-by-cors-policy-mfa-authenticators/195585/4 "2025-12-19T18:08:24Z")

</div>

@gerald.czifra sorry for the direct ping, but will be able to help on this ?

---

<div class="post-metadata">

**Author:** ![remus.ivan](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/remus.ivan/32/68771_2.png) [@remus.ivan](https://community.auth0.com/u/remus.ivan)\
**Post date:** [December 19, 2025, 11:06pm UTC](https://community.auth0.com/t/blocked-by-cors-policy-mfa-authenticators/195585/5 "2025-12-19T23:06:39Z")

</div>

Hi @khushbu,

Welcome back to the Auth0 Community

Unfortunately calling the `mfa/authenticators` endpoint from a front-end application is not feasible at the moment, since there is a backlog item that our engineers are still working on, so indeed calling it from a back-end is the solution at the moment.

When it comes to your call to the `/mfa/associate` please make sure that the audience passed in the request is associated with your canonical domain and not your custom domain, so the correct audience would be: `YOUR_TENANT.REGION.auth0.com/mfa/`

> [@khushbu](#):
>
> Or how associate api can be called using Universal flow and without ROPG?

You can also get around using an MFA Token by passing an Access token with enrollment scope to the “mfa/associate” endpoint, as suggested in this community topic as well - [Mfa association mfa-api with access token vs mfa token approach](https://community.auth0.com/t/mfa-association-mfa-api-with-access-token-vs-mfa-token-approach/137417).

Thank you, and if you have further questions please let me know!  
Best regards,  
Remus

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/auth0/original/3X/b/5/b560f266932fcce5d57f09a6595bd50518cae3f3.jpeg) [@system](https://community.auth0.com/u/system)\
**Post date:** [January 2, 2026, 11:07pm UTC](https://community.auth0.com/t/blocked-by-cors-policy-mfa-authenticators/195585/6 "2026-01-02T23:07:32Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.