# Blocked by CORS policy : mfa/authenticators

**URL:** <https://community.auth0.com/t/blocked-by-cors-policy-mfa-authenticators/195585>\
**Category:** Get Help\
**Tags:** mfa-api, mfa\
**Created:** [December 17, 2025, 10:54am UTC](https://community.auth0.com/t/blocked-by-cors-policy-mfa-authenticators/195585 "2025-12-17T10:54:05Z")\
**Posts on this page:** 1\
**Showing post:** 5

<div class="post-metadata">

**Author:** ![remus.ivan](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/remus.ivan/32/68771_2.png) [@remus.ivan](https://community.auth0.com/u/remus.ivan)\
**Post date:** [December 19, 2025, 11:06pm UTC](https://community.auth0.com/t/blocked-by-cors-policy-mfa-authenticators/195585/5 "2025-12-19T23:06:39Z")

</div>

Hi @khushbu,

Welcome back to the Auth0 Community

Unfortunately calling the `mfa/authenticators` endpoint from a front-end application is not feasible at the moment, since there is a backlog item that our engineers are still working on, so indeed calling it from a back-end is the solution at the moment.

When it comes to your call to the `/mfa/associate` please make sure that the audience passed in the request is associated with your canonical domain and not your custom domain, so the correct audience would be: `YOUR_TENANT.REGION.auth0.com/mfa/`

> [@khushbu](#):
>
> Or how associate api can be called using Universal flow and without ROPG?

You can also get around using an MFA Token by passing an Access token with enrollment scope to the “mfa/associate” endpoint, as suggested in this community topic as well - [Mfa association mfa-api with access token vs mfa token approach](https://community.auth0.com/t/mfa-association-mfa-api-with-access-token-vs-mfa-token-approach/137417).

Thank you, and if you have further questions please let me know!  
Best regards,  
Remus

---

_[View the full topic](https://community.auth0.com/t/blocked-by-cors-policy-mfa-authenticators/195585)._