Hi all, hoping someone can help me figure out why the Auth0 “Authorize App” consent screen keeps appearing on every login in my Android React Native app. As far as I can tell the configuration is correct, so I’m stuck.
Setup
- App: React Native (Expo) using react-native-auth0 v3.x, Android and iOS
- Application: Native type, explicitly showing as “First-party” in the dashboard
- API: “Allow Skipping User Consent” is ON
The problem
Every time the user signs out and signs back in via Google, the “Authorize App” consent screen appears - even after they’ve already accepted it on a previous login. The grant should already exist.
What I’ve already ruled out
The authorize URL contains no prompt parameter.
We are not calling clearSession() on logout - we intentionally leave the Auth0 SSO session intact and only clear local tokens. The consent screen appeared both with and without clearSession being called.
Auth0 logs
Each login cycle shows Success Login (google-oauth2) → Success Exchange (Authorization Code for Access Token). Notably, there are no consent-specific log events - no “Consent Required” or “Consent Granted” entries - which seems odd if the consent screen is genuinely being triggered.
There are also repeated Warning During Login entries: “A user has attempted to access a login page directly. This is not supported unless an Application Login URI is set…” but these come from IP 6—4 (Google-owned) with no associated user, so I suspect they’re crawler traffic rather than my users.
What am I missing?
The application is First-party + Native and the API has “Allow Skipping User Consent” ON - from everything I’ve read that should be sufficient to suppress the consent screen entirely. Is there a tenant-level setting, a grant expiry behaviour, or something specific to using connection=google-oauth2 that could be overriding this?
Any help appreciated!
Hi @timcallagy
Welcome to the Auth0 Community!
I understand that you are having issues skipping the consent screen on a First Party app despite having the " Allow Skipping User Consent " option turned on.
Since Allow Skipping User Consent is turned on and therefore prompt=consent is not included in the /authorize call, the screen that your users are seeing is likely not the actual consent screen, rather a confirmation prompt that is prompted on each authentication transaction when a non-verifiable callback URI is in use. This is a Measure Against Application Impersonation that prevents malicious apps from impersonating legitimate ones and receiving the authorization response (including tokens) without user awareness.
We strongly recommend you do not disable this protection for production. Malicious applications on the device could request id_tokens and access_tokens without any interaction from the user or other indications that something has happened.
If however you wish to disable the confirmation prompt, it can either be configured as a global tenant setting or at the application-level (application-level settings take precedence over the global tenant-level setting). The steps are mentioned in the documentation previously attached, but allow me to share the details here as well for ease of access:
Application-level
- Navigate to Auth0 Dashboard > Applications > Application Settings > Advanced > OAuth.
- Scroll to the Non-Verifiable Callback URI End-User Confirmation setting.
- Enable the toggle to activate the prompt or disable the toggle to deactivate the prompt.
Global
- Navigate to Auth0 Dashboard > Settings > Advanced.
- Find the Non-Verifiable Callback URI End-User Confirmation setting.
- Enable the toggle to activate the prompt.
Hope this helped resolve the issue on your end, please reach out to us for any other issues or requests and we will gladly look into it for you!
Have a great one,
Gerald
