Creating an SPA via management Node sdk has different options than Auth0 UI - cannot login

Get Help
,
1

Ready to post? :magnifying_glass_tilted_left: First, try searching for your answer.
When I create an spa application from the node management client I cannot login to my app using the client_id - Unauthorized. I noticed that this application has an APIs section, while when I create an SPA application with the normal Auth0 UI, there is no APIs option. I assume this is the issue. If so, I am not sure what scopes/permissions to give to my client SPA app from my main management API, or if there is an additional option I can set when creating my client app from the Node sdk.

Creation Options from the Node SDK

  const { data: application } = await management.clients.create({
    name: `${name}-app`,
    app_type: "spa",
    allowed_logout_urls: ["http://localhost:3000/logout"],
    callbacks: ["http://localhost:3000/callback"],
    allowed_origins: ["http://localhost:3000"],
    web_origins: ["http://localhost:3000"],
    allowed_origins: ["http://localhost:3000"],
    oidc_conformant: true,
    organization_usage: "require",
    organization_require_behavior: "post_login_prompt",
    jwt_configuration: {
      lifetime_in_seconds: 60 * 60 * 24,
    },
  });

Result from CLI Node App -

image
image1514Ă—160 10.7 KB

Result from UI-Created App -

image
image1222Ă—188 8.94 KB

3

Hi @getbounds,

I understand you’ve encountered an “Unauthorized” error during login when using your app’s client_id.

The behavior you observed where a SPA app does not have an APIs section is totally normal. This is because SPAs are public clients and cannot securely store secrets. See Get Management API Access Tokens for Single-Page Applications - Limitations for a thorough explanation.

In this case, access tokens are issued in the context of the user who is currently signed in to Auth0, which limits updates to only the logged-in user’s data.

Meaning that, if you need to perform non-user related requests using the Management API, we recommend getting the access token from the backend rather than the frontend in a SPA.

If you are still having issues, could you share the Management API endpoint request you are making?

Thanks,
Rueben