Since Sep 1 we have been getting issues with logging in to our app. No code change on our part. User-Password Authentication seems to occur successfully but subsequent stages of retrieving user details from the Management API are possibly failing/hanging. I’m struggling to pinpoint exactly where in our login sequence this is occurring but is it possible to view more detailed logs of request made to the Management API? Alternately have any updates occurred in the last few days that might impact our login process. I couldn’t see anything in release notes.
I understand that you are facing an issue where your application’s login flow has been failing since September 1, with User-Password Authentication succeeding but subsequent Management API calls to retrieve user details appearing to fail or hang, and you want to know whether detailed Management API request logs are available and whether any recent updates might be responsible.
The hanging/failing requests you have been seeing since September 1st could be tied to a recent incident on the Auth0 Status Page. Auth0 reported a Full Service Disruption titled “Elevated Error Rates on Multiple Cloud Environments” which has now been resolved, however it is possible for some isolated remnants to appear.
Here are the logging and troubleshooting options we can recommend:
Solution: Accessing and Reviewing Logs
Check the Auth0 Dashboard Logs. Navigate to Auth0 Admin Console → Logs. This shows authentication and authorization events, including Management API calls. Filter by date (starting September 1) and look for failed requests, errors, or unusual patterns. The logs display the HTTP status code, error message, and timestamp for each event.
Review the specific error codes. Look for any 401 (Unauthorized), 403 (Forbidden), 429 (Rate Limited), or 500-series errors on Management API calls. The error message in the dashboard log will often indicate whether the issue is authentication, authorization, rate limiting, or a service error.
Enable detailed request logging in your application. On your backend, log the full HTTP request and response for every Management API call—including the endpoint URL, headers (without secrets), request body, response status, and response body. This will help you identify exactly which endpoint is hanging or failing. Include timestamps so you can correlate with Auth0 dashboard logs.
Check for rate limiting. If your application suddenly increased the volume of Management API calls, you may be hitting rate limits. Auth0 enforces rate limits on the Management API; if you exceed them, requests return a 429 status. Review your call volume around September 1.
Verify your Management API credentials. Confirm that your Machine-to-Machine (M2M) application still has the correct scopes and that the client credentials (client ID and secret) are valid. A recent credential rotation or scope change could cause subsequent API calls to fail with 401 or 403 errors.
Official Workaround: Isolate the Failing Step
To pinpoint exactly where the login sequence breaks:
Add logging after each step. Log immediately after User-Password Authentication succeeds, then log before and after each Management API call (e.g., get user, read metadata, etc.). Include the response status and error message.
Test a single Management API call in isolation. Use a tool like Postman or curl to manually call the Management API endpoint you suspect is failing, using the same credentials and token your application uses. This will tell you whether the issue is in your application’s code or in Auth0.
Check for timeout settings. If the call is hanging (not returning an error), it may be timing out. Verify that your HTTP client has a reasonable timeout configured (typically 10–30 seconds) and that you are not waiting indefinitely for a response.
Hope these steps have helped pin-point the source of the issue, but let us know if you require any further assistance.
I can see a number of Failed Exchange logs related to an application we use, with 401 http status code Unauthorized. This began occurring after the start of September with no changes on our side. We have a number of requests being made at that time, some of which succeed and some of which fail. Before the start of September they were all succeeding. Could this be rate limiting in some way or a change in our allowance? Any ideas how I can drill down into this more would be great, thanks