# How to use an SPA with Passwordless login, Silent Auth and Lock together **URL:** \ **Category:** Get Help\ **Tags:** spa, grant-types, passwordless, silent-auth\ **Created:** [November 14, 2017, 9:37pm UTC](https://community.auth0.com/t/how-to-use-an-spa-with-passwordless-login-silent-auth-and-lock-together/8746 "2017-11-14T21:37:39Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![Mike\_Brown1](https://upload.wikimedia.org/wikipedia/commons/thumb/7/7c/User_font_awesome.svg/768px-User_font_awesome.svg.png) [@Mike\_Brown1](https://community.auth0.com/u/Mike_Brown1)\ **Post date:** [November 14, 2017, 9:37pm UTC](https://community.auth0.com/t/how-to-use-an-spa-with-passwordless-login-silent-auth-and-lock-together/8746/1 "2017-11-14T21:37:39Z")
We are trying to achieve what feels like a basic use-case; use an SPA with Passwordless login, very short lived JWTs that are refreshed using Silent Auth, and leverage the platform as much as possible (i.e. use Lock) We had this working nicely, but when we wanted to move from using the /delegate endpoint & refresh tokens to get new id tokens, its all got a bit complicated and confusing. Silent Auth appears to want OIDC compliance (and SSO (why?)) , which means our legacy grant types can’t be used, but we can’t simply switch to the oauth/tken endpoints from what I can see because we need Passwordless, and that means we have to use Hosted Login Pages! Please can someone point us to something that outlines the approach we need to take. It feels a very basic use-case so I can’t see why it so complicated to understand. ---
**Author:** ![jmangelo](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/jmangelo/32/7923_2.png) [@jmangelo](https://community.auth0.com/u/jmangelo)\ **Post date:** [December 28, 2017, 11:52pm UTC](https://community.auth0.com/t/how-to-use-an-spa-with-passwordless-login-silent-auth-and-lock-together/8746/2 "2017-12-28T23:52:20Z")
The recommended approach (without any use of legacy endpoints or grants) for a scenario where you need a SPA using passwordless authentication to obtain access token for an associated API and then be able to _refresh_ that token through the use of silent authentication could be accomplished by: - configuring the client application to use centralized login by redirecting the end-user to `/authorize` endpoint; use the `authorize` method of Auth0.js to accomplish this. - configure the hosted login page to use Lock Passwordless; you can do so by picking the existing passwordless template available when you enable hosted login page customization. - perform a silent authentication request to obtain _refreshed_ access tokens when the initial one expires; you can use the `checkSession` method of Auth0.js to accomplish this. ---
**Author:** ![system](https://global.discourse-cdn.com/auth0/original/3X/b/5/b560f266932fcce5d57f09a6595bd50518cae3f3.jpeg) [@system](https://community.auth0.com/u/system)\ **Post date:** [March 2, 2018, 5:57am UTC](https://community.auth0.com/t/how-to-use-an-spa-with-passwordless-login-silent-auth-and-lock-together/8746/3 "2018-03-02T05:57:24Z")