Kakao Social Connection Failure due to Locked 'profile' Scope (KOE205 Error) - Standard Marketplace Integration

Get Help
, ,
1

R1. Current Situation & Context

We are currently integrating Kakao Login into our React + Vite web application using the standard @auth0/auth0-react SDK alongside the official Kakao Social Connection provided in the Auth0 Marketplace.

The Problem: Whenever a user attempts to log in via the Kakao Social Connection, Kakao returns a 400 Bad Request with Error Code KOE205 (Invalid Scope: profile).

Upon deep technical investigation, we identified a critical specification mismatch between Auth0’s legacy Kakao Marketplace module and Kakao’s updated OAuth2.0 API:

  1. Kakao has deprecated the unified profile scope string. They now strictly segment it into profile_nickname and profile_image.

  2. However, the official Auth0 Kakao Social Connection has the legacy profile scope permanently checked and locked (Permissions -> profile is hardcoded as required in the Auth0 Dashboard UI), making it completely un-selectable or un-modifiable by developers.

  3. As a result, Auth0 backend silently forces scope=profile in the authorization request to Kakao, which causes Kakao’s authorization server to immediately reject the request with KOE205. Even passing an empty scope (scope: '') or scope: 'openid' from the frontend SDK (loginWithRedirect) does not override the backend-enforced connection parameters.

2. What is Required to Resolve This

To resolve this issue while maintaining the standard/out-of-the-box integration architecture, we require either:

  • An option in the Auth0 Dashboard to unlock, modify, or completely remove the forced profile permission within the official Kakao Social Connection settings, allowing us to align with Kakao’s updated scope strings.

  • Or, an official hotfix to the Marketplace extension that updates the underlying integration to no longer append the deprecated profile string when requesting authorization codes from Kakao.

3. Request for Auth0’s Position & Patch Feasibility

We intend to strictly adhere to official standards and avoid non-standard, fragile workarounds (such as maintaining a volatile Custom Social Connection script that can break during Auth0 runtime updates).

Since Kakao Login is the primary identity provider for millions of users in South Korea, this profile scope lock represents a critical blocker for any organization attempting to leverage Auth0’s native marketplace for the Korean market.

  • What is Auth0’s official stance on this Kakao scope specification mismatch?

  • Is there an immediate internal workaround to disable the forced profile scope injection from the tenant backend?

  • Is there an official patch scheduled to fix the Kakao Marketplace connection template to support the separated profile scopes?

We look forward to your urgent technical guidance and insight on this matter.

3

Hi @JayMoon000

Welcome to the Auth0 Community!

As you have stated, Kakao deprecated the unified, legacy profile scope in favor of individual granular consent items (profile_nickname and profile_image), any new Kakao applications (including verified Biz Apps) that attempt to use Auth0’s native Marketplace Social Connection are immediately blocked by Kakao’s authorization server with a KOE205 (Invalid Scope: profile) error.

  • The Problem Root Cause: Auth0’s standard Kakao Social Connection integration is maintained externally and has indeed fallen out of sync with Kakao’s updated scope/consent specifications.

  • Because Kakao strictly enforces the minimum disclosure principle, they completely reject requests containing unauthorized scopes (like profile), leading to the KOE205 error .

  • Patch Feasibility: Updating the native Marketplace Connection template is a top priority for developers targeting the South Korean market. However, because this connection is managed in tandem with integration partners (OSC Korea Co., Ltd.), there is no immediate patch scheduled at this time .

  • Is there an internal backend toggle? No. There is no hidden tenant flag, API toggle, or metadata switch that can selectively unlock the legacy permission checkbox in the standard Kakao Social Connection UI.

While you noted an understandable hesitation toward “non-standard, fragile workarounds,” in the Auth0 ecosystem, a Custom Social Connection is the officially prescribed, fully supported architectural pattern to address provider specification mismatches. This has also been stated in an old Auth0 community post.

[SOLUTION]

Step 1: Create the Custom Social Connection

  1. In your Auth0 Dashboard, navigate to Authentication > Social Connections.

  2. Click Create Connection (or the + icon)

  3. Scroll to the very bottom and select Create Custom

  4. Set the parameters exactly as follows:

    • Connection Name: Kakao-Custom (or Kakao)

    • Authorization URL: https://kauth.kakao.com/oauth/authorize

    • Token URL: https://kauth.kakao.com/oauth/token

    • Scope: profile_nickname profile_image account_email (This strictly bypasses the deprecated profile scope)

    • Client ID: (Your Kakao REST API Key)

    • Client Secret: (Your Kakao Login Client Secret under the “Security” tab)

Step 2: Use the Standard User Profile Script

To map Kakao’s JSON payload cleanly into Auth0’s standardized user object format, use the following robust script in your Custom Connection setup:

function fetchUserProfile(accessToken, context, callback) {
  request.get(
    {
      url: "https://kapi.kakao.com/v2/user/me",
      headers: {
        Authorization: "Bearer " + accessToken,
      },
    },
    (err, resp, body) => {
      if (err) {
        return callback(err);
      }
      if (resp.statusCode !== 200) {
        return callback(new Error("Failed to fetch profile: " + body));
      }

      let bodyParsed;
      try {
        bodyParsed = JSON.parse(body);
      } catch (jsonError) {
        return callback(new Error("Invalid JSON response: " + body));
      }

      // Check if profile exists safely
      const kAccount = bodyParsed.kakao_account || {};
      const kProfile = kAccount.profile || {};

      const profile = {
        user_id: bodyParsed.id,
        name: kProfile.nickname || "",
        nickname: kProfile.nickname || "",
        picture: kProfile.thumbnail_image_url || kProfile.profile_image_url || "",
        email: kAccount.email || "",
        email_verified: kAccount.is_email_verified || false,
      };

      callback(null, profile);
    }
  );
}

Step 3: Register the Redirect URI

Since this is a Custom Connection, your Auth0 Redirect URI will need to match the new connection.

  1. In your Kakao Developers Console, go to Kakao Login > Redirect URI.

  2. Add your tenant’s standard redirect callback:
    https://dev-4p22e0213s43i3im.us.auth0.com/login/callback

Kind Regards,
Nik