# Passwordless link login redirects with the 'id\_token not present in TokenSet' message on NextJS

**URL:** <https://community.auth0.com/t/passwordless-link-login-redirects-with-the-id-token-not-present-in-tokenset-message-on-nextjs/99299>\
**Category:** Get Help\
**Tags:** emails, management-api\
**Created:** [January 30, 2023, 2:44pm UTC](https://community.auth0.com/t/passwordless-link-login-redirects-with-the-id-token-not-present-in-tokenset-message-on-nextjs/99299 "2023-01-30T14:44:03Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![ccismas](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/ccismas/32/44130_2.png) [@ccismas](https://community.auth0.com/u/ccismas)\
**Post date:** [January 30, 2023, 2:44pm UTC](https://community.auth0.com/t/passwordless-link-login-redirects-with-the-id-token-not-present-in-tokenset-message-on-nextjs/99299/1 "2023-01-30T14:44:04Z")

</div>

Hi! I’m trying to log in using the passwordless method with magic link, with the nextjs package (@auth0/nextjs-auth0), and everything is going well until I click on the link that I receive in my inbox. When I click on the link, it redirects me to [http://localhost:3000/en/api/auth/callback#access\_token=SOME\_TOKEN&scope=openid&expires\_in=7200&token\_type=Bearer](http://localhost:3000/en/api/auth/callback#access_token=SOME_TOKEN&scope=openid&expires_in=7200&token_type=Bearer). Inside pages/api/auth/[…auth0].js I have this:

```auto
import auth0 from '../../../../utils/auth0';
export default auth0.handleAuth();

```

and inside utils/auth0 I have this:

```auto
import { initAuth0 } from '@auth0/nextjs-auth0';
import { env } from '../next.config';

export default initAuth0({
  baseURL: env.AUTH0_BASE_URL,
});

```

And when I get redirected to localhost, I get this response: id\_token not present in TokenSet

Any ideas?

## Update:

After upgrading the package from 1.9.2 to 2.2.1 I’m getting a different error: `Callback handler failed. CAUSE: Missing state parameter in Authorization Response.`

---

<div class="post-metadata">

**Author:** ![rueben.tiow](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/rueben.tiow/32/11646_2.png) [@rueben.tiow](https://community.auth0.com/u/rueben.tiow)\
**Post date:** [January 31, 2023, 11:43pm UTC](https://community.auth0.com/t/passwordless-link-login-redirects-with-the-id-token-not-present-in-tokenset-message-on-nextjs/99299/3 "2023-01-31T23:43:58Z")

</div>

Hi @ccismas,

Welcome to the Auth0 Community!

I understand that you are encountering the Missing State Parameter error.

This error can happen when the login request (`/authorize`) is missing the `state` query parameter.

The request should look something like the following:

```auto
https://YOUR_DOMAIN/authorize?
    response_type=code&
    client_id=YOUR_CLIENT_ID&
    redirect_uri=https://YOUR_APP/callback&
    scope={scope}&
    audience={apiAudience}&
    state={state}

```

To help you troubleshoot further, could you please [capture the login events in a HAR file](https://auth0.com/docs/troubleshoot/troubleshooting-tools/generate-and-analyze-har-files) and send them to me via DM’s?

In the meantime, I recommed checking out this related FAQ on [Why do I get a `state mismatch` error if I try to log in from different tabs?](https://github.com/auth0/nextjs-auth0/blob/b9fe9084289755bb375f3ba8af664af0b14cf9cf/FAQ.md#1-why-do-i-get-a-state-mismatch-error-if-i-try-to-log-in-from-different-tabs).

I look forward to hearing from you.

Thanks,  
Rueben

---

<div class="post-metadata">

**Author:** ![ccismas](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/ccismas/32/44130_2.png) [@ccismas](https://community.auth0.com/u/ccismas)\
**Post date:** [February 2, 2023, 7:45am UTC](https://community.auth0.com/t/passwordless-link-login-redirects-with-the-id-token-not-present-in-tokenset-message-on-nextjs/99299/4 "2023-02-02T07:45:49Z")

</div>

Hi @rueben.tiow , thanks for replying.

I was using embedded login for passwordless, as in, I’ve had an input in my web page, and then I would send an axios request with the email to {tenantUrl}/passwordless/start, but the I checked the /api/auth/login route (handled by auth0/next-auth0), and it seems like the package handles this by setting some cookies before sending the request (nonce, state, i think there was one more?). I guess these cookies are verified on the api/auth/callback route when getting redirected from the magic link, which is why I’m getting this error.

Would it be viable to set these cookies myself before firing the request to passwordless/start, while still using the auth0/next-auth0 package? If so, could you point me to some documentation about these cookies?

In case this is not possible, would the auth0-js package help me more here?

---

<div class="post-metadata">

**Author:** ![davidheyman](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/davidheyman/32/44600_2.png) [@davidheyman](https://community.auth0.com/u/davidheyman)\
**Post date:** [February 13, 2023, 2:17pm UTC](https://community.auth0.com/t/passwordless-link-login-redirects-with-the-id-token-not-present-in-tokenset-message-on-nextjs/99299/5 "2023-02-13T14:17:31Z")

</div>

I had the same issue and fixed it in v2.2.1 by changing my […auth0] file to:

```auto
import { handleAuth, handleLogin } from '@auth0/nextjs-auth0';

export default handleAuth({
  async login(req, res) {
    try {
      await handleLogin(req, res, {
        authorizationParams: {
          connection_scope: 'openid profile',
        },
      });
    } catch (error: unknown) {
      console.error(error);
    }
  },
});

```

Hope this helps!

---

<div class="post-metadata">

**Author:** ![rueben.tiow](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/rueben.tiow/32/11646_2.png) [@rueben.tiow](https://community.auth0.com/u/rueben.tiow)\
**Post date:** [February 17, 2023, 5:40pm UTC](https://community.auth0.com/t/passwordless-link-login-redirects-with-the-id-token-not-present-in-tokenset-message-on-nextjs/99299/6 "2023-02-17T17:40:38Z")

</div>

Hi @davidheyman,

Thank you for your reply.

> [@ccismas](#):
>
> I would send an axios request with the email to {tenantUrl}/passwordless/start, but the I checked the /api/auth/login route (handled by auth0/next-auth0), and it seems like the package handles this by setting some cookies before sending the request (nonce, state, i think there was one more?). I guess these cookies are verified on the api/auth/callback route when getting redirected from the magic link, which is why I’m getting this error.

This is correct. The state error you mentioned would suggest that the transient state cookie is missing when your browser returns to the /callback URL.

When you go to /login, the express middleware will leave some cookies with the app state and a nonce (and possibly some others), it’ll then use those cookies to verify the token it gets back from the auth server. [Reference: [BadRequestError: checks.state argument is missing · Issue #145 · auth0/express-openid-connect · GitHub](https://github.com/auth0/express-openid-connect/issues/145#issuecomment-707024770)]

And unfortunately, and AFAIK, we do not have any examples around setting the cookies manually.

> [@ccismas](#):
>
> In case this is not possible, would the auth0-js package help me more here?

Could you please try [configuring an Auth0LockPasswordless instance](https://github.com/auth0/lock#auth0lockpasswordless) with the Auth0.js package?

This should handle the state for you.

Please let me know if this works for you.

Thanks,  
Rueben

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/auth0/original/3X/b/5/b560f266932fcce5d57f09a6595bd50518cae3f3.jpeg) [@system](https://community.auth0.com/u/system)\
**Post date:** [March 3, 2023, 5:41pm UTC](https://community.auth0.com/t/passwordless-link-login-redirects-with-the-id-token-not-present-in-tokenset-message-on-nextjs/99299/7 "2023-03-03T17:41:38Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.