React SPA and "access_denied: Password login via OIDC-conformant clients with externally-hosted..."

[dan.woda]

Hi @jeffeld!

Welcome to the Auth0 Community!

Take a look at this response to a similar problem.

Let me know if this helps,
Dan

@jerdog

The error you mentioned typically occurs when the state parameter is missing and you are using an OIDC-conformant client. Usually this problem occurs when users bookmark the /login URL that /authorize redirects to and attempt to log in directly.

The endpoint that the client application should redirect to is /authorize which is the entry point for redirect-based flows (https://auth0.com/docs/api/authentication#authorize-client ).