Sms passwordless authentication using auth0.js

[james.merrigan]

Hi @joupe

Welcome to the Community!

Based on the error it is likely that you have configured a “Regular Web Application” in Auth0, and are making the request without including the client_secret in the body. You can find out more information on this via the following link:

Passwordless connection not working for tenants created after Jan 2, 2020

We recently introduced a change that requires is to send client_secret when starting the flow in confidential clients (eg: regular webapps as opposed to single page apps). This lets Auth0 authenticate that the API call was made from the right app. For new tenants, the toggle to disable this behavior is not available. If you invoke /passwordless/start from a backend (regular web app), start sending the client secret in the body. If you invoke it from a frontend (single page app), change the Au…

However as you are using Auth0.js, which is a client-side library intended for SPA applications, you’re unable to use a “Regular Web Application” type with this SDK as a client secret value is required. While you can send one, we recommend against doing this as it’s difficult to store the client secret in the browser securely.

Given that, I would recommend following the second point of the post linked above to ensure your application type is set correctly.

Let me know how you get on!