"Suspicious request requires verification" error returned from /oauth/token endpoint

Help
1

I am trying to log in using username-password and whilst doing so and entering correct credentials, I receive an error message “Suspicious request requires verification”. I’m struggling to figure out whether this is account specific, because it doesn’t say the account is blocked. What verification is required?

Simulator Screen Shot - iPhone 11 - 2020-04-06 at 08.58.58
Simulator Screen Shot - iPhone 11 - 2020-04-06 at 08.58.58823×295 38.9 KB

2

That’s interesting, can you tell us what stack you use? Thanks!

3

Hello Konrad,

Thanks for your prompt response.
We are developing for iOS 13.3, using Swift 5 and integrating with Auth0’s Authorisation Code Flow API (Authentication API Explorer).
This is an error that seems to affect only some of our accounts and devices while we are testing. Some of the accounts are used by multiple team members to test, so I wonder if that is triggering this “suspicious request”. We are trying to get one account per person in order to not trigger this suspicion with Auth0 systems.

4

Hmm that’s interesting? Do you see some other pattern when comparing the users that have it working vs the ones that have this error?

5

Hello Konrad,

I have the feeling that this error seems to be IP specific and not account specific. Can one IP address log into multiple accounts without triggering this error? Or does an IP address become “suspicious” if it is accessing multiple?

Thanks

6

I found out that it can be related to new anomaly detection feature that Auth0 team is working on. Can you send me your tenant name via private message? Thanks!

9

I managed to confirm that it’s not the new anomaly detection feature. We’re looking into it deeper!

10

Closing this one for now and moving it into private conversation. As soon as we establish the reason we will share it with the whole community here.

12

For everyone experiencing this issue.

Based on observed usage, we enabled an early access program for some of the users that provides a higher level of protection for logins. It has a side affect that it isn’t fully compatible with all our SDKs yet and we apologize for the problems that it caused.

If you come across such error please send a private message here in the forum to @konrad.sopala