Unable to Configure True Passwordless (Email OTP + SMS OTP) Without Password-Based Login

Get Help
,
1

Hello Auth0 Support Team,

I am facing a configuration issue while attempting to enable true passwordless authentication in my Auth0 application and would appreciate clarification on whether this is a platform limitation or a misconfiguration.

Goal
Enable passwordless authentication using:

  • Email OTP

  • Phone (SMS) OTP
    with no username/password-based login exposed to users.

Observed Behavior

  1. When the Database connection is disabled:

    • Email OTP login works as expected.

    • Phone/SMS OTP login is disabled and does not appear as an option.

  2. When the Database connection is enabled:

    • Phone/SMS OTP login becomes available.

    • Email authentication defaults to email + password.

    • Email OTP-based login is no longer available in Universal Login.

Expectation

I expected to be able to:

  • Enable both Email OTP and SMS OTP simultaneously

  • Prevent any password-based login (email + password)

  • Achieve a fully passwordless experience using Universal Login

Questions

  1. Is a Database connection mandatory for SMS/Phone OTP by design?

  2. If yes, is it currently unsupported to use Email OTP + SMS OTP together without exposing password-based authentication?

  3. Is there an officially recommended approach to achieve true passwordless authentication across both email and phone?

  4. Does achieving this require Custom Universal Login, multiple applications, or is it not supported at the platform level?

I would appreciate confirmation on whether this behavior is expected and, if so, guidance on the best-practice architecture to implement true passwordless authentication.

Thank you for your support.

3

Hi @nitins9868,

Welcome back to the Auth0 Community!

Email and password connections, as well as Passwordless connections, are both treated as database connections. The Universal Login Experience, by default, will display only one at a time. It requires a specific configuration of your Authentication Profile and Application Parameters. The behavior you’re seeing—where enabling a database connection forces a password field—is expected because the New Universal Login currently prioritizes the email password connection for “Identifier First” flows unless specifically instructed otherwise.

To answer your questions:

1.No, a Database connection is not mandatory for a passwordless connection screen by design. You can disable your Database connection if you do not wish to use it.

3.The official recommended approach would be to tell Auth0 what connection to use for login. You can check the following community post:

If you have any further questions, please don’t hesitate to reach out.

Have a good one,
Vlad

1 Like