Using Passwordless code, through API

[luca.rossi]

Hi,

we have been using Passwordless with Magic Link, using the /passwordless/start endpoint.

We would like to switch to the Code option (instead of Magic Link), but I see that the /passwordless/verify/ endpoint is disabled/deprecated. How should we use Passwordless with Code through API (so, not through the hosted page)?

Thank you
Luca

[luca.rossi]

Can someone reply on this?

[lukerollans]

@luca.rossi

We have a similar issue open here: "passwordless/verify" incorrect documentation?

Once it’s resolved it might help you as well

[n.bijl]

@James.Morrison any news on this?

we are trying to implement the passwordless flow, but even the playground doesn’t work (getting a 404 when sending the email token)…
Documentation also seems outdated, is that true?

Is there an example of how to implement passwordless? Or at least a list of API call that I can use?

I do get a 200 status when calling /passwordless/verify but… that’s all, i’m not getting a access or refresh token

Could you please reply? If we can’t get this working i’m afraid we have to look for a different identity provider…

[James.Morrison]

Hi @n.bijl, I sent you a direct message in regards to a HAR file request to further investigate the 404 you are experiencing. When you get a chance can you give that a look. The documentation is not currently known to be out of date. If you feel something is missing please let us know so we can add it accordingly.

As far as the Passwordless/verify status question as shared in the linked topic by Lukerollans, below is the quoted answer to that.

@James.Morrison

After checking with our support team, I have been able to confirm that the messaging found on the Authenticate User section leveraging the POST /passwordless/verify is still correct, which is below:

This feature is disabled by default for new tenants as of 8 June 2017. Please see Application Grant Types for more information.

This means that the /passwordless/verify feature is no longer an available option and has been disabled. However we are investigating other alternatives for a suitable replacement but we don’t have an ETA on that solution as of yet. I apologize for any confusion on this subject.

Linking Passwordless documentation as well for context: Passwordless Connections

[n.bijl]

Hi @James.Morrison,
i’m experiencing the 404 within the playground already, there the /passwordless/verify url is still used. So this is outdated…

If that URL is disabled, then how can we implement passwordless authentication? Please provide a playground where passwordless authentication is working or explain more about how to combine passwordless with the Application Grant Types.

Thanks!

[n.bijl]

Hi @James.Morrison
could you help us or assign my question to someone else?

If not I think we have no other option than to chose another service to handle authentication/authorization.

Thanks!

[n.bijl]

We finally found the solution. After some testing and finding this post:

How to authorize user with email/password from server code?

I am trying to use Auth0 to validate a user’s email and password, calling it from server code using simple HTTP calls. What I am doing is equivalent to curl --request POST \ --url 'https://me.auth0.com/oauth/token' \ --header 'content-type: application/json' \ --data '{"grant_type":"password", "username": "mark@me.com", "password": "not this", "audience": "https://demo.me.com/auth0", "client_id": "client string", "client_secret": "secret string", "connection": "Username-Password-Authenti…

Steps to implement:

1. Request POST https://domain.eu.auth0.com/passwordless/start
   with body:
   {
   “client_id”: “client_id”,
   “connection”: “email”,
   “email”: “email”,
   “send”: “code”,
   “authParams”: {
   “scope”: “openid profile offline_access”
   }
   }

Considering you have setup the passwordless connection you will receive an email.
Now make sure you setup ‘Default Directory’ under tenant settings, set this to “email” to use the email passwordless connection.
Also, enable the password grant type under your application settings → Advanced → Grant Types.
(read the warnings on this page!)

Now you can send the verification code to the following oauth endpoint:
POST https://domain.eu.auth0.com/oauth/token
with body:
{
“scope”:“openid offline_access”,
“response_token”:“token”
“sso”:“false”
“connection”:“email”
“username”:“email”
“password”: “verification code”
“client_id”:“client_id”
“grant_type”:“password”
}

Now we can continue implementing this in our app
Please add this to the documentation pages so the next guy can find it easily.

[James.Morrison]

I’m happy to hear you got it handled @n.bijl and thank you for detailing steps to resolve the challenge. I will look into documenting this into a FAQ for future easy of use. Thanks again for your patience!

[andres.aguiar]

Hi!

This solution is now obsolete. You can find instructions on how to implement this flow here https://auth0.com/docs/connections/passwordless/guides/embedded-login-native

Regards,

Andres

[konrad.sopala]

Thanks for the headsup @andres.aguiar!