Why can't SPAs use Embedded Passwordless Login?

[osdiab]

Hello,

I’m working on a SPA and we wanted to use embedded passwordless login, but I ran into this closed thread:

Passwordless Authentication grant type not allowed for client

What we’re trying to achieve We’re trying to make a single page application with a custom passwordless sign-up/login form. The application would be built in react. The problem We’re trying to use the Authentication API found here: https://auth0.com/docs/api/authentication. It works fine to initiate a passwordless flow using the POST /passwordless/start endpoint. However, when we try to authenticate the user, it always fails with the following error: Grant type ‘http://auth0.com/oauth/grant-…

We’re going to try to reimplement our Auth0 implementation to use a regular flow, but is there a specific reason why this restriction exists? Kinda frustrating we need to redo our auth structure (again), so it would be nice to have a reason for the restriction.

[dan.woda]

Hi @osdiab,

I edited your title for clarity

I think it is actually possible to work around this. This thread shows to how get it working:

Grant type 'http://auth0.com/oauth/grant-type/passwordless/otp' not allowed for the client

Yes that works! Choosing the regular web app type made it visible. Thanks @nicolas_sabena for your help!

If you are curious on why we recommend universal login vs embedded, this doc talks about it:

Centralized Universal Login vs. Embedded Login

If you want to give some feedback to our product team about your needs, we would love to hear more about your use-case.

Auth0: Secure access for everyone. But not just anyone.

Thanks! Let me know if you have questions.
Dan