# \#oauth2 **URL:** https://community.auth0.com/tag/oauth2/891.md [Latest](https://community.auth0.com/latest.md) · [Categories](https://community.auth0.com/categories.md) · [Tags](https://community.auth0.com/tags.md) --- ## [Introducing IdentiFlows.dev: A Visual Reference for Identity Flows](https://community.auth0.com/t/introducing-identiflows-dev-a-visual-reference-for-identity-flows/203773)
**Author:** [@andrea.chiarelli](https://community.auth0.com/u/andrea.chiarelli)\ **Replies:** 1\ **Last updated:** [September 29, 2026, 3:01pm UTC](https://community.auth0.com/t/introducing-identiflows-dev-a-visual-reference-for-identity-flows/203773 "2026-09-29T15:01:29Z")
If you are a visual learner or you would like to have authorization and authentication flow diagrams at hand, the identiflow.dev website is for you. Read this blog post to learn more. --- ## [Kakao Social Connection Failure due to Locked 'profile' Scope (KOE205 Error) - Standard Marketplace Integration](https://community.auth0.com/t/kakao-social-connection-failure-due-to-locked-profile-scope-koe205-error-standard-marketplace-integration/201849)
**Author:** [@JayMoon000](https://community.auth0.com/u/JayMoon000)\ **Replies:** 1\ **Last updated:** [July 20, 2026, 10:26pm UTC](https://community.auth0.com/t/kakao-social-connection-failure-due-to-locked-profile-scope-koe205-error-standard-marketplace-integration/201849 "2026-07-20T22:26:30Z")
R1. Current Situation & Context We are currently integrating Kakao Login into our React + Vite web application using the standard @auth0/auth0-react SDK alongside the official Kakao Social Connection provided in the Aut… --- ## [The Many Faces of OAuth 2.0 Token Exchange](https://community.auth0.com/t/the-many-faces-of-oauth-2-0-token-exchange/200512)
**Author:** [@andrea.chiarelli](https://community.auth0.com/u/andrea.chiarelli)\ **Replies:** 1\ **Last updated:** [June 3, 2026, 4:22pm UTC](https://community.auth0.com/t/the-many-faces-of-oauth-2-0-token-exchange/200512 "2026-06-03T16:22:48Z")
Token exchange is a pattern that has multiple use cases. Learn what they are and what is the best approach in your own scenario by reading The Many Faces of OAuth 2.0 Token Exchange --- ## [Demystifying OAuth Security: State vs. Nonce vs. PKCE](https://community.auth0.com/t/demystifying-oauth-security-state-vs-nonce-vs-pkce/195011)
**Author:** [@andrea.chiarelli](https://community.auth0.com/u/andrea.chiarelli)\ **Replies:** 1\ **Last updated:** [November 28, 2025, 9:26am UTC](https://community.auth0.com/t/demystifying-oauth-security-state-vs-nonce-vs-pkce/195011 "2025-11-28T09:26:58Z")
Have you ever wondered what the state, nonce, code\_challenge, and code\_verifier parameters are for in OAuth requests? This blog post will provide the answers you are looking for. --- ## [RFC 8707 implementation: audience vs resource](https://community.auth0.com/t/rfc-8707-implementation-audience-vs-resource/188990)
**Author:** [@davidshen84](https://community.auth0.com/u/davidshen84)\ **Replies:** 7\ **Last updated:** [November 21, 2025, 3:56pm UTC](https://community.auth0.com/t/rfc-8707-implementation-audience-vs-resource/188990 "2025-11-21T15:56:52Z")
Hi, I was testing my auth0 configuration with MCP Inspector and ran into a discussion on github. The keyword audience was only used to the description of the concept. It is not a registered parameter. The registered pa… --- ## [Protect Your Access Tokens with DPoP (Demonstrating Proof of Possession)](https://community.auth0.com/t/protect-your-access-tokens-with-dpop-demonstrating-proof-of-possession/191057)
**Author:** [@andrea.chiarelli](https://community.auth0.com/u/andrea.chiarelli)\ **Replies:** 1\ **Last updated:** [August 25, 2025, 7:35am UTC](https://community.auth0.com/t/protect-your-access-tokens-with-dpop-demonstrating-proof-of-possession/191057 "2025-08-25T07:35:55Z")
Did you know you can bind an access token to the client application, improving its security? DPoP allows you to do this. Read more here. --- ## [Anatomy of an OAuth 2.0 Authorization Request](https://community.auth0.com/t/anatomy-of-an-oauth-2-0-authorization-request/189540)
**Author:** [@andrea.chiarelli](https://community.auth0.com/u/andrea.chiarelli)\ **Replies:** 3\ **Last updated:** [August 18, 2025, 2:11pm UTC](https://community.auth0.com/t/anatomy-of-an-oauth-2-0-authorization-request/189540 "2025-08-18T14:11:13Z")
Have you ever wondered what all those parameters that make up an OAuth 2.0 or OpenID Connect authorization request mean? This article explains all the details of the core parameters and some of the most common ones you … --- ## [OAuth 2.0 Access Tokens and the Principle of Least Privilege](https://community.auth0.com/t/oauth-2-0-access-tokens-and-the-principle-of-least-privilege/189310)
**Author:** [@andrea.chiarelli](https://community.auth0.com/u/andrea.chiarelli)\ **Replies:** 1\ **Last updated:** [July 17, 2025, 10:43am UTC](https://community.auth0.com/t/oauth-2-0-access-tokens-and-the-principle-of-least-privilege/189310 "2025-07-17T10:43:23Z")
How can you apply the Principle of Least Privilege when using OAuth 2.0 access tokens to protect your applications? Learn more through this blog post. --- ## [Model Context Protocol (MCP) Spec Updates from June 2025: One Small Step for a Spec, One Giant Leap for Security](https://community.auth0.com/t/model-context-protocol-mcp-spec-updates-from-june-2025-one-small-step-for-a-spec-one-giant-leap-for-security/188468)
**Author:** [@jesstemporal](https://community.auth0.com/u/jesstemporal)\ **Replies:** 0\ **Last updated:** [June 26, 2025, 1:54pm UTC](https://community.auth0.com/t/model-context-protocol-mcp-spec-updates-from-june-2025-one-small-step-for-a-spec-one-giant-leap-for-security/188468 "2025-06-26T13:54:32Z")
Learn about the new classification of MCP servers as OAuth Resource Servers, implementing Resource Indicators to prevent token misuse, and the clearer security best practices designed to help you build more robust and se… --- ## [OAuth 2.0 and OpenID Connect: The Professional Guide](https://community.auth0.com/t/oauth-2-0-and-openid-connect-the-professional-guide/185468)
**Author:** [@robertino.calcaterra](https://community.auth0.com/u/robertino.calcaterra)\ **Replies:** 1\ **Last updated:** [April 14, 2025, 7:55pm UTC](https://community.auth0.com/t/oauth-2-0-and-openid-connect-the-professional-guide/185468 "2025-04-14T19:55:35Z")
The final release of Vittorio Bertocci’s book about OAuth 2.0 and OpenID Connect is finally out! Learn more about the project journey and download your free copy. Read more… :writing\_hand:t2: Brought to you by @andrea.… --- ## [Urgent: Figma social connection is broken](https://community.auth0.com/t/urgent-figma-social-connection-is-broken/181943)
**Author:** [@developer12](https://community.auth0.com/u/developer12)\ **Replies:** 11\ **Last updated:** [February 20, 2025, 10:44pm UTC](https://community.auth0.com/t/urgent-figma-social-connection-is-broken/181943 "2025-02-20T22:44:12Z")
Figma is making changes to their API. https://www.figma.com/developers/api#oauth\_migration\_guide There is currently a brownout period to test if your API will break starting on the 24th of February 2025. Considerin… --- ## [We would like to does Auth0 support any FAPI speicifcations like PAR/ RAR](https://community.auth0.com/t/we-would-like-to-does-auth0-support-any-fapi-speicifcations-like-par-rar/92255)
**Author:** [@ganeshtec](https://community.auth0.com/u/ganeshtec)\ **Replies:** 2\ **Last updated:** [May 19, 2023, 8:11am UTC](https://community.auth0.com/t/we-would-like-to-does-auth0-support-any-fapi-speicifcations-like-par-rar/92255 "2023-05-19T08:11:19Z")
For open banking use case we would like to know does auth0 supports FAPI specifications like PAR/ RAR. --- ## [OAuth 2.0 at+jwt access token](https://community.auth0.com/t/oauth-2-0-at-jwt-access-token/97402)
**Author:** [@charlesb](https://community.auth0.com/u/charlesb)\ **Replies:** 1\ **Last updated:** [January 4, 2023, 11:42pm UTC](https://community.auth0.com/t/oauth-2-0-at-jwt-access-token/97402 "2023-01-04T23:42:50Z")
Hi there. I would like to know how I can to make auth0 generate access tokens with type header “at+jwt” instead of “jwt”. Thank you & BR --- ## [Getting Management API Access Tokens for SPAs](https://community.auth0.com/t/getting-management-api-access-tokens-for-spas/94734)
**Author:** [@liam-ssg](https://community.auth0.com/u/liam-ssg)\ **Replies:** 2\ **Last updated:** [November 21, 2022, 9:41am UTC](https://community.auth0.com/t/getting-management-api-access-tokens-for-spas/94734 "2022-11-21T09:41:58Z")
Here’s what I’m trying to do: Authenticate with Google to sign-in (done). I can get the user profile using auth0-spa-js, and that works. Get the Access Token that was issued by Google in my SPA. I think I’ll need the m… --- ## [Problems re-enabling Google social sign-in: redirect\_uri mismatch](https://community.auth0.com/t/problems-re-enabling-google-social-sign-in-redirect-uri-mismatch/34510)
**Author:** [@thedanielmay](https://community.auth0.com/u/thedanielmay)\ **Replies:** 3\ **Last updated:** [November 11, 2022, 9:04pm UTC](https://community.auth0.com/t/problems-re-enabling-google-social-sign-in-redirect-uri-mismatch/34510 "2022-11-11T21:04:58Z")
Hi, I had Google social sign-in working fine until I tried passwordless SMS, disabled Google social sign-in, and cannot re-enable it successfully. Current behavior: On clicking to login, I get this screen: Goin… --- ## [Auth0 User ID vs. Sub Claim](https://community.auth0.com/t/auth0-user-id-vs-sub-claim/93311)
**Author:** [@filipem](https://community.auth0.com/u/filipem)\ **Replies:** 1\ **Last updated:** [December 21, 2022, 10:57pm UTC](https://community.auth0.com/t/auth0-user-id-vs-sub-claim/93311 "2022-12-21T22:57:33Z")
Hey folks. We have an internal discussion I’m hopeful you can help resolve. In the past I have used the value contained in the sub claim of the access token as the unique identifier of a user. We use Google oauth, so th… --- ## [Custom OAuth2 Application W/Custom Social Connection](https://community.auth0.com/t/custom-oauth2-application-w-custom-social-connection/86858)
**Author:** [@jorgemendoza](https://community.auth0.com/u/jorgemendoza)\ **Replies:** 1\ **Last updated:** [September 27, 2022, 11:43pm UTC](https://community.auth0.com/t/custom-oauth2-application-w-custom-social-connection/86858 "2022-09-27T23:43:24Z")
My company is in need of developing it’s own custom social connection and with that we are also implementing the necessary OAuth2 endpoints. My question is what exactly are the Authorization URL and Token URL endpoints … --- ## [Connecting to non-default Database in a password grant flow](https://community.auth0.com/t/connecting-to-non-default-database-in-a-password-grant-flow/86960)
**Author:** [@guybrush](https://community.auth0.com/u/guybrush)\ **Replies:** 1\ **Last updated:** [July 14, 2022, 9:33am UTC](https://community.auth0.com/t/connecting-to-non-default-database-in-a-password-grant-flow/86960 "2022-07-14T09:33:34Z")
I’m using a password grant OAuth flow, but can’t connect to a non-default Database/Connection. I’ve got two applications configured on a tenant, each with their own database. Both are using a password grant flow. … --- ## [Surface custom scopes on consent screen for first-party applications](https://community.auth0.com/t/surface-custom-scopes-on-consent-screen-for-first-party-applications/86291)
**Author:** [@ian-ridian](https://community.auth0.com/u/ian-ridian)\ **Replies:** 1\ **Last updated:** [July 4, 2022, 9:23pm UTC](https://community.auth0.com/t/surface-custom-scopes-on-consent-screen-for-first-party-applications/86291 "2022-07-04T21:23:37Z")
Is this possible? I set up an application (as regular web app), an API (added two custom scopes and kept consent enabled), and a test user (assigned to my application with custom scopes/permissions assigned). So far, on… --- ## [Custom Domain + Google OAuth Login + Development Environment not working](https://community.auth0.com/t/custom-domain-google-oauth-login-development-environment-not-working/80849)
**Author:** [@tom19](https://community.auth0.com/u/tom19)\ **Replies:** 2\ **Last updated:** [April 28, 2022, 11:24am UTC](https://community.auth0.com/t/custom-domain-google-oauth-login-development-environment-not-working/80849 "2022-04-28T11:24:38Z")
I’m having some trouble setting up a custom domain to be used by my Auth0 tenant. Here’s my setup and what I did so far: The Auth0 tenant is set to Development I created a custom domain and added it to my tenant (the t… --- ## [Problem creating custom Twitter OAuth2 Social Connection](https://community.auth0.com/t/problem-creating-custom-twitter-oauth2-social-connection/78824)
**Author:** [@samiur](https://community.auth0.com/u/samiur)\ **Replies:** 1\ **Last updated:** [February 26, 2022, 1:00am UTC](https://community.auth0.com/t/problem-creating-custom-twitter-oauth2-social-connection/78824 "2022-02-26T01:00:15Z")
Hi there, We’re about to start using the Twitter v2 API, which requires their newly released OAuth2 auth flow. However, they seem to only support PKCE based auth flow, and require the code\_challenge and code\_challenge\_… --- ## [Logging in with email doesn't populate email, it populates name](https://community.auth0.com/t/logging-in-with-email-doesnt-populate-email-it-populates-name/76037)
**Author:** [@john25](https://community.auth0.com/u/john25)\ **Replies:** 1\ **Last updated:** [January 14, 2022, 7:04pm UTC](https://community.auth0.com/t/logging-in-with-email-doesnt-populate-email-it-populates-name/76037 "2022-01-14T19:04:27Z")
I’m creating new users using very basic oath2 flow from a rails app. I sign up using email address, and log in fine. I get verification emails. However, the data Auth0 sends to me with the token shows the email in the na… --- ## [Auth0 mfa-otp grant flow sequence diagram or something like that?](https://community.auth0.com/t/auth0-mfa-otp-grant-flow-sequence-diagram-or-something-like-that/73001)
**Author:** [@Uzlopak](https://community.auth0.com/u/Uzlopak)\ **Replies:** 3\ **Last updated:** [November 13, 2021, 12:42am UTC](https://community.auth0.com/t/auth0-mfa-otp-grant-flow-sequence-diagram-or-something-like-that/73001 "2021-11-13T00:42:14Z")
Hi, I would like to know how the mfa-otp grant works. What http codes are sent back and forth. What is the potential payload and result of each http call. etc… A sequence diagram would be super helpful. Where can I fin… --- ## [Resource Owner Password Flow - Rules are not executed](https://community.auth0.com/t/resource-owner-password-flow-rules-are-not-executed/65322)
**Author:** [@christian.b](https://community.auth0.com/u/christian.b)\ **Replies:** 3\ **Last updated:** [July 1, 2021, 10:18am UTC](https://community.auth0.com/t/resource-owner-password-flow-rules-are-not-executed/65322 "2021-07-01T10:18:31Z")
Hello, I’m currently trying to implement the Resource Owner Password Flow for an application that cannot be redirected to the Auth0 login page. What I’m doing is: Taking username, password and calling the oauth/token en… --- ## [Post user registration Actions / Hooks / Rules with Social Providers](https://community.auth0.com/t/post-user-registration-actions-hooks-rules-with-social-providers/63314)
**Author:** [@dave6](https://community.auth0.com/u/dave6)\ **Replies:** 2\ **Last updated:** [May 25, 2021, 9:06am UTC](https://community.auth0.com/t/post-user-registration-actions-hooks-rules-with-social-providers/63314 "2021-05-25T09:06:08Z")
I am trying to add a Post User Registration action that fires after a user registers to the application via a Social Provider. Google and Facebook are my social providers. Are Post User Registration Actions / Hooks / Ru… --- ## [How can we twitter OAuth without social login?](https://community.auth0.com/t/how-can-we-twitter-oauth-without-social-login/62901)
**Author:** [@daiki44](https://community.auth0.com/u/daiki44)\ **Replies:** 5\ **Last updated:** [May 18, 2021, 12:30pm UTC](https://community.auth0.com/t/how-can-we-twitter-oauth-without-social-login/62901 "2021-05-18T12:30:23Z")
Hi. I want to use Twitter OAuth with Auth0. But we don’t want to use the social login only using OAuth token and Twitter APIs. Can we do that? If it is yes, how can we implement that? --- ## [Unable to return to my app after e-mail verification](https://community.auth0.com/t/unable-to-return-to-my-app-after-e-mail-verification/58947)
**Author:** [@damian.d940](https://community.auth0.com/u/damian.d940)\ **Replies:** 2\ **Last updated:** [March 8, 2021, 2:28pm UTC](https://community.auth0.com/t/unable-to-return-to-my-app-after-e-mail-verification/58947 "2021-03-08T14:28:16Z")
Hi. I’ve setup a very simple single page app (actually an index.html file with the contents of the javascript Login demo), served by nginx and hosted in a docker container on my Linux desktop. The app listens to a name l… --- ## [Pre-assigning roles to social accounts](https://community.auth0.com/t/pre-assigning-roles-to-social-accounts/58027)
**Author:** [@dallagi](https://community.auth0.com/u/dallagi)\ **Replies:** 4\ **Last updated:** [February 22, 2021, 7:11pm UTC](https://community.auth0.com/t/pre-assigning-roles-to-social-accounts/58027 "2021-02-22T19:11:14Z")
Hi, We’d like to assign roles and permissions to users connecting via social login (Google) based on their email address. The reason is that we’re switching users from our existing internal auth system (based on Google… --- ## [Is RFC 8693 OAuth 2.0 Token Exchange coming?](https://community.auth0.com/t/is-rfc-8693-oauth-2-0-token-exchange-coming/51434)
**Author:** [@mschenk](https://community.auth0.com/u/mschenk)\ **Replies:** 2\ **Last updated:** [October 14, 2020, 2:18pm UTC](https://community.auth0.com/t/is-rfc-8693-oauth-2-0-token-exchange-coming/51434 "2020-10-14T14:18:12Z")
This topic from the beginning of this year indicated support for RFC 8693 was in progress, but I haven’t seen any update or announcement about it since then. Is it still coming? --- ## [Social connection](https://community.auth0.com/t/social-connection/50182)
**Author:** [@Rodion](https://community.auth0.com/u/Rodion)\ **Replies:** 1\ **Last updated:** [September 22, 2020, 7:55am UTC](https://community.auth0.com/t/social-connection/50182 "2020-09-22T07:55:53Z")
Hello! I’m encountering a problem for which I can not find any reference, so probably it’s something stupid, but still. Error happens if I try to test social connection (doesn’t matter which one, I tried Google and Fac… [Next page](https://community.auth0.com/tag/oauth2/891.md?match_all_tags=true&page=1&tags%5B%5D=oauth2)