# \#protocols **URL:** https://community.auth0.com/tag/protocols/2120.md [Latest](https://community.auth0.com/latest.md) · [Categories](https://community.auth0.com/categories.md) · [Tags](https://community.auth0.com/tags.md) --- ## [Auth0 CIMD registration appears incompatible with the current ChatGPT Client ID Metadata Document](https://community.auth0.com/t/auth0-cimd-registration-appears-incompatible-with-the-current-chatgpt-client-id-metadata-document/203817)
**Author:** [@davomeist](https://community.auth0.com/u/davomeist)\ **Replies:** 7\ **Last updated:** [November 5, 2026, 8:33am UTC](https://community.auth0.com/t/auth0-cimd-registration-appears-incompatible-with-the-current-chatgpt-client-id-metadata-document/203817 "2026-11-05T08:33:43Z")
I am trying to use Auth0 as the OAuth Authorization Server for an MCP server that is consumed by ChatGPT. ChatGPT is using Client ID Metadata Document (CIMD) registration. The ChatGPT Client ID Metadata Document is: h… --- ## [Fallback to appending .well-known to path when trying to automatically download public key from JWT](https://community.auth0.com/t/fallback-to-appending-well-known-to-path-when-trying-to-automatically-download-public-key-from-jwt/203661)
**Author:** [@klasen](https://community.auth0.com/u/klasen)\ **Replies:** 2\ **Last updated:** [October 12, 2026, 7:24am UTC](https://community.auth0.com/t/fallback-to-appending-well-known-to-path-when-trying-to-automatically-download-public-key-from-jwt/203661 "2026-10-12T07:24:40Z")
Hi, when attempting to automatically download public key from JWT, jwt.io should fallback to appending .well-known path components if a request to a URL constructed by inserting fails. From RFC 8414: \[...\] However,… --- ## [Unable to get a token on behalf of a user. "Client must be a Custom API Client with resource\_server\_id"](https://community.auth0.com/t/unable-to-get-a-token-on-behalf-of-a-user-client-must-be-a-custom-api-client-with-resource-server-id/200896)
**Author:** [@dave.natalie](https://community.auth0.com/u/dave.natalie)\ **Replies:** 1\ **Last updated:** [June 17, 2026, 5:35pm UTC](https://community.auth0.com/t/unable-to-get-a-token-on-behalf-of-a-user-client-must-be-a-custom-api-client-with-resource-server-id/200896 "2026-06-17T17:35:28Z")
I am following the documentation here. When I send the token request, I get the following response. { "error": "invalid\_request", "error\_description": "Client must be a Custom API Client with resource\_server\_… --- ## [Access token with custom API scopes through Implicit Flow?](https://community.auth0.com/t/access-token-with-custom-api-scopes-through-implicit-flow/200692)
**Author:** [@Adelin](https://community.auth0.com/u/Adelin)\ **Replies:** 1\ **Last updated:** [June 10, 2026, 12:12am UTC](https://community.auth0.com/t/access-token-with-custom-api-scopes-through-implicit-flow/200692 "2026-06-10T00:12:14Z")
I am wondering whether it is possible to get an user access token with a custom scope for an API that is configured to allow all apps for User-Delegated Access. I tried to just add the scope in the /authorize request, b… --- ## [What does one do with Invalid SessionIndex/NameID](https://community.auth0.com/t/what-does-one-do-with-invalid-sessionindex-nameid/198981)
**Author:** [@jsoref](https://community.auth0.com/u/jsoref)\ **Replies:** 3\ **Last updated:** [April 29, 2026, 5:09pm UTC](https://community.auth0.com/t/what-does-one-do-with-invalid-sessionindex-nameid/198981 "2026-04-29T17:09:15Z")
We got an event: { "date": "...", "type": "flo", "description": "Invalid SessionIndex/NameID", "connection\_id": "", "client\_id": "...", "client\_name": "...", "ip": "...", "user\_agent": "Edge 146.0.0 / Wi… --- ## [What does one do with Unsupported response type: ZhAkG qt\_mXRWo](https://community.auth0.com/t/what-does-one-do-with-unsupported-response-type-zhakg-qt-mxrwo/199026)
**Author:** [@jsoref](https://community.auth0.com/u/jsoref)\ **Replies:** 3\ **Last updated:** [April 29, 2026, 4:05pm UTC](https://community.auth0.com/t/what-does-one-do-with-unsupported-response-type-zhakg-qt-mxrwo/199026 "2026-04-29T16:05:09Z")
We got an event: { "date": "2026-04-15T21:25:00.624Z", "type": "f", "description": "Unsupported response type: ZhAkG qt\_mXRWo", "connection\_id": "", "client\_id": "...", "ip": "...", "user\_agent": "Chrome 1… --- ## [Embedded Login with Cross Origin Authentication](https://community.auth0.com/t/embedded-login-with-cross-origin-authentication/197334)
**Author:** [@monishchaganti2001](https://community.auth0.com/u/monishchaganti2001)\ **Replies:** 1\ **Last updated:** [February 18, 2026, 5:39pm UTC](https://community.auth0.com/t/embedded-login-with-cross-origin-authentication/197334 "2026-02-18T17:39:32Z")
Hi everyone, We’re building a proof-of-concept for a client (enterprise healthcare) to evaluate different Auth0 authentication approaches side-by-side. One of the POCs requires a fully custom embedded login experience —… --- ## [Python Token Validation](https://community.auth0.com/t/python-token-validation/196326)
**Author:** [@jonathan.hughes](https://community.auth0.com/u/jonathan.hughes)\ **Replies:** 2\ **Last updated:** [January 30, 2026, 9:57pm UTC](https://community.auth0.com/t/python-token-validation/196326 "2026-01-30T21:57:56Z")
I have a react single page app working to login and I get the token with the following method: const token = await getAccessTokenSilently(); I then pass this token into a back end python server but I need to make sure … --- ## [{organization\_name} based Redirect URI with Apache](https://community.auth0.com/t/organization-name-based-redirect-uri-with-apache/194776)
**Author:** [@BitshiftNate](https://community.auth0.com/u/BitshiftNate)\ **Replies:** 1\ **Last updated:** [November 24, 2025, 8:18pm UTC](https://community.auth0.com/t/organization-name-based-redirect-uri-with-apache/194776 "2025-11-24T20:18:47Z")
Hello all, I’m currently in the process of creating a B2B SaaS application that requires each customer to have a separate tenant which is an entirely separate server. I’m running an Apache server to host the front-end … --- ## [How to set SAML RelayState in Actions?](https://community.auth0.com/t/how-to-set-saml-relaystate-in-actions/121123)
**Author:** [@aliaksei](https://community.auth0.com/u/aliaksei)\ **Replies:** 6\ **Last updated:** [November 11, 2025, 5:18pm UTC](https://community.auth0.com/t/how-to-set-saml-relaystate-in-actions/121123 "2025-11-11T17:18:02Z")
Hi, I’m migrating from Rules to Action Flows. Now I’m completely stuck with migrating the following Rule code: function (user, context, callback) { // some SAML mapping here //... context.samlConfiguration.Re… --- ## [JWKS Caching Strategy Recommendations](https://community.auth0.com/t/jwks-caching-strategy-recommendations/183415)
**Author:** [@FrostbyteApps](https://community.auth0.com/u/FrostbyteApps)\ **Replies:** 5\ **Last updated:** [March 27, 2025, 3:46pm UTC](https://community.auth0.com/t/jwks-caching-strategy-recommendations/183415 "2025-03-27T15:46:53Z")
When looking at the cache control headers for the JWKS endpoints of my project, I receive the following values… public, max-age=15, stale-while-revalidate=15, stale-if-error=86400 This cache control leads me to believe… --- ## [Linking SAML account and want to require user to enter password before linking](https://community.auth0.com/t/linking-saml-account-and-want-to-require-user-to-enter-password-before-linking/188947)
**Author:** [@jeremybong](https://community.auth0.com/u/jeremybong)\ **Replies:** 3\ **Last updated:** [July 15, 2025, 11:51am UTC](https://community.auth0.com/t/linking-saml-account-and-want-to-require-user-to-enter-password-before-linking/188947 "2025-07-15T11:51:33Z")
Hello! My team is in the process of migrating to Auth0 and SSO, and I have a question regarding converting previous non-SSO users to SSO users. Here’s our scenario: all our current users are non-SSO users and use their … --- ## [Getting started with Okta/Auth0 to integrate third party IDP in our SaaS](https://community.auth0.com/t/getting-started-with-okta-auth0-to-integrate-third-party-idp-in-our-saas/185384)
**Author:** [@7hibault](https://community.auth0.com/u/7hibault)\ **Replies:** 3\ **Last updated:** [April 23, 2025, 4:52pm UTC](https://community.auth0.com/t/getting-started-with-okta-auth0-to-integrate-third-party-idp-in-our-saas/185384 "2025-04-23T16:52:50Z")
Hi all, Our clients are asking us if they can log into our apps using their Okta IDP. They’re asking specifically about SAML integration, but I’m not sure if that’s a hard requirement. I’ve had an Okta/auth0 representa… --- ## [How to set audience in application M2M](https://community.auth0.com/t/how-to-set-audience-in-application-m2m/185162)
**Author:** [@renan.padilha](https://community.auth0.com/u/renan.padilha)\ **Replies:** 1\ **Last updated:** [April 8, 2025, 5:50pm UTC](https://community.auth0.com/t/how-to-set-audience-in-application-m2m/185162 "2025-04-08T17:50:19Z")
Hello, I am trying to configure an application M2M accessing a Resource Server configuring Spring 3.4.4 with Java 21. I am trying to implement oAuth2Client lib (spring-security-oauth2-client) of Spring, but there is no… --- ## [Outbound SCIM configuration](https://community.auth0.com/t/outbound-scim-configuration/151278)
**Author:** [@himani.asrani](https://community.auth0.com/u/himani.asrani)\ **Replies:** 1\ **Last updated:** [November 22, 2024, 4:57pm UTC](https://community.auth0.com/t/outbound-scim-configuration/151278 "2024-11-22T16:57:17Z")
We have a requirement of moving users along with their password and information from Auth0 to other system. All the documents found are for Inbound SCIM configuration i.e from other system to Auth0 Does Auth0 support O… --- ## [Any workadounds for Safari ITP issue with transaction cookie when using express-openid-connect?](https://community.auth0.com/t/any-workadounds-for-safari-itp-issue-with-transaction-cookie-when-using-express-openid-connect/150940)
**Author:** [@mhautala](https://community.auth0.com/u/mhautala)\ **Replies:** 4\ **Last updated:** [November 12, 2024, 3:31pm UTC](https://community.auth0.com/t/any-workadounds-for-safari-itp-issue-with-transaction-cookie-when-using-express-openid-connect/150940 "2024-11-12T15:31:01Z")
We have faced issue which seems to be related to Safari’s Intelligent Tracking Protection functionality when using express-openid-connect library. Safari may drop the transaction cookie auth\_verification when browser is… --- ## [Modifying ID token](https://community.auth0.com/t/modifying-id-token/141143)
**Author:** [@richardb](https://community.auth0.com/u/richardb)\ **Replies:** 3\ **Last updated:** [August 15, 2024, 8:29pm UTC](https://community.auth0.com/t/modifying-id-token/141143 "2024-08-15T20:29:06Z")
Hello, I modify some user information using the management API, but then I also want my ID token to be updated. Can I directly modify my current ID token, or do I need to request a new one from auth0? Thank you and hav… --- ## [To visually verify RS256-signed tokens](https://community.auth0.com/t/to-visually-verify-rs256-signed-tokens/136592)
**Author:** [@martin617](https://community.auth0.com/u/martin617)\ **Replies:** 1\ **Last updated:** [June 26, 2024, 7:24pm UTC](https://community.auth0.com/t/to-visually-verify-rs256-signed-tokens/136592 "2024-06-26T19:24:38Z")
Hello, On the Auth0 documentation page ‘Validate JSON Web Tokens’ (https://auth0.com/docs/secure/tokens/json-web-tokens/validate-json-web-tokens), it would have saved me a few hours of time if the instruction steps in t… --- ## [Adding permissions in ID token](https://community.auth0.com/t/adding-permissions-in-id-token/130106)
**Author:** [@ahmed.mekliov](https://community.auth0.com/u/ahmed.mekliov)\ **Replies:** 5\ **Last updated:** [March 29, 2024, 8:43pm UTC](https://community.auth0.com/t/adding-permissions-in-id-token/130106 "2024-03-29T20:43:07Z")
Is it considered bad practice in terms of OAuth2 specification to add roles/permissions in ID token? --- ## [RFC for \`screen\_hint\` parameter](https://community.auth0.com/t/rfc-for-screen-hint-parameter/121590)
**Author:** [@jozefizso](https://community.auth0.com/u/jozefizso)\ **Replies:** 2\ **Last updated:** [November 29, 2023, 8:05pm UTC](https://community.auth0.com/t/rfc-for-screen-hint-parameter/121590 "2023-11-29T20:05:40Z")
Hi, I checked the screen\_hint parameter which is used for the Signup URLs. Is this parameter specified in some RFC and will it be documented in the OAuth parameters at OAuth Parameters ? --- ## [SAML, SLO not working for me](https://community.auth0.com/t/saml-slo-not-working-for-me/118113)
**Author:** [@johan.eggers](https://community.auth0.com/u/johan.eggers)\ **Replies:** 2\ **Last updated:** [October 10, 2023, 7:47am UTC](https://community.auth0.com/t/saml-slo-not-working-for-me/118113 "2023-10-10T07:47:04Z")
Hi, I am trying to use the SAML SLO endpoint. I am using the npm library ‘saml2-js’, which nicely constructed this SAML slo token / request: Calling this url in the browser is successful and in the monitoring I get… --- ## [Auth0 authorize endpoint keeps going to http instead of https](https://community.auth0.com/t/auth0-authorize-endpoint-keeps-going-to-http-instead-of-https/117677)
**Author:** [@webmaster9](https://community.auth0.com/u/webmaster9)\ **Replies:** 1\ **Last updated:** [October 4, 2023, 2:27pm UTC](https://community.auth0.com/t/auth0-authorize-endpoint-keeps-going-to-http-instead-of-https/117677 "2023-10-04T14:27:35Z")
Hi there, We are using cloudflare with auth0 authentication and for some reason, the redirect uri is using http instead of https, we have tried adding http forwarder in our program.cs to no success. Any help is apprecia… --- ## [What's the difference between \`oauth2-token-exchange\`, \`oauth2-access-token\` and \`oauth2-refresh-token\`](https://community.auth0.com/t/whats-the-difference-between-oauth2-token-exchange-oauth2-access-token-and-oauth2-refresh-token/117398)
**Author:** [@Will956](https://community.auth0.com/u/Will956)\ **Replies:** 1\ **Last updated:** [September 29, 2023, 5:14pm UTC](https://community.auth0.com/t/whats-the-difference-between-oauth2-token-exchange-oauth2-access-token-and-oauth2-refresh-token/117398 "2023-09-29T17:14:24Z")
Hello :wave: I’m looking at the authentication protocol object from the post-login action and I’m wondering what is the difference between those 3 values: oauth2-refresh-token oauth2-access-token oauth2-token-exchange … --- ## [Got "502 Bad Gateway" on login callback when using NGINX reverse proxy](https://community.auth0.com/t/got-502-bad-gateway-on-login-callback-when-using-nginx-reverse-proxy/116896)
**Author:** [@michael.samorokov](https://community.auth0.com/u/michael.samorokov)\ **Replies:** 2\ **Last updated:** [September 23, 2023, 7:25am UTC](https://community.auth0.com/t/got-502-bad-gateway-on-login-callback-when-using-nginx-reverse-proxy/116896 "2023-09-23T07:25:12Z")
hello! I’m trying to integrate ASP.NET Core application with Auth0. I’m using Auth0.AspNetCore.Authentication NuGet package following tutorial documentation by @andrea.chiarelli . It works fine when I’m trying locally… --- ## [Is it possible to implement SSO with SAML using ReactJS and .NET 7?](https://community.auth0.com/t/is-it-possible-to-implement-sso-with-saml-using-reactjs-and-net-7/109513)
**Author:** [@datum](https://community.auth0.com/u/datum)\ **Replies:** 2\ **Last updated:** [September 14, 2023, 11:37am UTC](https://community.auth0.com/t/is-it-possible-to-implement-sso-with-saml-using-reactjs-and-net-7/109513 "2023-09-14T11:37:36Z")
I am trying to implement SSO with SAML in a React application with .NET 7 as the back end. I was able to create a SAML authentication in .NET 7 wit an another Identity Management Services and it works fine with MVC. But … --- ## [Redirecting Users to Different Web Applications After Universal Login](https://community.auth0.com/t/redirecting-users-to-different-web-applications-after-universal-login/114430)
**Author:** [@leonardo.lombardi](https://community.auth0.com/u/leonardo.lombardi)\ **Replies:** 1\ **Last updated:** [August 25, 2023, 4:22pm UTC](https://community.auth0.com/t/redirecting-users-to-different-web-applications-after-universal-login/114430 "2023-08-25T16:22:49Z")
Hello Auth0 Community, I have set up a single Auth0 tenant that serves two distinct web applications. These applications are hosted on different domains, let’s say app1.com and app2.com. I aim to implement a Universal … --- ## [Help debugging some SAML Responses](https://community.auth0.com/t/help-debugging-some-saml-responses/111138)
**Author:** [@trevor.hirst](https://community.auth0.com/u/trevor.hirst)\ **Replies:** 1\ **Last updated:** [July 26, 2023, 10:17pm UTC](https://community.auth0.com/t/help-debugging-some-saml-responses/111138 "2023-07-26T22:17:19Z")
Is it possible to log/capture the request.body.SAMLResponse value? I’ve tried using a rule and the request body appears to be an empty object. As a side question, is it required for a SAMLResponse to contain both the re… --- ## [Is Nonce requried for the Authoziation Code flow](https://community.auth0.com/t/is-nonce-requried-for-the-authoziation-code-flow/111419)
**Author:** [@IvanM](https://community.auth0.com/u/IvanM)\ **Replies:** 1\ **Last updated:** [July 20, 2023, 2:31pm UTC](https://community.auth0.com/t/is-nonce-requried-for-the-authoziation-code-flow/111419 "2023-07-20T14:31:45Z")
Hello community, I’m implementing Authoziation Code flow via NodeJS Lambda AWS and I have a question about the Nonce. Is it needed when using the Authorization Flow? If not, could please help me to find some official … --- ## [Adding Custom SAML Attributes from User Profile to Claims in Custom Action](https://community.auth0.com/t/adding-custom-saml-attributes-from-user-profile-to-claims-in-custom-action/107054)
**Author:** [@monstarmike](https://community.auth0.com/u/monstarmike)\ **Replies:** 1\ **Last updated:** [May 21, 2023, 12:21am UTC](https://community.auth0.com/t/adding-custom-saml-attributes-from-user-profile-to-claims-in-custom-action/107054 "2023-05-21T00:21:58Z")
Hello, I’ve set up an enterprise connection where Auth0 is the service provider. I’m mapping customer attributes on the provider, StoreID and Role, to location\_id and idp\_provided\_role on the user profile. I logged in … --- ## [Spa oauth flow without user authentication prompt](https://community.auth0.com/t/spa-oauth-flow-without-user-authentication-prompt/107398)
**Author:** [@tojeffraymond](https://community.auth0.com/u/tojeffraymond)\ **Replies:** 1\ **Last updated:** [May 19, 2023, 6:39pm UTC](https://community.auth0.com/t/spa-oauth-flow-without-user-authentication-prompt/107398 "2023-05-19T18:39:56Z")
HELLO, Our web application development partner for our company’s portal has developed an authentication middleware within the Netlity CDN to authenticate our SPA web application before it reaches the backend API via the… [Next page](https://community.auth0.com/tag/protocols/2120.md?match_all_tags=true&page=1&tags%5B%5D=protocols)