Auth0 CORS Error

How to fix it

Try these in order — the most common fix is first.

1. 1. Add your origin

   Copy steps
   1. Dashboard > Applications > your application > Settings
   2. Add the origin to Allowed Web Origins (paths, query strings and hash are ignored, so do not include them) and to Allowed Origins (CORS)
   3. Save Changes
   Did this fix it? Yes No

2. 2. Enable cross-origin authentication

   Copy steps
   1. Under Cross-Origin Authentication, turn on Allow Cross-Origin Authentication
   2. Enter your origin in Allowed Origins (CORS) and Save Changes
   Did this fix it? Yes No

3. 3. Use a custom domain

   1. Chrome, Opera and Safari do not support cross-origin authentication with third-party cookies disabled unless Custom Domains are enabled
   Did this fix it? Yes No

Symptoms

Browser console shows "blocked by CORS policy: No Access-Control-Allow-Origin header" on calls to your-tenant.auth0.com.

Why it happens

• Origin not listed in Allowed Origins (CORS) or Allowed Web Origins (403 "Origin ... is not allowed")
• Cross-origin authentication not enabled (401 unauthorized_client)
• Allowed Web Origins value contains a path, query string or hash
• Third-party cookies blocked in Chrome, Opera or Safari without a custom domain

This guide also covers

• auth0 cors error
• auth0 allowed web origins
• auth0 no access-control-allow-origin

The same problem in other apps

All not loading, error messages & connection guides →

• Firebase auth/invalid-api-key Error (Firebase)
• Supabase Max Client Connections Reached (Supabase)

Other Auth0 errors

• Auth0 Callback URL Mismatch Error
• Auth0 Invalid State Error
• Auth0 Login Loop: Silent Authentication Not Working
• Auth0 Refresh Token Not Working
• Auth0 invalid_grant Error
• Auth0 Social Login Not Working
• Auth0 Rate Limit Exceeded (429 Too Many Requests)
• Auth0 MAU Limit & Pricing Jump