Auth0 Login Loop: Silent Authentication Not Working

How to fix it

Try these in order — the most common fix is first.

1. 1. Use a custom domain

   Copy steps
   1. Configure a Custom Domain so the Auth0 domain shares your app's domain
   2. On the Free plan a custom domain needs a valid credit card on file for verification (it is not charged)
   Did this fix it? Yes No

2. 2. Use refresh token rotation

   Copy steps
   1. Enable Allow Refresh Token Rotation in the application Settings
   2. Request the offline_access scope; rotation helps SPAs keep sessions alive when browser privacy features block the Auth0 session cookie
   Did this fix it? Yes No

3. 3. Fix the logout redirect

   Copy steps
   1. Make the logout redirect URL an anonymous page not protected by login
   2. Make it different from the login callback URL and list it in Allowed Logout URLs
   Did this fix it? Yes No

Symptoms

User logs in, is redirected back, and immediately bounced to login again; getTokenSilently fails with "login_required" or times out.

Why it happens

• Chrome, Opera and Safari block third-party cookies, breaking cross-origin authentication unless a custom domain is used
• Safari "Prevent cross-site tracking" (ITP) can break token renewal even with third-party cookies enabled
• Logout redirect URL points to a page that triggers login again, or equals the login callback URL

This guide also covers

• auth0 login loop
• auth0 silent authentication not working
• auth0 third party cookies
• auth0 login_required

Other Auth0 errors

• Auth0 Callback URL Mismatch Error
• Auth0 Invalid State Error
• Auth0 CORS Error
• Auth0 Refresh Token Not Working
• Auth0 invalid_grant Error
• Auth0 Social Login Not Working
• Auth0 Rate Limit Exceeded (429 Too Many Requests)
• Auth0 MAU Limit & Pricing Jump