What was going on
Following the Auth0 React quickstart with auth0-spa-js, the code exchange failed with 401 Unauthorized from POST /oauth/token, and the Auth0 logs showed Type: Failed exchange, Description: Unauthorized. The same domain and clientId worked in an older auth0-js implementation. The cause was the application type in the Auth0 dashboard: machine-to-machine (and other non-SPA types) cannot perform the SPA authorization-code exchange.
What fixed it
Check the application type in your Auth0 dashboard: for auth0-spa-js it must be a Single Page Application. A machine-to-machine app cannot be converted to another type, so create a new SPA application and use its client ID; reporters confirmed this cleared the 401. Also verify Allowed Web Origins and Allowed Callback URLs include your app's origin, since misconfigured origins are the other common trigger the maintainers pointed to.