# Consent loops
## The behavior
Every login shows "Authorize [app] to access [API]?" even though the user approved it before. Or the app errors that consent was not granted.
## Rules
- Third-party applications ALWAYS show consent. No toggle removes it; that is the point of third-party.
- First-party applications can skip consent per API: Dashboard > Applications > APIs > your API > "Allow Skipping User Consent".
- Consent cannot be skipped when the callback is YOUR_HOST. Local dev always prompts; this surprises everyone once.
- Consent is per API audience. Requesting a different audience re-prompts.
## Fix
1. Confirm the app is marked first-party (Application > Settings > Advanced > OAuth > OIDC Conformant and app type; third-party is a separate application flag).
2. Enable skip-consent on the API for first-party apps.
3. For local dev, accept the prompt or test consent-skip behavior in a deployed preview environment.
4. If the user clicks Deny, the callback gets `error=access_denied`; handle it with a human message, not a crash.
## Checklist
- Skip-consent only expected for first-party + non-YOUR_HOST + same audience.
- Denied consent handled gracefully in the callback.