# Silent auth failures
## The errors (from getTokenSilently / checkSession)
- `login_required`: no Auth0 session (logged out, session expired, or cookie blocked). Fix: interactive login.
- `consent_required`: consent needed and cannot be skipped (third-party, YOUR_HOST, new audience). Fix: interactive login with consent.
- `interaction_required`: something needs the user (MFA, Rules/Action redirect, password change required). Fix: interactive login.
## Pattern
```
try {
tok = await getAccessTokenSilently();
} catch (e) {
if (["login_required","consent_required","interaction_required","missing_refresh_token"].includes(e.error)) {
await loginWithRedirect({ authorizationParams: { audience: "[your api]" } });
} else { throw e; }
}
```
Never loop getTokenSilently on these errors; each attempt fails identically and burns rate limit.
## Cookie angle
Silent auth uses a hidden iframe + the Auth0 session cookie. Blocked third-party cookies produce `login_required` even when the user HAS a session. Custom domains fix it (first-party cookie). Rotating refresh tokens are the other fix: with `useRefreshTokens`, the SDK renews without the iframe at all.
## missing_refresh_token
The SDK has no refresh token to use: offline_access was not requested, rotation is off, or storage was cleared. Fix the login call, then re-login.
## Checklist
- Every silent-auth error has an interactive fallback.
- No retry loops on interaction errors.