getTokenSilently fails: login_required, consent_required, interaction_required

TL;DR: Silent token renewal fails with a named error telling you exactly what interaction is needed. Each maps to a different fix; retrying silently never works. Fix: interactive login. - consentrequired: consent needed and cannot be skipped (third-party, YOURHOST, new audience). Fix: interactive login with consent. - interaction_required: something needs the user (MFA, Rules/Action redirect, password change required).

The error

text
missing_refresh_token

The fix

TL;DR: Silent token renewal fails with a named error telling you exactly what interaction is needed. Each maps to a different fix; retrying silently never works. Fix: interactive login. - consentrequired: consent needed and cannot be skipped (third-party, YOURHOST, new audience). Fix: interactive login with consent. - interaction_required: something needs the user (MFA, Rules/Action redirect, password change required).

The error

missing_refresh_token

The fix

Silent auth failures

The errors (from getTokenSilently / checkSession)

• login_required: no Auth0 session (logged out, session expired, or cookie blocked). Fix: interactive login.
• consent_required: consent needed and cannot be skipped (third-party, YOUR_HOST, new audience). Fix: interactive login with consent.
• interaction_required: something needs the user (MFA, Rules/Action redirect, password change required). Fix: interactive login.

Pattern

try {
  tok = await getAccessTokenSilently();
} catch (e) {
  if (["login_required","consent_required","interaction_required","missing_refresh_token"].includes(e.error)) {
    await loginWithRedirect({ authorizationParams: { audience: "[your api]" } });
  } else { throw e; }
}

Never loop getTokenSilently on these errors; each attempt fails identically and burns rate limit.

Cookie angle

Silent auth uses a hidden iframe + the Auth0 session cookie. Blocked third-party cookies produce login_required even when the user HAS a session. Custom domains fix it (first-party cookie). Rotating refresh tokens are the other fix: with useRefreshTokens, the SDK renews without the iframe at all.

missingrefreshtoken

The SDK has no refresh token to use: offline_access was not requested, rotation is off, or storage was cleared. Fix the login call, then re-login.

Checklist

• Every silent-auth error has an interactive fallback.
• No retry loops on interaction errors.

When to use this

• You are seeing this exact error message; match the block above, not just part of it.
• The failing call matches the scenario in the title: getTokenSilently fails.
• You want the fastest verified fix before digging through logs.

When not to use this

• Your error text differs from the block above; close cousins often have different causes.
• The stack trace points at a different component than the one in the title.
• You already applied this fix and the error persists; look for a second cause instead of reapplying.

Compatibility

• Not pinned to a specific version; follows current getTokenSilently behavior.

Also seen as

• `## The fix

Silent auth failures

The errors (from getTokenSilently / checkSession)

-`

• `: consent needed and cannot be skipped (third-party, YOUR_HOST, new audience). Fix: interactive login with consent.

-`

Auth0's SPA SDK docs describe getTokenSilently and its error codes. The silent authentication flow and its cookie dependency are documented in Auth0's session docs. Verified against live docs 2026-09-26.