# Silent auth failures

## The errors (from getTokenSilently / checkSession)

- `login_required`: no Auth0 session (logged out, session expired, or cookie blocked). Fix: interactive login.
- `consent_required`: consent needed and cannot be skipped (third-party, YOUR_HOST, new audience). Fix: interactive login with consent.
- `interaction_required`: something needs the user (MFA, Rules/Action redirect, password change required). Fix: interactive login.

## Pattern

```
try {
  tok = await getAccessTokenSilently();
} catch (e) {
  if (["login_required","consent_required","interaction_required","missing_refresh_token"].includes(e.error)) {
    await loginWithRedirect({ authorizationParams: { audience: "[your api]" } });
  } else { throw e; }
}
```

Never loop getTokenSilently on these errors; each attempt fails identically and burns rate limit.

## Cookie angle

Silent auth uses a hidden iframe + the Auth0 session cookie. Blocked third-party cookies produce `login_required` even when the user HAS a session. Custom domains fix it (first-party cookie). Rotating refresh tokens are the other fix: with `useRefreshTokens`, the SDK renews without the iframe at all.

## missing_refresh_token

The SDK has no refresh token to use: offline_access was not requested, rotation is off, or storage was cleared. Fix the login call, then re-login.

## Checklist

- Every silent-auth error has an interactive fallback.
- No retry loops on interaction errors.