Auth0 "service not found" error

Question

I'm attempting to use Auth0 to issue JWT tokens for accessing my API (so that Auth0 handles all the OAuth and security concerns, etc., and my API just needs to check the token). When I try to test the Authorization Code flow for clients to receive an access token (using Node + Express), the following happens:

• The authorization code request works fine, and the client is redirected back to my redirect_uri with the code appended to the query. All good.

• The token request then always fails. If I include the audience parameter, the request returns an access_denied error with the following details: Service not found: {the audience parameter} , regardless of what value I set for the audience parameter.

• If I don't include the audience parameter, I get a server_error with the message Service not found: https://oauth.auth0.com/userinfo .

I've checked every Auth0 setting and read every documentation page thoroughly, and so far nothing has worked. I've also tested the Authorization Code flow in Auth0's API debugger, and it worked fine. My test follows exactly the same parameters, and yet still receives an error requesting the token. I'm testing on localhost. The client credentials and implicit flows are working fine.

Here is a test endpoint I created which retrieves the authorization code from Auth0:

 const qs = require('querystring'); const getCode = (req, res) => { const params = { audience, // the value of the API Audience setting for the client client_id, // the client ID redirect_uri, // the redirect_uri, which is also listed in the Allowed Callback URLs field response_type: `code`, scope: `offline_access open` // ask to return ID token and refresh token, state: `12345`, }; const authDomain = `mydomain.auth0.com/oauth`; res.redirect(`${authDomain}/oauth/authorize?${qs.stringify(params)}`); };

The redirect_uri then redirects to the following endpoint, where I make the request for the access token:

 const https = require('https'); const callback = (req, res) => { const body = { client_id, client_secret, code: req.query.code, grant_type: `authorization_code`, redirect_uri, // same value as provided during the code request }; const opts = { headers: { 'Content-Type': `application/json` }, hostname: `mydomain.auth0.com`, method: `POST`, path: `/oauth/token`, }; const request = https.request(opts, response => { let data = ``; response.on(`data`, chunk => { data += chunk; }); response.on(`error`, res.send(err.message)); response.on(`end`, () => res.json(JSON.parse(data))); // this executes, but displays the error returned from Auth0 }); request.on(`error`, err => res.send(err.message)); request.end(JSON.stringify(body), `utf8`); };

Any suggestions as to what I might be doing wrong?

Answer 1

The issue was that I was calling the incorrect URL at Auth0. I mistakenly thought that both the authorization and token endpoints began with /oauth , when in fact the authorization endpoint is just /authorize , while the token endpoint is /oauth/authorize . Correcting the URLs in my code fixed the problem.

Answer 2

My solution was the identifier of the api was not found. If it is not exact it won't find it. I had an extra backslash on my 'audience' where the identifier didnt have one. pretty easy mistake but the error is not very clear in Auth0.

Answer 3

In my case, I was using auth0 react hooks. So the example code looked like this:

const getUserMetadata = async () => {
        const domain = process.env.REACT_APP_AUTH0_DOMAIN

        try {
            const accessToken = await getAccessTokenSilently({
                audience: `https://${domain}/api/v2/`,
                scope: 'read:current_user',
            })
            console.log('accessToken', accessToken)
            localStorage.setItem('access_token', accessToken)

            setUserAuthenticated(true)
        } catch (e) {
            console.log('error in getting access token', e.message)
        }
    }

My solution to this was using by default Auth0 Audience value in audience field

 const getUserMetadata = async () => {
    const auth0audience = process.env.REACT_APP_AUTH0_AUDIENCE

    try {
        const accessToken = await getAccessTokenSilently({
            audience: auth0audience,
            scope: 'read:current_user',
        })
        console.log('accessToken', accessToken)
        localStorage.setItem('access_token', accessToken)

        setUserAuthenticated(true)
    } catch (e) {
        console.log('error in getting access token', e.message)
    }
}

Because its stated in auth0 docs of configuring custom domains that, you need to use by default API audience

Source - https://auth0.com/docs/brand-and-customize/custom-domains/configure-features-to-use-custom-domains