MFA API with Custom Domain Leads to Error: "The mfa_token provided is invalid. Try getting a new token."

Custom DomainsMulti-factor AuthenticationAPI

Last Updated: Sep 10, 2025

Overview

An obtained mfa_token through ROPG, as documented in Authenticate Using the Resource Owner Password Flow with MFA, cannot be used with the /mfa/authenticators endpoint when using the custom domain for a tenant. The following error is returned:

Response: {
"error": "invalid_grant",
"error_description": "The mfa_token provided is invalid. Try getting a new token."
}

The mfa_token works with the canonical domain on an endpoint of the MFA API; however, the mfa_token does not work with the custom domain.

Applies To

Resource Owner Password Grant (ROPG)
Multifactor Authentication (MFA)
Custom Domain

Cause

Currently, custom domains are not fully supported for the MFA API functionalities. This includes the custom guardian apps as well. The Auth0 engineering team has multiple in-progress efforts to get custom domains fully supported.

Solution

The best approach until custom domains fully support MFA functionalities is to keep using the canonical domain, which has consistent results. A custom domain can be used for all /oauth/token requests, but the MFA API audience will still need to be https://<AUTH0_DOMAIN>/mfa/.