An Auth0 custom token exchange fails with a Consent required error because the target API requires user consent in a non-interactive flow. Resolve this issue by enabling the option to skip user consent in the API settings. When using custom token exchange to regenerate tokens for a user, the initial API request fails, and Auth0 generates the following error:

Consent required

Subsequent requests without any consent added succeed.

• Auth0
• Custom Token Exchange
• APIs

The target API for the request requires user consent. Custom Token Exchange is a non-interactive flow. Because there is no browser involved in this back-channel request, Auth0 cannot display a consent dialog to the user, which causes the request to fail.

How is the "Consent required" error resolved?

Bypass the consent requirement for the specific API by navigating to the application settings and enabling the option to skip user consent.

1. Navigate to the Auth0 Dashboard.
2. Go to Applications > APIs and select the target API.
3. Under the Settings tab, go to the Access Settings section, and enable Allow Skipping User Consent.
4. Save the changes.

Related References

• Custom Token Exchange Limitations