> ## Documentation Index
> Fetch the complete documentation index at: https://auth0.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Troubleshoot Universal Portals

> Find the cause and the fix for common Universal Portals problems, including sign-in, Organization, component, Forms, and session problems.

> [!WARNING]
>
> **The Auth0 Universal Portals feature is in .**

Each entry describes a symptom, the likely cause, and the fix. Most problems come from the portal application's settings. To review them, read [Configure an Application for Universal Portals](https://auth0.com/docs/customize/portals/configure-portal-application.md).

Check your tenant [logs](https://auth0.com/docs/deploy-monitor/logs.md) first. Many errors, especially those around authentication and access to the Portal, appear in them.

## Sign-in and access

For issues with user sign-in and access, review the following troubleshooting tips.

> **A login prompt appears after the portal session ends**
>
> **Potential cause**: When the portal session ends, the user signs in again with [single sign-on](https://auth0.com/docs/authenticate/single-sign-on) and no prompt, as long as the user's Auth0 session is still active. The login page appears only when the Auth0 session has also ended.
>
> **Fix**: This is expected. To let users return without a prompt for longer, extend the Auth0 session in your tenant's session settings. To learn more, read [Sessions and token lifetimes](https://auth0.com/docs/customize/portals/architecture.md#sessions-and-token-lifetimes).

> **The session transfer token is rejected and the login page appears**
>
> **Potential cause**: The token expired after 60 seconds, was already used, or the portal application does not accept [session transfer tokens](https://auth0.com/docs/authenticate/single-sign-on/native-to-web). When the Portal is opened in an Organization context, the `organization` value can also differ from the Organization of the token.
>
> **Fix**: Exchange the [refresh token](https://auth0.com/docs/secure/tokens/refresh-tokens) immediately before you open the in-app browser, and use each token once. Check the portal application's `session_transfer` settings. Check your tenant logs for the message "Single Sign-On failed". To learn more, read [Open a Portal from a native application](https://auth0.com/docs/customize/portals/access-portals.md#open-a-portal-from-a-native-application).

> **The user lands on an unexpected page after logging out**
>
> **Potential cause**: After logout, Auth0 sends the user to the first URL in the application's [**Allowed Logout URLs**](https://auth0.com/docs/get-started/applications/application-settings.md#application-uris).
>
> **Fix**: Put the URL where users should land, such as your application, first in the list.

> **The user cannot sign in because no connection is enabled**
>
> **Potential cause**: The portal application has no enabled connection, for example because you turned off every connection while reviewing the list.
>
> **Fix**: Open the portal application in the Auth0 Dashboard and select the [**Connections**](https://auth0.com/docs/get-started/applications/set-up-database-connections.md) tab. Turn on at least one connection that your users need. If you use [Organizations](https://auth0.com/docs/manage-users/organizations.md), also check that the Organization has an enabled connection for the user. To learn more, read [Validate enabled connections](https://auth0.com/docs/customize/portals/configure-portal-application.md#validate-enabled-connections).

## Organizations

For [Auth0 Organizations](https://auth0.com/docs/manage-users/organizations.md) in business Portals, use the following recommended troubleshooting tips.

> **Organization components show an error or no data**
>
> **Potential cause**: The user opened the Portal without the `organization` parameter, so the session has no Organization. The [My Organization API](https://auth0.com/docs/manage-users/my-organization-api.md) acts on an Organization.
>
> **Fix**: Add `organization` to the portal URL. To learn more, read [Open a Portal in an Organization context](https://auth0.com/docs/customize/portals/access-portals.md#open-a-portal-in-an-organization-context).

> **The user cannot sign in to the Portal with the organization parameter**
>
> **Potential cause**: The user is not a member of the Organization, the Organization has no enabled connection for the user, or the portal application does not allow Organizations.
>
> **Fix**: Check the Organization's members and connections. Check that the application has `organization_usage` set to `allow`. To learn more, read [Organization context](https://auth0.com/docs/customize/portals/configure-portal-application.md#organization-context).

> **An Organization component shows an error after the user saves a change**
>
> **Potential cause**: The user does not have write permission for the Organization. Portals do not disable buttons based on permissions, so the error appears after the user submits.
>
> **Fix**: Give the user the Organization permissions that the component needs. To learn more, read [My Organization API](https://auth0.com/docs/manage-users/my-organization-api.md).

> **The Portal shows tenant branding instead of the Organization's branding**
>
> **Potential cause**: The Portal was opened without an Organization, or Auth0 could not load the Organization's [branding](https://auth0.com/docs/manage-users/organizations/configure-organizations/create-organizations.md).
>
> **Fix**: Open the Portal with `organization`. Check that the Organization has branding configured.

## Components and API calls

If you are experiencing issues with Universal Portals components or API calls, use the following tips.

> **A component shows 'We couldn't load this information'**
>
> **Potential cause**: The portal application is missing a [client grant](https://auth0.com/docs/get-started/applications/application-access-to-apis-client-grants.md) or a [refresh token](https://auth0.com/docs/secure/tokens/refresh-tokens) policy for the [resource server](https://auth0.com/docs/get-started/apis) or the scopes the component needs.
>
> **Fix**: Add the client grant and the refresh token policy for the [My Account API](https://auth0.com/docs/manage-users/my-account-api.md) or the [My Organization API](https://auth0.com/docs/manage-users/my-organization-api.md) with the scopes the component needs. To see the scopes, read [Portal Components Library Reference](https://auth0.com/docs/customize/portals/portal-components.md#universal-components).

> **Components fail intermittently during normal use**
>
> **Potential cause**: [Refresh token rotation](https://auth0.com/docs/secure/tokens/refresh-tokens/refresh-token-rotation) is enabled on the portal application. Portals do not support it.
>
> **Fix**: Turn rotation off in the portal application. To learn more, read [Settings you must not change](https://auth0.com/docs/customize/portals/configure-portal-application.md#settings-you-must-not-change).

> **A request fails with 403 and 'This audience is not allowed'**
>
> **Potential cause**: A request asked for an audience other than the [My Account API](https://auth0.com/docs/manage-users/my-account-api.md) or the [My Organization API](https://auth0.com/docs/manage-users/my-organization-api.md) of your tenant.
>
> **Fix**: Components call only the My Account API and the My Organization API. Check that the portal application has a [client grant](https://auth0.com/docs/get-started/applications/application-access-to-apis-client-grants.md) for the [resource server](https://auth0.com/docs/get-started/apis). To learn more, read [Allowed resource servers](https://auth0.com/docs/customize/portals/architecture.md#allowed-resource-servers).

> **The multi-factor authentication (MFA) challenge does not appear when the user deletes an authenticator**
>
> **Potential cause**: The challenge opens in a popup, and the browser blocked it.
>
> **Fix**: Allow popups for the Portal domain, and then try again. To learn more, read [Step-up authentication](https://auth0.com/docs/customize/portals/architecture.md#step-up-authentication).

> **A component shows 'Too many requests'**
>
> **Potential cause**: The [My Account API](https://auth0.com/docs/manage-users/my-account-api.md) rate limit applied to the user's requests.
>
> **Fix**: Wait a moment, and then select the retry button on the component.

## Forms

> **A Form saves but the user is not updated**
>
> **Potential cause**: The Form's [Flow](https://auth0.com/docs/customize/forms/flows.md) has no [Forms vault](https://auth0.com/docs/customize/forms/vaults.md) connection, or the connection's application lacks the scopes to update users.
>
> **Fix**: Create a vault connection backed by a [machine-to-machine application](https://auth0.com/docs/get-started/auth0-overview/create-applications/machine-to-machine-apps.md) with the scopes the Flow needs. To learn more, read [Forms that update users](https://auth0.com/docs/customize/portals/configure-portal-application.md#forms-that-update-users).

## Sessions and logout

> **Components fail after the user logs out of another application**
>
> **Potential cause**: Logging out ends the user's Auth0 session and invalidates the [refresh token](https://auth0.com/docs/secure/tokens/refresh-tokens) that the Portal uses to mint access tokens. The portal session cookie remains until it expires, so the Portal can stay open while its components fail.
>
> **Fix**: Ask the user to log out of the Portal, and then open it again. To learn more, read [Sessions and token lifetimes](https://auth0.com/docs/customize/portals/architecture.md#sessions-and-token-lifetimes).

> **Passkeys stop working after you switch to a custom domain**
>
> **Potential cause**: [Passkeys](https://auth0.com/docs/authenticate/database-connections/passkeys) are bound to the domain where the user enrolled them.
>
> **Fix**: Users must enroll their passkeys again on the new domain. Use a [custom domain](https://auth0.com/docs/customize/custom-domains.md) from the start to avoid this.

## Layout

> **The hide parameters have no effect**
>
> **Potential cause**: The parameter name or value is wrong. The Portal accepts only `hide_sidebar=true`, `hide_topbar=true`, and `hide_user_menu=true`.
>
> **Fix**: Use the exact names and the value `true`. To learn more, read [Hide portal navigation for in-app browsers](https://auth0.com/docs/customize/portals/access-portals.md#hide-portal-navigation-for-in-app-browsers).

## Error pages

When a request fails before the Portal loads, the browser shows an error page with an HTTP status and a message.

| **Status** | **Message** | **Meaning** | **Fix** |
| - | - | - | - |
| **401** | Unauthorized | The request has no valid portal session. | Open the portal URL again and sign in. |
| **403** | Forbidden | The Portal refused the request. | Check the portal application's configuration. To learn more, read [Configure an Application for Universal Portals](https://auth0.com/docs/customize/portals/configure-portal-application.md). |
| **404** | Portal not found | No Portal has this slug on this domain. | Check the slug and the domain in the portal URL. |
| **404** | Page not found | The Portal has no page with this slug. | Check the page slug, and the Portal's default page. |
| **500** | Internal server error | The Portal could not complete the request. | Try again. If it persists, contact Auth0 Support with the time and the portal slug. |

## Next steps

> **[Configure an Application for Universal Portals](https://auth0.com/docs/customize/portals/configure-portal-application.md)**
>
> Review the application settings that cause most Portal errors.