Troubleshooting

The most common errors when integrating Block-Auth. Each one shows the message you see, why it happens and how to fix it.

App not active

Message: App not active, contact your admin (403).

Cause: your app is not active yet. An app becomes active only after its domain is validated with a DNS record.

Fix: in the Dashboard, open the app, copy the verification value and add it as a TXT record on your domain. Then press validate. DNS changes can take a few minutes to propagate. See Validate your domain.

Authentication blocked

Message: Authentication blocked: tenant billing grace period ended. (403).

Cause: your company account has a pending payment and the grace period is over. Logins to all its apps are blocked.

Fix: settle the billing from the Dashboard. Logins work again as soon as the account is up to date.

Invalid redirect_uri

Message: Invalid redirect_uri (400), from /api/auth/authorize or /api/auth/token.

Cause: the redirectUri you send doesn't meet the rules.

Fix: make sure that it:

• Uses https. Your app's domain must be validated, so in development use your development domain through a tunnel, not localhost (one app per environment).
• Has exactly the host of your app's domain, port included.
• Has no user, password or #fragment, and is shorter than 2048 characters.
• Is the same in /api/auth/authorize and in /api/auth/token.

Invalid code

Message: Invalid code (400), from /api/auth/token.

Cause: the code expired, was already redeemed, or was issued for another redirectUri.

Fix: redeem the code as soon as your callback receives it: it lasts 60 seconds and works only once. Don't redeem it twice, for example on a page reload or a double request. Send the same redirectUri you used to get it.

The login popup does not open

Message: Login popup blocked or Login window closed in the browser console.

Cause: the browser blocked the popup, or your page lost contact with it.

Fix:

• Open the login straight from the user's click. If your code awaits something before opening it, the browser blocks the popup.
• Serve the page from your app's validated domain.
• If your site sends Cross-Origin-Opener-Policy: same-origin, change it to same-origin-allow-popups. Otherwise your page can't receive the result from the popup.

Backend routes do not answer

Message: [Block-Auth] … in the browser console, after the login or when the page loads.

Cause: the widget calls /code, /me and /logout under /auth/blockauth (or your authEndpoint), and one of them is missing, unreachable or answered by your frontend instead of your backend.

Fix: follow the message. It names the route and what to change:

• answered 404: add that route to your backend (Backend routes).
• did not reach your backend: serve the routes from the same origin as your page, or allow your page's origin in your backend's CORS with credentials. The routes must answer without redirects.
• without JSON: your frontend server answered instead of your backend. Proxy /auth/blockauth to your backend in your dev server (examples for Vite and Angular) and in production.
• could not redeem the code: check your backend logs and the apiKey, apiSecret hash and redirectUri it sends to /api/auth/token.

Content Security Policy

Message: errors like Refused to connect to … because it violates the Content Security Policy in the console.

Cause: your site sends a CSP that doesn't allow the SDK's connections.

Fix: add the widget's sources to your CSP:

connect-src 'self' https://wss.block-auth.io;
img-src 'self' https://dashboard.block-auth.io;
style-src 'self' 'unsafe-inline';

What each one is for is in Try it and go live.

No webhooks arrive

Cause: the URL is ignored, or your endpoint takes too long.

Fix: check that the URL in the Dashboard uses https, is on your app's domain and is not /signout/callback. Answer in under 5 seconds and don't redirect. Each event is sent only once. See Webhooks.

Other API errors

If you still can't solve it, contact Block-Auth support with the exact error message.