{"record":{"id":"eaf3ceebbd4d19a2","repo":"mastra-ai/mastra","slug":"failed-to-fetch-user-info-from-auth0","errorCode":null,"errorMessage":"Failed to fetch user info from Auth0","messagePattern":"Failed to fetch user info from Auth0","errorType":"http","errorClass":null,"httpStatus":null,"severity":"error","filePath":"auth/auth0/src/index.ts","lineNumber":636,"sourceCode":"      const params = new URLSearchParams({\n        client_id: self.clientId!,\n        returnTo: redirectUri,\n      });\n      return `https://${self.domain}/v2/logout?${params.toString()}`;\n    };\n  }\n\n  /**\n   * Fetch user info from Auth0's /userinfo endpoint.\n   */\n  private async _fetchUserInfo(accessToken: string): Promise<EEUser> {\n    const userInfoResponse = await fetch(`https://${this.domain}/userinfo`, {\n      headers: { Authorization: `Bearer ${accessToken}` },\n      signal: AbortSignal.timeout(10_000), // 10 second timeout\n    });\n\n    if (!userInfoResponse.ok) {\n      throw new Error('Failed to fetch user info from Auth0');\n    }\n\n    const userInfo = (await userInfoResponse.json()) as {\n      sub: string;\n      email?: string;\n      name?: string;\n      picture?: string;\n    };\n\n    return {\n      id: userInfo.sub,\n      email: userInfo.email,\n      name: userInfo.name,\n      avatarUrl: userInfo.picture,\n    };\n  }\n\n  // ============================================================================","sourceCodeStart":618,"sourceCodeEnd":654,"githubUrl":"https://github.com/mastra-ai/mastra/blob/75dd419e613fe9c39f846ffc500716141b74fda6/auth/auth0/src/index.ts#L618-L654","documentation":"MastraAuthAuth0 verifies a user's access token by calling Auth0's standard /userinfo endpoint (https://<domain>/userinfo) with a 10-second timeout. If the HTTP response status is not OK (e.g. 401 invalid/expired token, 403, 429, 5xx), the provider throws this generic error. It means Auth0 rejected or could not serve the userinfo request for the supplied bearer token.","triggerScenarios":"Any call path that resolves user info (e.g. authenticateUser/verifyToken) where fetch(`https://${this.domain}/userinfo`, { headers: { Authorization: Bearer <accessToken> } }) returns userInfoResponse.ok === false — expired/revoked/malformed access token, wrong Auth0 domain, audience mismatch, network/gateway errors, or the 10s AbortSignal.timeout firing (which surfaces as a fetch rejection/timeout before this throw, but non-2xx triggers the throw).","commonSituations":"Misconfigured AUTH0_DOMAIN env var (typo or wrong tenant), access tokens issued for a different API audience than the domain expects, expired or revoked tokens forwarded from the client, Auth0 tenant outages or rate limiting (429), and self-signed/corporate proxy TLS failures.","solutions":["Verify the access token is a valid, unexpired Auth0 token for the correct audience — re-authenticate the user to obtain a fresh token.","Check the Auth0 domain configuration (options.domain / AUTH0_DOMAIN) matches your tenant, e.g. 'your-tenant.us.auth0.com', with no stray https:// or trailing slash.","Log userInfoResponse.status in a local repro to distinguish 401 (bad token) from 403/429/5xx (permissions, rate limit, outage).","Confirm network egress: the provider hits https://<domain>/userinfo with a 10s timeout; ensure proxies/firewalls allow it."],"exampleFix":"// before: token minted for wrong audience, 401 on /userinfo\nconst auth = new MastraAuthAuth0({ domain: 'wrong-tenant.auth0.com' });\n\n// after: correct tenant domain and fresh audience-correct token\nconst auth = new MastraAuthAuth0({ domain: 'my-tenant.us.auth0.com' });\n// client obtains token with audience matching the API registered in Auth0","handlingStrategy":"try-catch","validationCode":"if (!accessToken || !domain) throw new Error('Auth0 access token and domain are required before verifying user info');","typeGuard":"function isAuth0AuthError(e: unknown): e is Error & { message: 'Failed to fetch user info from Auth0' } {\n  return e instanceof Error && e.message === 'Failed to fetch user info from Auth0';\n}","tryCatchPattern":"try {\n  await authConfig.verifyToken(token);\n} catch (e) {\n  if (isAuth0AuthError(e)) {\n    // treat as 401: force client re-authentication\n    return respondUnauthorized('Auth0 rejected the token; re-authenticate');\n  }\n  throw e;\n}","preventionTips":["Keep AUTH0_DOMAIN and client configuration in validated env checks at boot.","Refresh access tokens before expiry on the client instead of forwarding stale tokens.","Monitor Auth0 tenant status/rate limits; back off on 429 before retrying."],"tags":["network","auth0","oauth","http-4xx"],"backgroundTag":"userinfo-fetch-failed","analyzedSha":"75dd419e613fe9c39f846ffc500716141b74fda6","analyzedAt":"2026-08-30T00:15:31.844Z","schemaVersion":2},"datasetVersion":"2026-08-30T03:17:51.788Z"}