iOS users getting logged out multiple times a day

[LA-Johan]

Checklist

• The issue can be reproduced in the react-native-auth0 sample app (or N/A).
• I have looked into the Readme, Examples, and FAQ and have not found a suitable solution or answer.
• I have looked into the API documentation and have not found a suitable solution or answer.
• I have searched the issues and have not found a suitable solution or answer.
• I have searched the Auth0 Community forums and have not found a suitable solution or answer.
• I agree to the terms within the Auth0 Code of Conduct.

Description

Starting about 4 hours ago we've started seeing a new error entry in our Auth0 logs for iOS users. This issue is very widespread and does not coincide with any app release on our end.

Use DPoP Nonce: Authorization server requires nonce in DPoP proof

DPoP proof thumbprints don't match

Reproduction

Users getting logged out intermittently

Additional context

No response

react-native-auth0 version

5.1.0

React Native version

0.81.4

Expo version

No response

Platform

iOS

Platform version(s)

Multiple

[LA-Johan]

Why is the default value true for something that seems like an experimental feature released in a minor version?

react-native-auth0/src/types/common.ts

Line 104 in c90bfa4

* @default true

[lkp-k]

Thanks for making this, I am also facing the same issue.

Happens only on iOS, not on android. Same issue that I see in Auth0 Logs in their online console.

[subhankarmaiti]

Hi @LA-Johan and @lkp-k,

Thanks for reporting this. To clarify:

Why default to true?
We defaulted to true for enhanced security, but you can always set it to false. If your tenant doesn't have DPoP enabled, the SDK will still return Bearer tokens and work as before.

Help us debug:
To quickly resolve this, could you share:

• Is rotating refresh token enabled in your configuration?
• Is DPoP enabled for your tenant?
• Which authentication flow triggers the error (login, token refresh, etc.)?

Temporary workaround:
Set the DPoP flag to false to force the traditional Bearer token flow while we investigate.

// class based approach
const auth0 = new Auth0({
  domain: 'YOUR_AUTH0_DOMAIN',
  clientId: 'YOUR_AUTH0_CLIENT_ID',
  useDPoP: false
});

// hook based apprach
function App() {
  return (
    <Auth0Provider
      domain="YOUR_AUTH0_DOMAIN"
      clientId="YOUR_AUTH0_CLIENT_ID"
      useDPoP={false}
    >
      {/* Your app components */}
    </Auth0Provider>
  );
}

[LA-Johan]

Refresh tokens are enabled, the error happens on token refresh. We released a version with dpop manually set to false earlier today and we're waiting for it to propagate to users. I believe even for the hook based approach the property is called useDpop btw. Dpop is not enabled for our tenant.

…

On Wed, Nov 19, 2025 at 9:26 PM Subhankar Maiti ***@***.***> wrote: *subhankarmaiti* left a comment (auth0/react-native-auth0#1384) <#1384 (comment)> Hi @LA-Johan <https://github.com/LA-Johan> and @lkp-k <https://github.com/lkp-k>, Thanks for reporting this. To clarify: *Why default to true?* We defaulted to true for enhanced security, but you can always set it to false. If your tenant doesn't have DPoP enabled, the SDK will still return Bearer tokens and work as before. *Help us debug:* To quickly resolve this, could you share: - Is refresh token enabled in your configuration? - Which authentication flow triggers the error (login, token refresh, etc.)? *Temporary workaround:* Set the DPoP flag to false to force the traditional Bearer token flow while we investigate. // class based approachconst auth0 = new Auth0({ domain: 'YOUR_AUTH0_DOMAIN', clientId: 'YOUR_AUTH0_CLIENT_ID', useDPoP: false}); // hook based apprachfunction App() { return ( <Auth0Provider domain="YOUR_AUTH0_DOMAIN" clientId="YOUR_AUTH0_CLIENT_ID" DPoP={false} > {/* Your app components */} </Auth0Provider> );} — Reply to this email directly, view it on GitHub <#1384 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/A524DPDLHS6O3J4BWF3I6F335VGIZAVCNFSM6AAAAACMTEO3XKVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZTKNJVHA4TONJZGQ> . You are receiving this because you were mentioned.Message ID: ***@***.***>

[subhankarmaiti]

@LA-Johan

I believe even for the hook based approach the property is called useDpop btw.

Yes you are right, Updated the comment.

[lkp-k]

Is rotating refresh token enabled in your configuration? Yes
Is DPoP enabled for your tenant? No
Which authentication flow triggers the error (login, token refresh, etc.)? My app calls getCredentials in a api request hook, and as soon as the api application's token expires it fails the refresh credentials step

Same as LA-Johan I have to useDPoP={false}

[subhankarmaiti]

Thanks @LA-Johan and @lkp-k for sharing the details.
I was able to reproduce the issue, and it appears to be an underlying iOS SDK problem. We’re working on a fix. In the meantime, please use the workaround mentioned above — I’ve verified that it works correctly.

[LA-Johan]

Will the fix require another client change and do you have a rough ETA? Trying to decide if we should throw a force upgrade blocking screen in front of our users.

…

On Thu, Nov 20, 2025 at 3:17 AM Subhankar Maiti ***@***.***> wrote: *subhankarmaiti* left a comment (auth0/react-native-auth0#1384) <#1384 (comment)> Thanks @LA-Johan <https://github.com/LA-Johan> and @lkp-k <https://github.com/lkp-k> for sharing the details. I was able to reproduce the issue, and it appears to be an underlying iOS SDK problem. We’re working on a fix. In the meantime, please use the workaround mentioned above — I’ve verified that it works correctly. — Reply to this email directly, view it on GitHub <#1384 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/A524DPAEZ2QXN6H2LMKPMA335WPLBAVCNFSM6AAAAACMTEO3XKVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZTKNJXGQZTINRUHE> . You are receiving this because you were mentioned.Message ID: ***@***.***>

[subhankarmaiti]

Hi @LA-Johan,
The fix will require an SDK update. Once you upgrade to the latest version, you can revert the useDPoP flag to its default value and everything should work as expected. No client-side changes will be needed.
The rough ETA for the fix is early next week.

[LA-Johan]

The errors seems to have stopped, did you change anything on your end?

…

On Thu, Nov 20, 2025 at 7:16 AM Subhankar Maiti ***@***.***> wrote: *subhankarmaiti* left a comment (auth0/react-native-auth0#1384) <#1384 (comment)> Hi @LA-Johan <https://github.com/LA-Johan>, the fix will require an SDK update. Once you upgrade to the latest version, you can revert the useDPoP flag to its default value and everything should work as expected. No client-side changes will be needed. — Reply to this email directly, view it on GitHub <#1384 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/A524DPG4DXRDBWGRTREQ76T35XLMTAVCNFSM6AAAAACMTEO3XKVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZTKNJYGYYDQMZWGE> . You are receiving this because you were mentioned.Message ID: ***@***.***>

[subhankarmaiti]

I believe it stopped because you set useDPoP to false and released that change. Or are you saying that it has stopped for existing users on older app versions as well?

[LA-Johan]

Yes, for existing users as well. As a data point it also didn't start with any release from our end, we've had 5.1.0 out for weeks.

…

On Thu, Nov 20, 2025 at 7:37 AM Subhankar Maiti ***@***.***> wrote: *subhankarmaiti* left a comment (auth0/react-native-auth0#1384) <#1384 (comment)> I believe it stopped because you set useDPoP to false and released that change. Or are you saying that it has stopped for existing users on older app versions as well? — Reply to this email directly, view it on GitHub <#1384 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/A524DPH227JPCQJC2FAQXN335XN27AVCNFSM6AAAAACMTEO3XKVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZTKNJYG4YTAOJUGY> . You are receiving this because you were mentioned.Message ID: ***@***.***>

[LA-Johan]

Just heard this from a support engineer:

After doing internal reach-out the issue was released to a feature flag that was enabled during our release yesterday.

[subhankarmaiti]

Hi @LA-Johan @lkp-k ,
Wanted to provide you an update regarding the fix, It is not simple as we expected, We are working on the fix on the iOS SDK first, and then it will be extended to this SDK. So it's going to take a little bit more time, but we are actively working on it, and till then please use useDPoP={false}.