Troubleshooting Account Protection for Auth0

The Action follows your FAIL_OPEN setting and records the problem in the user's app_metadata as ap_last_error. Check that AP_BASE_URL is reachable and that AP_TIMEOUT_MS isn't set too low.

A configuration problem always fails open, whatever your FAIL_OPEN setting, because there's nothing safe to enforce. Check for a missing or invalid AP_USERNAME, AP_PASSWORD, AP_BASE_URL, or AP_ALLOWED_HOST, and confirm that the hostname of the base URL exactly matches the allowed host. The Action's logs show configuration error when this happens.

The Action doesn't write these values to Monitoring → Logs, so they won't appear there. Open your browser's Network tab, find the /authorize request, and confirm that both ext- parameters are in the URL. If any are missing, make sure you're reading them from the snapshot() bundle and that each value meets the limits in Limits for ext- Parameters in the Auth0 Login Redirect[Limits for ext- Parameters in the Auth0 Login Redirect].

Sign in to your Accertify Account Protection portal to see the user's history, including the recommendation for each login and sign-up attempt.

In Auth0's Monitoring → Logs, a blocked sign-up appears as a failed sign-up with extensibility_error. The description shows a short reason, such as ap_deny for a deny recommendation, or ap_unavailable when Accertify couldn't be reached and FAIL_OPEN is false.

Check the connection type. For which sign-ups the Pre User Registration Action screens, see Sign-Up Screening Coverage for Auth0[Sign-Up Screening Coverage for Auth0].

Contact your Accertify representative. Include: