---
title: Troubleshooting Account Protection for Auth0
slug: public-apis/troubleshooting-account-protection-for-auth0
createdAt: 2026-11-02T15:08:19.857Z
---

::::ExpandableHeading
###

**Topic type: Reference**

:::hint{type="warning"}
**Purpose**: Describes common issues with Accertify Account Protection for Auth0 and how to resolve them.

**Audience**: Engineers and administrators who operate the Auth0 integration.

**Applies to**: The Post Login and Pre User Registration Actions.

**Does not apply to**: Event types that are integrated directly with Accertify outside of Auth0.
:::
::::

## Accertify Connection

:::ExpandableHeading
### Accertify is unreachable or returning errors

The Action follows your `FAIL_OPEN` setting and records the problem in the user's `app_metadata` as `ap_last_error`. Check that `AP_BASE_URL` is reachable and that `AP_TIMEOUT_MS` isn't set too low.
:::

***

:::ExpandableHeading
### Every login is allowed, even with FAIL\_OPEN set to false

A configuration problem always fails open, whatever your `FAIL_OPEN` setting, because there's nothing safe to enforce. Check for a missing or invalid `AP_USERNAME`, `AP_PASSWORD`, `AP_BASE_URL`, or `AP_ALLOWED_HOST`, and confirm that the hostname of the base URL exactly matches the allowed host. The Action's logs show `configuration error` when this happens.
:::

***

## Login and Sign-Up Data

:::ExpandableHeading
### The ext- values don't seem to reach Auth0

The Action doesn't write these values to **Monitoring → Logs**, so they won't appear there. Open your browser's Network tab, find the `/authorize` request, and confirm that both `ext-` parameters are in the URL. If any are missing, make sure you're reading them from the `snapshot()` bundle and that each value meets the limits in [Limits for ext- Parameters in the Auth0 Login Redirect](docId\:wPjzSjrRQySPva4cK8SsV).
:::

***

## Blocked and Unscreened Attempts

:::ExpandableHeading
### A login or sign-up was blocked. How do I see why?

Sign in to your Accertify Account Protection portal to see the user's history, including the recommendation for each login and sign-up attempt.

In Auth0's **Monitoring → Logs**, a blocked sign-up appears as a failed sign-up with `extensibility_error`. The description shows a short reason, such as `ap_deny` for a deny recommendation, or `ap_unavailable` when Accertify couldn't be reached and `FAIL_OPEN` is `false`.
:::

***

:::ExpandableHeading
### Some sign-ups aren't being screened

Check the connection type. For which sign-ups the Pre User Registration Action screens, see [Sign-Up Screening Coverage for Auth0](docId:1qVbpSvIf1O-5b9WtSW77).
:::

***

## Getting Help

:::ExpandableHeading
### I need help from Accertify

Contact your Accertify representative. Include:

- Your Auth0 tenant name.
- The approximate time of the affected login.
- Any `ap_last_error` value from the user's `app_metadata`.
:::



***

**See also**:

::::LinkArray{contentSource="CUSTOM"}
:::LinkArrayItem
[Account Protection Action Settings](docId\:CKmGRPHPq-gqQuJ6HwoY6)
:::

:::LinkArrayItem
[Limits for ext- Parameters in the Auth0 Login Redirect](docId\:wPjzSjrRQySPva4cK8SsV)
:::

:::LinkArrayItem
[Sign-Up Screening Coverage for Auth0](docId:1qVbpSvIf1O-5b9WtSW77)
:::

:::LinkArrayItem
[Account Protection Recommendations in Auth0](docId\:v0lnnu9s6yJFlhDN_HQ5M)
:::
::::