CHANGELOG.md

Change Log

v2.16.2 (2026-04-17)

Full Changelog

Changed

• chore(deps): bump @auth0/auth0-spa-js from 2.18.0 to 2.19.2 #1093 (yogeshchoudhary147)

v2.16.1 (2026-03-31)

Full Changelog

Changed

• chore(deps): bump @auth0/auth0-spa-js from 2.18.2 to 2.18.3 #1068 (dependabot[bot])
• chore(deps): bump @auth0/auth0-spa-js from 2.18.0 to 2.18.2 #1065 (dependabot[bot])

v2.16.0 (2026-03-25)

Full Changelog

Added

• feat: add client prop to Auth0Provider #1041 (yogeshchoudhary147)
• Native to Web SSO support (via auth0-spa-js v2.18.0)

Changed

• chore(deps): bump @auth0/auth0-spa-js from 2.17.1 to 2.18.0 #1059 (yogeshchoudhary147)

v2.15.1 (2026-03-13)

Full Changelog

Changed

• chore(deps): update @auth0/auth0-spa-js to version 2.17.1 #1045 (gyaneshgouraw-okta)

v2.15.0 (2026-02-17)

Full Changelog

Added

• feat: add Step-Up Authentication section and related examples to documentation #1023 (gyaneshgouraw-okta)

v2.14.0 (2026-02-13)

Full Changelog

Added

• feat: add Multi-Factor Authentication (MFA) support #1014 (gyaneshgouraw-okta)

Changed

• chore: bump @auth0/auth0-spa-js to v2.15.0 #1017 (yogeshchoudhary147)

v2.13.0 (2026-02-05)

Full Changelog

Added

• feat: add loginWithCustomTokenExchange and deprecate exchangeToken #1010 (yogeshchoudhary147)

v2.12.0 (2026-01-28)

Full Changelog

Added

• feat: add getConfiguration method to Auth0Client and updated documentation #991 (gyaneshgouraw-okta)
• Security: Example app update Next.js dependency for CVE-2025-55184 and CVE-2025-55183 #951 (tusharpandey13)

v2.11.0 (2025-12-11)

Full Changelog

Added

• chore: upgrade @auth0/auth0-spa-js to v2.11.0 #948 (yogeshchoudhary147)

v2.10.0 (2025-12-05)

Full Changelog

Added

• feat: add custom token exchange support #928 (gyaneshgouraw-okta)

v2.9.0 (2025-11-18)

Full Changelog

Added

• Refactor connectAccountWithRedirect to Use Top-Level Scopes and Upgrade Auth0 SPA JS to v2.9.0 #933 (gyaneshgouraw-okta)
• docs: Add Ask DeepWiki badge to README #922 (arpit-jn)

v2.8.0 (2025-10-17)

Full Changelog

Added

• Bump auth0-spa-js for connected account updates #923 (adamjmcgrath)

v2.7.0 (2025-10-15)

Full Changelog

Added

• Add support for connected accounts #912 (adamjmcgrath)

v2.6.0 (2025-10-06)

Full Changelog

Added

• Implement MRRT #906 (aridibag)

v2.5.0 (2025-09-17)

Full Changelog

Added

• Add support for DPoP #869 (martinml)

v2.4.0 (2025-07-22)

Full Changelog

Added

• Bump @auth0/auth0-spa-js from 2.2.0 to 2.3.0 #858 (dependabot[bot])

Fixed

• Enhance type safety in Auth0Provider and reducer by introducing generic user type #842 (gyaneshgouraw-okta)

v2.3.0 (2025-01-21)

Full Changelog

Added

• Release v2.3.0 #825 (tusharpandey13)
• Feature/react19 #824 (tusharpandey13)
• Add ReversingLabs Workflow (Don't Merge) #782 (developerkunal)

Changed

• ci: changed pull_request_target to pull_request and removed the authorize step #796 (desusai7)
• Bump @testing-library/react from 14.1.2 to 14.3.1 #757 (dependabot[bot])
• Bump ts-jest from 29.1.1 to 29.1.5 #766 (dependabot[bot])
• Bump cypress from 13.6.1 to 13.12.0 #770 (dependabot[bot])
• Bump @types/jest from 29.5.11 to 29.5.12 #750 (dependabot[bot])
• Bump @types/react from 18.2.45 to 18.2.64 #747 (dependabot[bot])
• Bump browserstack-cypress-cli from 1.28.0 to 1.28.1 #715 (dependabot[bot])

Fixed

• fix npm release workflow #826 (tusharpandey13)
• Update codeowner file with new GitHub team name #790 (stevenwong-okta)
• Workaround for failing "integration test (CRA)" #769 (nandan-bhat)

Removed

• Revert "Release v2.3.0" #827 (tusharpandey13)

Security

• Bump pretty-quick from 3.1.3 to 3.3.1 #736 (dependabot[bot])
• Bump next from 13.5.6 to 14.1.1 in /examples/nextjs-app #761 (dependabot[bot])
• Bump jose from 4.11.0 to 4.15.5 in /examples/users-api #749 (dependabot[bot])
• Bump express from 4.18.2 to 4.19.2 in /examples/users-api #754 (dependabot[bot])
• Bump follow-redirects from 1.15.3 to 1.15.6 #752 (dependabot[bot])
• Bump ws from 7.5.9 to 7.5.10 #768 (dependabot[bot])
• Bump braces from 3.0.2 to 3.0.3 #773 (dependabot[bot])
• Bump oidc-provider from 8.4.3 to 8.4.5 #720 (dependabot[bot])

v2.2.4 (2023-12-11)

Full Changelog

Changed

• Update Auth0-SPA-JS to latest version #690 (frederikprijck)

v2.2.3 (2023-11-02)

Full Changelog

Fixed

• Revert "Make OAuthError extend GenericError" #646 (frederikprijck)

v2.2.2 (2023-10-31)

Full Changelog

Fixed

• Export all errors from SPA-JS #637 (frederikprijck)

Changed

• Make OAuthError extend GenericError #638 (frederikprijck)

v2.2.1 (2023-08-22)

Full Changelog

Fixed

• bump auth0-spa-js to latest version #560 (frederikprijck)

v2.2.0 (2023-07-13)

Full Changelog

Added

• Support Organization Name #552 (frederikprijck)

Fixed

• Fix incorrect logout jsdocx example #551 (frederikprijck)
• Fix inconsistent logout function types #548 (frederikprijck)

v2.1.1 (2023-06-14)

Full Changelog

Changed

• bump SPA-JS to the latest version #543 (frederikprijck)

v2.1.0 (2023-05-05)

Full Changelog

Added

• Adding onBeforeAuthentication to the withAuthenticationRequired HOC #534 (stephenkelzer)

v2.0.2 (2023-04-26)

Full Changelog

Fixed

• Remove useUnknownInCatchVariables to be compliant with TS ^4.4 #511 (cemercier)

v2.0.1 (2023-02-22)

Full Changelog

Fixed

• Support redirectUri again in a deprecated way #507 (frederikprijck)

v2.0.0 (2023-01-19)

Auth0-React v2 includes many significant changes compared to v1:

• Removal of polyfills from bundles
• Introduction of authorizationParams and logoutParams for properties sent to Auth0
• Removal of buildAuthorizeUrl and buildLogoutUrl
• Removal of redirectMethod on loginWithRedirect in favour of openUrl
• Removal of localOnly from logout in favour of openUrl
• Renaming of ignoreCache to cacheMode and introduction of cache-only
• Use application/x-www-form-urlencoded by default
• Do not fallback to refreshing tokens via iframe by default
• Changes to default scopes and removal of advancedOptions.defaultScope
• Removal of claimCheck on withAuthenticationRequired

As with any major version bump, v2 of Auth0-React contains a set of breaking changes. Please review the migration guide thoroughly to understand the changes required to migrate your application to v2.

v2.0.0-beta.0 (2022-12-12)

Auth0-React v2 includes many significant changes compared to v1:

• Removal of polyfills from bundles
• Introduction of authorizationParams and logoutParams for properties sent to Auth0
• Removal of buildAuthorizeUrl and buildLogoutUrl
• Removal of redirectMethod on loginWithRedirect in favour of openUrl
• Removal of localOnly from logout in favour of openUrl
• Renaming of ignoreCache to cacheMode and introduction of cache-only
• Use application/x-www-form-urlencoded by default
• Do not fallback to refreshing tokens via iframe by default
• Changes to default scopes and removal of advancedOptions.defaultScope
• Removal of claimCheck on withAuthenticationRequired

As with any major version bump, v2 of Auth0-React contains a set of breaking changes. Please review the migration guide thoroughly to understand the changes required to migrate your application to v2.

v1.12.1 (2023-01-12)

Full Changelog

Security

• Upgrade @auth0/auth0-spa-js to 1.22.6 #468 (ewanharris)

This patch release is identical to 1.12.0 but has been released to ensure tooling no longer detects a vulnerable version of jsonwebtoken being used by @auth0/auth0-spa-js.

Even though 1.22.5 of @auth0/auth0-spa-js was not vulnerable for the related CVE because of the fact that jsonwebtoken is a devDependency of @auth0/auth0-spa-js, we are cutting a release to ensure build tools no longer report our SDK's that use @auth0/auth0-spa-js as vulnerable to the mentioned CVE.

v1.12.0 (2022-10-12)

Full Changelog

Added

• [SDK-3666] Support multiple providers #416 (ewanharris)

v1.11.0 (2022-09-13)

Full Changelog

Added

• Enrich onRedirectCallback method with User object (#400) #401 (devjmetivier)

v1.10.2 (2022-06-22)

Full Changelog

Fixed

• Correctly extend Error for OAuthError #367 (mjbcopland)

v1.10.1 (2022-04-28)

Full Changelog

Fixed

• Make sure handleRedirectCallback is only called once in StrictMode React 18 #355 (adamjmcgrath)

v1.10.0 (2022-04-19)

Full Changelog

Added

• Update React and other deps #350 (adamjmcgrath)

Fixed

• appState is an optional argument #341 (adamjmcgrath)

v1.9.0 (2022-01-14)

Full Changelog

Added

• Update to auth0-spa-js@1.19.3 #319 (adamjmcgrath)
• Memoize context value in auth0-provider #318 (claycoleman)

Fixed

• Avoid potential multiple invocations of loginWithRedirect #311 (kweiberth)
• Add connection property to Auth0ProviderOptions #283 (stevehobbsdev)

v1.8.0 (2021-09-20)

Full Changelog

Added

• Bump Auth0-SPA-JS to 1.18.0 #279 (adamjmcgrath)

v1.7.0 (2021-09-06)

Full Changelog

Added

• Bump SPA JS to 1.17.1 #270 (adamjmcgrath)

v1.6.0 (2021-07-14)

Added

• [SDK-2603] Expose custom caching options from Auth0 SPA SDK #255 (stevehobbsdev)

v1.5.0 (2021-05-05)

Added

• Expose handleRedirectCallback #233 (stevehobbsdev)
• Add TUser type param to useAuth0 hook #230 (Jameskmonger)

Changed

• Update User type #236 (tkiryu)

Fixed

• Check for state along with error param #231 (adamjmcgrath)

v1.4.0 (2021-03-26)

Added

• Update SPA JS, add organizations docs and example #211 (adamjmcgrath)

Fixed

• Update auth state on access token fail #219 (adamjmcgrath)
• Updates to user should not update memoized getAccessToken* methods #213 (adamjmcgrath)

v1.3.0 (2021-02-16)

Added

• Added buildAuthorizeUrl and buildLogoutUrl #190 (THISS)

Changed

• isLoading should default to true even when doing SSR #193 (adamjmcgrath)

v1.2.0 (2020-11-04)

Added

• [SDK-2106] Memoize auth methods #150 (adamjmcgrath)
• Add react fast refresh support #151 (Idered)
• [SDK-2105] Skip redirect callback option #148 (adamjmcgrath)
• [SDK-2104] Update peerDeps to account for react 17 #147 (adamjmcgrath)
• [SDK-1938] Update the user/isAuthenticated state after getting a token #146 (adamjmcgrath)
• Add config argument to getAccessTokenWithPopup #141 (ygist)
• Export AppState type for custom onRedirectCallback's #120 (adamjmcgrath)

v1.1.0 (2020-09-17)

Added

• [SDK-1927] Check for state param in callback url #107 (adamjmcgrath)
• Support react v16.11 #99 (tiagob)

Fixed

• [SDK-1836] Update state for local logouts #81 (adamjmcgrath)
• Add config argument to loginWithPopup #77 (Aulos)

v1.0.0 (2020-06-19)

Breaking Change

• Allow custom returnTo in withAuthenticationRequired #41 (adamjmcgrath)

v0.4.0 (2020-06-05)

Added

• [SDK-1697] Add custom user agent to spa js #28 (adamjmcgrath)
• Use checkSession to start login #27 (adamjmcgrath)
• [SDK-1690] Add generated API docs #25 (adamjmcgrath)

v0.3.1 (2020-06-01)

Fixed

• getToken methods were being called in the wrong scope #24 (adamjmcgrath)

v0.3.0 (2020-05-29)

Added

• [SDK-1641] Add SSR support #17 (adamjmcgrath)

Breaking Changes

• [SDK-1694] Camel case props #22 (adamjmcgrath)
• [SDK-1693] Renames some init props #21 (adamjmcgrath)

v0.2.0 (2020-05-20)

Added

• [SDK-1642] Add missing methods from SPA JS #11 (adamjmcgrath)
• [SDK-1582] Normalize the auth0 error and add error handling to the basic example #10 (adamjmcgrath)

Changed

• Rename auth prop to prevent clashes and align with public api #14 (adamjmcgrath)
• Bundle SPA JS with the SDK for easier install #13 (adamjmcgrath)

v0.1.0 (2020-05-08)

Added

• [SDK-1580][SDK-1581] Add withAuth and withLoginRequired #7 (adamjmcgrath)
• [SDK-1583] Setup basic README for Early Access #6 (adamjmcgrath)
• [SDK-1577][SDK-1578] Add login functionality #5 (adamjmcgrath)
• [SDK-1576] Linting #4 (adamjmcgrath)
• [SDK-1572] Added CircleCI config #3 (Widcket)
• [SDK-1568] Set up unit tests #2 (adamjmcgrath)
• [SDK-1570][SDK-1571] Setup dev environment and build targets #1 (adamjmcgrath)