# Auth0 requires organization check

**URL:** <https://community.grafana.com/t/auth0-requires-organization-check/162936>\
**Category:** Authentication\
**Created:** [May 18, 2026, 12:28pm UTC](https://community.grafana.com/t/auth0-requires-organization-check/162936 "2026-05-18T12:28:10Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![sltt](https://avatars.discourse-cdn.com/v4/letter/s/bb73d2/32.png) [@sltt](https://community.grafana.com/u/sltt)\
**Post date:** [May 18, 2026, 12:28pm UTC](https://community.grafana.com/t/auth0-requires-organization-check/162936/1 "2026-05-18T12:28:10Z")

</div>

- What Grafana version and what operating system are you using?  
Grafana OSS v13.1.0

- **What** are you trying to achieve?  
Use Auth0 to authenticate in Grafana

- **How** are you trying to achieve it?  
I have followed [Configure Generic OAuth authentication | Grafana documentation](https://grafana.com/docs/grafana/latest/setup-grafana/configure-access/configure-authentication/generic-oauth/?pg=blog&plcmt=body-txt#set-up-oauth2-with-auth0)

- What happened?  
Auth0 checks the session contains a selected organization within Auth0

- What did you **expect** to happen?  
Grafana logins with a valid Auth0, who previously selected a valid Auth0 organization

- Can you copy/paste the configuration(s) that you are having problems with?

```auto
  \[auth.generic_oauth\]
  enabled = true
  name = Auth0
  allow_sign_up = true
  auto_login = true
  client_id = myClientId
  client_secret = mySecret
  scopes = openid profile email offline_access
  auth_style = InParams
  auth_url = myAuth0/authorize
  token_url = myAuth0/auth/token
  api_url = myAuth0/userinfo
  use_pkce = true
  use_refresh_token = true

```

- Did you receive any errors in the Grafana UI or in related logs? If so, please tell us **exactly** what they were.  
logger=http.server t=2026-05-18T11:29:56.664747997Z level=error msg="failed to login " error=access\_denied errorDesc=“Check your organization access and try again”

- Did you follow any online instructions? If so, what is the URL?

> **[Set up OAuth2 with Auth0 - Configure Generic OAuth authentication | Grafana...](https://grafana.com/docs/grafana/latest/setup-grafana/configure-access/configure-authentication/generic-oauth/?pg=blog&plcmt=body-txt#set-up-oauth2-with-auth0)**
>
> There are numerous authentication methods available in Grafana to verify user identity. The authentication configuration dictates which users can access Grafana and the methods they can use for logging in. You can also configure Grafana to...

So the problem I am facing is that Auth0 requires an organization. I login successfully with Auth0 in another browser tab, when I go to Grafana’s tab, it is supposed to use the same Auth0, and indeed it uses it, but Auth0 complains that the organization is missing, and I did selected the organization in the Auth0 login.

Another option that the Auht0 admin gave me is that Grafana sends the query parama prompt=none, but I don’t know how to do that, and simply adding the query parameter to the authorize endpoint did not work.

---

<div class="post-metadata">

**Author:** ![infofcc3](https://sea2.discourse-cdn.com/grafana/user_avatar/community.grafana.com/infofcc3/32/51248_2.png) [@infofcc3](https://community.grafana.com/u/infofcc3)\
**Post date:** [May 21, 2026, 4:49am UTC](https://community.grafana.com/t/auth0-requires-organization-check/162936/2 "2026-05-21T04:49:54Z")

</div>

So the issue in the config which you posted is

 ![Screenshot (65)](https://us1.discourse-cdn.com/grafana/original/3X/a/1/a112ab2b454df72c9b20fb1c2e11f809d7e943a6.png)

1. auto\_login = true → this causes a infinite redirect loop .Grafana redirect to Auth0 and Auth0 redirect back which repeats forever  
so replace this by **auto\_login = false**  
2)Wrong token\_url → Auth0 token endpoint is never → /auth/token  
this cause **failed to get token from provider** error  
so use token\_url -\>https://YOUR\_DOMAIN/oauth/token  
3)Missing extra\_params →   
**Main Issue:** Without sending “organisation=org\_id” to Auth0 on every login request, Auth0 cannot see which organisation the user belongs so it throws **error → access\_denied — Check your organisation access and try again**  
Remove error by using extra\_params = organisation=your\_org\_id  
Always use extra\_params this is the best way to pass organisation to Auth0.  
4)auth\_style = InParams . This forces client credentials into URL parameters instead of the request body. With use\_pkce = true already set, this creates a conflict in how Auth0 receives the authentication request. so **remove** this line completely  
5)Incomplete auth\_url and api\_url  
Grafana cannot make a valid redirect without the full URL.  
so use this  
auth\_url = https://YOUR\_DOMAIN/authorize  
api\_url = https://YOUR\_DOMAIN/userinfo

make sure you configured the application URLs

 ![Screenshot (64)](https://us1.discourse-cdn.com/grafana/original/3X/1/e/1ea67b051f89264cf1187a91aab8edacb2a3ef99.png)

---

<div class="post-metadata">

**Author:** ![sltt](https://avatars.discourse-cdn.com/v4/letter/s/bb73d2/32.png) [@sltt](https://community.grafana.com/u/sltt)\
**Post date:** [May 28, 2026, 6:45am UTC](https://community.grafana.com/t/auth0-requires-organization-check/162936/3 "2026-05-28T06:45:37Z")

</div>

Thanks @infofcc3 for taking your time to answering my question. I did not find this “extra\_params” as a possibe setting.  
Anyway, the organization is dynamic.  
We ended up intercepting the authorize redirect and injecting the organization query parameter.  
Best