Users outside US can no longer log in. Regression from 3.12.1.

[alexRocket891]

Checklist

• The issue can be reproduced in the Auth0.Android sample app (or N/A).
• I have looked into the Readme, Examples, and FAQ and have not found a suitable solution or answer.
• I have looked into the API documentation and have not found a suitable solution or answer.
• I have searched the issues and have not found a suitable solution or answer.
• I have searched the Auth0 Community forums and have not found a suitable solution or answer.
• I agree to the terms within the Auth0 Code of Conduct.

Description

Passwordless SMS and email OTP submission (loginWithPhoneNumber / loginWithEmail after startPasswordlessWithPhoneNumber / startPasswordlessWithEmail) fails with AuthenticationException ("Failed to execute the network request") for users in Spain and India starting with SDK version 3.12.2. The same phone number and email work for users in the USA on the same app version.

What we confirmed during testing:

• Clean uninstall + reinstall on 3.12.2+ does NOT fix the issue
• Same device, same phone number, same app version — works in USA,
  fails in Spain and India
• Both SMS and email passwordless fail identically
• 3.12.1 works for the same users without any other changes

We don't have DPoP turned on currently.

Reproduction

1. Install the app built with SDK 3.12.2+ on a device in Spain or India
2. Enter a phone number and request a passwordless SMS OTP
3. Auth0 dashboard confirms the OTP was sent successfully (sms/email arrives)
4. Auth0's passwordless function runs into the error onFailure(error: AuthenticationException) fires with "Failed to execute
   network request"

Additional context

Example code how we use it:

apiClient
                .passwordlessWithSMS(
                    phoneNumber = _loginForm.value.formattedPhoneNumber(),
                    passwordlessType = PasswordlessType.CODE,
                )
                .start(
                    object : Callback<Void?, AuthenticationException> {
                        override fun onSuccess(result: Void?) {
                            // continue to OTP screen
                        }

                        override fun onFailure(error: AuthenticationException) {
                            // log error
                        }
                    },
                )

Auth0.Android version

3.12.2 and 3.13.0

Android version(s)

8 to 16

[pmathew92]

Hi @alexRocket891 , Thanks for reporting this . Is the passwordless login working on 3.12.1 or previous versions ? Is this the only flow that you are facing issue ? Could you also share what the cause property of the exception is printing ?

[pmathew92]

@alexRocket891 I tried the passwordless email flow myself and it is working fine (I am based located in India).

email_flow.mp4

[alexRocket891]

Hi @pmathew92, thanks for the response.

To clarify, everything works correctly on 3.12.1. The only change made was updating the SDK version, after which authentication stopped working for our users outside the US.

To answer your questions:

• So far, we haven’t received reports of issues with social logins regarding this specific "outside US" problem—it seems limited to passwordless authentication.

• This is the second major issue we’ve encountered in the last two versions. The previous version introduced crashes across all login types (including social) when calling SecureCredentialsManager.saveCredentials(credentials) due to the encryption changes.

Regarding the logs, we had to ship 3.12.1 as a hotfix to restore functionality, and we don't have a dedicated logging system built into the release apps yet to capture the cause property from those users. I’m unable to reproduce this via VPN myself, but I’m working on obtaining logs now so I can help tackle this better.

I also tried to use the sample app to reproduce this, but I'm having trouble running it as it seems significantly outdated. It’s using Gradle 7.5, is incompatible with JDK 21, and relies on Kotlin 1.8.10 rather than 2.x. It also depends on SDK 2.9.2.

Is this sample still actively maintained? I noticed the strings.xml.example file as well, which adds an extra step that can be easily overlooked. Additionally, I couldn’t find a sample that demonstrates the specific passwordless functionality shown in your video; the current one seems focused on WebAuth. I don’t currently have the capacity to re-implement the sample from scratch just to evaluate this, so any guidance or a more modern sample would be greatly appreciated.

[alexRocket891]

Update: case property shows Vu4: Failed to execute the network request
Also I was able to log these:

Auth0 Authentication Failure 
--------------------------------------------------  
• Code        : a0.sdk.internal_error.unknown  
• Status HTTP : 0  
• Description : Failed with unknown error  
• Error Name  : N/A 
--------------------------------------------------  
• Network Error?      : true  
• Invalid Creds?      : false  
• Access Denied?      : false  
• MFA Required?       : false  
• Password Leaked?    : false  
• Rule Error?         : false 
--------------------------------------------------

One of the affected users reported that they were able to go past the first step (sending out the otp code), and they had this error come up when entered the correct otp code. Here is an example code of what we do in that step:

apiClient
                .loginWithPhoneNumber(
                    _loginForm.value.formattedPhoneNumber(),
                    _otpText.value,
                )
                .validateClaims()
                .addParameter("scope", "offline_access")
                .addParameter("audience", [audience])
                .start(
                    object : Callback<Credentials, AuthenticationException> {
                        override fun onSuccess(result: Credentials) {
                            secureCredentialsManager.saveCredentials(result)
                            // continue
                        }

                        override fun onFailure(error: AuthenticationException) {
                            error.logAuth0Error()
                            // show error on ui
                        }
                    },
                )

Any idea what could be causing this? Now that one user was able to reach the 2nd step, the issue seems weirder. Can we do anything on our side to mitigate this other than being stuck on 3.12.1? Thank you!

[alexRocket891]

Another update:

After uninstalling and reinstalling - users started reporting that it started working. Previously they claimed it did not - so I apologize for saying it did not in the previous comments. The problem is that we cannot just ask all our users to uninstall and reinstall the app to be able to log in. Is there a way we could work around this? Could this be connected to the fact that 3.12.2 changed the encryption? Long shot, but I am clueless what else could this be.

[pmathew92]

Hi @alexRocket891 , I understand your concern. We highly doubt this is a SDK issue since the changes in 3.12.2 or later is completely unrelated to how the Passwordless or any other login API call works. The changes are related to credentials storage and we are working on the fix for the issue introduced on it.
I have created a minimal sample app for you to try out and check
https://github.com/pmathew92/Auth0_Sample
Let me know if you are able to reproduce this in the above app and please share me the details

[pmathew92]

Failed to execute the network request error is thrown when there is a SocketException || SocketTimeoutException || UnknownHostException and could be due to the user network not being able to connect with your tenant probably due to VPN or some other reasons.

[alexRocket891]

I was able to gather some logs from the auth0_sample, it did confirm, that 3.12.1 works but 3.13.0 does not - tested on same device right after each other. If the user updates from an existing 3.12.1 auth0 sdk version to an app that has 3.13.0 - it will fail with this network request.

Log from 3.12.1

[00:24:00] Checking for existing credentials...
[00:24:00] CREDENTIALS MANAGER ERROR
           Code: NO_CREDENTIALS
           Message: No Credentials were previously set.
[00:24:18] Requesting passwordless email
[00:24:23] Success: Passwordless email sent.
[00:24:29] Verifying OTP
[00:24:34] Success: Credentials saved to secure storage.[6:27 PM]

Log from 3.13.0

[00:26:04] Checking for existing credentials...
[00:26:05] Existing session found for user. Clearing...
[00:26:06] Cleared existing credentials for user
[00:26:10] Requesting passwordless email
[00:26:15] Success: Passwordless email sent.
[00:26:27] Verifying OTP
[00:26:37] AUTHENTICATION ERROR
           Code: a0.sdk.internal_error.unknown
           Status Code: 0
           Description: Failed with unknown error
           Underlying Cause: NetworkErrorException - Failed to execute the network request

[pmathew92]

Hi @alexRocket891 , Thanks for sharing this. Did you try updating to 3.12.2 after 3.12.1 . If not ,could you try this flow. I am trying out which version introduced this regression. Were you behind any VPN when you tried this ? Were you on wifi or cellular network while trying this ?
Were you able to see some logs in your Auth0 tenant ? Could you also share which locality is your tenant based off like US , EU etc
Are you initialising DPoP in the AuthenticationClient or the CredentialsManager class ?

[aujrocket]

I will be able to test next week going from 3.12.1 to 3.12.2. No VPN was used. The person in Spain and India tried both internet connection. Our Auth0 tenant logs say everything was successful. Located in US. We do not use DPoP to my knowledge. Sorry I cannot be more helpful atm.

[pmathew92]

@aujrocket Thank you and apologies for the inconvenience cause due to this .I wasn't able to reproduce this hence woudl require your help to narrow this down. If you could share, once you have time , how you are initialising your AuthenticationAPIClient and CredentialsManager class , that will also be helpful

[aujrocket]

@Provides
    fun provideAuth0(
        @ApplicationContext context: Context,
    ): Auth0 {
        return Auth0.getInstance(
            context.getString(R.string.auth0ClientId),
            context.getString(R.string.auth0Domain),
        )
    }

@Provides
    fun provideAuth0ApiClient(auth0: Auth0): AuthenticationAPIClient {
        return AuthenticationAPIClient(auth0)
    }

@Provides
    fun provideSecureCredentialsManager(
        @ApplicationContext context: Context,
        apiClient: AuthenticationAPIClient,
        auth0: Auth0,
    ): SecureCredentialsManager {
        return SecureCredentialsManager(
            apiClient = apiClient,
            context = context,
            auth0 = auth0,
            storage = SharedPreferencesStorage(context, sharedPreferencesName = AUTH0_SHARED_PREFERENCES_NAME),
        )
    }

In case you ask why we override the sharedprefs name:

The problem: Android's Auto Backup was restoring Auth0's SharedPreferences credentials from a cloud backup onto the
device. When credentials are restored from backup, the associated Keystore encryption keys are not restored (they're
hardware-bound and can't be backed up). This left Auth0 with a credential blob it couldn't decrypt, causing login
failures on the Realme Note 60x (and potentially other devices after reinstalls or device migrations).

The fix was two-fold:

1. Give Auth0's SharedPreferencesStorage a custom name ("auth0_storage") instead of the default
2. Add that file to backup_rules.xml with so Android never backs up or restores those credentials

[aujrocket]

New update: some users started seeing the same network error even with 3.12.1 - but not all the time, just occasionally, while 3.13.0 was all the time persistent. @pmathew92 Do you think it would help if I would manually write some retry logic that silently retries 2-3 times with short delay before surfacing an error message to the user and giving up?

[pmathew92]

Hi @aujrocket , Yes please try adding some retry logic from the app side and check if that mitigates the issue.