# initiateBackchannelAuthentication vs backchannelAuthentication in Auth0-Auth-JS: A Complete Guide

> Understand the difference between initiateBackchannelAuthentication and backchannelAuthentication in Auth0-Auth-JS. Discover when to use each for complete CIBA flow control.

- Repository: [Auth0/auth0-auth-js](https://github.com/auth0/auth0-auth-js)
- Tags: deep-dive
- Published: 2026-02-25

---

**`backchannelAuthentication` executes the complete Client-Initiated Backchannel Authentication (CIBA) flow with automatic polling, while `initiateBackchannelAuthentication` only starts the flow and returns the authentication request ID for manual handling.**

The `auth0/auth0-auth-js` SDK provides two distinct approaches to implementing the Client-Initiated Backchannel Authentication (CIBA) protocol for decoupled authentication scenarios. Understanding the difference between `initiateBackchannelAuthentication` and `backchannelAuthentication` is essential for developers building applications where the consumption device (like a smart TV or IoT device) is separate from the authentication device (the user's phone or security key).

## What is Client-Initiated Backchannel Authentication (CIBA)?

CIBA is an OAuth 2.0 extension that enables a client application to initiate authentication on a separate device from where the user actually performs the login. This flow is ideal for input-constrained devices like smart TVs, kiosks, or IoT hardware where entering credentials directly on the device is impractical. The user receives a notification on their authentication device (typically a smartphone) to approve or deny the request.

## Key Differences Between initiateBackchannelAuthentication and backchannelAuthentication

The SDK implements these as two distinct methods in [`packages/auth0-auth-js/src/auth-client.ts`](https://github.com/auth0/auth0-auth-js/blob/main/packages/auth0-auth-js/src/auth-client.ts), each serving different architectural needs based on who controls the polling logic.

### backchannelAuthentication: The Complete Flow

The `backchannelAuthentication` method (lines 444-496) executes the entire CIBA flow automatically. It performs three operations sequentially:

1. Calls the `/bc-authorize` endpoint to initiate the authentication
2. Polls the token endpoint at the specified interval until the user completes authentication on their device
3. Returns a complete `TokenResponse` containing `access_token`, `id_token`, and other credentials

This method handles all polling logic internally, including respecting the `interval` parameter and managing `BackchannelAuthenticationError` states.

### initiateBackchannelAuthentication: Manual Control

The `initiateBackchannelAuthentication` method (lines 498-549) only performs the first step of the CIBA flow. It:

1. Calls the `/bc-authorize` endpoint
2. Returns the raw response containing `auth_req_id`, `expires_in`, and `interval`
3. Does not poll the token endpoint

This gives developers full control over the polling strategy, allowing for custom backoff algorithms, server-side handling, or UI updates between polling attempts.

### backchannelAuthenticationGrant: The Token Exchange

When using the manual flow, you must subsequently call `backchannelAuthenticationGrant` (lines 560-576) to exchange the `auth_req_id` for tokens. This method handles the token endpoint request once you determine the user has completed authentication.

## Implementation Details in auth0-auth-js

Both methods are implemented in [`packages/auth0-auth-js/src/auth-client.ts`](https://github.com/auth0/auth0-auth-js/blob/main/packages/auth0-auth-js/src/auth-client.ts) and share common infrastructure:

- **Discovery**: Both start by calling `#discover()` to retrieve issuer metadata, including the `backchannel_authentication_endpoint` and `token_endpoint`
- **Parameter Building**: Both construct a `URLSearchParams` object with `scope`, `client_id`, `binding_message`, and `login_hint` containing the user's `sub` claim
- **Error Handling**: Both utilize `BackchannelAuthenticationError` defined in [`packages/auth0-auth-js/src/errors.ts`](https://github.com/auth0/auth0-auth-js/blob/main/packages/auth0-auth-js/src/errors.ts) for flow-specific error conditions

The type definitions for `BackchannelAuthenticationOptions` and `TokenResponse` are located in [`packages/auth0-auth-js/src/types.ts`](https://github.com/auth0/auth0-auth-js/blob/main/packages/auth0-auth-js/src/types.ts).

## Code Examples

### Using backchannelAuthentication (Automatic Polling)

Use this approach when you want the SDK to handle the entire flow:

```typescript
import { AuthClient } from '@auth0/auth0-auth-js';

const authClient = new AuthClient({
  domain: 'your-domain.auth0.com',
  clientId: 'your-client-id',
  clientSecret: 'your-client-secret'
});

// Executes complete flow: initiation + polling + token retrieval
const tokenResponse = await authClient.backchannelAuthentication({
  bindingMessage: 'Approve purchase #1234',
  loginHint: { sub: 'auth0|5f6e7d8c9b0a1b2c3d4e5f6g' }
});

console.log(tokenResponse.access_token);
console.log(tokenResponse.id_token);

```

The SDK automatically polls the token endpoint at the interval specified by the authorization server until the user completes authentication on their device.

### Using initiateBackchannelAuthentication (Manual Control)

Use this approach when you need custom polling logic or server-side handling:

```typescript
import { AuthClient } from '@auth0/auth0-auth-js';

const authClient = new AuthClient({
  domain: 'your-domain.auth0.com',
  clientId: 'your-client-id',
  clientSecret: 'your-client-secret'
});

// Step 1: Initiate the flow and get the auth_req_id
const { authReqId, expiresIn, interval } = await authClient.initiateBackchannelAuthentication({
  bindingMessage: 'Approve purchase #1234',
  loginHint: { sub: 'auth0|5f6e7d8c9b0a1b2c3d4e5f6g' }
});

console.log(`Auth Request ID: ${authReqId}`);
console.log(`Poll interval: ${interval} seconds`);

// Step 2: Custom polling logic (e.g., with exponential backoff)
await new Promise(resolve => setTimeout(resolve, interval * 1000));

// Step 3: Exchange the auth_req_id for tokens
const tokenResponse = await authClient.backchannelAuthenticationGrant({ authReqId });

console.log(tokenResponse.access_token);

```

This pattern allows you to implement custom backoff strategies, update UI progress indicators between polls, or handle the token exchange on a different server.

## When to Use Each Method

Choose **`backchannelAuthentication`** when:
- You want the simplest integration with minimal code
- The default polling interval meets your requirements
- You don't need to update UI between polling attempts
- You're implementing a standard client-side CIBA flow

Choose **`initiateBackchannelAuthentication`** when:
- You need custom polling intervals or exponential backoff
- You want to display progress indicators or status updates between polls
- You're implementing server-side token exchange
- You need to persist the `auth_req_id` across process restarts
- You want to implement custom error handling for specific polling scenarios

## Summary

- **`backchannelAuthentication`** in [`packages/auth0-auth-js/src/auth-client.ts`](https://github.com/auth0/auth0-auth-js/blob/main/packages/auth0-auth-js/src/auth-client.ts) (lines 444-496) executes the complete CIBA flow, automatically polling the token endpoint and returning a `TokenResponse`.

- **`initiateBackchannelAuthentication`** in [`packages/auth0-auth-js/src/auth-client.ts`](https://github.com/auth0/auth0-auth-js/blob/main/packages/auth0-auth-js/src/auth-client.ts) (lines 498-549) only initiates the flow, returning the `auth_req_id` and polling parameters without making token requests.

- **`backchannelAuthenticationGrant`** in [`packages/auth0-auth-js/src/auth-client.ts`](https://github.com/auth0/auth0-auth-js/blob/main/packages/auth0-auth-js/src/auth-client.ts) (lines 560-576) completes the manual flow by exchanging the `auth_req_id` for tokens.

- Use the automatic method for simplicity and the manual methods when you need custom polling logic, server-side handling, or UI updates between authentication steps.

## Frequently Asked Questions

### What is the main difference between backchannelAuthentication and initiateBackchannelAuthentication?

The primary difference is that `backchannelAuthentication` executes the complete Client-Initiated Backchannel Authentication flow including automatic polling of the token endpoint until the user authenticates, while `initiateBackchannelAuthentication` only starts the flow by calling the `/bc-authorize` endpoint and returns the authentication request ID for manual handling.

### When should I use initiateBackchannelAuthentication instead of backchannelAuthentication?

Use `initiateBackchannelAuthentication` when you need fine-grained control over the polling strategy, such as implementing exponential backoff, displaying progress indicators between polling attempts, handling the token exchange server-side, or persisting the authentication request ID across process restarts. The automatic method is preferred for standard client-side implementations.

### What method do I call after initiateBackchannelAuthentication to get the tokens?

After calling `initiateBackchannelAuthentication` and receiving the `auth_req_id`, you must call `backchannelAuthenticationGrant` and pass the `authReqId` parameter to exchange the authentication request ID for access tokens, ID tokens, and other credentials once the user has completed authentication on their device.

### Where are these methods implemented in the auth0-auth-js source code?

Both methods are implemented in the `AuthClient` class within [`packages/auth0-auth-js/src/auth-client.ts`](https://github.com/auth0/auth0-auth-js/blob/main/packages/auth0-auth-js/src/auth-client.ts). Specifically, `backchannelAuthentication` occupies lines 444-496, `initiateBackchannelAuthentication` is found at lines 498-549, and the companion method `backchannelAuthenticationGrant` is located at lines 560-576. Error handling uses `BackchannelAuthenticationError` from [`packages/auth0-auth-js/src/errors.ts`](https://github.com/auth0/auth0-auth-js/blob/main/packages/auth0-auth-js/src/errors.ts).