Ah, I see! Yeah, that’s a pain.
Rather than solving it this way - which will continue to be painful, as it doesn’t mesh well with the Streamlit execution model - I’d suggest trying to move the auth step back up to the client (possibly with a proxy in between, if the Auth0 endpoint requires a non-null origin).
Components do allow API calls, but the allow-same-origin restriction definitely makes things trickier, because you need to make sure that CORS is properly configured at every link in the chain that returns a response to your component’s frontend.
The Flask example code I posted in the earlier question should work, for example. I tested it locally before posting it, just running with the simple flask dev server, via flask run --port 3001.
If you’re not able to get that example code to work, it might make more sense to begin with trying to debug that issue first. I wonder if the proxy you mentioned having set up is causing issues?