In the SPA + API architecture scenario ( Single-Page Applications (SPA) with API ), using a framework like VueJS or React against a REST API, I believe I understand that it is the responsibility of the SPA to authenticate the user against Auth0. In doing so, the SPA will receive back an Access Token (…

Hi Dave, First, if you have a SPA that has a single (or primary) REST API for a backend, my recommendation is that you treat this as a classic web app and use Auth Code Flow: [image] Authorization Code Flow Learn how the Authorization Code flow works and why you should use it for regula…

Hi Dave There is a lot of information here: [image] Validate Access Tokens Describes how to validate an access token. You need very little information from Auth0 to validate an access token, and that information is available from the .jwks endpoint. It shoul…

Hi @john.gateley - thank you for the links. I definitely will go read all of that carefully. But, I need a better mental model of how this all should work first. So, if you’ll indulge a couple more questions, that would be very helpful. As a reminder, the context is an architecture where there is …

Thank you, John. I appreciate the recommendation on approach and rationale. As I’m using Phoenix on the server side, I can use Guardian or another of the JWT libraries listed for Elixir on jwt.io for the token verification.

SPA + API responsibilities

Get Help

Topic		Replies	Views
Validate Auth token before serving API Get Help	2	2565	April 8, 2021
How to secure an SPA which fetch data from REST api? Does every authentication needs to be done at backend? Get Help jwt , api , login	4	4770	March 9, 2021
LOCK and SPA, how does the server know if the access_token is valid ? Get Help lock	13	4082	March 2, 2018
Auth0 Configuration with UI-Less Service API and a separate UI app Get Help jwt , spa , api-authorization	2	3776	December 4, 2018
Validating SPA JWT Tokens in the backend Get Help management-api , clients	2	1383	November 14, 2022

SPA + API responsibilities

Related topics