Access token for machine-to-machine API

[tyf]

Thanks for following up @tms!

@tms

I have a backend API. I already have an Application of type SPA. When I use the client_id and client_secret of that SPA Application, I get a 403 complaint in response to the token request.

It is not recommended that SPAs request management API tokens for reasons outlined here. The M2M approach essentially allows your backend to proxy requests on behalf of your SPA, keeping the client id and secret safe. This use case is outline here:

How can I enable users to change their email address from a SPA or native app?

Question: How can I enable users to change their email address from a SPA or native app? Answer: Public clients (like SPAs and native applications) are restricted from requesting tokens for the management API with the proper scopes for updating a user’s email. These types of applications are limited to a few specific scopes. Because of these limitations, email change requests from public clients must flow through a backend or proxy API. This could be a serverless function with the sole purpose…

@tms

I therefore gather that each API I create (I have two so far) requires a Machine-To-Machine Application instance, and I then need an additional SPA Application for each front-end that I use.

You should be able to utilize a single M2M app and authorize it for multiple APIs.

Best practice to set up one m2m app and multiple APIs

Hi @domasr, Welcome to the Auth0 Community! Generally, you would have one application. The application requests tokens from the auth server and uses the tokens to request resources from the API. I don’t see the benefit of multiple M2M applications in this scenario, but I would be happy to explore further if you provide more detail.