# Access Token with the read:messages scope isn't reflecting in express-jwt-authz

**URL:** <https://community.auth0.com/t/access-token-with-the-read-messages-scope-isnt-reflecting-in-express-jwt-authz/43770>\
**Category:** Get Help\
**Created:** [May 28, 2020, 11:02pm UTC](https://community.auth0.com/t/access-token-with-the-read-messages-scope-isnt-reflecting-in-express-jwt-authz/43770 "2020-05-28T23:02:16Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![kdesimini](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/kdesimini/32/21577_2.png) [@kdesimini](https://community.auth0.com/u/kdesimini)\
**Post date:** [May 28, 2020, 11:02pm UTC](https://community.auth0.com/t/access-token-with-the-read-messages-scope-isnt-reflecting-in-express-jwt-authz/43770/1 "2020-05-28T23:02:16Z")

</div>

Following [this](https://auth0.com/docs/quickstart/backend/nodejs/01-authorization#protect-api-endpoints) section on securing an API endpoint using express, the actual scope is being returned and causing an “Insufficient scope” scope error. It’s not pulling from the ‘permissions’ key as expected.

“scope”: “openid profile email”,  
“permissions”: [“read:id”]

With this happening, would my best bet be to send a request to get this changed in the library or am I doing something wrong here?

---

<div class="post-metadata">

**Author:** ![kdesimini](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/kdesimini/32/21577_2.png) [@kdesimini](https://community.auth0.com/u/kdesimini)\
**Post date:** [May 28, 2020, 11:04pm UTC](https://community.auth0.com/t/access-token-with-the-read-messages-scope-isnt-reflecting-in-express-jwt-authz/43770/2 "2020-05-28T23:04:03Z")

</div>

When I change the “scopeKey” variable in the library source code, it grabs the permissions key. I don’t see any changes that would have caused this issue in the first place.

---

<div class="post-metadata">

**Author:** ![kdesimini](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/kdesimini/32/21577_2.png) [@kdesimini](https://community.auth0.com/u/kdesimini)\
**Post date:** [May 28, 2020, 11:13pm UTC](https://community.auth0.com/t/access-token-with-the-read-messages-scope-isnt-reflecting-in-express-jwt-authz/43770/3 "2020-05-28T23:13:53Z")

</div>

Oops nevermind. There’s a custom scope key option.

---

<div class="post-metadata">

**Author:** ![konrad.sopala](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/konrad.sopala/32/13516_2.png) [@konrad.sopala](https://community.auth0.com/u/konrad.sopala)\
**Post date:** [May 29, 2020, 8:54am UTC](https://community.auth0.com/t/access-token-with-the-read-messages-scope-isnt-reflecting-in-express-jwt-authz/43770/4 "2020-05-29T08:54:24Z")

</div>

Glad you have figured it out!

---

<div class="post-metadata">

**Author:** ![konrad.sopala](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/konrad.sopala/32/13516_2.png) [@konrad.sopala](https://community.auth0.com/u/konrad.sopala)\
**Post date:** [June 1, 2020, 6:38am UTC](https://community.auth0.com/t/access-token-with-the-read-messages-scope-isnt-reflecting-in-express-jwt-authz/43770/5 "2020-06-01T06:38:17Z")

</div>