Accessing API resources by user id

[konstantinov.v.konst]

I have a mobile app where the user logs in and an Tickets API from which the app retrieves the user’s tickets. The problem is that the GET tickets endpoint is such /tickets/{userid}. The userId is a GUID created inside my application, it is different from the auth0 user id. I have two questions about this:

1. When the user logs in the app how can the app retrieve the user’s application userId in order to be able to call the API.
2. Once the app has the userId, how can I secure the API in suck a way that this user can call the GET tickets endpoint only with this userId. For every other userId he should get a Forbidden response.

Thank you in advance and I will be glad to provide more details if needed. My API is written in C#.

[tyf]

Hello @konstantinov.v.konst welcome to the community!

@konstantinov.v.konst

When the user logs in the app how can the app retrieve the user’s application userId in order to be able to call the API.

When a user logs in via Auth0, depending on the implementation both the associated ID token and Access token will have a sub claim which is the Auth0 user ID.

Alternatively, you could add an Action that calls an API (that you would write) when a user is first created, grabs your external database userid. It would then add the userid to the user’s app_metadata and eventually as a custom claim to a token.

@konstantinov.v.konst

Once the app has the userId, how can I secure the API in suck a way that this user can call the GET tickets endpoint only with this userId. For every other userId he should get a Forbidden response.

I recommend taking a look at our Architecture Scenarios documentation for an overview of what this may look like:

Mobile Applications with API

Hope this helps!

[konstantinov.v.konst]

Thank you for your reply. I have a follow-up question.

Alternatively, you could add an Action that calls an API (that you would write) when a user is first created, grabs your external database userid.

How can I test Auth0 Actions locally. For instance, if I create an action that calls my local API, how can I redirect the call to my machine?

[tyf]

Apologize for the delayed response on this one!

@konstantinov.v.konst

How can I test Auth0 Actions locally. For instance, if I create an action that calls my local API, how can I redirect the call to my machine?

Unfortunately because your local machine and the Auth0 authorization servers do not share the same instance you won’t be able to communicate with localhost