# AccessTokenError when requesting offline\_access scope

**URL:** <https://community.auth0.com/t/accesstokenerror-when-requesting-offline-access-scope/62813>\
**Category:** Get Help\
**Tags:** access-token, angular\
**Created:** [May 13, 2021, 9:02pm UTC](https://community.auth0.com/t/accesstokenerror-when-requesting-offline-access-scope/62813 "2021-05-13T21:02:59Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![jsw](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/jsw/32/12681_2.png) [@jsw](https://community.auth0.com/u/jsw)\
**Post date:** [May 13, 2021, 9:02pm UTC](https://community.auth0.com/t/accesstokenerror-when-requesting-offline-access-scope/62813/1 "2021-05-13T21:02:59Z")

</div>

I came across this thread with a very similar issue and I’m still confused:

[https://community.auth0.com/t/accesstokenerror-could-not-retrieve-an-access-token-with-scopes-openid-profile-email/61745/22](https://community.auth0.com/t/accesstokenerror-could-not-retrieve-an-access-token-with-scopes-openid-profile-email/61745/22)

If I have this in `pages/api/auth/[...auth0].ts`

```auto
export default handleAuth({
  async login(req, res) {
    try {
      await handleLogin(req, res, {
        authorizationParams: {
          audience: 'https://[redacted]', // or AUTH0_AUDIENCE
          // Add the `offline_access` scope to also get a Refresh Token
          scope: 'openid profile email offline_access do:anything' // or AUTH0_SCOPE
        }
      });
    } catch (error) {
      res.status(error.status || 400).end(error.message);
    }
  }
});

```

And then later inside a `getServerSideProps` call

```auto
const { accessToken} = await getAccessToken(context.req, context.res, {
    scopes: ['openid', 'profile', 'email', 'offline_access', 'do:anything']
  });

```

I get this error

```auto
AccessTokenError: Could not retrieve an access token with scopes "openid profile email offline_access do:anything". The user will need to sign in again.

```

But if I remove the `scopes` parameter above, it works AND the server indicates that the JWT has `scope: 'openid profile email do:anything'`. Note that my custom `do:anything` scope is there, but `offline_access` is missing.

Can someone help me understand what’s going on and which scopes should be used in which calls? Thanks!

---

<div class="post-metadata">

**Author:** ![stephanie.chamblee](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/stephanie.chamblee/32/26087_2.png) [@stephanie.chamblee](https://community.auth0.com/u/stephanie.chamblee)\
**Post date:** [May 14, 2021, 1:43pm UTC](https://community.auth0.com/t/accesstokenerror-when-requesting-offline-access-scope/62813/3 "2021-05-14T13:43:56Z")

</div>

Hi @jsw,

I went ahead and moved your reply to its own topic with a reference to the original topic for better visibility for your question.

I see that you are specifying an audience. Is the audience your own custom API? If so, is it configured to allow offline access?

 ![Screen Shot 2021-05-14 at 9.41.34 AM](https://global.discourse-cdn.com/auth0/original/3X/c/0/c0ab7e321d55caf0ab5dcc640b1b5f3d70c8c6d7.png)

Also, within your SPA’s application settings, do you have Refresh Token rotation enabled?

 ![Screen Shot 2021-05-14 at 9.42.41 AM](https://global.discourse-cdn.com/auth0/original/3X/7/a/7a2fb53ce1eb36c3ca2cd637b08833b250f04788.png)

> **[Refresh Tokens](https://auth0.com/docs/secure/tokens/refresh-tokens)**
>
> Describes how refresh tokens work to allow the application to ask Auth0 to issue a new access token or ID token without having to re-authenticate the user.

---

<div class="post-metadata">

**Author:** ![jsw](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/jsw/32/12681_2.png) [@jsw](https://community.auth0.com/u/jsw)\
**Post date:** [May 14, 2021, 9:11pm UTC](https://community.auth0.com/t/accesstokenerror-when-requesting-offline-access-scope/62813/4 "2021-05-14T21:11:31Z")

</div>

@stephanie.chamblee The audience is a custom API, which I had not configured offline access. I also updated the application to enable Refresh Token Rotation. Now it seems to work, but I still have a remaining question… The call to `getAccessToken` in `GetServerSideProps` doesn’t seem to matter whether I specify scopes or not. In both cases, the server is confirming that the access token has all the scopes that were requested via `handleLogin` in `[....auth0].ts`. Can you help me understand the purpose of the scopes provided to `handleAuth` vs `getAccessToken`? Thanks!

---

<div class="post-metadata">

**Author:** ![stephanie.chamblee](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/stephanie.chamblee/32/26087_2.png) [@stephanie.chamblee](https://community.auth0.com/u/stephanie.chamblee)\
**Post date:** [May 17, 2021, 12:20pm UTC](https://community.auth0.com/t/accesstokenerror-when-requesting-offline-access-scope/62813/5 "2021-05-17T12:20:05Z")

</div>

Hi @jsw,

I’m glad to hear refresh tokens are working now!

The `getAccessTokenSilently` method will return the same Access Token that was obtained during login so long as it is still valid. It will only request a new token if the Access Token in memory has expired or if a different scope or audience is requested.

The scopes are optional in this method and if not passed, the same scopes will be used that are configured in `handleAuth`.

Here are the docs on this method: [https://auth0.github.io/auth0-angular/classes/authservice.html#getaccesstokensilently](https://auth0.github.io/auth0-angular/classes/authservice.html#getaccesstokensilently)

---

<div class="post-metadata">

**Author:** ![jsw](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/jsw/32/12681_2.png) [@jsw](https://community.auth0.com/u/jsw)\
**Post date:** [May 17, 2021, 7:07pm UTC](https://community.auth0.com/t/accesstokenerror-when-requesting-offline-access-scope/62813/6 "2021-05-17T19:07:51Z")

</div>

Hi @stephanie.chamblee

I am using `auth0/nextjs-auth0`, not `@auth0/auth0-angular`, but I assume what you said about `getAccessTokenSilently` applies equivalently to `getAccessToken` in the NextJS module.

---

<div class="post-metadata">

**Author:** ![stephanie.chamblee](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/stephanie.chamblee/32/26087_2.png) [@stephanie.chamblee](https://community.auth0.com/u/stephanie.chamblee)\
**Post date:** [May 17, 2021, 7:09pm UTC](https://community.auth0.com/t/accesstokenerror-when-requesting-offline-access-scope/62813/7 "2021-05-17T19:09:30Z")

</div>

Yes, that is correct, both SDKs should behave the same in that regard.

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/auth0/original/3X/b/5/b560f266932fcce5d57f09a6595bd50518cae3f3.jpeg) [@system](https://community.auth0.com/u/system)\
**Post date:** [June 1, 2021, 7:10pm UTC](https://community.auth0.com/t/accesstokenerror-when-requesting-offline-access-scope/62813/8 "2021-06-01T19:10:21Z")

</div>

This topic was automatically closed 15 days after the last reply. New replies are no longer allowed.