# Add All User Permissions to AccessToken in onExecutePostLogin Action

**URL:** <https://community.auth0.com/t/add-all-user-permissions-to-accesstoken-in-onexecutepostlogin-action/111682>\
**Category:** Get Help\
**Tags:** extensibility, actions-extensibility\
**Created:** [July 20, 2023, 1:51pm UTC](https://community.auth0.com/t/add-all-user-permissions-to-accesstoken-in-onexecutepostlogin-action/111682 "2023-07-20T13:51:16Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![tea-jay](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/tea-jay/32/48774_2.png) [@tea-jay](https://community.auth0.com/u/tea-jay)\
**Post date:** [July 20, 2023, 1:51pm UTC](https://community.auth0.com/t/add-all-user-permissions-to-accesstoken-in-onexecutepostlogin-action/111682/1 "2023-07-20T13:51:16Z")

</div>

We have a front end application which is handling user login, and receiving an AccessToken. We are then planning on using that AccessToken in multiple API’s in our ecosystem. We would like this AccessToken to include the user’s permissions for each API they might contact.

I created an API in Auth0 Dashboard

 ![Screen Shot 2023-07-20 at 9.43.38 AM](https://global.discourse-cdn.com/auth0/original/3X/4/3/43c330623d963e42cc8492af3e5bdf47469ed4cf.png)

And enabled RBAC Settings

 ![Screen Shot 2023-07-20 at 9.44.47 AM](https://global.discourse-cdn.com/auth0/original/3X/8/3/83ede3ad6d1955d3d1d5232eb08809f5b6262f81.png)

Based on the descriptions in the RBAC Settings, i assumed that this would have been enough to add permissions to users AccessToken when they login in on our front end client, however this did not reflect in the token.

I tried creating an Action which would inject the permissions, but it seems i can only inject roles through the actions interface.  
Here’s the action’s code:

```auto

/**
* Handler that will be called during the execution of a PostLogin flow.
*
* @param {Event} event - Details about the user and the context in which they are logging in.
* @param {PostLoginAPI} api - Interface whose methods can be used to change the behavior of the login.
*/
exports.onExecutePostLogin = async (event, api) => {
  const ROLES_NAMESPACE = 'https://roles';
  const PERMISSIONS_NAMESPACE = 'https://permissions';
  if (event.authorization) {

    api.idToken.setCustomClaim(`${ROLES_NAMESPACE}`, event.authorization.roles);
    
    api.accessToken.setCustomClaim(`${ROLES_NAMESPACE}`, event.authorization.roles);
    api.accessToken.setCustomClaim(`${PERMISSIONS_NAMESPACE}`, event.user.app_metadata);
  }
};

```

And a screenshot showing it is in the login flow

 ![Screen Shot 2023-07-20 at 9.49.10 AM](https://global.discourse-cdn.com/auth0/original/3X/e/0/e0a366215c5e697e8f8cbd983b8b7a69958532a4.png)

Not sure if this what I’m attempting to do is possible. I am guessing I am missing some key concept as to why this shouldn’t be done this way if anyone wants to help me understand what i missing lol

---

<div class="post-metadata">

**Author:** ![rueben.tiow](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/rueben.tiow/32/11646_2.png) [@rueben.tiow](https://community.auth0.com/u/rueben.tiow)\
**Post date:** [July 20, 2023, 6:40pm UTC](https://community.auth0.com/t/add-all-user-permissions-to-accesstoken-in-onexecutepostlogin-action/111682/3 "2023-07-20T18:40:46Z")

</div>

Hi @tea-jay,

Welcome to the Auth0 Community!

To add all user permission to the Access Token, you will need to toggle on the **Enable RBAC** and **Add Permissions in the Access Token** features in your API"s RBAC settings.

It looks like you have already completed this step, which is all you need to get the permissions added to the access token.

Our [How can I add the permissions claim in my Access Token with Rules?](https://community.auth0.com/t/how-can-i-add-the-permissions-claim-in-my-access-token-with-rules/87156) FAQ also mentions this.

With that, could you please provide me more details on the login request you made, such as sharing the `/authorize` request?

This will give me more information on your issue so I can help you get it working.

Thanks,  
Rueben

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/auth0/original/3X/b/5/b560f266932fcce5d57f09a6595bd50518cae3f3.jpeg) [@system](https://community.auth0.com/u/system)\
**Post date:** [August 3, 2023, 6:41pm UTC](https://community.auth0.com/t/add-all-user-permissions-to-accesstoken-in-onexecutepostlogin-action/111682/4 "2023-08-03T18:41:31Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.