# Adding permissions in ID token **URL:** \ **Category:** Get Help\ **Tags:** oauth-2-0, protocols\ **Created:** [March 20, 2024, 5:09pm UTC](https://community.auth0.com/t/adding-permissions-in-id-token/130106 "2024-03-20T17:09:59Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![ahmed.mekliov](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/ahmed.mekliov/32/49698_2.png) [@ahmed.mekliov](https://community.auth0.com/u/ahmed.mekliov)\ **Post date:** [March 20, 2024, 5:09pm UTC](https://community.auth0.com/t/adding-permissions-in-id-token/130106/1 "2024-03-20T17:09:59Z")
Is it considered bad practice in terms of OAuth2 specification to add roles/permissions in ID token? ---
**Author:** ![rueben.tiow](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/rueben.tiow/32/11646_2.png) [@rueben.tiow](https://community.auth0.com/u/rueben.tiow)\ **Post date:** [March 20, 2024, 6:50pm UTC](https://community.auth0.com/t/adding-permissions-in-id-token/130106/3 "2024-03-20T18:50:41Z")
Hi @ahmed.mekliov, Welcome to the Auth0 Community! Yes, because the ID token holds information related to the user’s identity, as opposed to an access token, which contains information about a user’s access to protected resources. This often includes roles and permissions that define the extent of the user’s access to these resources. For example, an Admin role might have CRUD (Create, Read, Update, Delete) permissions, whereas an end-user role might be limited to read-only permissions. Given that, it’s considered best practice to store roles and permissions in the access token rather than the ID token. Let me know if you have any additional questions. Cheers, Rueben ---
**Author:** ![ahmed.mekliov](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/ahmed.mekliov/32/49698_2.png) [@ahmed.mekliov](https://community.auth0.com/u/ahmed.mekliov)\ **Post date:** [March 21, 2024, 8:22am UTC](https://community.auth0.com/t/adding-permissions-in-id-token/130106/4 "2024-03-21T08:22:18Z")
Hi @rueben.tiow , My question is related to a broader topic that we are currently facing. We need to get the permission/roles in FE in order to be able to show/hide different elements. Since the access token is not meant to be used in FE and it is considered bad practice to store the roles in ID token as well I was wondering what would be the best solution for situation like ours. Regards, Ahmed ---
**Author:** ![rueben.tiow](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/rueben.tiow/32/11646_2.png) [@rueben.tiow](https://community.auth0.com/u/rueben.tiow)\ **Post date:** [March 21, 2024, 4:13pm UTC](https://community.auth0.com/t/adding-permissions-in-id-token/130106/5 "2024-03-21T16:13:31Z")
Hi @ahmed.mekliov, Thanks for the reply. You should be able to use the access token on your front-end application. See [OAuth 2.0 Authorization Framework](https://auth0.com/docs/authenticate/protocols/oauth). ---
**Author:** ![ahmed.mekliov](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/ahmed.mekliov/32/49698_2.png) [@ahmed.mekliov](https://community.auth0.com/u/ahmed.mekliov)\ **Post date:** [March 26, 2024, 2:13pm UTC](https://community.auth0.com/t/adding-permissions-in-id-token/130106/6 "2024-03-26T14:13:24Z")
Hey, @rueben.tiow Yes, that is true, but is it considered a safe practice, since the access token issued for the resource owners and the FE is just a sending them to BE where the whole validation of the token and checking for the permissions is triggered. And according to OAuth specifications : _An access token is used by a client to access a resource._ And since there are no resources on FE I didn’t considered access token as valid option initially. What do you think? Regards, Ahmed ---
**Author:** ![rueben.tiow](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/rueben.tiow/32/11646_2.png) [@rueben.tiow](https://community.auth0.com/u/rueben.tiow)\ **Post date:** [March 29, 2024, 8:43pm UTC](https://community.auth0.com/t/adding-permissions-in-id-token/130106/7 "2024-03-29T20:43:07Z")
Hi @ahmed.mekliov, > [@ahmed.mekliov](#): > > is it considered a safe practice, since the access token issued for the resource owners and the FE is just a sending them to BE where the whole validation of the token and checking for the permissions is triggered. This is true if you are accessing a protected resource. The FE is issued an access token from the BE after validating login credentials. The access token will contain permissions defined by `scopes` and are used to determine if the user is allowed to access the resource. Let me mention that you are not prohibited from adding permissions to the ID token, but as we discussed, it’s not ideal if you intend to use them to show/hide different types of data. Thanks, Rueben ---
**Author:** ![system](https://global.discourse-cdn.com/auth0/original/3X/b/5/b560f266932fcce5d57f09a6595bd50518cae3f3.jpeg) [@system](https://community.auth0.com/u/system)\ **Post date:** [April 12, 2024, 8:43pm UTC](https://community.auth0.com/t/adding-permissions-in-id-token/130106/8 "2024-04-12T20:43:54Z")
This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.