# Adding user roles to access token

**URL:** <https://community.auth0.com/t/adding-user-roles-to-access-token/97373>\
**Category:** Get Help\
**Tags:** management-api, roles\
**Created:** [January 3, 2023, 9:10am UTC](https://community.auth0.com/t/adding-user-roles-to-access-token/97373 "2023-01-03T09:10:18Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![chris.tice](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/chris.tice/32/42255_2.png) [@chris.tice](https://community.auth0.com/u/chris.tice)\
**Post date:** [January 3, 2023, 9:10am UTC](https://community.auth0.com/t/adding-user-roles-to-access-token/97373/1 "2023-01-03T09:10:18Z")

</div>

Following this guide ([Login Flow](https://auth0.com/docs/customize/actions/flows-and-triggers/login-flow#add-user-roles-to-id-and-access-tokens)), I can successfully add the list of users roles to the access token, but it only works when the role has been assigned as part of organization.

If I assign the role to the user directly (from the user details page), it does not show up in the list of roles.

Is it possible to include user roles that have been added directly?

---

<div class="post-metadata">

**Author:** ![ty.frith](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/ty.frith/32/58484_2.png) [@ty.frith](https://community.auth0.com/u/ty.frith)\
**Post date:** [January 5, 2023, 1:13am UTC](https://community.auth0.com/t/adding-user-roles-to-access-token/97373/3 "2023-01-05T01:13:58Z")

</div>

Hey there @chris.tice welcome to the community!

This is a bit of a tricky use case - The following topic is more geared towards permissions, the same goes for roles as well:

> [@How to add user permissions to ID token](https://community.auth0.com/t/how-to-add-user-permissions-to-id-token/88714):
>
> Hey community. From our single-page application, we want to know the current user’s permission so we can control access to certain sections or buttons of our app. We’re using organizations. As you’re probably aware, permissions are assigned to roles. Users, in my understanding, can be assigned to roles within the context of organizations and can also be assigned to roles directly (outside the context of organizations). Because of this, we essentially need the union of permissions from (1) all t…

Hope this helps!

---

<div class="post-metadata">

**Author:** ![chris.tice](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/chris.tice/32/42255_2.png) [@chris.tice](https://community.auth0.com/u/chris.tice)\
**Post date:** [January 5, 2023, 6:27am UTC](https://community.auth0.com/t/adding-user-roles-to-access-token/97373/4 "2023-01-05T06:27:20Z")

</div>

What I ended up doing is using a custom Action with the Management API to query for a users direct roles, and adding the list of roles to the token as a custom claim.

> **[Login Flow](https://auth0.com/docs/customize/actions/flows-and-triggers/login-flow)**
>
> Learn about the Actions Login Flow and the post-login Action trigger, which is executed after a user logs in and when a Refresh Token is requested.

```auto
exports.onExecutePostLogin = async (event, api) => {
  const ManagementClient = require('auth0').ManagementClient;
  const management = new ManagementClient({
      domain: event.secrets.domain,
      clientId: event.secrets.clientId,
      clientSecret: event.secrets.clientSecret,
  });

  const namespace = 'my-namespace';
  try {
    // Get the list of global roles for a user
    const roles = await management.getUserRoles({
      id: event.user.user_id,
    });

    const roleNames = roles.map((role) => role.name);

    api.idToken.setCustomClaim(`${namespace}/globalRoles`, roleNames);
    api.accessToken.setCustomClaim(`${namespace}/globalRoles`, roleNames);
  } catch (e) {
    console.log(e);
  }
};

```

---

<div class="post-metadata">

**Author:** ![ty.frith](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/ty.frith/32/58484_2.png) [@ty.frith](https://community.auth0.com/u/ty.frith)\
**Post date:** [January 5, 2023, 11:30pm UTC](https://community.auth0.com/t/adding-user-roles-to-access-token/97373/5 "2023-01-05T23:30:44Z")

</div>

Hey @chris.tice thanks for sharing here 😄

Just be aware that calls to the Management API are rate limited as stated in the doc on [Actions limitations](https://auth0.com/docs/customize/actions/limitations).

You may also want to look into caching Management API tokens:

[https://community.auth0.com/t/caching-management-api-access-tokens-in-login-action/95855](https://community.auth0.com/t/caching-management-api-access-tokens-in-login-action/95855)

Cheers!

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/auth0/original/3X/b/5/b560f266932fcce5d57f09a6595bd50518cae3f3.jpeg) [@system](https://community.auth0.com/u/system)\
**Post date:** [January 19, 2023, 11:30pm UTC](https://community.auth0.com/t/adding-user-roles-to-access-token/97373/6 "2023-01-19T23:30:46Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.