Allow currently logged in user of Web App to delete their account

Get Help
3

Hi @jinteki,

Welcome to the Community!

It is possible to get an Access Token for the Management API so that the current user can update their profile, however, they will not be able to delete their account. The DELETE /api/v2/users/{id} endpoint requires the delete:users permission which is not in the list of available scopes and endpoints for SPAs.

You can read more about getting an Access Token for your SPA here: Get Management API Access Tokens for Single-Page Applications

Here are a couple of options you might consider:

  1. Allow users to deactivate their account by storing a flag in the user’s app_metadata that indicates whether the account is active or not. You could use the PATCH /api/v2/users/{id} endpoint for this and request the update:current_user_metadata as a scope for the Auth0Provider in the app.
  2. Create a Machine-to-Machine application for your own custom API and authorize it to use the delete:users scope. Instead of the client making the request to the Management API, it would be the backend. For example, if you are using the Node Management API client :
  management.users.delete({ id: USER_ID }, function (err) {
    if (err) {
      // Handle error.
    }
 
    // User deleted.
  });