# Angular 10, .net core 5.0 backend API PKCE

**URL:** <https://community.auth0.com/t/angular-10-net-core-5-0-backend-api-pkce/55241>\
**Category:** Get Help\
**Tags:** jwt, api, auth0\
**Created:** [December 22, 2020, 3:06pm UTC](https://community.auth0.com/t/angular-10-net-core-5-0-backend-api-pkce/55241 "2020-12-22T15:06:13Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![wharris47](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/wharris47/32/14207_2.png) [@wharris47](https://community.auth0.com/u/wharris47)\
**Post date:** [December 22, 2020, 3:06pm UTC](https://community.auth0.com/t/angular-10-net-core-5-0-backend-api-pkce/55241/1 "2020-12-22T15:06:13Z")

</div>

I have followed all of the online documentation and can’t successfully call custom backend API. I’m getting 401 Unauthorized response, with error message: www-authenticate: Bearer error=“invalid\_token”

I’m using @auth0/auth0-angular npm package, and it’s attaching a bearer token to the request, but it’s not a valid jwt token. Am I missing a step?

Configuration:

```
AuthModule.forRoot({
  domain: 'xxxx.auth0.com',
  clientId: 'xxxxxxx',
  httpInterceptor: {
    allowedList: [
      { uri: 'https://localhost:44317/*' }
    ]
  }
}),

```

],  
providers: [{ provide: HTTP\_INTERCEPTORS, useClass: AuthHttpInterceptor, multi: true },],

Here’s the bearer token that is getting attached to the request:

authorization: Bearer -GdEMsgGB6PQA5RQ\_EQLWoefS3GW1EOo

Thanks in advance,

William

---

<div class="post-metadata">

**Author:** ![dan.woda](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/dan.woda/32/18340_2.png) [@dan.woda](https://community.auth0.com/u/dan.woda)\
**Post date:** [December 28, 2020, 8:20pm UTC](https://community.auth0.com/t/angular-10-net-core-5-0-backend-api-pkce/55241/3 "2020-12-28T20:20:14Z")

</div>

Hi @wharris47,

Welcome to the Community!

It looks like you are getting an opaque token, which is only intended to be consumed by Auth0s APIs.

If you want to request a JWT that can be consumed by your custom API, you need to declare and audience, usually the indentifier you registered for your API.

If you would like to follow a tutorial, then check out the second part to the angular quickstart:

> **[Auth0 Angular SDK Quickstarts: Call an API](https://auth0.com/docs/quickstart/spa/angular/02-calling-an-api)**
>
> This tutorial demonstrates how to make API calls to the Auth0 Management API.

---

<div class="post-metadata">

**Author:** ![wharris47](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/wharris47/32/14207_2.png) [@wharris47](https://community.auth0.com/u/wharris47)\
**Post date:** [December 29, 2020, 3:35am UTC](https://community.auth0.com/t/angular-10-net-core-5-0-backend-api-pkce/55241/4 "2020-12-29T03:35:55Z")

</div>

Thank you so much! I spent all weekend trying to get this to work. Awesome to see my API response on the 1st attempt!

I need to add email to the bearer token now, I think I came across docs on how to do that already.

Thanks again!

Chris

---

<div class="post-metadata">

**Author:** ![dan.woda](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/dan.woda/32/18340_2.png) [@dan.woda](https://community.auth0.com/u/dan.woda)\
**Post date:** [December 29, 2020, 5:53pm UTC](https://community.auth0.com/t/angular-10-net-core-5-0-backend-api-pkce/55241/5 "2020-12-29T17:53:54Z")

</div>

Sounds good! Thanks for providing an update.

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/auth0/original/3X/b/5/b560f266932fcce5d57f09a6595bd50518cae3f3.jpeg) [@system](https://community.auth0.com/u/system)\
**Post date:** [January 13, 2021, 5:53pm UTC](https://community.auth0.com/t/angular-10-net-core-5-0-backend-api-pkce/55241/6 "2021-01-13T17:53:55Z")

</div>

This topic was automatically closed 15 days after the last reply. New replies are no longer allowed.