# /api/v2/users/{Auth0UserId} returning token invalid after successfully calling /oauth/token

**URL:** <https://community.auth0.com/t/api-v2-users-auth0userid-returning-token-invalid-after-successfully-calling-oauth-token/73694>\
**Category:** Get Help\
**Tags:** access\_token, api\
**Created:** [November 24, 2021, 10:03am UTC](https://community.auth0.com/t/api-v2-users-auth0userid-returning-token-invalid-after-successfully-calling-oauth-token/73694 "2021-11-24T10:03:02Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![Auth0\_user](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/auth0_user/32/33197_2.png) [@Auth0\_user](https://community.auth0.com/u/Auth0_user)\
**Post date:** [November 24, 2021, 10:03am UTC](https://community.auth0.com/t/api-v2-users-auth0userid-returning-token-invalid-after-successfully-calling-oauth-token/73694/1 "2021-11-24T10:03:02Z")

</div>

Hi, I am calling the /oauth/token endpoint and successfully being returned an access token and I have verified it on [jwt.io](http://jwt.io). I immediately then use that token in a GET request for user data but that request returns an invalid token error. Below is my implementation:

```auto
async function getAuthToken() {
	try {
		const res = await fetch(
			`${process.env.AUTH0_ISSUER_BASE_URL}/oauth/token`,
			{
				method: 'POST',
				headers: { 'content-type': 'application/json' },
				body: JSON.stringify({
					client_id: process.env.AUTH0_CLIENT_ID,
					client_secret: process.env.AUTH0_CLIENT_SECRET,
					audience: process.env.AUTH0_AUDIENCE,
					grant_type: 'client_credentials',
				}),
			}
		);
		return await res.json();
	} catch (e) {
		console.error(e);
	}
}

export async function getUserAppMeta(auth0UserId) {
	const { access_token } = await getAuthToken();
	try {
		const res = await fetch(
			`${process.env.AUTH0_DEV_ENDPOINT}/users/${auth0UserId}`,
			{
				method: 'GET',
				headers: {
					Authorization: `Bearer ${access_token}`,
					'Content-Type': 'application/json',
				},
			}
		);
		return await res.json();
	} catch (e) {
		console.error(e);
	}
}

```

Am I doing something obviously incorrect? Any advise is appreciated.

---

<div class="post-metadata">

**Author:** ![dan.woda](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/dan.woda/32/18340_2.png) [@dan.woda](https://community.auth0.com/u/dan.woda)\
**Post date:** [November 26, 2021, 9:32pm UTC](https://community.auth0.com/t/api-v2-users-auth0userid-returning-token-invalid-after-successfully-calling-oauth-token/73694/3 "2021-11-26T21:32:03Z")

</div>

Hi @Auth0_user,

First, I would recommend using one of our client libraries. If you are using node, you can use this module: [GitHub - auth0/node-auth0: Node.js client library for the Auth0 platform.](https://github.com/auth0/node-auth0)

Also, can you share the entire error? There should be some more details about what is failing.

---

<div class="post-metadata">

**Author:** ![Auth0\_user](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/auth0_user/32/33197_2.png) [@Auth0\_user](https://community.auth0.com/u/Auth0_user)\
**Post date:** [December 6, 2021, 4:52pm UTC](https://community.auth0.com/t/api-v2-users-auth0userid-returning-token-invalid-after-successfully-calling-oauth-token/73694/4 "2021-12-06T16:52:34Z")

</div>

Hi @dan.woda,

Thanks for coming back to me and sorry for my slow reply. I am still struggling with this.

This the error /users/ endpoint returns:

```auto
{
	"statusCode": 401,
	"error": "Unauthorized",
	"message": "Invalid token",
	"attributes": {
		"error": "Invalid token"
	}
}

```

But I have just hit the /oauth/token endpoint successfully before and used the token it returned. For context I have been following the docs on this [Get Management API Access Tokens for Production](https://auth0.com/docs/security/tokens/access-tokens/get-management-api-access-tokens-for-production).

Am I missing scopes or can the /users/ endpoint only be hit from a server? Do I have to use this npm package to complete it?

> **[auth0](https://www.npmjs.com/package/auth0)**
>
> SDK for Auth0 API v2. Latest version: 3.1.1, last published: 12 days ago. Start using auth0 in your project by running \`npm i auth0\`. There are 312 other projects in the npm registry using auth0.

Thanks again

---

<div class="post-metadata">

**Author:** ![Auth0\_user](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/auth0_user/32/33197_2.png) [@Auth0\_user](https://community.auth0.com/u/Auth0_user)\
**Post date:** [December 6, 2021, 11:21pm UTC](https://community.auth0.com/t/api-v2-users-auth0userid-returning-token-invalid-after-successfully-calling-oauth-token/73694/5 "2021-12-06T23:21:44Z")

</div>

I have got it working. The issue was scopes. I had to update my application permissions to send/receive the scopes I wanted to read user data. This took me a long time to figure out and really I came across it by chance and desperation. I think this needs to be more prominent in the documentation.

---

<div class="post-metadata">

**Author:** ![dan.woda](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/dan.woda/32/18340_2.png) [@dan.woda](https://community.auth0.com/u/dan.woda)\
**Post date:** [December 7, 2021, 4:30pm UTC](https://community.auth0.com/t/api-v2-users-auth0userid-returning-token-invalid-after-successfully-calling-oauth-token/73694/6 "2021-12-07T16:30:27Z")

</div>

Thanks for following up and for the feedback.

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/auth0/original/3X/b/5/b560f266932fcce5d57f09a6595bd50518cae3f3.jpeg) [@system](https://community.auth0.com/u/system)\
**Post date:** [December 22, 2021, 4:30pm UTC](https://community.auth0.com/t/api-v2-users-auth0userid-returning-token-invalid-after-successfully-calling-oauth-token/73694/7 "2021-12-22T16:30:45Z")

</div>

This topic was automatically closed 15 days after the last reply. New replies are no longer allowed.