# Appropriate token usage for 1p webapp **URL:** \ **Category:** Get Help\ **Tags:** jwt, id-token, oidc, access-token\ **Created:** [September 26, 2022, 10:20pm UTC](https://community.auth0.com/t/appropriate-token-usage-for-1p-webapp/91333 "2022-09-26T22:20:37Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![pdewilde](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/pdewilde/32/40193_2.png) [@pdewilde](https://community.auth0.com/u/pdewilde)\ **Post date:** [September 26, 2022, 10:20pm UTC](https://community.auth0.com/t/appropriate-token-usage-for-1p-webapp/91333/1 "2022-09-26T22:20:37Z")
I have a traditional web application, and I am planning on using auth0 for its support for multiple social logins. Authorization will not be done using JWT claims, as there are scenarios where a user could have many different roles, and permission model is strongly coupled to business logic (user X can access Y if X’s user id is stored in the db record for Y). The idea is that auth0 will be used for authentication (we know user X is the one making the request), but authorization decisions (can X access resource Y) will be done in the backend based on whether Y is associated with X. What trips me up is the claims an ID token is for authentication, while an access token is for calling an API with authorization. [Why You Should Always Use Access Tokens to Secure an API](https://auth0.com/blog/why-should-use-accesstokens-to-secure-an-api/) My question is: what token should my (server-side) web-app pass onto APIs (which I own) it calls? Should it be the ID token because I only am passing only _who_ is logged in (authentication), or should it be the access token, even though no authorization information will be contained? It seems like the backend API is really concerned about authentication in this scenario, but I am not sure as I go back and forth when reading various docs. I’ve also read things saying not to use access tokens for authentication, but that kind of feels like what I would be doing. ---
**Author:** ![ty.frith](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/ty.frith/32/58484_2.png) [@ty.frith](https://community.auth0.com/u/ty.frith)\ **Post date:** [September 27, 2022, 11:04pm UTC](https://community.auth0.com/t/appropriate-token-usage-for-1p-webapp/91333/4 "2022-09-27T23:04:41Z")
Hey there @pdewilde welcome to the community! Thanks for the detailed description of your use case 🙂 > [@pdewilde](#): > > What trips me up is the claims an ID token is for authentication, while an access token is for calling an API with authorization. [Why You Should Always Use Access Tokens to Secure an API](https://auth0.com/blog/why-should-use-accesstokens-to-secure-an-api/?_gl=1*17fjzwh*rollup_ga*NjQ1Mjc3NzgyLjE2NDg2ODEyMDU.*rollup_ga_F1G3E656YZ*MTY2NDMxNzAxNC44Ni4xLjE2NjQzMTgxMzUuNDcuMC4w&_ga=2.129186180.989924553.1664215071-645277782.1648681205) > > My question is: what token should my (server-side) web-app pass onto APIs (which I own) it calls? Should it be the ID token because I only am passing only _who_ is logged in (authentication), or should it be the access token, even though no authorization information will be contained? This is a common question for which there is plenty of “controversy” around. Basically, as long as your client and API are within the logical bounds of the same application it may be OK to use the ID Token in this way. I won’t go into too much detail here but the following response in a blog discussion is really helpful. > [@Developing a Secure API with NestJS](https://community.auth0.com/t/developing-a-secure-api-with-nestjs/33026/24): > > Zach, let me address first the concepts the usage of Access Tokens vs ID Tokens. The following is based on one of the videos created by Vittorio in our “Learn Identity” series: [Calling an API](https://auth0.com/docs/videos/learn-identity/04-calling-an-api) On the “Calling an API” video, on 33:27, you can hear Vittorio recap on “Access tokens vs ID tokens”. Here are the highlights of his recap: Access Token: An access token is meant to grant a client access to a resource (delegated authorization). Per the OAuth 2.0 spec, there is no mandated format fo… Here is the video that is referenced, also very helpful! > **[Auth0 Docs](https://auth0.com/docs/articles)** > > Get started using Auth0. Implement authentication for any kind of application in minutes. Albeit a bit confusing, hopefully this helps to clear things up a bit! ---
**Author:** ![system](https://global.discourse-cdn.com/auth0/original/3X/b/5/b560f266932fcce5d57f09a6595bd50518cae3f3.jpeg) [@system](https://community.auth0.com/u/system)\ **Post date:** [October 11, 2022, 11:05pm UTC](https://community.auth0.com/t/appropriate-token-usage-for-1p-webapp/91333/5 "2022-10-11T23:05:18Z")
This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.