# Architecture for implicit grant and user id **URL:** \ **Category:** Get Help\ **Tags:** implicit-grant, claims, jwt\ **Created:** [June 29, 2021, 7:05am UTC](https://community.auth0.com/t/architecture-for-implicit-grant-and-user-id/65235 "2021-06-29T07:05:49Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![laughing\_man77](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/laughing_man77/32/25862_2.png) [@laughing\_man77](https://community.auth0.com/u/laughing_man77)\ **Post date:** [June 29, 2021, 7:05am UTC](https://community.auth0.com/t/architecture-for-implicit-grant-and-user-id/65235/1 "2021-06-29T07:05:49Z")
Hi I need a bit of advice. I’m the maintainer of a new Open Source project: ApiOpenStudio, and I’m upgrading the codebase ATM to use JWT tokens instead of the custom token stored in the DB (I know, even though it’s a short-lived token, that is not secure!). So far, I have implemented generation and validation of the tokens in the API itself. But I also want to take into account enterprise scale users who utilise a separate or 3rd party authentication service. Ideally, I want to not have to make any DB calls to validate the user against role permissions, so implicit grant would be ideal here. I’m still researching into how this works and whether it requires custom claim values. My main question is how easy is it to integrate user data like UID or roles into claims in a JWT token? Will I be making it difficult for users to integrate their base users data into 3rd party systems like here? How have people solved similar issues? Like integrating Auth0 with a remote custom DB? ---
**Author:** ![dan.woda](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/dan.woda/32/18340_2.png) [@dan.woda](https://community.auth0.com/u/dan.woda)\ **Post date:** [June 29, 2021, 4:33pm UTC](https://community.auth0.com/t/architecture-for-implicit-grant-and-user-id/65235/3 "2021-06-29T16:33:54Z")
> [@laughing\_man77](#): > > My main question is how easy is it to integrate user data like UID or roles into claims in a JWT token? You can easily add custom data to the id and access tokens with actions. Here is an example of adding roles to the tokens after login: [https://auth0.com/docs/actions/triggers/post-login#add-user-roles-to-tokens](https://auth0.com/docs/actions/triggers/post-login#add-user-roles-to-tokens) You can also add custom data to the user’s profile in auth0 by adding it to metadata. Here is more info on it: > **[Understand How Metadata Works in User Profiles](https://auth0.com/docs/manage-users/user-accounts/metadata)** > > Describes Auth0 user, application, and client metadata. Learn how you can use metadata to store information that does not originate from an identity provider. > [@laughing\_man77](#): > > Will I be making it difficult for users to integrate their base users data into 3rd party systems like here? How have people solved similar issues? Like integrating Auth0 with a remote custom DB? Integrating with a custom database is a common use case: > **[Custom Database Connections](https://auth0.com/docs/authenticate/database-connections/custom-db)** > > Learn about authenticating users using your database as an identity provider. ---
**Author:** ![dan.woda](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/dan.woda/32/18340_2.png) [@dan.woda](https://community.auth0.com/u/dan.woda)\ **Post date:** [June 29, 2021, 4:38pm UTC](https://community.auth0.com/t/architecture-for-implicit-grant-and-user-id/65235/4 "2021-06-29T16:38:09Z")
> [@laughing\_man77](#): > > Ideally, I want to not have to make any DB calls to validate the user against role permissions, so implicit grant would be ideal here. JWT tokens, being signed and verifiable, will allow you to validate without a call to your DB. Implicit flow is simply a way to transact with a public client that can’t store a secret. We would recommend using the auth code + PKCE flow for browser-based public clients like SPAs instead of implicit (it’s the more modern flow). ---
**Author:** ![laughing\_man77](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/laughing_man77/32/25862_2.png) [@laughing\_man77](https://community.auth0.com/u/laughing_man77)\ **Post date:** [June 30, 2021, 12:42am UTC](https://community.auth0.com/t/architecture-for-implicit-grant-and-user-id/65235/5 "2021-06-30T00:42:24Z")
Many thanks Dan, I’ll go through those links you’ve passed on. Those should give me enough info to make a plan on how to refactor ApiOpenStudio for security, speed and different user’s requirements 👍 ---
**Author:** ![dan.woda](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/dan.woda/32/18340_2.png) [@dan.woda](https://community.auth0.com/u/dan.woda)\ **Post date:** [June 30, 2021, 2:59pm UTC](https://community.auth0.com/t/architecture-for-implicit-grant-and-user-id/65235/6 "2021-06-30T14:59:16Z")
No problem. Let us know if you have any questions. ---
**Author:** ![system](https://global.discourse-cdn.com/auth0/original/3X/b/5/b560f266932fcce5d57f09a6595bd50518cae3f3.jpeg) [@system](https://community.auth0.com/u/system)\ **Post date:** [July 15, 2021, 2:59pm UTC](https://community.auth0.com/t/architecture-for-implicit-grant-and-user-id/65235/7 "2021-07-15T14:59:26Z")
This topic was automatically closed 15 days after the last reply. New replies are no longer allowed.