# Auth0 Core roles and permissions not in access token

**URL:** <https://community.auth0.com/t/auth0-core-roles-and-permissions-not-in-access-token/56287>\
**Category:** Get Help\
**Created:** [January 16, 2021, 12:06am UTC](https://community.auth0.com/t/auth0-core-roles-and-permissions-not-in-access-token/56287 "2021-01-16T00:06:52Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![julian3](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/julian3/32/26840_2.png) [@julian3](https://community.auth0.com/u/julian3)\
**Post date:** [January 16, 2021, 12:06am UTC](https://community.auth0.com/t/auth0-core-roles-and-permissions-not-in-access-token/56287/1 "2021-01-16T00:06:52Z")

</div>

I went through the guide for adding roles and permissions using the Auth0 extension. This works fine.

> **[Single-Page Applications (SPA) with API](https://auth0.com/docs/get-started/architecture-scenarios/spa-api)**
>
> Explains the architecture scenario where a single-page application (SPA) talks to an API using OpenID Connect (OIDC), and the OAuth 2.0 Implicit Grant Flow, to authenticate users with Auth0.

Auth0 says the Auth0 extension is deprecated however, and to use Auth0 core instead. So the task for me was to migrate to core auth. To do that, I took the sample app and started adding core roles and permissions.

> **[Auth0 React SDK Quickstarts: Login](https://auth0.com/docs/quickstart/spa/react)**
>
> Auth0 allows you to add authentication to your React application quickly and to gain access to user profile information. This guide demonstrates how to integrate Auth0 with any new or existing React application using the Auth0 React SDK.

I’ve added two permissions to my api and my user: create:timesheets and read:timesheets.

I’ve enabled rbac for my api, and asked to include the permissions in my token.

I still have the auth0 extension rule in place.

I’ve added a jwtAuthz check in the simple express server provided with the sample app above.

In the sample app, where you go to ping an external api, i grab a token like so:

```
  const token = await getAccessTokenSilently({
    scope: 'create:timesheets',
  });

```

Now when I click “ping api”, I get a message " You need to consent to get access to users api". If I click that link, I get a generic login, which just repeats the same message.

If I examine the token, it does not include the requested scope.

If I look at authenticated applications for this user, the app in question is there as expected.

What am I missing? Should I just use the auth0 extension in the end? Is there an example of using core auth roles and permissions somewhere?

Thanks,

Julian

---

<div class="post-metadata">

**Author:** ![julian3](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/julian3/32/26840_2.png) [@julian3](https://community.auth0.com/u/julian3)\
**Post date:** [January 19, 2021, 12:52am UTC](https://community.auth0.com/t/auth0-core-roles-and-permissions-not-in-access-token/56287/2 "2021-01-19T00:52:35Z")

</div>

It turns out that the auth0 extension rule is specifically excluding the permissions from my token. Disabling that rule fixes the problem. It doesn’t appear to do what it claims to do.

> **[Auth0 Configuration (SPAs + API)](https://auth0.com/docs/get-started/architecture-scenarios/spa-api/part-2)**
>
> Auth0 Configuration for the SPA + API architecture scenario

---

<div class="post-metadata">

**Author:** ![julian3](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/julian3/32/26840_2.png) [@julian3](https://community.auth0.com/u/julian3)\
**Post date:** [January 19, 2021, 1:22am UTC](https://community.auth0.com/t/auth0-core-roles-and-permissions-not-in-access-token/56287/3 "2021-01-19T01:22:44Z")

</div>

I can also answer the other part of my question, which was really about requesting a scope not at login, but when you actually need it. And I can confirm this works too. There was just some changes to (react) state management needed, and critically, matching invocations in callApi and handleConsent (in ExternalApi.js):

```auto
       await getAccessTokenWithPopup({
        scope: 'openid profile email create:timesheets',        
      });

```

and

```auto
      const token = await getAccessTokenSilently({
        scope: 'openid profile email create:timesheets',
      });

```

---

<div class="post-metadata">

**Author:** ![konrad.sopala](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/konrad.sopala/32/13516_2.png) [@konrad.sopala](https://community.auth0.com/u/konrad.sopala)\
**Post date:** [January 19, 2021, 9:33am UTC](https://community.auth0.com/t/auth0-core-roles-and-permissions-not-in-access-token/56287/4 "2021-01-19T09:33:13Z")

</div>

Glad you have figured it out and thanks for sharing with the rest of community!

---

<div class="post-metadata">

**Author:** ![konrad.sopala](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/konrad.sopala/32/13516_2.png) [@konrad.sopala](https://community.auth0.com/u/konrad.sopala)\
**Post date:** [January 28, 2021, 3:22pm UTC](https://community.auth0.com/t/auth0-core-roles-and-permissions-not-in-access-token/56287/5 "2021-01-28T15:22:36Z")

</div>