# Auth0 JWT does not have permissions **URL:** \ **Category:** Get Help\ **Tags:** laravel, permissions, access-token, login\ **Created:** [May 4, 2022, 9:07am UTC](https://community.auth0.com/t/auth0-jwt-does-not-have-permissions/82849 "2022-05-04T09:07:55Z")\ **Posts on this page:** 13\ **Page:** 1
**Author:** ![DispatchCode](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/dispatchcode/32/36465_2.png) [@DispatchCode](https://community.auth0.com/u/DispatchCode)\ **Post date:** [May 4, 2022, 9:07am UTC](https://community.auth0.com/t/auth0-jwt-does-not-have-permissions/82849/1 "2022-05-04T09:07:55Z")
Hello, we’re trying to use scopes for our application (PHP + Laravel framework) and the JWT returned by Auth0 doesn’t seem to have the requested permissions. We did the following after installing the SDK: 1. we created a custom API from the Auth0 panel 2. enable RBAC and “Add Permissions in the Access Token” 3. added roles and permissions to a couple of users 4. added the audience Plus in our code we have a class that extends `\Auth0\Laravel\Contract\Auth\User\Repository` and inside the fromSession method when we look at the response content (eg. the argument of the method) we does not have the “permissions” field. In the `.env` file we defined also: ```auto AUTH0_DOMAIN=our domain AUTH0_CLIENT_ID=our client id AUTH0_CLIENT_SECRET=our client secret AUTH0_REDIRECT_URI=our redirect url ``` What we did wrong? ☹ Would appreciate any help or pointers in figuring this out. Thanks in advance. ---
**Author:** ![dan.woda](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/dan.woda/32/18340_2.png) [@dan.woda](https://community.auth0.com/u/dan.woda)\ **Post date:** [May 4, 2022, 6:04pm UTC](https://community.auth0.com/t/auth0-jwt-does-not-have-permissions/82849/3 "2022-05-04T18:04:38Z")
Hi @DispatchCode, Welcome to the Auth0 Community! Can you please confirm you are looking at the access token for the permissions? ---
**Author:** ![evansims](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/evansims/32/27011_2.png) [@evansims](https://community.auth0.com/u/evansims)\ **Post date:** [May 4, 2022, 7:58pm UTC](https://community.auth0.com/t/auth0-jwt-does-not-have-permissions/82849/4 "2022-05-04T19:58:21Z")
👋 Depending on your implementation, you may need to configure your AUTH0\_AUDIENCE to your custom API identifier as well. It doesn’t appear that is in your ENV file currently. ---
**Author:** ![dan.woda](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/dan.woda/32/18340_2.png) [@dan.woda](https://community.auth0.com/u/dan.woda)\ **Post date:** [May 4, 2022, 8:10pm UTC](https://community.auth0.com/t/auth0-jwt-does-not-have-permissions/82849/5 "2022-05-04T20:10:01Z")
Thanks for the suggestion @evansims! 🙌 ---
**Author:** ![DispatchCode](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/dispatchcode/32/36465_2.png) [@DispatchCode](https://community.auth0.com/u/DispatchCode)\ **Post date:** [May 5, 2022, 8:12am UTC](https://community.auth0.com/t/auth0-jwt-does-not-have-permissions/82849/6 "2022-05-05T08:12:47Z")
Thanks for your feedback guys 🙂 @dan.woda positive. What we expect is an array like: ```auto "permissions": [ "create:articles", "viewall:categories" ] ``` But in the output there is none. @evansims done! But it still don’t work. We have AUTH0\_AUDIENCE and AUTH0\_SCOPE as well, but the output dosen’t change. ---
**Author:** ![dan.woda](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/dan.woda/32/18340_2.png) [@dan.woda](https://community.auth0.com/u/dan.woda)\ **Post date:** [May 5, 2022, 2:51pm UTC](https://community.auth0.com/t/auth0-jwt-does-not-have-permissions/82849/7 "2022-05-05T14:51:56Z")
Can you please share with us an example access token? You can omit any sensitive data. ---
**Author:** ![DispatchCode](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/dispatchcode/32/36465_2.png) [@DispatchCode](https://community.auth0.com/u/DispatchCode)\ **Post date:** [May 12, 2022, 9:37am UTC](https://community.auth0.com/t/auth0-jwt-does-not-have-permissions/82849/8 "2022-05-12T09:37:39Z")
First of all, excuse me for my delay. I would like to do it @dan.woda but I don’t know how get it, due to the laravel implementation, but I can paste what we get from the method “fromSession” doing a dump of $user: ```auto "nickname" => "nickname" "name" => "Marco C" "picture" => picture url" "updated_at" => "2022-05-12T09:22:45.381Z" "email" => "mail_address" "email_verified" => true "iss" => "our url" "sub" => "auth0|key" "aud" => "aud_code" "iat" => 123456789 "exp" => 123456789 "nonce" => "nonce" ``` I’m pretty sure that we are doing something wrong with the Laravel implementation. Just to clarify, I did the same process (authentication) using CURL as mentioned before, and after the /token call I get what I’m expected (token decoded from [jwt.io](http://jwt.io)): ```auto { "iss": "https://url", "sub": "auth0|key", "aud": "https://oururl/api", "iat": 12355788, "exp": 12355788, "azp": "hash", "scope": "viewall:categories", "permissions": [ "create:articles", "viewall:categories" ] } ``` How can we get souch informations? Thanks for your support! EDIT: I almost forgot. After some search few days ago I found this [Sample Use Cases: Scopes and Claims](https://auth0.com/docs/get-started/apis/scopes/sample-use-cases-scopes-and-claims) It could be an option or it would be a wrong way to get such informations? ---
**Author:** ![dan.woda](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/dan.woda/32/18340_2.png) [@dan.woda](https://community.auth0.com/u/dan.woda)\ **Post date:** [May 12, 2022, 3:49pm UTC](https://community.auth0.com/t/auth0-jwt-does-not-have-permissions/82849/9 "2022-05-12T15:49:34Z")
> [@DispatchCode](#): > > but I can paste what we get from the method “fromSession” doing a dump of $user: This is a dump of the _ID Token_, which does not include permissions for the user. > [@DispatchCode](#): > > Just to clarify, I did the same process (authentication) using CURL as mentioned before, and after the /token call I get what I’m expected (token decoded from [jwt.io](http://jwt.io)): This is the _Access Token_, which includes permission info. It looks like you will need the find this information in the Access Token. ---
**Author:** ![evansims](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/evansims/32/27011_2.png) [@evansims](https://community.auth0.com/u/evansims)\ **Post date:** [May 13, 2022, 5:56pm UTC](https://community.auth0.com/t/auth0-jwt-does-not-have-permissions/82849/10 "2022-05-13T17:56:34Z")
Hey again @DispatchCode 👋 It sounds like you might be using the PHP SDK for authentication rather than authorization, in which case this might not work the way you’re expecting as you’re working with ID rather than Access Tokens. This is a super common misunderstanding, and I don’t blame anyone for getting confused with this stuff! There’s a good post on our blog about the differences here: [ID Token and Access Token: What Is the Difference?](https://auth0.com/blog/id-token-access-token-what-is-the-difference/) For what you’re looking to do, you might want to consider injecting the permissions into your ID Tokens. I believe someone contributed a rule for this a while back that might help you, although admittedly, I have not tried it myself and your mileage may vary: [Accessing the permissions array in the access token - #10 by ryantomaselli](https://community.auth0.com/t/accessing-the-permissions-array-in-the-access-token/27559/10) ---
**Author:** ![dan.woda](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/dan.woda/32/18340_2.png) [@dan.woda](https://community.auth0.com/u/dan.woda)\ **Post date:** [May 13, 2022, 8:34pm UTC](https://community.auth0.com/t/auth0-jwt-does-not-have-permissions/82849/11 "2022-05-13T20:34:20Z")
Thanks for the added context @evansims! @DispatchCode If you are planning on using that rule, be aware of the [Management API Endpoint Rate Limits](https://auth0.com/docs/troubleshoot/customer-support/operational-policies/rate-limit-policy/management-api-endpoint-rate-limits). Depending on how many logins you are processing, you could run into this rate limit and that could break your login flow. Let us know if you have any other questions. Thanks! ---
**Author:** ![evansims](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/evansims/32/27011_2.png) [@evansims](https://community.auth0.com/u/evansims)\ **Post date:** [May 14, 2022, 12:44am UTC](https://community.auth0.com/t/auth0-jwt-does-not-have-permissions/82849/12 "2022-05-14T00:44:16Z")
Thanks @dan.woda I always forget to mention that side of things, whoops! Going back to the Access Token, I forgot to mention you should be able to access that Token from an authenticated session using the `Auth0\SDK\Auth0::getAccessToken()` method, but it is the token in it’s “raw” JWT format — it isn’t decoded like the ID Token is for you. You should be able to run it through the `Auth0\SDK\Auth0::decode()` method to get to the data you’re looking for, though. More on that here: [GitHub - auth0/auth0-PHP: PHP SDK for Auth0 Authentication and Management APIs.](https://github.com/auth0/auth0-PHP#decoding-an-access-token) ---
**Author:** ![DispatchCode](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/dispatchcode/32/36465_2.png) [@DispatchCode](https://community.auth0.com/u/DispatchCode)\ **Post date:** [May 17, 2022, 2:58pm UTC](https://community.auth0.com/t/auth0-jwt-does-not-have-permissions/82849/13 "2022-05-17T14:58:57Z")
Thanks @dan.woda and @evansims, your answers has been very helpful! Also thank you for the links given, I suspect that they’re wiil be helpful. Looking to the source code of the Auth0 Laravel SDK and PHP-SDK and the snipped provided by evanism, I finally figoured out how get permissions. For those who are interested in it, this is what I did, with a little “write up”: ```auto $auth0Sdk = app('auth0')->getSdk(); $parse = new Parser($auth0Sdk->getAccessToken(), $auth0Sdk->configuration()); dd($parse->getClaim("permissions")); ``` Here `app('auth0')->getSdk();` returns an `SdkConfiguration` instance that will be used later as an argument for the Parse constructor; the other argument is the JWT token mentioned by dan.woda and evansims. If you don’t use Parse but instead you call the decode method: ```auto $auth0Token = $auth0Sdk->decode($auth0Sdk->getAccessToken()); ``` You will get an instance of Token that has a “parse” private member. Apparently there is no way to get the Parse instance inside it. If you create an instance of Parse like shown before, internally (in the constructor), the parse method will be called and the token will be decoded. The output will be: ```auto ^ array:3 [▼ 0 => "create:articles" 1 => "read:admin-messages" 2 => "viewall:categories" ] ``` Simpler that I could even imagine! I hope this can help someone in the same situations around here. Thanks for your support 🙂 you can close that topic. ---
**Author:** ![dan.woda](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/dan.woda/32/18340_2.png) [@dan.woda](https://community.auth0.com/u/dan.woda)\ **Post date:** [June 28, 2022, 10:34pm UTC](https://community.auth0.com/t/auth0-jwt-does-not-have-permissions/82849/14 "2022-06-28T22:34:29Z")