Auth0 Machine to Machine permission in JWT

[kwintenli]

Hi there,

I have a question related to Auth0 Machine to Machine application’s permission setup.

We have a single API, both a SPA and Machine to Machine applications will have access to this API

For authenticating through the SPA, we’ve got the permissions as a permission after decoded the JWT

But when authenticating through the Machine to Machine application, it will become a scope property

Is it a normal behavior? Is there a way to unify the property name? thanks

[dan.woda]

Hi @kwintenli,

Welcome to the Auth0 Community Forum!

It looks like this has been addressed here;

Trouble understanding scopes vs permissions

Hi @Luukth Sorry for the delay in the response. Let me try to address some of your doubts The express API checks for permissions in the scope. Not in the access token permissions. You can specify the customScopeKey option to use the permissions claim instead of the scope. The goal of having the permissions claim instead of the scope claim to perform authorization is for the cases you just need to know what permissions the user has in a given API and you don’t need to collect consent from t…

Can you take a look and see if adding option described in that response solves the issue?

If not, please let me know and we can evaluate further strategies.

Thanks,
Dan