# Auth0-react is not accepting scopes

**URL:** <https://community.auth0.com/t/auth0-react-is-not-accepting-scopes/134769>\
**Category:** Get Help\
**Tags:** login-experience, new-universal-login-experience\
**Created:** [May 22, 2024, 6:48pm UTC](https://community.auth0.com/t/auth0-react-is-not-accepting-scopes/134769 "2024-05-22T18:48:45Z")\
**Posts on this page:** 9\
**Page:** 1

<div class="post-metadata">

**Author:** ![omar.muhtaseb](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/omar.muhtaseb/32/49184_2.png) [@omar.muhtaseb](https://community.auth0.com/u/omar.muhtaseb)\
**Post date:** [May 22, 2024, 6:48pm UTC](https://community.auth0.com/t/auth0-react-is-not-accepting-scopes/134769/1 "2024-05-22T18:48:45Z")

</div>

I’m using auth0-react in my application to authenticate users. I’m trying to get the refresh token, but every time I add the scope, it’s getting overwritten by the default scopes.  
Here’s the provider data

```auto
        <Auth0Provider
          domain={ENVIRONMENT}
          clientId={ENVIRONMENT}
          authorizationParams={{
            redirect_uri: CALLBACK_URL,
            audience: ENVIRONMENT,
            scope: 'openid profile email offline_access',
          }}
        >

```

Here’s the loginWithRedirect

```auto
      loginWithRedirect({
        authorizationParams: { scope: 'openid profile email offline_access' },
      }).catch(console.error);

```

and here is getting access token

```auto
        accessToken = await getAccessTokenSilently({
          timeoutInSeconds: 1,
          authorizationParams: { scope: 'openid profile email offline_access' },
        });

```

Whenever I send the request, it’s always without the offline\_access scope.  
 ![image](https://global.discourse-cdn.com/auth0/original/3X/b/8/b8dad79701660532261aa56dc5b7d323de18ea70.png)

I also have the refresh token enabled for the app

 ![image](https://global.discourse-cdn.com/auth0/original/3X/8/6/86944919b483c98d4fbd03c7de0da3d29fc71b4a.png)

---

<div class="post-metadata">

**Author:** ![ty.frith](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/ty.frith/32/58484_2.png) [@ty.frith](https://community.auth0.com/u/ty.frith)\
**Post date:** [May 22, 2024, 11:00pm UTC](https://community.auth0.com/t/auth0-react-is-not-accepting-scopes/134769/3 "2024-05-22T23:00:30Z")

</div>

Hey there @omar.muhtaseb welcome to the community!

Interesting 🤔 Does setting `useRefreshTokens={true}` in [Auth0Provider](https://auth0.github.io/auth0-react/interfaces/Auth0ProviderOptions.html#useRefreshTokens) cause the `offline_access` scope to be included?

---

<div class="post-metadata">

**Author:** ![omar.muhtaseb](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/omar.muhtaseb/32/49184_2.png) [@omar.muhtaseb](https://community.auth0.com/u/omar.muhtaseb)\
**Post date:** [May 23, 2024, 12:41pm UTC](https://community.auth0.com/t/auth0-react-is-not-accepting-scopes/134769/4 "2024-05-23T12:41:24Z")

</div>

I added that as well  
 ![image](https://global.discourse-cdn.com/auth0/original/3X/2/4/2459940fdcf839b418d6b950ee2cb9ab7fc0f803.png)

But it is still the same, this is the getTokenSilently request  
 ![image](https://global.discourse-cdn.com/auth0/original/3X/f/b/fbf0f03fb1d099ad50c11c0faabf5f38bfd96b27.png)  
 ![image](https://global.discourse-cdn.com/auth0/original/3X/2/a/2a74f5402a9970e51c9d10d392c5782ec256e85a.png)  
 ![image](https://global.discourse-cdn.com/auth0/original/3X/4/6/46809878eaa8b287b67ef84034958701ecb4afb4.png)

---

<div class="post-metadata">

**Author:** ![ty.frith](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/ty.frith/32/58484_2.png) [@ty.frith](https://community.auth0.com/u/ty.frith)\
**Post date:** [May 23, 2024, 4:17pm UTC](https://community.auth0.com/t/auth0-react-is-not-accepting-scopes/134769/5 "2024-05-23T16:17:43Z")

</div>

Thanks for confirming - Does the API which you are using as `audience` have the “allow offline access” option toggled?

> **[API Settings](https://auth0.com/docs/get-started/apis/api-settings#access-settings)**
>
> Describes the settings related to APIs available in the Auth0 Dashboard.

---

<div class="post-metadata">

**Author:** ![omar.muhtaseb](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/omar.muhtaseb/32/49184_2.png) [@omar.muhtaseb](https://community.auth0.com/u/omar.muhtaseb)\
**Post date:** [May 23, 2024, 7:59pm UTC](https://community.auth0.com/t/auth0-react-is-not-accepting-scopes/134769/6 "2024-05-23T19:59:57Z")

</div>

I don’t see this option in my API

 ![image](https://global.discourse-cdn.com/auth0/original/3X/0/7/07cc1c5cf75989d3ff2f2096ca78d738a7bd0102.png)

---

<div class="post-metadata">

**Author:** ![ty.frith](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/ty.frith/32/58484_2.png) [@ty.frith](https://community.auth0.com/u/ty.frith)\
**Post date:** [May 23, 2024, 9:33pm UTC](https://community.auth0.com/t/auth0-react-is-not-accepting-scopes/134769/7 "2024-05-23T21:33:20Z")

</div>

Are you by chance using the management API as your audience (`https://{your_domain}/api/v2`)?

> [@Having trouble enabling Allow Offline Access](https://community.auth0.com/t/having-trouble-enabling-allow-offline-access/30803/3):
>
> Hi! The issue here is that you are using the management API. It is not possible to get refresh tokens for the Management API, so therefore there is no “Offline Access” to enable in the settings. You will instead need to create a new token each time, which can be done programmatically by following the steps here: [Get Management API Access Tokens for Production](https://auth0.com/docs/api/management/v2/get-access-tokens-for-production) Other APIs have refresh tokens / enable Offline access, but the management API does not because it only support client credentials grant…

---

<div class="post-metadata">

**Author:** ![omar.muhtaseb](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/omar.muhtaseb/32/49184_2.png) [@omar.muhtaseb](https://community.auth0.com/u/omar.muhtaseb)\
**Post date:** [May 27, 2024, 4:13pm UTC](https://community.auth0.com/t/auth0-react-is-not-accepting-scopes/134769/8 "2024-05-27T16:13:00Z")

</div>

Yes, that’s the API I’m using.  
Based on what you just shared, do I need to create another API to get a refresh token? I need to implement the offline access in my case.

---

<div class="post-metadata">

**Author:** ![ty.frith](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/ty.frith/32/58484_2.png) [@ty.frith](https://community.auth0.com/u/ty.frith)\
**Post date:** [May 28, 2024, 9:56pm UTC](https://community.auth0.com/t/auth0-react-is-not-accepting-scopes/134769/9 "2024-05-28T21:56:00Z")

</div>

Thanks for confirming!

> [@omar.muhtaseb](#):
>
> Based on what you just shared, do I need to create another API to get a refresh token?

Yes, you will need to [register an API](https://auth0.com/docs/get-started/auth0-overview/set-up-apis) in Auth0. At that point you will be able to add the `offline_access` scope and use refresh tokens.

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/auth0/original/3X/b/5/b560f266932fcce5d57f09a6595bd50518cae3f3.jpeg) [@system](https://community.auth0.com/u/system)\
**Post date:** [June 20, 2024, 3:35pm UTC](https://community.auth0.com/t/auth0-react-is-not-accepting-scopes/134769/10 "2024-06-20T15:35:32Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.