# Auth0 Secure Api for logged users

**URL:** <https://community.auth0.com/t/auth0-secure-api-for-logged-users/6627>\
**Category:** Get Help\
**Tags:** api-authorization\
**Created:** [May 15, 2017, 9:53pm UTC](https://community.auth0.com/t/auth0-secure-api-for-logged-users/6627 "2017-05-15T21:53:37Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![l.pollastri](https://upload.wikimedia.org/wikipedia/commons/thumb/7/7c/User_font_awesome.svg/768px-User_font_awesome.svg.png) [@l.pollastri](https://community.auth0.com/u/l.pollastri)\
**Post date:** [May 15, 2017, 9:53pm UTC](https://community.auth0.com/t/auth0-secure-api-for-logged-users/6627/1 "2017-05-15T21:53:37Z")

</div>

In my architecture I have a Client (Android application), Auth0 as authorization server and a Backend Server that provides data to logged users with RESTful Apis.

I am struggling to understand which is the correct practice to implement to provide RESTful Apis to only Logged Users.

1- I should use as authorization header of my request the access token provided by auth0 after the login operation, and validate it on server side with /userinfo auth0 api

or

2- I should protect my Apis with client credentials and provide as authorization an access token provided by auth 0 with /oauth/token method with grant\_type client credentials ? In this way how can I add user id or email data to access token?

I think the first one is the correct one, but I am still confused.

Thanks.

---

<div class="post-metadata">

**Author:** ![prashantT](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/prashantt/32/6002_2.png) [@prashantT](https://community.auth0.com/u/prashantT)\
**Post date:** [May 16, 2017, 10:07am UTC](https://community.auth0.com/t/auth0-secure-api-for-logged-users/6627/2 "2017-05-16T10:07:39Z")

</div>

For mobile apps, you would use the Authorization Code (PKCE) grant to obtain an access\_token authorized to call your API. The following docs outline this flow:

- [https://auth0.com/docs/api-auth/grant/authorization-code-pkce](https://auth0.com/docs/api-auth/grant/authorization-code-pkce)
- [Call Your API Using the Authorization Code Flow with PKCE](https://auth0.com/docs/api-auth/tutorials/authorization-code-grant-pkce)

---

<div class="post-metadata">

**Author:** ![l.pollastri](https://upload.wikimedia.org/wikipedia/commons/thumb/7/7c/User_font_awesome.svg/768px-User_font_awesome.svg.png) [@l.pollastri](https://community.auth0.com/u/l.pollastri)\
**Post date:** [May 17, 2017, 3:30pm UTC](https://community.auth0.com/t/auth0-secure-api-for-logged-users/6627/3 "2017-05-17T15:30:17Z")

</div>

Ok thanks, but after auth server successfully authenticate the user, my client got a server response that is OIDC connect with an ID\_token used by the client to get user information and an access\_token which I think I will use to authenticate the user to the resource server API.  
Now how can I verify that this access\_token is valid?

1- I should make a server call to /userinfo endpoint and consume the response every time?

or

2- I should verify this token on server side? This token is not JWT format, do you know which format is used for this token?

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/auth0/original/3X/b/5/b560f266932fcce5d57f09a6595bd50518cae3f3.jpeg) [@system](https://community.auth0.com/u/system)\
**Post date:** [March 2, 2018, 5:53am UTC](https://community.auth0.com/t/auth0-secure-api-for-logged-users/6627/4 "2018-03-02T05:53:56Z")

</div>