Auth0Client for M2M?

[tjones]

Hey there, is it possible to use Auth0Client for M2M communication? I can happily implement the POST example here to get an access token to call my API with but I’m planning on using this flow for applications external to my organization. I’d prefer to ask them to copy/paste a one-liner that instantiates Auth0Client to retrieve an access token rather than having them construct their own POST request.

When I try to instantiate Auth0Client with the app’s credentials I get

{"error":"access_denied","error_description":"Client is not authorized to access \\"https://...". You need to create a \\"client-grant\\" associated to this API. See: https://auth0.com/docs/api/v2#!/Client_Grants/post_client_grants"} (Auth0::AccessDenied)

[tyf]

Hey there @tjones welcome to the community!

I assume you’re referring to Auth0Client of of auth0-spa-js? This is a client-side SDK not intended to handle client credentials of any kind (see public vs confidential applications). A client credentials exchange should take place server-side and you can go about writing that code however you like.

More info here:

Auth0 Support for API Keys and Personal Access Tokens

Problem statement: Does Auth0 support the concept of API keys or personal access tokens (think GitHub)? Answer: Auth0 does not provide a solution for personal access tokens. If this is something you are interested in, please upvote this feedback request. Regarding API keys: A client credentials grant is more or less equivalent to an API key - The primary difference being that API keys are typically validated by the API itself whereas client credentials are exchanged for a token at an authoriza…

[tjones]

Sorry, I should have been more specific. I was referring to the ruby-auth0 client. I’m assuming the response still applies?

[tyf]

Gotcha, thanks for clarifying and sorry just getting back to you on this!

Management API SDK libraries includingruby-auth0 are designed to be used against the Auth0 Management API as opposed to your own - It doesn’t sound like that’s suitable for your use case.