# AWS Lambda M2M OAuth

**URL:** <https://community.auth0.com/t/aws-lambda-m2m-oauth/121656>\
**Category:** Get Help\
**Tags:** reusable-refresh-tokens, sessions\
**Created:** [November 26, 2023, 4:00pm UTC](https://community.auth0.com/t/aws-lambda-m2m-oauth/121656 "2023-11-26T16:00:15Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Kada](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/kada/32/52736_2.png) [@Kada](https://community.auth0.com/u/Kada)\
**Post date:** [November 26, 2023, 4:00pm UTC](https://community.auth0.com/t/aws-lambda-m2m-oauth/121656/1 "2023-11-26T16:00:15Z")

</div>

Hey there,

I have multiple AWS Lambda that need secure access to my backend API protected by Auth0

From what I understand, I need to create a M2M Application for them in Auth0, and use the M2M grand client flow from OAuth to get an access token so that I can securely consume my backend API from AWS Lambda

Is it a bad idea to get a new access token for every invocation of a given lambda?

Or do I need to setup a more complex architecture when I store the access token and refresh the token in a database, and refresh the token when needed?

What’s the recommended approach here?

---

<div class="post-metadata">

**Author:** ![dan.woda](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/dan.woda/32/18340_2.png) [@dan.woda](https://community.auth0.com/u/dan.woda)\
**Post date:** [November 29, 2023, 8:47pm UTC](https://community.auth0.com/t/aws-lambda-m2m-oauth/121656/3 "2023-11-29T20:47:18Z")

</div>

Hi @Kada,

M2M tokens destined for a custom API are subject to the M2M token quota (this excludes Auth0 Management API tokens, for example). You can see quotas in the dashboard or on our [pricing page](https://auth0.com/pricing).

As a result, you will want to make efficient use of the Access Tokens in your serverless functions and generally do not want to request a new token if not necessary.

Storing and refreshing the token when it returns expired is the usual approach. Here’s some discussion on it: [aws api gateway - Aws Lambda - how to persist valid tokens for use with other invocations - Stack Overflow](https://stackoverflow.com/questions/65336330/aws-lambda-how-to-persist-valid-tokens-for-use-with-other-invocations)

Hope this helps!

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/auth0/original/3X/b/5/b560f266932fcce5d57f09a6595bd50518cae3f3.jpeg) [@system](https://community.auth0.com/u/system)\
**Post date:** [December 13, 2023, 8:47pm UTC](https://community.auth0.com/t/aws-lambda-m2m-oauth/121656/4 "2023-12-13T20:47:55Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.