Basic Auth0 question about JWT id_tokens and Universal Login flow

[tyf]

Happy to help!

@davidaventimiglia

There’s an id_token and an access_token, and the former I guess identifies the user and proves that they’ve logged into (been validated by) Auth0, whereas the latter I guess grants access to an API. Question: do I need both? It seems like the id_token is essential, but I can’t figure out a use for the access_token in my application.

The access token is used to call an API - Typically, this is added as a header in a request to an external API at which point the API verifies it and additionally checks for permissions. Some libraries that do this can be found here.

@davidaventimiglia

Is it possible to achieve token storage (id_token and/or access_token) in the browser in memory or local storage without JavaScript and the Auth0 SDK? I’m guessing “no” but again I’m trying to build up an accurate mental model of this stuff.

You can technically use the Authentication API to carry out most login functionality typically managed by Auth0 SDKS - The API will return tokens, but storage would be entirely up to you at that point without an SDK.