# Best practice to find a user in my API database from a verified JWT access token

**URL:** <https://community.auth0.com/t/best-practice-to-find-a-user-in-my-api-database-from-a-verified-jwt-access-token/64880>\
**Category:** Get Help\
**Tags:** jwt, api, auth0\
**Created:** [June 22, 2021, 7:43pm UTC](https://community.auth0.com/t/best-practice-to-find-a-user-in-my-api-database-from-a-verified-jwt-access-token/64880 "2021-06-22T19:43:43Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![duncanmcleod972](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/duncanmcleod972/32/30145_2.png) [@duncanmcleod972](https://community.auth0.com/u/duncanmcleod972)\
**Post date:** [June 22, 2021, 7:43pm UTC](https://community.auth0.com/t/best-practice-to-find-a-user-in-my-api-database-from-a-verified-jwt-access-token/64880/1 "2021-06-22T19:43:43Z")

</div>

Hi everyones,

My goal in one sentence:  
**Find an existing user in my API database from a verified JWT access token**  
(I mean here : Find the user who send the current request)

What I have done and it works :

I have a basic web application where my frontend ask for an accessToken and store it into the local storage.

```auto
const accessToken = await this.auth0Client.getTokenSilently();
localStorage.setItem('accessToken', accessToken);

```

Then this token is inserted as an authorization header with all the requests sended to my personal API

I also added a rule into the auth0 web interface, thus I can retreive the email into the accessToken.

```auto
function (user, context, callback) {  
  context.accessToken['https://mynamespace.com/email'] = user.email;
  context.accessToken['https://mynamespace.com/email_verified'] = user.email_verified;

  return callback(null, user, context);
}

```

All of this works but seems complicated to me, I feel I am missing some points here, am I ?  
Is this follow the best practices ?  
I have read [here](https://softwareengineering.stackexchange.com/questions/356959/is-it-bad-practice-to-store-a-users-email-address-in-a-jwt) it is not a good practice to store email into access token, is that true ?

Thank you for your answers !

---

<div class="post-metadata">

**Author:** ![stephanie.chamblee](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/stephanie.chamblee/32/26087_2.png) [@stephanie.chamblee](https://community.auth0.com/u/stephanie.chamblee)\
**Post date:** [June 23, 2021, 1:30pm UTC](https://community.auth0.com/t/best-practice-to-find-a-user-in-my-api-database-from-a-verified-jwt-access-token/64880/3 "2021-06-23T13:30:26Z")

</div>

Hi @duncanmcleod972,

Welcome to the Community!

The Access Token’s `sub` claim is the Auth0 user ID. One way you could handle this is by updating your DB to include a foreign key for the Auth0 user ID so that you can look up the user using the Access Token’s `sub` claim.

You can also retrieve additional profile info by calling the `/userinfo` endpoint from your backend, using the Access Token in the Authorization header as a bearer token.

Our docs offer info on why only the user ID is included in the Access Token:

> Note that the token does not contain any information about the user besides their ID ( **sub** claim). It only contains authorization information about which actions the application is allowed to perform at the API ( **scope** claim). This is what makes it useful for securing an API, but not for authenticating a user.

> **[Tokens](https://auth0.com/docs/secure/tokens)**
>
> Describes the types of tokens related to identity and authentication and how they are used by Auth0.

---

<div class="post-metadata">

**Author:** ![duncanmcleod972](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/duncanmcleod972/32/30145_2.png) [@duncanmcleod972](https://community.auth0.com/u/duncanmcleod972)\
**Post date:** [June 23, 2021, 11:36pm UTC](https://community.auth0.com/t/best-practice-to-find-a-user-in-my-api-database-from-a-verified-jwt-access-token/64880/4 "2021-06-23T23:36:30Z")

</div>

This totally make sense ! Thanks a lot for your answer 😀

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/auth0/original/3X/b/5/b560f266932fcce5d57f09a6595bd50518cae3f3.jpeg) [@system](https://community.auth0.com/u/system)\
**Post date:** [July 8, 2021, 11:36pm UTC](https://community.auth0.com/t/best-practice-to-find-a-user-in-my-api-database-from-a-verified-jwt-access-token/64880/5 "2021-07-08T23:36:31Z")

</div>

This topic was automatically closed 15 days after the last reply. New replies are no longer allowed.