Caching API Access Tokens in Login Action

[saintf]

Hi there -
We’re trying to enrich our access tokens with some information we store. To do so, we leverage actions where, on login, we call our own API and get details about the user/etc to embed in the token.

In order to protect the API itself, we used a M2M token and cached it as detailed in several FAQ’s:

How do I call my API from an Action?

Hey, So I’m in the process of trying to add a user to my database using an API call from a “Post User Registration” Action. I have followed this blog post here: and seem to have everything looking good. On top of that when I run the test it says the action was successful. The only problem is that my API is not being called at all even though I have triple checked that the URL is correct. Here is the code I’m working with: import axios from "axios"; exports.onExecutePostUserRegistration = …

Use Signed Access Token in a Post-Login Action API Request

Hello! We have an external permission service outside of Auth0 where we’d like to fetch permissions and then set these permissions as a customClaim on the accessToken. However, the permission service requires an Auth0 accessToken… Inside a Post-Login action, we’re attempting to make an axios request w/ the accessToken as an Authorization header. This header value needs to be a signed Auth0 accessToken, and we’re trying to use the event.accessToken inside the scope of the Action. However, this …

Caching Management API Access Tokens in Login Action

Problem statement: How do I cache a Management API access token(s) using the Node Management Client and Actions caching functionality? Auth0 recently announced the ability to cache tokens within our extensibility solution, Actions. This has been a much requested feature that we are excited to have finally released. As many users utilize the Node Management Client to interact with the Management API by way of Actions, the question of how to incorporate the new caching functionality has arisen. S…

However, this doesn’t seem to work in terms of quotas - where M2M are 1000 tokens. If caching only holds for 15 minutes and our users are quite active, then that’s nearly 95 tokens a day, which quickly fills up the quota.

It also seems that we’re not quite caching successfully (perhaps the size of the token?) so we may get less cache hits than we’d like, and again, that only goes against our quotas.

Is there any way to cache the token in a place that is secure (i.e. Auth0 – we don’t really want to launch our own caching solution outside as it kind of defeats the purpose, right?) so that we’re not re-requesting over and over again and going against quotas?

Many thanks,
-Fernando

[dan.woda]

Hi @saintf,

Welcome to the Auth0 Community!

The caching mechanism you reference in Actions is the existing solution for caching resources. Feel free to create a #feedback request!

It may be helpful to store some of that user data in app_metadata or user_metadata, such that every transaction doesn’t result in a M2M call (this will also ensure your auth round trip is as fast as possible), otherwise, you may run up the M2M token quota like you’ve stated.