# Caching API Access Tokens in Login Action **URL:** \ **Category:** Get Help\ **Tags:** apis, application\ **Created:** [March 21, 2023, 11:22am UTC](https://community.auth0.com/t/caching-api-access-tokens-in-login-action/102986 "2023-03-21T11:22:00Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![saintf](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/saintf/32/27584_2.png) [@saintf](https://community.auth0.com/u/saintf)\ **Post date:** [March 21, 2023, 11:22am UTC](https://community.auth0.com/t/caching-api-access-tokens-in-login-action/102986/1 "2023-03-21T11:22:00Z")
Hi there - We’re trying to enrich our access tokens with some information we store. To do so, we leverage actions where, on login, we call our own API and get details about the user/etc to embed in the token. In order to protect the API itself, we used a M2M token and cached it as detailed in several FAQ’s: > [@How do I call my API from an Action?](https://community.auth0.com/t/how-do-i-call-my-api-from-an-action/69041): > > Hey, So I’m in the process of trying to add a user to my database using an API call from a “Post User Registration” Action. I have followed this blog post here: [https://community.auth0.com/t/how-do-i-call-my-api-from-a-rule/41309](https://community.auth0.com/t/how-do-i-call-my-api-from-a-rule/41309) and seem to have everything looking good. On top of that when I run the test it says the action was successful. The only problem is that my API is not being called at all even though I have triple checked that the URL is correct. Here is the code I’m working with: i… > [@Use Signed Access Token in a Post-Login Action API Request](https://community.auth0.com/t/use-signed-access-token-in-a-post-login-action-api-request/76363): > > Hello! We have an external permission service outside of Auth0 where we’d like to fetch permissions and then set these permissions as a customClaim on the accessToken. However, the permission service requires an Auth0 accessToken… Inside a Post-Login action, we’re attempting to make an axios request w/ the accessToken as an Authorization header. This header value needs to be a signed Auth0 accessToken, and we’re trying to use the event.accessToken inside the scope of the Action. However, this … [https://community.auth0.com/t/caching-management-api-access-tokens-in-login-action/95855](https://community.auth0.com/t/caching-management-api-access-tokens-in-login-action/95855) However, this doesn’t seem to work in terms of quotas - where M2M are 1000 tokens. If caching only holds for 15 minutes and our users are quite active, then that’s nearly 95 tokens a day, which quickly fills up the quota. It also seems that we’re not quite caching successfully (perhaps the size of the token?) so we may get less cache hits than we’d like, and again, that only goes against our quotas. Is there any way to cache the token in a place that is secure (i.e. Auth0 – we don’t really want to launch our own caching solution outside as it kind of defeats the purpose, right?) so that we’re not re-requesting over and over again and going against quotas? Many thanks, -Fernando ---
**Author:** ![dan.woda](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/dan.woda/32/18340_2.png) [@dan.woda](https://community.auth0.com/u/dan.woda)\ **Post date:** [March 23, 2023, 4:55pm UTC](https://community.auth0.com/t/caching-api-access-tokens-in-login-action/102986/3 "2023-03-23T16:55:08Z")
Hi @saintf, Welcome to the Auth0 Community! The caching mechanism you reference in Actions is the existing solution for caching resources. Feel free to create a #feedback request! It may be helpful to store some of that user data in app\_metadata or user\_metadata, such that every transaction doesn’t result in a M2M call (this will also ensure your auth round trip is as fast as possible), otherwise, you may run up the M2M token quota like you’ve stated. ---
**Author:** ![system](https://global.discourse-cdn.com/auth0/original/3X/b/5/b560f266932fcce5d57f09a6595bd50518cae3f3.jpeg) [@system](https://community.auth0.com/u/system)\ **Post date:** [April 24, 2023, 1:51pm UTC](https://community.auth0.com/t/caching-api-access-tokens-in-login-action/102986/4 "2023-04-24T13:51:51Z")
This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.