# Can't get token with update:users scope **URL:** \ **Category:** Get Help\ **Tags:** account-linking, scopes, auth0, login\ **Created:** [September 1, 2021, 5:34pm UTC](https://community.auth0.com/t/cant-get-token-with-update-users-scope/68949 "2021-09-01T17:34:06Z")\ **Posts on this page:** 9\ **Page:** 1
**Author:** ![enes](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/enes/32/14208_2.png) [@enes](https://community.auth0.com/u/enes)\ **Post date:** [September 1, 2021, 5:34pm UTC](https://community.auth0.com/t/cant-get-token-with-update-users-scope/68949/1 "2021-09-01T17:34:06Z")
I have a Auth0 management api v2 for single page application (React.js). I m trying to implement link-identities but it always return 401 UnAuthorized response. Here is my request : Request url : [https://domain/api/v2/users/primary\_user\_id/identities](https://domain/api/v2/users/primary_user_id/identities) Header: Authorization: ‘Bearer primary\_Account\_token’ Body : link\_with: secondary\_account\_token This is response : “statusCode”: 401, “error”: “Unauthorized”, “message”: “Invalid token”, “attributes”: { “error”: “Invalid token” } I’ve noticed that jwt tokens which sent in identities request didn’t created by update:users scope. When i try to add this scope into my get token request, it return that : “User is not authorized to the audience for those scopes” Can you help me about that ? Thanks ---
**Author:** ![dan.woda](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/dan.woda/32/18340_2.png) [@dan.woda](https://community.auth0.com/u/dan.woda)\ **Post date:** [September 3, 2021, 4:28pm UTC](https://community.auth0.com/t/cant-get-token-with-update-users-scope/68949/3 "2021-09-03T16:28:23Z")
Hi @enes, Welcome to the Auth0 Community! You should not allow your SPA to obtain a management API access token with the `update:users` scope. [This doc is helpful if you would like to know more about why that is not allowed](https://auth0.com/docs/security/tokens/access-tokens/get-management-api-tokens-for-single-page-applications). The client side account linking implementation requires a `update:current_user_identities` scoped token. > **[User-Initiated Account Linking: Client-Side Implementation](https://auth0.com/docs/manage-users/user-accounts/user-account-linking/user-initiated-account-linking-client-side-implementation)** > > Learn how to provide a client-side UI that allows users to authenticate to their other accounts and link these to their primary account using a SPA. ---
**Author:** ![enes](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/enes/32/14208_2.png) [@enes](https://community.auth0.com/u/enes)\ **Post date:** [September 3, 2021, 4:44pm UTC](https://community.auth0.com/t/cant-get-token-with-update-users-scope/68949/4 "2021-09-03T16:44:48Z")
Hi @dan.woda thank you for response. I been trying to handle with client side account linking implementation. but it throw me 401 Unauthorized error. I m sending primary account’s access token which is obtained with update:current\_user\_identities scope at header. In the body, sending seconday account ID token as link\_with parameter. Also my request url is like this: [https://domain/api/v2/users/604f0baad113b5006ddd6797/identities](https://domain/api/v2/users/604f0baad113b5006ddd6797/identities) (primary account user\_id) { “statusCode”: 400, “error”: “Bad Request”, “message”: “Path validation error: ‘Object didn’t pass validation for format user-id: 604f0baad113b5006ddd6797’ on property id (ID of the primary user account to link a second user account to).”, “errorCode”: “invalid\_uri” } If i send [https://domain/api/v2/users/auth|604f0baad113b5006ddd6797/identities](https://domain/api/v2/users/auth%7C604f0baad113b5006ddd6797/identities) (with auth| prefix) { “statusCode”: 403, “error”: “Forbidden”, “message”: “User to be acted on does not match subject in bearer token.”, “errorCode”: “unowned\_resource” } ---
**Author:** ![dan.woda](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/dan.woda/32/18340_2.png) [@dan.woda](https://community.auth0.com/u/dan.woda)\ **Post date:** [September 3, 2021, 10:51pm UTC](https://community.auth0.com/t/cant-get-token-with-update-users-scope/68949/5 "2021-09-03T22:51:17Z")
Have you tried URL encoding the pipe character (`|`)? ---
**Author:** ![enes](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/enes/32/14208_2.png) [@enes](https://community.auth0.com/u/enes)\ **Post date:** [September 4, 2021, 10:05am UTC](https://community.auth0.com/t/cant-get-token-with-update-users-scope/68949/6 "2021-09-04T10:05:49Z")
@dan.woda I’ve tried like this : [https://dev-get-local.auth0.com/api/v2/users/auth`|`604f0baad113b5006ddd6797/identities](https://dev-get-local.auth0.com/api/v2/users/auth%60%7C%60604f0baad113b5006ddd6797/identities) (pipe character encoded is %7C). And response from endpoint : ```auto { "statusCode": 403, "error": "Forbidden", "message": "User to be acted on does not match subject in bearer token.", "errorCode": "unowned_resource" } ``` Let me clarify my use case one more time: 1 - I have two registered account. One of is email account without social. I m getting it’s access token via https://domain\_name/oauth/token endpoint with update:current\_user\_identities scope. 2 - Second account is registered with social via microsoft connection. I m getting it’s ID token with update:current\_user\_identities scope. In my request , i m sending email account’s access token at header as authorization paramater with Bearer prefix. Second account’s ID token is sending at body as link\_with parameter. At request url, adding first account’s user\_id as part of url. Tried it with 3 ways : [https://dev-get-local.auth0.com/api/v2/users/auth`|`604f0baad113b5006ddd6797/identities](https://dev-get-local.auth0.com/api/v2/users/auth%60%7C%60604f0baad113b5006ddd6797/identities) [https://dev-get-local.auth0.com/api/v2/users/auth|604f0baad113b5006ddd6797/identities](https://dev-get-local.auth0.com/api/v2/users/auth%7C604f0baad113b5006ddd6797/identities) [https://dev-get-local.auth0.com/api/v2/users/604f0baad113b5006ddd6797/identities](https://dev-get-local.auth0.com/api/v2/users/604f0baad113b5006ddd6797/identities) Nothing is works. ---
**Author:** ![enes](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/enes/32/14208_2.png) [@enes](https://community.auth0.com/u/enes)\ **Post date:** [September 6, 2021, 11:48am UTC](https://community.auth0.com/t/cant-get-token-with-update-users-scope/68949/7 "2021-09-06T11:48:39Z")
This fixed the issue : The user\_ID in your URL should be auth0%7C604f0baad113b5006ddd6797 - the other requests were sufficient to pass the URL string validation the endpoint has, but the user requested by the URL did not match the “sub” claim in the presented access token as they were missing the “0”. ---
**Author:** ![dan.woda](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/dan.woda/32/18340_2.png) [@dan.woda](https://community.auth0.com/u/dan.woda)\ **Post date:** [September 8, 2021, 5:07pm UTC](https://community.auth0.com/t/cant-get-token-with-update-users-scope/68949/8 "2021-09-08T17:07:44Z")
Glad you were able to figure it out. ---
**Author:** ![system](https://global.discourse-cdn.com/auth0/original/3X/b/5/b560f266932fcce5d57f09a6595bd50518cae3f3.jpeg) [@system](https://community.auth0.com/u/system)\ **Post date:** [September 23, 2021, 5:07pm UTC](https://community.auth0.com/t/cant-get-token-with-update-users-scope/68949/9 "2021-09-23T17:07:51Z")
This topic was automatically closed 15 days after the last reply. New replies are no longer allowed. ---
**Author:** ![lihua.zhang](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/lihua.zhang/32/39683_2.png) [@lihua.zhang](https://community.auth0.com/u/lihua.zhang)\ **Post date:** [June 23, 2022, 6:42am UTC](https://community.auth0.com/t/cant-get-token-with-update-users-scope/68949/10 "2022-06-23T06:42:34Z")
We have created a FAQ related to this topic. Please check it out: [How to Implement Client-Side User Initiated Account Linking](https://community.auth0.com/t/how-to-implement-client-side-user-initiated-account-linking/81199)