Auth0 Home Blog Docs

Configuring scopes in Access Token Provided by Rules


When I execute a rule in Auth0, there’s an available access token to make requests to the Auth0 management API. Looking through the scope of the token, it appears there’s only read:users and update:users is provided. Is there a way I can configure this token to have more scopes such as create:users, or will I have to create a new access token within the rule on every execution?


Judging by the following documentation, you should be able to do everything you’re wanting to:


Looking both articles I wasn’t able to find the specific information I needed. Just to clarify, the Rules environment has an auth0 object that contains an access token necessary to make API calls to Auth0, not set the scopes of the user in the context. In my case, I wanted to make a request to the management API to create a new (related) user, but the token given does not have the necessary scopes to do so.

Is it a matter of making a request within the rule to the /oauth/token endpoint and use it for subsequent requests to create the user, or is there a way I can configure the auth0 object in the rule to have the necessary scopes to begin with?