# Deactivate account after sign up

**URL:** <https://community.auth0.com/t/deactivate-account-after-sign-up/73602>\
**Category:** Get Help\
**Created:** [November 23, 2021, 4:41am UTC](https://community.auth0.com/t/deactivate-account-after-sign-up/73602 "2021-11-23T04:41:30Z")\
**Posts on this page:** 10\
**Page:** 1

<div class="post-metadata">

**Author:** ![jerryforcode](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/jerryforcode/32/32084_2.png) [@jerryforcode](https://community.auth0.com/u/jerryforcode)\
**Post date:** [November 23, 2021, 4:41am UTC](https://community.auth0.com/t/deactivate-account-after-sign-up/73602/1 "2021-11-23T04:41:30Z")

</div>

Hi,  
I would like to deactivate users based on user role selected in my custom signup field. Essentially I want to restrict access to my app until the user account has been reviewed and approved. How can I do this with auth0? after signup, can i send a request to block the user and also do a get request to check the status of the block?  
Please advise.

Thanks!

---

<div class="post-metadata">

**Author:** ![SaqibHussain](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/saqibhussain/32/42924_2.png) [@SaqibHussain](https://community.auth0.com/u/SaqibHussain)\
**Post date:** [November 25, 2021, 12:43am UTC](https://community.auth0.com/t/deactivate-account-after-sign-up/73602/2 "2021-11-25T00:43:54Z")

</div>

Hi @jerryforcode

Thanks for getting in touch with us here at Auth0 Community!

You could certainly do as you suggest i.e. block user via the Management API, useful endpoints for this would be:

Useful Management API Endpoints for this:

Search for user by email:  
[https://auth0.com/docs/api/management/v2#!/Users\_By\_Email/get\_users\_by\_email](https://auth0.com/docs/api/management/v2#!/Users_By_Email/get_users_by_email)

Update a User: [https://auth0.com/docs/api/management/v2#!/Users/patch\_users\_by\_id](https://auth0.com/docs/api/management/v2#!/Users/patch_users_by_id)

body=

```auto
{
"blocked": true
}

```

However there might be a simpler way via Auth0 Rules [https://auth0.com/docs/rules](https://auth0.com/docs/rules) and user profile app\_metadata [https://auth0.com/docs/users/metadata](https://auth0.com/docs/users/metadata)

You could create a rule (they fire on user login) to check the app\_metadata for a flag, if the flag is not set then disallow login to a certain app (or all apps). You set the flag manually against the user account (a possible approval process) to indicate the account is approved and the user can then login.

I played with a possible rule and the below should work for the above scenario (chop and change according to your use case)

```auto
function checkLoginStatus(user, context, callback) {
  if (context.clientName === 'My App 2') {
    user.app_metadata = user.app_metadata || {};
    if (user.app_metadata.LoginStatus !== "Reviewed") {
      return callback(
        new UnauthorizedError('This account need to be reviewed before it can login')
      );
    }
  }

  callback(null, user, context);
}

```

Approved user accounts will have this flag in app\_metadata, any account without this flag cannot login e.g. new sign ups:

```auto
{
  "LoginStatus" : "Reviewed"
}

```

I hope this helps get you started, any questions feel free to come back to me.  
Regards  
Saqib.

---

<div class="post-metadata">

**Author:** ![jerryforcode](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/jerryforcode/32/32084_2.png) [@jerryforcode](https://community.auth0.com/u/jerryforcode)\
**Post date:** [November 26, 2021, 1:05am UTC](https://community.auth0.com/t/deactivate-account-after-sign-up/73602/3 "2021-11-26T01:05:44Z")

</div>

I appreciate this 🙂

---

<div class="post-metadata">

**Author:** ![jerryforcode](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/jerryforcode/32/32084_2.png) [@jerryforcode](https://community.auth0.com/u/jerryforcode)\
**Post date:** [November 26, 2021, 4:25am UTC](https://community.auth0.com/t/deactivate-account-after-sign-up/73602/4 "2021-11-26T04:25:34Z")

</div>

everything worked - i just left out the `if (context.clientName === 'My App 2')` since its only going to be one app (dont know if you recommend this for security reasons? )  
However, I have a question with regards to the callback error denying access - that works and all, but how do get that response when a user tries to log in? I want to show a modal or something to indicate an error. I was trying to subscribe to `this.auth.loginWithRedirect` to see if it would return an error response but no luck.  
Please advise

---

<div class="post-metadata">

**Author:** ![jerryforcode](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/jerryforcode/32/32084_2.png) [@jerryforcode](https://community.auth0.com/u/jerryforcode)\
**Post date:** [November 26, 2021, 5:34am UTC](https://community.auth0.com/t/deactivate-account-after-sign-up/73602/5 "2021-11-26T05:34:12Z")

</div>

seems like this.auth.error$ helps to determine this

---

<div class="post-metadata">

**Author:** ![SaqibHussain](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/saqibhussain/32/42924_2.png) [@SaqibHussain](https://community.auth0.com/u/SaqibHussain)\
**Post date:** [November 26, 2021, 9:20am UTC](https://community.auth0.com/t/deactivate-account-after-sign-up/73602/6 "2021-11-26T09:20:06Z")

</div>

Hey @jerryforcode  
The UnauthorizedError will redirect back to your callback URL with `error` and `error_description` query parameters so you can harness that information on your client.

You can also review this post about custom error pages [https://community.auth0.com/t/render-a-custom-error-page-from-rule/61010](https://community.auth0.com/t/render-a-custom-error-page-from-rule/61010)  
Regards

---

<div class="post-metadata">

**Author:** ![jerryforcode](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/jerryforcode/32/32084_2.png) [@jerryforcode](https://community.auth0.com/u/jerryforcode)\
**Post date:** [November 27, 2021, 4:52am UTC](https://community.auth0.com/t/deactivate-account-after-sign-up/73602/7 "2021-11-27T04:52:08Z")

</div>

thanks @SaqibHussain … also, how can i clear the session after the attempt has been made. Because everytime i click login button again after, i get redirected to the error and its a loop i cant get out of unless the user app\_metadata value is changed to “Reviewed”. but if i clear my browser cookies it goes away. i dont see the cookie set in my browser though (kinda confused)

---

<div class="post-metadata">

**Author:** ![SaqibHussain](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/saqibhussain/32/42924_2.png) [@SaqibHussain](https://community.auth0.com/u/SaqibHussain)\
**Post date:** [November 28, 2021, 12:31pm UTC](https://community.auth0.com/t/deactivate-account-after-sign-up/73602/8 "2021-11-28T12:31:47Z")

</div>

Hi @jerryforcode  
Thanks for getting back in touch with us.  
It sounds like when you present your error page you will also need to clear you application session. How you do this depends on what SDK/Library you’re using but it would be something you need to manage yourself. Some SDK’s when you implement the logout will clear the application session as well maybe you can piggy back on some of the functionality to clear your application session/cookie. Please review this doc on session layers as it would be worth looking at that to understand the different sessions [https://auth0.com/docs/users/sessions/session-layers](https://auth0.com/docs/users/sessions/session-layers) and your relevant Auth0 library should be listed here [https://auth0.com/docs/libraries](https://auth0.com/docs/libraries) the Quickstarts also help in breaking down the logout requirements [https://auth0.com/docs/quickstarts](https://auth0.com/docs/quickstarts)

Please let me know if you need any further assistance on this.  
Regards

---

<div class="post-metadata">

**Author:** ![konrad.sopala](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/konrad.sopala/32/13516_2.png) [@konrad.sopala](https://community.auth0.com/u/konrad.sopala)\
**Post date:** [December 6, 2021, 7:51pm UTC](https://community.auth0.com/t/deactivate-account-after-sign-up/73602/9 "2021-12-06T19:51:17Z")

</div>

Thanks for helping on this one Saqib!

---

<div class="post-metadata">

**Author:** ![konrad.sopala](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/konrad.sopala/32/13516_2.png) [@konrad.sopala](https://community.auth0.com/u/konrad.sopala)\
**Post date:** [December 7, 2021, 2:25pm UTC](https://community.auth0.com/t/deactivate-account-after-sign-up/73602/10 "2021-12-07T14:25:42Z")

</div>