# Email Whitelist only for one app

**URL:** <https://community.auth0.com/t/email-whitelist-only-for-one-app/62877>\
**Category:** Get Help\
**Tags:** whitelist\
**Created:** [May 16, 2021, 7:30am UTC](https://community.auth0.com/t/email-whitelist-only-for-one-app/62877 "2021-05-16T07:30:38Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![sebastien.nicouleau](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/sebastien.nicouleau/32/26295_2.png) [@sebastien.nicouleau](https://community.auth0.com/u/sebastien.nicouleau)\
**Post date:** [May 16, 2021, 7:30am UTC](https://community.auth0.com/t/email-whitelist-only-for-one-app/62877/1 "2021-05-16T07:30:38Z")

</div>

Hello , I use a auth0 with social connection my application public, for the administration app , I want use the same scheme , but authorize only google et one domain email. I see the rule emailDomainWhitelist , but it"s possible to trigger the rule for the admin connection. Example add parameter in the auth0 client Javascript .

Thanks

---

<div class="post-metadata">

**Author:** ![stephanie.chamblee](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/stephanie.chamblee/32/26087_2.png) [@stephanie.chamblee](https://community.auth0.com/u/stephanie.chamblee)\
**Post date:** [May 17, 2021, 1:44pm UTC](https://community.auth0.com/t/email-whitelist-only-for-one-app/62877/3 "2021-05-17T13:44:05Z")

</div>

Hi @sebastien.nicouleau,

Welcome to the Community!

You can add a whitelist for a specific app by checking the application name in the rule:

```auto
function userWhitelistForSpecificApp(user, context, callback) {
  // only enforce for NameOfTheAppWithWhiteList
  // bypass this rule for all other apps
  if (context.clientName !== 'NameOfTheAppWithWhiteList') {
    return callback(null, user, context);
  }

  const whitelist = ['example.com', 'example.org']; //authorized domains
  const userHasAccess = whitelist.some(
      function (domain) {
        const emailSplit = user.email.split('@');
        return emailSplit[emailSplit.length - 1].toLowerCase() === domain;
      });

  if (!userHasAccess) {
    return callback(new UnauthorizedError('Access denied.'));
  }

  return callback(null, user, context);
}
```

---

<div class="post-metadata">

**Author:** ![sebastien.nicouleau](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/sebastien.nicouleau/32/26295_2.png) [@sebastien.nicouleau](https://community.auth0.com/u/sebastien.nicouleau)\
**Post date:** [May 17, 2021, 8:43pm UTC](https://community.auth0.com/t/email-whitelist-only-for-one-app/62877/4 "2021-05-17T20:43:38Z")

</div>

Hi Stephanie, thanks for your reply. But it’s not possible to pass any extra params from js librairie ?  
Or I create a new application in my auth0 account , with a new specific domain.

---

<div class="post-metadata">

**Author:** ![stephanie.chamblee](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/stephanie.chamblee/32/26087_2.png) [@stephanie.chamblee](https://community.auth0.com/u/stephanie.chamblee)\
**Post date:** [May 18, 2021, 12:44pm UTC](https://community.auth0.com/t/email-whitelist-only-for-one-app/62877/5 "2021-05-18T12:44:25Z")

</div>

If you have two separate apps (one public app and one admin app), then it’d be best to set up two separate applications in your Auth0 dashboard.

If it is the same application with two portals that are guarded by permissions, then you can use the same Auth0 application. If this is the case, then you can distinguish the two apps with a query param. In your app, you’d initiate auth with something like `loginWithRedirect({admin: true})` (the syntax for this depends on which SDK you are using). In your rule, you can check for this query param like this:

```auto
  const query = (context.request || {}).query || {};
  const isAdmin = query.admin;
  if (isAdmin) {
    return callback(null, user, context);
  }

```

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/auth0/original/3X/b/5/b560f266932fcce5d57f09a6595bd50518cae3f3.jpeg) [@system](https://community.auth0.com/u/system)\
**Post date:** [June 2, 2021, 12:44pm UTC](https://community.auth0.com/t/email-whitelist-only-for-one-app/62877/6 "2021-06-02T12:44:49Z")

</div>

This topic was automatically closed 15 days after the last reply. New replies are no longer allowed.