# Enabling app login to pass authorization code/user roles to API

**URL:** <https://community.auth0.com/t/enabling-app-login-to-pass-authorization-code-user-roles-to-api/134869>\
**Category:** Get Help\
**Tags:** apis, application\
**Created:** [May 23, 2024, 8:22pm UTC](https://community.auth0.com/t/enabling-app-login-to-pass-authorization-code-user-roles-to-api/134869 "2024-05-23T20:22:03Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![jon.nehring](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/jon.nehring/32/57385_2.png) [@jon.nehring](https://community.auth0.com/u/jon.nehring)\
**Post date:** [May 23, 2024, 8:22pm UTC](https://community.auth0.com/t/enabling-app-login-to-pass-authorization-code-user-roles-to-api/134869/1 "2024-05-23T20:22:03Z")

</div>

I set up both a sample app and API in Auth0 (app-a and api-1). I’m running two node js servers locally, one for the app and one for the api. I can get a authorization token just fine. I was able to add this rule to login flow in Actions:

```auto
exports.onExecutePostLogin = async (event, api) => {
  const namespace = 'https://api_1';
  if (event.authorization) {
    api.idToken.setCustomClaim(`${namespace}/roles`, event.authorization.roles);
    api.accessToken.setCustomClaim(`${namespace}/roles`, event.authorization.roles);
  }
}

```

That adds roles successfully to the idToken. However, I am struggling to find a way to pass those roles along when requesting an access token, which I am doing internally inside the app’s nodejs server file:

```auto
async function fetchAccessToken() {
    try {
        const response = await axios.post(`${process.env.AUTH_ISSUER_BASE_URL}/oauth/token`, {
            "client_id": process.env.AUTH_CLIENT_ID,
            "client_secret": process.env.AUTH_SECRET,
            "audience": "https://api_1",
            "grant_type": "client_credentials"
        }, {
            headers: {'Content-Type': 'application/json'}
        });
        return response.data;
    } catch (error) {
        console.error("Error fetching API access token:", error);
        return null;
    }
}

```

I get an access token but it doesn’t include the roles. I believe I need to supply an authorization code in the request. But I have not been able to succeed at doing that when creating another function using authorization\_code as the grant type. (FYI, the client\_id and client\_secret are from app-1).

I have RBAC enabled for the API.

---

<div class="post-metadata">

**Author:** ![ty.frith](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/ty.frith/32/58484_2.png) [@ty.frith](https://community.auth0.com/u/ty.frith)\
**Post date:** [May 23, 2024, 10:10pm UTC](https://community.auth0.com/t/enabling-app-login-to-pass-authorization-code-user-roles-to-api/134869/3 "2024-05-23T22:10:30Z")

</div>

Hey @jon.nehring welcome to the community!

> [@jon.nehring](#):
>
> I get an access token but it doesn’t include the roles. I believe I need to supply an authorization code in the request. But I have not been able to succeed at doing that when creating another function using authorization\_code as the grant type. (FYI, the client\_id and client\_secret are from app-1).

The action code you shared is only going to run when users log in - The `fetchAccessToken` function is getting an access token using the [client credentials](https://auth0.com/docs/get-started/authentication-and-authorization-flow/client-credentials-flow) grant and is there for machine to machine.

For Node, you’ll want to look into using a library like `express-openid-connect` which does support a user login using the authorization code flow. You can find a quickstart [here](https://auth0.com/docs/quickstart/webapp/express/01-login) that goes over the general implementation. In particular, you will want to take a look at this [example](https://github.com/auth0/express-openid-connect/blob/master/EXAMPLES.md#4-obtaining-access-tokens-to-call-external-apis) which show’s passing an `audience` param which is required in order to get an access token that can be used against your API.

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/auth0/original/3X/b/5/b560f266932fcce5d57f09a6595bd50518cae3f3.jpeg) [@system](https://community.auth0.com/u/system)\
**Post date:** [June 6, 2024, 10:10pm UTC](https://community.auth0.com/t/enabling-app-login-to-pass-authorization-code-user-roles-to-api/134869/4 "2024-06-06T22:10:59Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.