I am trying to get password change ticket by sending post request to /api/v2/tickets/password-change.
Its returning:
'{"statusCode":403,"error":"Forbidden","message":"Insufficient scope, expected any of: create:user_tickets","errorCode":"insufficient_scope"}'
Where as this scope is listed in the scopes list in API settings, screenshot: Screenshot by Lightshot
It looks like the authentication token is lacking this code, i am getting authentication token using following curl command: Screenshot by Lightshot
What you need to make sure is that the client identifier associated with that request was authorized to obtain an access token containing the scope in question.
You can do so in the Non Interactive Clients section by authorizing the client application, selecting the scope and then saving. The screenshots you provided although they indicate that the client credentials is being performed correctly (from a syntax point of view) do not provide any information about the authorization grant associated with the client.
@jmangelo Thank you that worked. Can we use customized auth0 hosted password reset page as an overlay in our application instead of user getting redirected to password reset page? I went on the route of cross-origin-authentication but that is not working for me.