# Generate access token in a rule to get user info after redirect

**URL:** <https://community.auth0.com/t/generate-access-token-in-a-rule-to-get-user-info-after-redirect/77423>\
**Category:** Get Help\
**Tags:** rules, redirect, access-token, auth0\
**Created:** [February 1, 2022, 5:48pm UTC](https://community.auth0.com/t/generate-access-token-in-a-rule-to-get-user-info-after-redirect/77423 "2022-02-01T17:48:23Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![dmytro.karpovych](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/dmytro.karpovych/32/34803_2.png) [@dmytro.karpovych](https://community.auth0.com/u/dmytro.karpovych)\
**Post date:** [February 1, 2022, 5:48pm UTC](https://community.auth0.com/t/generate-access-token-in-a-rule-to-get-user-info-after-redirect/77423/1 "2022-02-01T17:48:23Z")

</div>

I used rules to redirect all unverified users to a custom page that asks to verify email.  
To show user’s email I used query param:

```auto
context.redirect = {
  url: `${configuration.WEBSITE_URL}/email-verification?email=${encodeURIComponent(user.email)}`
};

```

There is a way to generate an access token that will allow fetching information for one particular user?  
Because I don’t want to use query parameters for security reasons.

Instead of it, I want to use something like:

```auto
const token = genToken(user.user_id);
context.redirect = {
  url: `${configuration.WEBSITE_URL}/email-verification?token=${token}`
};

```

---

<div class="post-metadata">

**Author:** ![pranshushah](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/pranshushah/32/34583_2.png) [@pranshushah](https://community.auth0.com/u/pranshushah)\
**Post date:** [February 2, 2022, 6:07am UTC](https://community.auth0.com/t/generate-access-token-in-a-rule-to-get-user-info-after-redirect/77423/2 "2022-02-02T06:07:52Z")

</div>

try to use post-login action instead of rules with that you can do this securely.

[action-redirect](https://auth0.com/docs/customize/actions/flows-and-triggers/login-flow/redirect-with-actions)

---

<div class="post-metadata">

**Author:** ![konrad.sopala](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/konrad.sopala/32/13516_2.png) [@konrad.sopala](https://community.auth0.com/u/konrad.sopala)\
**Post date:** [February 2, 2022, 2:08pm UTC](https://community.auth0.com/t/generate-access-token-in-a-rule-to-get-user-info-after-redirect/77423/3 "2022-02-02T14:08:54Z")

</div>

Teamwork makes the dreamwork!

---

<div class="post-metadata">

**Author:** ![dmytro.karpovych](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/dmytro.karpovych/32/34803_2.png) [@dmytro.karpovych](https://community.auth0.com/u/dmytro.karpovych)\
**Post date:** [February 2, 2022, 3:50pm UTC](https://community.auth0.com/t/generate-access-token-in-a-rule-to-get-user-info-after-redirect/77423/4 "2022-02-02T15:50:54Z")

</div>

Do you mean something like this?

> **[Redirect with Actions](https://auth0.com/docs/customize/actions/flows-and-triggers/login-flow/redirect-with-actions#pass-data-to-the-external-site)**
>
> Learn how to use post-login Actions to redirect users before an authentication transaction is complete.

Maybe do you know a way to do the same stuff from rules?  
Because we have a lot of code and it will be not easy to transfer all of them into the actions

---

<div class="post-metadata">

**Author:** ![pranshushah](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/pranshushah/32/34583_2.png) [@pranshushah](https://community.auth0.com/u/pranshushah)\
**Post date:** [February 4, 2022, 5:07pm UTC](https://community.auth0.com/t/generate-access-token-in-a-rule-to-get-user-info-after-redirect/77423/5 "2022-02-04T17:07:52Z")

</div>

I am not 100% sure but I think you can’t do this with rules. but in your case, if you can decouple redirection-related logic from the current rule and put it into action and it will be a secure approach.

---

<div class="post-metadata">

**Author:** ![pranshushah](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/pranshushah/32/34583_2.png) [@pranshushah](https://community.auth0.com/u/pranshushah)\
**Post date:** [February 4, 2022, 5:10pm UTC](https://community.auth0.com/t/generate-access-token-in-a-rule-to-get-user-info-after-redirect/77423/6 "2022-02-04T17:10:22Z")

</div>

because in our example we are doing the same thing with (actions) and if you really want to use rules just throw and access deny error and handle logic by yourself.

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/auth0/original/3X/b/5/b560f266932fcce5d57f09a6595bd50518cae3f3.jpeg) [@system](https://community.auth0.com/u/system)\
**Post date:** [February 19, 2022, 5:10pm UTC](https://community.auth0.com/t/generate-access-token-in-a-rule-to-get-user-info-after-redirect/77423/7 "2022-02-19T17:10:58Z")

</div>

This topic was automatically closed 15 days after the last reply. New replies are no longer allowed.