# Getting a user's email from an access token

**URL:** <https://community.auth0.com/t/getting-a-users-email-from-an-access-token/118962>\
**Category:** Get Help\
**Tags:** configuration, application\
**Created:** [October 19, 2023, 9:03pm UTC](https://community.auth0.com/t/getting-a-users-email-from-an-access-token/118962 "2023-10-19T21:03:36Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![stuartp](https://upload.wikimedia.org/wikipedia/commons/thumb/7/7c/User_font_awesome.svg/768px-User_font_awesome.svg.png) [@stuartp](https://community.auth0.com/u/stuartp)\
**Post date:** [October 19, 2023, 9:03pm UTC](https://community.auth0.com/t/getting-a-users-email-from-an-access-token/118962/1 "2023-10-19T21:03:36Z")

</div>

I’m taking my first steps learning Auth0 and have got a sample website ([ASP.net](http://ASP.net) Core Razor pages) set up to call an API by following [Securing Razor Pages Applications with Auth0](https://auth0.com/blog/securing-razor-pages-applications-with-auth0/) and [Authorization for ASP.NET Core Web APIs (auth0.com)](https://auth0.com/blog/aspnet-web-api-authorization/)

I can log in, get an access token, pass it to the secured API and the API runs. Great.

But how do I know _who_ has called the API? The access token doesn’t tell me, i.e. I cannot see the user’s email address.

I’ve tried adding a custom action to add the user email to the access token with this code:

exports.onExecutePostLogin = async (event, api) =\> {  
// This adds the authenticated user’s email address to the access token.  
if (event.authorization) {  
const namespace = ‘’;  
api.accessToken.setCustomClaim(`${namespace}/claims/email`, event.user.email);  
}  
};

But it hasn’t worked.

Also thought I could use “Get user info” to get the user details given the access token, before realising I don’t know how to get to the token in the Web Api.

Many forum posts advise about “rules” which are no longer available.

Please advise!

Thanks

Stuart

---

<div class="post-metadata">

**Author:** ![ty.frith](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/ty.frith/32/58484_2.png) [@ty.frith](https://community.auth0.com/u/ty.frith)\
**Post date:** [October 19, 2023, 9:40pm UTC](https://community.auth0.com/t/getting-a-users-email-from-an-access-token/118962/3 "2023-10-19T21:40:54Z")

</div>

Hello @stuartp welcome to the community!

> [@stuartp](#):
>
> But how do I know _who_ has called the API? The access token doesn’t tell me, i.e. I cannot see the user’s email address.

You can also rely on the `sub` claim included in the access and/or ID token. This is just the user’s ID in Auth0.

> [@stuartp](#):
>
> I’ve tried adding a custom action to add the user email to the access token with this code:
> 
> exports.onExecutePostLogin = async (event, api) =\> {  
> // This adds the authenticated user’s email address to the access token.  
> if (event.authorization) {  
> const namespace = ‘’;  
> api.accessToken.setCustomClaim(`${namespace}/claims/email`, event.user.email);  
> }  
> };

You have the right idea adding an `email` claim via an Action - You should be able to simplify it even further as `email` is [not a restricted claim](https://auth0.com/docs/secure/tokens/json-web-tokens/create-custom-claims#non-restricted-claims) and can therefore be used directly:

```auto
exports.onExecutePostLogin = async (event, api) => {
  if (event.authorization) {
  api.accessToken.setCustomClaim("email", event.user.email);
  }
};

```

I’m not able to tell by what you’ve shared, but you do also need to include the `email` scope if you aren’t already - Please see the following:

> <https://github.com/auth0/auth0-aspnetcore-authentication/blob/main/EXAMPLES.md#scopes>

---

<div class="post-metadata">

**Author:** ![stuartp](https://upload.wikimedia.org/wikipedia/commons/thumb/7/7c/User_font_awesome.svg/768px-User_font_awesome.svg.png) [@stuartp](https://community.auth0.com/u/stuartp)\
**Post date:** [October 19, 2023, 10:16pm UTC](https://community.auth0.com/t/getting-a-users-email-from-an-access-token/118962/4 "2023-10-19T22:16:46Z")

</div>

Thanks 🙂

I don’t have a “sub” claim in the returned token.

I’ve simplified the action but am not getting the email address.

I’ve updated my Program.cs to read:

```auto
 {
     options.Domain = builder.Configuration["Auth0:Domain"];
     options.ClientId = builder.Configuration["Auth0:ClientId"];
     options.ClientSecret = builder.Configuration["Auth0:ClientSecret"];
     options.Scope = "openid profile email";
 }).WithAccessToken(options =>
 {
     options.Audience = "https://localhost:7251";
 });
type or paste code here

```

So this should request the email scope…?

What I have noticed on the test page is that if the user is not logged in, an access token is still returned. I don’t understand how that can be. Is it possible I am not requesting an access token for the logged in user? This is how I am requesting it:

```auto
Auth0Token authToken = new();
try
{
    authToken = await "https://ukfasteners.uk.auth0.com/oauth/token".WithHeader("content-type", "application/x-www-form-urlencoded").PostUrlEncodedAsync(new
    {
        grant_type = "client_credentials",
        client_id = "<clientID>",
        client_secret = "<clientSecret>",
        audience = "https://localhost:7251"
    }).ReceiveJson<Auth0Token>();
}
catch (FlurlHttpException flEx)
{
    string error = await flEx.GetResponseStringAsync();
}

```

---

<div class="post-metadata">

**Author:** ![ty.frith](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/ty.frith/32/58484_2.png) [@ty.frith](https://community.auth0.com/u/ty.frith)\
**Post date:** [October 19, 2023, 11:13pm UTC](https://community.auth0.com/t/getting-a-users-email-from-an-access-token/118962/5 "2023-10-19T23:13:06Z")

</div>

Thanks for the additional info!

> [@stuartp](#):
>
> What I have noticed on the test page is that if the user is not logged in, an access token is still returned. I don’t understand how that can be. Is it possible I am not requesting an access token for the logged in user? This is how I am requesting it:
> 
> ```auto
> Auth0Token authToken = new();
> try
> {
> authToken = await "https://ukfasteners.uk.auth0.com/oauth/token".WithHeader("content-type", "application/x-www-form-urlencoded").PostUrlEncodedAsync(new
> {
> grant_type = "client_credentials",
> client_id = "<clientID>",
> client_secret = "<clientSecret>",
> audience = "https://localhost:7251"
> }).ReceiveJson<Auth0Token>();
> }
> catch (FlurlHttpException flEx)
> {
> string error = await flEx.GetResponseStringAsync();
> }
> 
> ```

You’re thinking is exactly correct - This code is using a [client credentials flow](https://auth0.com/docs/get-started/authentication-and-authorization-flow/client-credentials-flow) and therefore the access token returned is considered M2M (i.e. no user involved, just the authorized client). Are you using an Auth0 SDK at all on the web application side of things? I am unfortunately not a .NET expert, but the gist of it is outlined here in [ASP .NET Core SDK example](https://github.com/auth0/auth0-aspnetcore-authentication/blob/main/EXAMPLES.md#calling-an-api).

---

<div class="post-metadata">

**Author:** ![stuartp](https://upload.wikimedia.org/wikipedia/commons/thumb/7/7c/User_font_awesome.svg/768px-User_font_awesome.svg.png) [@stuartp](https://community.auth0.com/u/stuartp)\
**Post date:** [October 20, 2023, 12:53am UTC](https://community.auth0.com/t/getting-a-users-email-from-an-access-token/118962/6 "2023-10-20T00:53:58Z")

</div>

I was so close 😃  
Like two lines of code close.  
It is working now - I have the email address of the caller in the API.  
Thanks for all your help 🙂

---

<div class="post-metadata">

**Author:** ![ty.frith](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/ty.frith/32/58484_2.png) [@ty.frith](https://community.auth0.com/u/ty.frith)\
**Post date:** [October 20, 2023, 7:09pm UTC](https://community.auth0.com/t/getting-a-users-email-from-an-access-token/118962/7 "2023-10-20T19:09:12Z")

</div>

Awesome! Good to know and thanks for following up here 🙂

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/auth0/original/3X/b/5/b560f266932fcce5d57f09a6595bd50518cae3f3.jpeg) [@system](https://community.auth0.com/u/system)\
**Post date:** [November 3, 2023, 7:09pm UTC](https://community.auth0.com/t/getting-a-users-email-from-an-access-token/118962/8 "2023-11-03T19:09:44Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.