Hi @alt1,
Are you viewing the user’s permissions in an Access Token or an ID Token?
When you supply an audience for your SPA, Auth0 will issue a JWT Access Token that can be used with the external API you’ve configured as the audience. Otherwise, if the audience is not provided, then Auth0 will supply an opaque Access Token that can’t be decoded. This Access Token can be used to hit the /userinfo endpoint to get the user’s profile.