Hooks and id_token

[mathiasconradt]

Where do these permissions come from? Are you using Auth0’s RBAC core feature?
Another question: why do you need the permissions in the ID token and not the access token?

This might be a helpful post:

Difference between scopes and permissions in access token

Update 11/May/2020: For M2M / Client Credentials Grant, the permissions for a M2M client is put in both scope and permissions claim. I’ve tested it and it works as expected, so the approach below should not be necessary anymore. Original answer: I might have missed some DMs in between, but even with the RBAC Core (not Authorization extension - doesn’t actually make a difference): I was able to reproduce the behaviour described by the OP. In M2M settings, the scopes set for a client for acce…