How can an admin retrieve organization members using only an access token (without Management API & client_secret)?

Help
,
1

Hello everyone,

I am currently implementing a system where an admin of an Auth0 Organization needs to retrieve the list of members in their organization. However, I want to avoid using the Management API because it requires a Machine-to-Machine (M2M) token, which in turn requires storing and exposing a client_secret—something I want to avoid for security reasons.

My Setup:

  • I have Organizations enabled in my Auth0 tenant.
  • I can successfully authenticate as an admin and obtain an access_token with my organization.
  • I would like to retrieve the list of users that belong to my organization using only the access_token of an authenticated admin.

Key Questions:

  1. Is there any alternative way for an admin to retrieve only the users of their own organization without requiring the Management API?
  2. Can the access_token issued to an authenticated admin include a scope or permission that allows fetching the organization’s users?
  3. If this is not possible directly, what is the recommended approach to securely expose this information without requiring a backend service that holds a client_secret?
  4. Would it be possible to leverage ID tokens, user metadata, or custom claims to achieve this?

I appreciate any insights, best practices, or workarounds that the community can suggest. Thanks in advance!

3

Hi @luiss.dimatteo,

Unfortunately, the only way to get a list of users in an Organization is by using the Management API to get an access token to make a request to the Get members endpoint.

The best approach is to use the Management API for this scenario. While you might be able to leverage ID tokens, user metadata or custom claims to achieve this, it might reach its size limit if you have too much data stored.

Thanks,
Rueben

4

Hi Rueben,

Thanks for your response! I understand that the Management API is the official way to retrieve organization members. However, in a multi-tenant setup with multiple organizations, I can’t share my client_secret with all admins.

How do I ensure that Company A cannot modify users from Company B, given that the Management API operates at the tenant level? Is there a way to scope API access per organization to avoid security risks?

Is there an enterprise-friendly?

Looking forward to your insights! Thanks again.