# How can an admin retrieve organization members using only an access token (without Management API & client\_secret)? **URL:** \ **Category:** Get Help\ **Tags:** organizations-management-api, management-api\ **Created:** [February 21, 2025, 3:02pm UTC](https://community.auth0.com/t/how-can-an-admin-retrieve-organization-members-using-only-an-access-token-without-management-api-client-secret/182599 "2025-02-21T15:02:22Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![luiss.dimatteo](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/luiss.dimatteo/32/71984_2.png) [@luiss.dimatteo](https://community.auth0.com/u/luiss.dimatteo)\ **Post date:** [February 21, 2025, 3:02pm UTC](https://community.auth0.com/t/how-can-an-admin-retrieve-organization-members-using-only-an-access-token-without-management-api-client-secret/182599/1 "2025-02-21T15:02:22Z")
Hello everyone, I am currently implementing a system where an **admin** of an **Auth0 Organization** needs to retrieve the list of members in their organization. However, I want to avoid using the **Management API** because it requires a **Machine-to-Machine (M2M) token**, which in turn requires storing and exposing a `client_secret`—something I want to avoid for security reasons. ### **My Setup:** - I have **Organizations enabled** in my Auth0 tenant. - I can successfully authenticate as an admin and obtain an **access\_token** with my organization. - I would like to retrieve the list of users that belong to my organization **using only the access\_token** of an authenticated admin. ### **Key Questions:** 1. Is there any **alternative way** for an admin to retrieve **only the users of their own organization** without requiring the Management API? 2. Can the `access_token` issued to an authenticated admin include a scope or permission that allows fetching the organization’s users? 3. If this is not possible directly, what is the **recommended approach** to securely expose this information without requiring a backend service that holds a `client_secret`? 4. Would it be possible to **leverage ID tokens, user metadata, or custom claims** to achieve this? I appreciate any insights, best practices, or workarounds that the community can suggest. Thanks in advance! ---
**Author:** ![rueben.tiow](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/rueben.tiow/32/11646_2.png) [@rueben.tiow](https://community.auth0.com/u/rueben.tiow)\ **Post date:** [February 21, 2025, 7:45pm UTC](https://community.auth0.com/t/how-can-an-admin-retrieve-organization-members-using-only-an-access-token-without-management-api-client-secret/182599/3 "2025-02-21T19:45:05Z")
Hi @luiss.dimatteo, Unfortunately, the only way to get a list of users in an Organization is by using the Management API to get an access token to make a request to the [Get members endpoint](https://auth0.com/docs/api/management/v2/organizations/get-members). The best approach is to use the Management API for this scenario. While you might be able to leverage ID tokens, user metadata or custom claims to achieve this, it might reach its size limit if you have too much data stored. Thanks, Rueben ---
**Author:** ![luiss.dimatteo](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/luiss.dimatteo/32/71984_2.png) [@luiss.dimatteo](https://community.auth0.com/u/luiss.dimatteo)\ **Post date:** [February 21, 2025, 8:02pm UTC](https://community.auth0.com/t/how-can-an-admin-retrieve-organization-members-using-only-an-access-token-without-management-api-client-secret/182599/4 "2025-02-21T20:02:16Z")
Hi Rueben, Thanks for your response! I understand that the Management API is the official way to retrieve organization members. However, in a **multi-tenant setup** with **multiple organizations** , I can’t share my `client_secret` with all admins. How do I ensure that **Company A** cannot modify users from **Company B** , given that the Management API operates at the **tenant level**? Is there a way to **scope API access per organization** to avoid security risks? Is there an **enterprise-friendly**? Looking forward to your insights! Thanks again. ---
**Author:** ![system](https://global.discourse-cdn.com/auth0/original/3X/b/5/b560f266932fcce5d57f09a6595bd50518cae3f3.jpeg) [@system](https://community.auth0.com/u/system)\ **Post date:** [March 7, 2025, 8:02pm UTC](https://community.auth0.com/t/how-can-an-admin-retrieve-organization-members-using-only-an-access-token-without-management-api-client-secret/182599/5 "2025-03-07T20:02:55Z")
This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.