# How do I accept an access token in Spring Boot?

**URL:** <https://community.auth0.com/t/how-do-i-accept-an-access-token-in-spring-boot/164845>\
**Category:** Get Help\
**Tags:** configuration, application\
**Created:** [December 20, 2024, 9:19pm UTC](https://community.auth0.com/t/how-do-i-accept-an-access-token-in-spring-boot/164845 "2024-12-20T21:19:46Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![jackiegleason](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/jackiegleason/32/8119_2.png) [@jackiegleason](https://community.auth0.com/u/jackiegleason)\
**Post date:** [December 20, 2024, 9:19pm UTC](https://community.auth0.com/t/how-do-i-accept-an-access-token-in-spring-boot/164845/1 "2024-12-20T21:19:46Z")

</div>

I am trying to get an access key then pass the key to my backend spring resource. Currently I can see the frontend getting the request via

```auto
let token;
        try {
            token = await input.getAccessTokenSilently({
                audience: '...',
                scope: 'read:transactions'
            });
        } catch (e) {
            token = await input.getAccessTokenWithPopup({
                audience: '...',
                scope: 'read:transactions'
            });
        }
       const response = await fetch(input.endpoint, {
        headers: {
            'Authorization': `Bearer ${input.token}`
        }
       });

```

This seems to work fine but on the backend I have

```auto
@Bean
    public SecurityFilterChain filterChain(
            HttpSecurity http
    ) throws Exception {
        http.csrf(AbstractHttpConfigurer::disable)
                .oauth2Login(AbstractHttpConfigurer::disable)
                .oauth2ResourceServer(AbstractHttpConfigurer::disable)
                .oauth2ResourceServer((oauth2) -> oauth2
                        .jwt((jwt) -> jwt.decoder(jwtDecoder()))
                )
                .authorizeHttpRequests(
                        (authz) -> authz
                                .requestMatchers(
                                        "/transaction/**"
                                ).authenticated()
                                .requestMatchers(
                                        "/pages/**",
                                        "/api"
                                ).authenticated()
                                .anyRequest().permitAll()
                ).exceptionHandling(handling -> handling
                        .authenticationEntryPoint((request, response, authException) -> {
                            // Redirect to root path for 403 errors
                            response.sendRedirect("/");
                        })
                ).sessionManagement(
                        session -> session
                                .sessionCreationPolicy(SessionCreationPolicy.IF_REQUIRED)
                );
        return http.build();
    }

    @Bean
    JwtDecoder jwtDecoder() {
        NimbusJwtDecoder jwtDecoder = JwtDecoders.fromOidcIssuerLocation(issuer);

        OAuth2TokenValidator<Jwt> audienceValidator = new AudienceValidator(audience);
        OAuth2TokenValidator<Jwt> withIssuer = JwtValidators.createDefaultWithIssuer(issuer);
        OAuth2TokenValidator<Jwt> withAudience = new DelegatingOAuth2TokenValidator<>(withIssuer, audienceValidator);

        jwtDecoder.setJwtValidator(withAudience);

        return jwtDecoder;
    }

    private static class AudienceValidator implements OAuth2TokenValidator<Jwt> {
        private final String audience;

        public AudienceValidator(String audience) {
            this.audience = audience;
        }

        public OAuth2TokenValidatorResult validate(Jwt jwt) {
            OAuth2Error error = new OAuth2Error("invalid_token", "The required audience is missing", null);

            if (jwt.getAudience().contains(audience)) {
                return OAuth2TokenValidatorResult.success();
            }
            return OAuth2TokenValidatorResult.failure(error);
        }
    }

```

This ends up failing and throwing a 401. I can’t seem to check the access token because it doesn’t parse in [jwt.io](http://jwt.io) so I was wondering what I might be doing wrong?

---

<div class="post-metadata">

**Author:** ![jackiegleason](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/jackiegleason/32/8119_2.png) [@jackiegleason](https://community.auth0.com/u/jackiegleason)\
**Post date:** [December 21, 2024, 2:32am UTC](https://community.auth0.com/t/how-do-i-accept-an-access-token-in-spring-boot/164845/2 "2024-12-21T02:32:25Z")

</div>

It does seem I am getting a opaque token and that I may need to do this…

> [@Added Audience and STILL getting Opaque token instead of JWT token with React](https://community.auth0.com/t/added-audience-and-still-getting-opaque-token-instead-of-jwt-token-with-react/110636):
>
> Hello, I’m currently developing a React application using Auth0 for authentication. I have set up the Auth0Provider with the correct audience and I’m using the getAccessTokenSilently method to retrieve the access token. However, I’m encountering an issue where I’m receiving an opaque token instead of the expected JWT token. This is causing problems when I try to use this token to authenticate with my API. Good to note, my client side code is deployed with AWS Amplify Here’s the relevant code…

However this confuses me for 2 reasons.

1. I may need different permissions for different requests so I can’t really set it at the Provider level. I have previous code that used to work at the token acquisition level but it seems like something changed.

2. Why do I need to call an access token function if this sort of thing is stored at the Provider level? Why doesn’t it provide it as a variable instead?

---

<div class="post-metadata">

**Author:** ![jackiegleason](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/jackiegleason/32/8119_2.png) [@jackiegleason](https://community.auth0.com/u/jackiegleason)\
**Post date:** [December 21, 2024, 3:00am UTC](https://community.auth0.com/t/how-do-i-accept-an-access-token-in-spring-boot/164845/3 "2024-12-21T03:00:11Z")

</div>

This worked

```javascript
        const audience = '...';
        const scope = 'openid profile read:transactions';
        const authorizationParams = {
            audience,
            scope
        }
        try {
            console.log("Getting token silently");
            token = await input.getAccessTokenSilently({
                authorizationParams
            });
        } catch (e) {
            console.log("Getting token with popup");
            token = await input.getAccessTokenWithPopup({
                authorizationParams
            });
        }

```

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/auth0/original/3X/b/5/b560f266932fcce5d57f09a6595bd50518cae3f3.jpeg) [@system](https://community.auth0.com/u/system)\
**Post date:** [February 28, 2025, 1:07pm UTC](https://community.auth0.com/t/how-do-i-accept-an-access-token-in-spring-boot/164845/4 "2025-02-28T13:07:36Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.