How do I handle the legacy access_token?

[Pickles]

I’m trying to build a Google Action that account links using Auth0. Login works fine but after login Google is not sending my services the JWT token, it’s sending the shorter access_token and as far as I can tell there’s no way to change that. I see a lot of documentation on Auth0 about how to use the JWT but nothing on what to do with that older access_token. Thanks.

[Pickles]

Ok was finally able to figure this out: In the Advance Settings of my app there’s a /userinfo endpoint. I just need to sent that the access_token and I get back the user information.

[mfl]

So there is no way to include scopes in the access_token using the implicit OpenId Connect flow?

To me it seams like a unnecessary http request to have to request /userinfo for the users scopes, every time a request is made.

[Pickles]

Yeah I agree, this is the problem the JWT is trying to solve…but Google Actions doesn’t support JWT so here we are. One thing I was considering is storing the key and the information returned from it in my application in some sort of session object. But as of now it’s doing that request every single time.

[mfl]

Try adding audience to the WebAuth parameters. Worked for me

[Pickles]

Could you be more specific? Where do I add this parameter? And to confirm this will solve the problem of having to do the extra API call whenever my webhook service is called?

[mfl]

auth0 = new auth0.WebAuth({
domain: ‘DOMAIN’,
clientID: ‘CLIENTID’,
redirectUri: ‘REDIRECTURL’,
responseType: ‘token id_token’,
scope: ‘openid SCOPES’,
audience: ‘Unique API ID’
});

https://auth0.com/docs/tokens/access-token#access-token-format
" * If the audience is set to the unique identifier of a custom API, then the Access Token will be a JSON Web Token (JWT)."

[Pickles]

Unless I’m misunderstanding here, I’m at the mercy of what Google Actions decides to send me. Currently it’s only sending me the old access token so I have to do the extra call to get user data. AFAIK I can’t configure my Google Actions app to include any additional params.