# How do I restrict scopes in auth\_token based on user profile?

**URL:** <https://community.auth0.com/t/how-do-i-restrict-scopes-in-auth-token-based-on-user-profile/7633>\
**Category:** Get Help\
**Tags:** jwtconfiguration, access\_token, rules, scopes, access-token\
**Created:** [July 24, 2017, 11:51am UTC](https://community.auth0.com/t/how-do-i-restrict-scopes-in-auth-token-based-on-user-profile/7633 "2017-07-24T11:51:42Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![dimitrovs](https://upload.wikimedia.org/wikipedia/commons/thumb/7/7c/User_font_awesome.svg/768px-User_font_awesome.svg.png) [@dimitrovs](https://community.auth0.com/u/dimitrovs)\
**Post date:** [July 24, 2017, 11:51am UTC](https://community.auth0.com/t/how-do-i-restrict-scopes-in-auth-token-based-on-user-profile/7633/1 "2017-07-24T11:51:42Z")

</div>

These are my business rules:

1. Registered users have:  
`app_metadata: { "projects": "test", "test2", "test3" ] }`
2. If a user is requesting `access_token` for audience “my.secret.api” then:

- The user may request at most one scope
- The requested scope must be an exact match to an item in the `projects` array of the user’s `app_metadata` .

Here is my current implementation which appears to work:

```
function (user, context, callback) { if (context.request.query.audience === 'my.secret.api' && context.request.query.scope) {  
    var requestedScopes = context.request.query.scope.split(' ');  
    if (requestedScopes.length === 1 && user.app_metadata.projects.indexOf(requestedScopes[0]) !== -1) {  
      context.accessToken.scope = requestedScopes;  
    } else {  
      context.accessToken.scope = ];  
    }     
  }
callback(null, user, context); 
}

```

Is my implementation the correct way to achieve this? It appears to work even if ‘my.secret.api’ does not have scope ‘project3’ (which is a nice side effect). I am confused by when to modify the context.accessToken.scope vs. jwtConfiguration , the documentation is not clear at all on this.

---

<div class="post-metadata">

**Author:** ![jmangelo](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/jmangelo/32/7923_2.png) [@jmangelo](https://community.auth0.com/u/jmangelo)\
**Post date:** [August 3, 2017, 7:55pm UTC](https://community.auth0.com/t/how-do-i-restrict-scopes-in-auth-token-based-on-user-profile/7633/2 "2017-08-03T19:55:33Z")

</div>

Judging correctness is very difficult because what’s correct for one scenario may not be for another. However, here’s some notes in relation to the implementation in question:

- using `context.accessToken.scope` is what you should use when you want to influence the scopes of the issued token; `jwtConfiguration` is not applicable for this situation.
- using rules to define custom authorization policies that influence the issued scopes based on the current user is the currently recommended approach; however, have in mind that recommended may be too much of a strong word because, at this time, it’s the only option available.
- when you use rules to implement the authorization policy you have a lot of control, including issuing scopes that don’t map to predefined ones, however, with that control comes more responsibility.

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/auth0/original/3X/b/5/b560f266932fcce5d57f09a6595bd50518cae3f3.jpeg) [@system](https://community.auth0.com/u/system)\
**Post date:** [March 2, 2018, 5:55am UTC](https://community.auth0.com/t/how-do-i-restrict-scopes-in-auth-token-based-on-user-profile/7633/3 "2018-03-02T05:55:34Z")

</div>