# How do you use Auth0 to authenticate & authorize 3rd party vendors? **URL:** \ **Category:** Get Help\ **Tags:** clients\ **Created:** [April 11, 2017, 1:28am UTC](https://community.auth0.com/t/how-do-you-use-auth0-to-authenticate-authorize-3rd-party-vendors/6173 "2017-04-11T01:28:34Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![sean.lindo](https://upload.wikimedia.org/wikipedia/commons/thumb/7/7c/User_font_awesome.svg/768px-User_font_awesome.svg.png) [@sean.lindo](https://community.auth0.com/u/sean.lindo)\ **Post date:** [April 11, 2017, 1:28am UTC](https://community.auth0.com/t/how-do-you-use-auth0-to-authenticate-authorize-3rd-party-vendors/6173/1 "2017-04-11T01:28:34Z")
I’m currently looking into Non-Interactive Clients to create a client for each vendor that uses our service and then setting appropriate scopes for each-- my other alternative is creating a user and leveraging `app_metadata` to set their scopes. I also created a simple Rule to ensure these users can’t log into any other client, strictly the API-specific Client. There are obvious differences between the two, I’m just unsure which falls under a best practice. Also, we don’t anticipate these vendors accessing anything user-specific for now. ---
**Author:** ![jmangelo](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/jmangelo/32/7923_2.png) [@jmangelo](https://community.auth0.com/u/jmangelo)\ **Post date:** [April 11, 2017, 3:04pm UTC](https://community.auth0.com/t/how-do-you-use-auth0-to-authenticate-authorize-3rd-party-vendors/6173/2 "2017-04-11T15:04:29Z")
If you don’t want to distinguish between multiple users within the same vendor which seems to be the case as you mention that if opting for the user-based option you would create a (_assuming single_) user and that vendor will not access services that are user-specific. In this situation I would recommend going with the creation of a non-interactive client application for each vendor. You can make use of `client_metadata` to maintain the association between vendor and respective client application. Additionally, for client credentials grants there’s a built-in authorization grant management interface that would let you easily configure/view the allowed scopes through the Auth0 Dashboard itself. Alternatively, you could also automate this process through the [Management API](https://auth0.com/docs/api/management/v2). ---
**Author:** ![simon.spencer](https://upload.wikimedia.org/wikipedia/commons/thumb/7/7c/User_font_awesome.svg/768px-User_font_awesome.svg.png) [@simon.spencer](https://community.auth0.com/u/simon.spencer)\ **Post date:** [January 3, 2018, 9:47am UTC](https://community.auth0.com/t/how-do-you-use-auth0-to-authenticate-authorize-3rd-party-vendors/6173/3 "2018-01-03T09:47:01Z")
Suppose we need to identify these vendors in our API, how can we do that? Is it a valid approach to have a local database of client\_id → vendor. So in our API we would read the client\_id from te JWT and map the request to a given Vendor. is that the best way to do it? ---
**Author:** ![jmangelo](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/jmangelo/32/7923_2.png) [@jmangelo](https://community.auth0.com/u/jmangelo)\ **Post date:** [January 17, 2018, 12:42am UTC](https://community.auth0.com/t/how-do-you-use-auth0-to-authenticate-authorize-3rd-party-vendors/6173/4 "2018-01-17T00:42:10Z")
Yes, that seems fine; it would be the same as maintaining a user database at the API level where you would identify the user by user identifier. Instead you’re dealing with clients/vendors and client identifiers. ---
**Author:** ![system](https://global.discourse-cdn.com/auth0/original/3X/b/5/b560f266932fcce5d57f09a6595bd50518cae3f3.jpeg) [@system](https://community.auth0.com/u/system)\ **Post date:** [March 2, 2018, 5:53am UTC](https://community.auth0.com/t/how-do-you-use-auth0-to-authenticate-authorize-3rd-party-vendors/6173/5 "2018-03-02T05:53:11Z")