# How to add client scopes and validate them for each login?

**URL:** <https://community.auth0.com/t/how-to-add-client-scopes-and-validate-them-for-each-login/68599>\
**Category:** Get Help\
**Tags:** scopes\
**Created:** [August 26, 2021, 9:34am UTC](https://community.auth0.com/t/how-to-add-client-scopes-and-validate-them-for-each-login/68599 "2021-08-26T09:34:52Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![enam](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/enam/32/31364_2.png) [@enam](https://community.auth0.com/u/enam)\
**Post date:** [August 26, 2021, 9:34am UTC](https://community.auth0.com/t/how-to-add-client-scopes-and-validate-them-for-each-login/68599/1 "2021-08-26T09:34:52Z")

</div>

I am migrating my application from identity server to support Auth0. I can’t find how can I define client’s available scopes and every time when user tries to login validate whether that client application has access to scopes which it requests.  
E.g. I want to define “client1” which has allowed scope “scope1” and an api “api1” which has “scope1” permission. User provides its login/password, client credentials, api identifier “api1” and requested scope “scope1”.  
We need somehow check whether that client application has access to “scope1”. It it has then it can get access token to consume “api1” otherwise it doesn’t have permission to that scope.  
Now application can get every scopes that the “api1” defined.

---

<div class="post-metadata">

**Author:** ![ruchi](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/ruchi/32/18068_2.png) [@ruchi](https://community.auth0.com/u/ruchi)\
**Post date:** [August 28, 2021, 8:41pm UTC](https://community.auth0.com/t/how-to-add-client-scopes-and-validate-them-for-each-login/68599/2 "2021-08-28T20:41:39Z")

</div>

Hi @enam - welcome to the Auth0 community!

Auth0 has built-in support through our Authorization Core feature ([https://auth0.com/docs/authorization/how-to-use-auth0s-core-authorization-feature-set](https://auth0.com/docs/authorization/how-to-use-auth0s-core-authorization-feature-set)) to restrict the scopes returned **based on the user that is performing the authentication**.

There is support for restricting scopes based on client application, but only in client credentials flows where it’s the client itself that authenticates (no end-user).

There is a similar community post discussion on this topic that you might helpful - [Is it possible to restrict the scopes available to a SPA](https://community.auth0.com/t/is-it-possible-to-restrict-the-scopes-available-to-a-spa/51990).

---

<div class="post-metadata">

**Author:** ![enam](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/enam/32/31364_2.png) [@enam](https://community.auth0.com/u/enam)\
**Post date:** [August 29, 2021, 6:37pm UTC](https://community.auth0.com/t/how-to-add-client-scopes-and-validate-them-for-each-login/68599/3 "2021-08-29T18:37:20Z")

</div>

Thanks @ruchi for your answer.

---

<div class="post-metadata">

**Author:** ![konrad.sopala](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/konrad.sopala/32/13516_2.png) [@konrad.sopala](https://community.auth0.com/u/konrad.sopala)\
**Post date:** [August 30, 2021, 8:38am UTC](https://community.auth0.com/t/how-to-add-client-scopes-and-validate-them-for-each-login/68599/4 "2021-08-30T08:38:07Z")

</div>

We are here for you!

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/auth0/original/3X/b/5/b560f266932fcce5d57f09a6595bd50518cae3f3.jpeg) [@system](https://community.auth0.com/u/system)\
**Post date:** [September 14, 2021, 8:38am UTC](https://community.auth0.com/t/how-to-add-client-scopes-and-validate-them-for-each-login/68599/5 "2021-09-14T08:38:15Z")

</div>

This topic was automatically closed 15 days after the last reply. New replies are no longer allowed.