# How to Add Permissions from Roles to Access Token

**URL:** <https://community.auth0.com/t/how-to-add-permissions-from-roles-to-access-token/97954>\
**Category:** Get Help\
**Tags:** user-profile, user-management\
**Created:** [January 11, 2023, 3:41pm UTC](https://community.auth0.com/t/how-to-add-permissions-from-roles-to-access-token/97954 "2023-01-11T15:41:30Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![hunter.heavener](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/hunter.heavener/32/39704_2.png) [@hunter.heavener](https://community.auth0.com/u/hunter.heavener)\
**Post date:** [January 11, 2023, 3:41pm UTC](https://community.auth0.com/t/how-to-add-permissions-from-roles-to-access-token/97954/1 "2023-01-11T15:41:30Z")

</div>

**My Setup**  
I have an API with many different permissions associated with it. Additionally, I have several user roles created that combine multiple permissions into meaningful groups. And, by extension, users have roles assigned to them based on the access they should need for our app.

**The Problem**  
I have RBAC enabled on my API and I am able to get the `permissions` claim added to the token, however, it does not include permissions that are included in the role assigned to the user. I assumed that any permissions granted to the user through a role would be added here, but that’s not the case.

**The Question**  
How can I add these permissions from the user’s role(s) to the access token so that they are available in my SPA?

Thanks in advance!

---

<div class="post-metadata">

**Author:** ![rueben.tiow](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/rueben.tiow/32/11646_2.png) [@rueben.tiow](https://community.auth0.com/u/rueben.tiow)\
**Post date:** [January 11, 2023, 9:53pm UTC](https://community.auth0.com/t/how-to-add-permissions-from-roles-to-access-token/97954/3 "2023-01-11T21:53:03Z")

</div>

Hi @hunter.heavener,

Thanks for reaching out to the Auth0 Community!

> [@hunter.heavener](#):
>
> How can I add these permissions from the user’s role(s) to the access token so that they are available in my SPA?

After my investigation, I can confirm that you have correctly configured your API with RBAC and enabled the **Add Permissions in the Access Token** toggle. I also found that your users were correctly assigned to Permissions.

Now, when I try to reproduce the issue on my side, I did not find the same observations. I managed to get the permissions claim with the assigned permissions added to the access token every time by starting the request with something like the following:

```auto
https://YOUR_DOMAIN/authorize?
    response_type=code&
    client_id=YOUR_CLIENT_ID&
    redirect_uri=https://YOUR_APP/callback&
    scope={scope}
    audience={apiAudience}&
    state={state}

```

Given that, could you please [capture a HAR file of the authentication events](https://auth0.com/docs/troubleshoot/troubleshooting-tools/generate-and-analyze-har-files) and DM it to me to investigate further?

And if possible, could you please create a test user for me and DM me the credentials to test the authentication flow of your application?

Thanks,  
Rueben

---

<div class="post-metadata">

**Author:** ![hunter.heavener](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/hunter.heavener/32/39704_2.png) [@hunter.heavener](https://community.auth0.com/u/hunter.heavener)\
**Post date:** [January 12, 2023, 3:10pm UTC](https://community.auth0.com/t/how-to-add-permissions-from-roles-to-access-token/97954/4 "2023-01-12T15:10:26Z")

</div>

Hey @rueben.tiow, thank you for looking into this for me. I’m just seeing your reply and I am going to test this in Postman and see if I get different results. I’d be happy to DM you with a HAR file also. Additionally, I don’t think I mentioned that I’m also using the React SDK client-side and I’m retrieving the access token silently through the `getAccessTokenSilently` method. It could be that I have something not configured correctly in my provider. I’ll test a couple more things and post an update here soon.

Also, the Auth0Provider is configured like this in my application:

```xml
<Auth0Provider
    useRefreshTokens
    domain={MY_DOMAIN}
    clientId={MY_CLIENT_ID}
    redirectUri={REDIRECT_URI}
    scope="openid profile email"
    audience={MY_API}
    cacheLocation="localstorage">
    ...
</Auth0Provider>

```

---

<div class="post-metadata">

**Author:** ![hunter.heavener](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/hunter.heavener/32/39704_2.png) [@hunter.heavener](https://community.auth0.com/u/hunter.heavener)\
**Post date:** [January 12, 2023, 3:33pm UTC](https://community.auth0.com/t/how-to-add-permissions-from-roles-to-access-token/97954/5 "2023-01-12T15:33:04Z")

</div>

Hey @rueben.tiow, you’ll have to be patient with me because I am by no means an OAuth or Auth0 expert. I attempted the request you created above in Postman and it returned the universal login page and I’m not sure how to go from that to an access token (at least not in Postman). I’m sure that’s me doing something wrong but I’m not sure what I’m doing incorrectly. Or maybe that’s normal? Perhaps I’m not supposed to be able to perform the flow in Postman. If that’s the case, where should I perform this request from?

If you could provide some more instruction on how exactly to set this up it would be greatly appreciated.

Thank you!

---

<div class="post-metadata">

**Author:** ![hunter.heavener](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/hunter.heavener/32/39704_2.png) [@hunter.heavener](https://community.auth0.com/u/hunter.heavener)\
**Post date:** [January 12, 2023, 3:52pm UTC](https://community.auth0.com/t/how-to-add-permissions-from-roles-to-access-token/97954/6 "2023-01-12T15:52:36Z")

</div>

In the meantime, here is a sample of the token data I have access to in my SPA:

```json
{
    "iss": "<API_AUDIENCE>",
    "sub": "google-oauth2|<id>",
    "aud": [
        "<API_AUDIENCE>",
        "<APP_AUDIENCE>/userinfo"
    ],
    "iat": 1673538464,
    "exp": 1673624864,
    "azp": "<redacted>",
    "scope": "openid profile email",
    "permissions": []
}

```

---

<div class="post-metadata">

**Author:** ![hunter.heavener](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/hunter.heavener/32/39704_2.png) [@hunter.heavener](https://community.auth0.com/u/hunter.heavener)\
**Post date:** [January 13, 2023, 8:46pm UTC](https://community.auth0.com/t/how-to-add-permissions-from-roles-to-access-token/97954/7 "2023-01-13T20:46:36Z")

</div>

Well this is getting immortalized here. If you see the permissions claim but don’t see any permissions inside the claim, make sure your role has permissions in it 😅

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/auth0/original/3X/b/5/b560f266932fcce5d57f09a6595bd50518cae3f3.jpeg) [@system](https://community.auth0.com/u/system)\
**Post date:** [January 27, 2023, 8:47pm UTC](https://community.auth0.com/t/how-to-add-permissions-from-roles-to-access-token/97954/8 "2023-01-27T20:47:35Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.