How to add user permissions to ID token

[aaron.hardy]

Thanks @tyf.

@tyf

What might be an option, is to rely on the permission array added to the Access Token from a login within the context of a Organization

This is the primary thing I’m trying to avoid. The frontend is supposed to treat the access token as an opaque string and shouldn’t try to decode it:

Custom claims in access token with auth0-spa-js

Welcome to the Auth0 community, @n.selikoff! The access token is meant to be sent to an API/backend, and not to be decoded by the SPA (frontend). The SPA should treat it as an opaque string. This is why the SDK does not decode the access token or provide a method to access the contents. The ID token can be used in the SPA though. As you’ve already figured out, getIdTokenClaims() method can be used to get the claims.

Respecting this, if I want to access the permissions that are on the access token, I would have to make an extra call to my server API so that the server can decode the access token and return the permissions from it.

Also, if the permissions are in the access token, it means they would be sent to the server on every request to the server when they aren’t actually needed by the server at all. They’re only needed by the SPA.

It seems like it would be much more appropriate and simpler to just add the permissions to the identity token, which is intended for the SPA to use, but I don’t see a feasible way to accomplish this with Auth0.