# How to get Management API accessToken silently while SPA was already configured for a custom API? **URL:** \ **Category:** Get Help\ **Tags:** spa, user\_metadata, access-token, login\ **Created:** [May 2, 2021, 11:45am UTC](https://community.auth0.com/t/how-to-get-management-api-accesstoken-silently-while-spa-was-already-configured-for-a-custom-api/62081 "2021-05-02T11:45:57Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![AlperenOzturk](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/alperenozturk/32/29171_2.png) [@AlperenOzturk](https://community.auth0.com/u/AlperenOzturk)\ **Post date:** [May 2, 2021, 11:45am UTC](https://community.auth0.com/t/how-to-get-management-api-accesstoken-silently-while-spa-was-already-configured-for-a-custom-api/62081/1 "2021-05-02T11:45:57Z")
Hey there, I am using React.js and the @auth0/auth0-react SDK. I have a custom backend API. So my Auth0Provider component is configured with the audience of that custom API. However i also want the user to able to update user’s own user\_metadata using the Management API. I have created a page component to get input from user and update the user\_metadata with that input. So I need to get an accessToken for the Management API, and this is where the issue occurs. If I try to use ‘getAccessTokenSilently’ it redirect me to a page because I have already signed in for the custom API and so all the progress is lost, another way is to use getAccessTokenWithPopup. This way react.js prompts a popup page, and gets the accessToken without any need of additional login. But this triggers another issue. Popups are not that eye-pleasing and often gets blocked by the browser. So i have to use silent method somehow. Hope you can help me. Thanks in advance. ---
**Author:** ![stephanie.chamblee](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/stephanie.chamblee/32/26087_2.png) [@stephanie.chamblee](https://community.auth0.com/u/stephanie.chamblee)\ **Post date:** [May 4, 2021, 2:13pm UTC](https://community.auth0.com/t/how-to-get-management-api-accesstoken-silently-while-spa-was-already-configured-for-a-custom-api/62081/3 "2021-05-04T14:13:24Z")
Hi @AlperenOzturk, Welcome to the Community! You can specify a different `audience` with `getAccessTokenSilently` without being redirected to login, but you’d need to use a Custom Domain for this to work when third-party cookies are blocked. The options available would be: - Proxy the Management API request in your own API - This is the recommended approach as it would allow you to implement your own business-specific data validation. It’s also not recommended to expose a Managment API Access Token in a public client that allows the user to update their metadata as explained in the [docs](https://auth0.com/docs/tokens/management-api-access-tokens/get-management-api-tokens-for-single-page-applications): > Auth0 does not recommend putting Management API Tokens on the frontend that allow users to change user metadata. This can allow users to manipulate their own metadata in a way that could be detrimental to the functioning of the applications. It also allows a customer to do a DoS attack against someone’s management API by just spamming it and hitting rate limits. - Use a Custom Domain so that silent authentication would not fail and you’d be able to receive an Access Token - Use `loginWithPopup` as you are currently ---
**Author:** ![AlperenOzturk](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/alperenozturk/32/29171_2.png) [@AlperenOzturk](https://community.auth0.com/u/AlperenOzturk)\ **Post date:** [May 4, 2021, 2:51pm UTC](https://community.auth0.com/t/how-to-get-management-api-accesstoken-silently-while-spa-was-already-configured-for-a-custom-api/62081/4 "2021-05-04T14:51:37Z")
Thanks for the advice. By saying Proxy the Management API over your custom API , do you mean that I must create a machine-to-machine application, send a request to my custom API backend using frontend, process that request at the backend server and then create a request using machine-to-machine client? If that’s what you mean i thought about this but sadly there is very low machine-to-machine request limit for Free Tier if I’m not wrong. If you mean something else please explain this to me a bit or direct me to a docs resource. ---
**Author:** ![stephanie.chamblee](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/stephanie.chamblee/32/26087_2.png) [@stephanie.chamblee](https://community.auth0.com/u/stephanie.chamblee)\ **Post date:** [May 4, 2021, 3:52pm UTC](https://community.auth0.com/t/how-to-get-management-api-accesstoken-silently-while-spa-was-already-configured-for-a-custom-api/62081/5 "2021-05-04T15:52:23Z")
You’re welcome! Yes, that is what I was referring to with the proxy option as described here: [https://auth0.com/docs/tokens/management-api-access-tokens/get-management-api-access-tokens-for-production](https://auth0.com/docs/tokens/management-api-access-tokens/get-management-api-access-tokens-for-production) Tokens requested for internal Auth0 API’s such as the Management API v2 (for example, when the `audience` is `https://YOUR_DOMAIN/api/v2/`) won’t count towards the M2M quota: [https://community.auth0.com/t/do-management-api-tokens-count-towards-my-m2m-token-quota/43822](https://community.auth0.com/t/do-management-api-tokens-count-towards-my-m2m-token-quota/43822) ---
**Author:** ![AlperenOzturk](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/alperenozturk/32/29171_2.png) [@AlperenOzturk](https://community.auth0.com/u/AlperenOzturk)\ **Post date:** [May 4, 2021, 4:24pm UTC](https://community.auth0.com/t/how-to-get-management-api-accesstoken-silently-while-spa-was-already-configured-for-a-custom-api/62081/6 "2021-05-04T16:24:40Z")
Oh got it. Didn’t know about that. Proxy the request over my backend server seems the way to go then. Thanks for everything. ---
**Author:** ![system](https://global.discourse-cdn.com/auth0/original/3X/b/5/b560f266932fcce5d57f09a6595bd50518cae3f3.jpeg) [@system](https://community.auth0.com/u/system)\ **Post date:** [May 19, 2021, 4:24pm UTC](https://community.auth0.com/t/how-to-get-management-api-accesstoken-silently-while-spa-was-already-configured-for-a-custom-api/62081/7 "2021-05-19T16:24:45Z")
This topic was automatically closed 15 days after the last reply. New replies are no longer allowed.