# How to get Sub Claim from Access Token

**URL:** <https://community.auth0.com/t/how-to-get-sub-claim-from-access-token/57499>\
**Category:** Get Help\
**Tags:** auth0-spa-js, access\_token, spa, js\
**Created:** [February 7, 2021, 12:25am UTC](https://community.auth0.com/t/how-to-get-sub-claim-from-access-token/57499 "2021-02-07T00:25:11Z")\
**Posts on this page:** 9\
**Page:** 1

<div class="post-metadata">

**Author:** ![iltimas.doha](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/iltimas.doha/32/27406_2.png) [@iltimas.doha](https://community.auth0.com/u/iltimas.doha)\
**Post date:** [February 7, 2021, 12:25am UTC](https://community.auth0.com/t/how-to-get-sub-claim-from-access-token/57499/1 "2021-02-07T00:25:11Z")

</div>

Hello,

tl;dr I would like to understand how I can extract the User Sub claim from an Access Token.

**Context:**

We’re building an SPA that exclusively uses serverless function (from Vercel) to make authenticated calls to an IdP at throughput (60 calls/min, which are bursted in \<1 sec, every sec) that is faster than the Auth0 Authentication `/userinfo` endpoint ratelimit (5 calls/min). We use this endpoint to hit the Management `/api/v2/users/{id}` endpoint and retrieve the IdP Access Tokens, which we then store in a Redis DB to be cache’d for future requests. However we would still need to make a `/userinfo` call every time the serverless function runs so we can obtain the sub which used as the key in Redis. If the serverless function can decode the sub from the access token, we could just ask the redis cache directly, avoiding calls to Auth0 for all requests outside of login.

**System Arch:**

The following are how we understand and implement both Login and Authenticated Calls to IdP flows, followed by how we would ideally like to make the Authenticated Calls to IdP.

**Login** :

 ![Screen Shot 2021-02-06 at 6.15.07 PM](https://global.discourse-cdn.com/auth0/original/3X/8/9/893b4c0db82eb82285fa726844c870bb3a8d277c.png)

1. Trigger `loginWithPopup()` on the browser client and login with IdP
2. Auth0 completes OAuth1 flow with IdP API
3. IdP API returns IdP Access tokens to Auth0 \*which is stored in an Auth0 DB
4. (accidentally labeled this 5) Auth0 return ID and accessTokens to Browser? (this part is unclear to me, tho probably not important to the problem)
5. ^^
6. Browser Client sends Access Token retrieved by the `auth0-spa-js` function `getTokenSilently()` to Vercel
7. Vercel hits `/userinfo` endpoint with Access Token as Bearer
8. Auth0 replies with User Info
9. Vercel hits `/api/v2/users/{id}` where ID is the extracted Sub Claim from the Auth0 response is the previous step
10. Auth0 responds with an object that contains the IdP access token \*which was retreived from an Auth0 DB
11. Finally Vercel stores the info in a Redis DB where the key is the sub and the value is the IdP Access Token

**Authenticated Call to IdP** _(this is made 60/min)_ :

 ![Screen Shot 2021-02-06 at 6.27.33 PM](https://global.discourse-cdn.com/auth0/original/3X/c/9/c99675dd57151d999dfbd4677b1fd7b804c8e405.png)

1. Logged In User makes request that requires data from the IdP with the Auth0 Access Token retrieved by the `auth0-spa-js` function `getTokenSilently()` passed in the request
2. Vercel hits `/userinfo` endpoint with Access Token as Bearer
3. Auth0 replies with User Info
4. Vercel sends extracted Sub Claim from the Auth0 response is the previous step to Redis DB
5. Redis DB finds the key (Sub Claim) and returns the value (IdP Access Token)
6. Vercel makes authenticated request to IdP using the user’s IdP Access Token
7. IdP API returns payload
8. Vercel passes payload back to User

**Steps 2 and 3 are the problematic ones** because this call to Auth0 would be made 60/min, bursted in \<2sec

Referencing some documentation from Auth0:  
[https://auth0.com/docs/tokens/access-tokens](https://auth0.com/docs/tokens/access-tokens)

> The token does not contain any information about the user except for the user ID (located in the `sub` claim).

Since we use the Sub Claim to store the IdP Access Token, we could decode the Access Token instead of making the call to Auth0 to get the Sub Claim.

However in our testing we found that the Access Token retrieved by the `auth0-spa-js` function `getTokenSilently()` is not a JWT, which is corroborated by Auth0 Docs:  
[https://auth0.com/docs/tokens#access-tokens](https://auth0.com/docs/tokens#access-tokens)

> [Access tokens](https://auth0.com/docs/tokens/access-tokens) (which aren’t always JWTs) […]

In what ways could we decode the Access Token into a Sub Claim. And if this is not possible, how can we avoid calls to Auth0 API when we need make requests to the IdP. Our ideal flow would look like the following:

 ![Screen Shot 2021-02-06 at 6.35.04 PM](https://global.discourse-cdn.com/auth0/original/3X/1/2/12a638de0704548ad20ddab811fdb01c94729998.png)

---

<div class="post-metadata">

**Author:** ![konrad.sopala](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/konrad.sopala/32/13516_2.png) [@konrad.sopala](https://community.auth0.com/u/konrad.sopala)\
**Post date:** [February 8, 2021, 8:57am UTC](https://community.auth0.com/t/how-to-get-sub-claim-from-access-token/57499/2 "2021-02-08T08:57:35Z")

</div>

Hey there!

When it comes to consulting such complex scenarios, I highly encourage you to discuss it with our Professional Services:

> **[Auth0 Professional Services](https://auth0.com/docs/get-started/professional-services)**
>
> Describes the Auth0 professional services offerings.

---

<div class="post-metadata">

**Author:** ![iltimas.doha](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/iltimas.doha/32/27406_2.png) [@iltimas.doha](https://community.auth0.com/u/iltimas.doha)\
**Post date:** [February 8, 2021, 9:50pm UTC](https://community.auth0.com/t/how-to-get-sub-claim-from-access-token/57499/3 "2021-02-08T21:50:53Z")

</div>

> [@konrad.sopala](#):
>
> When it comes to consulting such complex scenarios, I highly encourage you to discuss it

Hi. I gave the scenario for reference, but my initial question still stands. How do I extract the Sub from the Access Token? Is this possible?

---

<div class="post-metadata">

**Author:** ![sandrino-a0](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/sandrino-a0/32/11203_2.png) [@sandrino-a0](https://community.auth0.com/u/sandrino-a0)\
**Post date:** [February 9, 2021, 12:03pm UTC](https://community.auth0.com/t/how-to-get-sub-claim-from-access-token/57499/4 "2021-02-09T12:03:34Z")

</div>

> **[serverless-jwt/packages/next at master · sandrinodimattia/serverless-jwt - @serverless-jwt/next](https://github.com/sandrinodimattia/serverless-jwt/tree/master/packages/next#serverless-jwtnext)**
>
> master/packages/next

Using this library you would use **claims.sub**

---

<div class="post-metadata">

**Author:** ![konrad.sopala](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/konrad.sopala/32/13516_2.png) [@konrad.sopala](https://community.auth0.com/u/konrad.sopala)\
**Post date:** [February 9, 2021, 12:16pm UTC](https://community.auth0.com/t/how-to-get-sub-claim-from-access-token/57499/5 "2021-02-09T12:16:16Z")

</div>

Thanks for sharing that with the rest of community Sandrino!

---

<div class="post-metadata">

**Author:** ![iltimas.doha](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/iltimas.doha/32/27406_2.png) [@iltimas.doha](https://community.auth0.com/u/iltimas.doha)\
**Post date:** [February 9, 2021, 5:22pm UTC](https://community.auth0.com/t/how-to-get-sub-claim-from-access-token/57499/6 "2021-02-09T17:22:10Z")

</div>

Ok, yes I managed to get this done! I’ll drop some more refs and docs for others, but my main problem was not declaring a aud, which meant I was getting an opaque string instead of JWT.

@sandrino-a0 My next question is. What part of this is secure, if we never hit the Auth0 API (which for my context is preferred)? What’s to stop an attacker from forging request or replaying request?

---

<div class="post-metadata">

**Author:** ![iltimas.doha](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/iltimas.doha/32/27406_2.png) [@iltimas.doha](https://community.auth0.com/u/iltimas.doha)\
**Post date:** [February 9, 2021, 5:33pm UTC](https://community.auth0.com/t/how-to-get-sub-claim-from-access-token/57499/7 "2021-02-09T17:33:56Z")

</div>

Posting my solution for ref:

In general to get the Sub claim you must verify and decode the JWT (there are a lot of libs, including the one above, that do this). The specifics of which are covered in many other places.

If you are getting an opaque string as your access token, you must include an audience/`aud` claim when getting the token. That `aud` will be the identifier from an API in your dashboard.

For example in my code, this is the options I pass when making a instance of the Auth0 client:

```plaintext
let auth0Client = await createAuth0Client({
 domain: config.domain,
 client_id: config.clientId,
 audience: "literallyAnyString",
});

```

Where “literallyAnyString” is the identifier that you assigned when making the API  
(Auth0 implicitly suggests the url of the API, but it can be… literally any string)

This will ensure you are now sending access tokens as JWTs.

Example of where you will/would have set the identifier:

 ![Screen Shot 2021-02-09 at 12.30.08 PM](https://global.discourse-cdn.com/auth0/original/3X/2/1/217caa1111d5f22e00b9038dc1ff04b81a2a7c34.png)

You can also find it at the API screen:

 ![Screen Shot 2021-02-09 at 12.31.32 PM](https://global.discourse-cdn.com/auth0/original/3X/1/0/10d72c0510c5cc9c17c2e1f5503ca26fad3dee76.png)

---

<div class="post-metadata">

**Author:** ![konrad.sopala](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/konrad.sopala/32/13516_2.png) [@konrad.sopala](https://community.auth0.com/u/konrad.sopala)\
**Post date:** [February 10, 2021, 2:45pm UTC](https://community.auth0.com/t/how-to-get-sub-claim-from-access-token/57499/8 "2021-02-10T14:45:29Z")

</div>

Thanks for sharing that with the rest of community!

---

<div class="post-metadata">

**Author:** ![konrad.sopala](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/konrad.sopala/32/13516_2.png) [@konrad.sopala](https://community.auth0.com/u/konrad.sopala)\
**Post date:** [February 25, 2021, 10:24am UTC](https://community.auth0.com/t/how-to-get-sub-claim-from-access-token/57499/9 "2021-02-25T10:24:25Z")

</div>