# How to integrate a Express Backend with an Auth0 frontend for controlled access to server routes?

**URL:** <https://community.auth0.com/t/how-to-integrate-a-express-backend-with-an-auth0-frontend-for-controlled-access-to-server-routes/123126>\
**Category:** Get Help\
**Tags:** user-search, user-management\
**Created:** [December 14, 2023, 10:11pm UTC](https://community.auth0.com/t/how-to-integrate-a-express-backend-with-an-auth0-frontend-for-controlled-access-to-server-routes/123126 "2023-12-14T22:11:20Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![michaelnicol71](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/michaelnicol71/32/53286_2.png) [@michaelnicol71](https://community.auth0.com/u/michaelnicol71)\
**Post date:** [December 14, 2023, 10:11pm UTC](https://community.auth0.com/t/how-to-integrate-a-express-backend-with-an-auth0-frontend-for-controlled-access-to-server-routes/123126/1 "2023-12-14T22:11:20Z")

</div>

Hello,

I am new to Auth0 and MongoDB and started working on a website for an organization that needs layers of permissions.

My backend runs Express.js which connects to MongoDB, and my frontend runs client-side rendering React.js.

I have a basic project with a single sign-in and sign-out button from this tutorial here: [https://www.youtube.com/watch?v=pAzqscDx580](https://www.youtube.com/watch?v=pAzqscDx580)

How can I secure my express backend routes such that only certain users can access them?

My idea is that each backend route requires a user token, passed as a URL param, to access. I then use auth0 on the backend to figure out who this user is, and I then check the MongoDB database to see the user’s permissions. If the user’s permissions allow them to access this server route, I complete the task for that route.

These routes include accessing MongoDB.

How would I go about implementing this? Is there a better option?

---

<div class="post-metadata">

**Author:** ![ty.frith](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/ty.frith/32/58484_2.png) [@ty.frith](https://community.auth0.com/u/ty.frith)\
**Post date:** [December 15, 2023, 2:22am UTC](https://community.auth0.com/t/how-to-integrate-a-express-backend-with-an-auth0-frontend-for-controlled-access-to-server-routes/123126/3 "2023-12-15T02:22:57Z")

</div>

Hello @michaelnicol71 welcome to the community!

> [@michaelnicol71](#):
>
> How can I secure my express backend routes such that only certain users can access them?

I recommend checking out the [express-oauth2-jwt-bearer](https://packages/express-oauth2-jwt-bearer) package - Here’s a [quickstart](https://auth0.com/docs/quickstart/backend/nodejs/01-authorization) which should be helpful and FWIW our react sample [uses this package as well](https://github.com/auth0-samples/auth0-react-samples/blob/master/Sample-01/api-server.js).

> [@michaelnicol71](#):
>
> My idea is that each backend route requires a user token, passed as a URL param, to access. I then use auth0 on the backend to figure out who this user is, and I then check the MongoDB database to see the user’s permissions. If the user’s permissions allow them to access this server route, I complete the task for that route.

This sounds about right! Just make sure you are passing an [access token](https://auth0.com/docs/secure/tokens/access-tokens) as opposed to ID token.

---

<div class="post-metadata">

**Author:** ![michaelnicol71](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/michaelnicol71/32/53286_2.png) [@michaelnicol71](https://community.auth0.com/u/michaelnicol71)\
**Post date:** [December 17, 2023, 12:42am UTC](https://community.auth0.com/t/how-to-integrate-a-express-backend-with-an-auth0-frontend-for-controlled-access-to-server-routes/123126/4 "2023-12-17T00:42:22Z")

</div>

I am now attempting to set up scopes, roles, and permissions for users accessing routes.

For reference, here is the example quickstart code:

```auto
// server.js
const { requiredScopes } = require('express-oauth2-jwt-bearer');

const checkScopes = requiredScopes('read:messages');

app.get('/api/private-scoped', checkJwt, checkScopes, function(req, res) {
  res.json({
    message: 'Hello from a private endpoint! You need to be authenticated and have a scope of read:messages to see this.'
  });
});

```

How can I access the user’s information inside of the route?

Two people might have the scope of “all:email” in their role, but depending on who that user is, the people they have access to email will vary.

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/auth0/original/3X/b/5/b560f266932fcce5d57f09a6595bd50518cae3f3.jpeg) [@system](https://community.auth0.com/u/system)\
**Post date:** [December 31, 2023, 12:42am UTC](https://community.auth0.com/t/how-to-integrate-a-express-backend-with-an-auth0-frontend-for-controlled-access-to-server-routes/123126/5 "2023-12-31T00:42:38Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.