# How to obtain an AccessToken for accessing my API containing current users information? **URL:** \ **Category:** Get Help\ **Tags:** jwt, api, login, auth0\ **Created:** [February 27, 2021, 4:19pm UTC](https://community.auth0.com/t/how-to-obtain-an-accesstoken-for-accessing-my-api-containing-current-users-information/58627 "2021-02-27T16:19:24Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![clubbing](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/clubbing/32/12811_2.png) [@clubbing](https://community.auth0.com/u/clubbing)\ **Post date:** [February 27, 2021, 4:19pm UTC](https://community.auth0.com/t/how-to-obtain-an-accesstoken-for-accessing-my-api-containing-current-users-information/58627/1 "2021-02-27T16:19:24Z")
Hi, I’m little confused how to achieve the following scenario, where my Frontend (SPA) will access a REST API including the current authenticated Auth0-User and the roles, that was linked to this particular user: 1. SPA contains Auth0-SignUp/SignIn capabilities 2. After a SignUp in the SPA, user will be created in Backend via REST API and Post-Creation-Hook 3. After SignIn, my SPA will get the UserID of my backend via meta\_data of the Auth0-User 4. When accessing my Backend via Rest-API, an AccessToken (JWT) will be obtained and be validated on the Backend This is what I have so far. But now I don’t want just to create a “global” accessToken for my own REST API, which was created with grant\_type “credentials”, clientId and clientSecret. Instead, I want to create a JWT-token for the current authenticated User that my Backend can check not only, if the general JWT token is valid, but also, which user was responsible for this specific API request. What would be the right workflow for this? ---
**Author:** ![sgo](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/sgo/32/13789_2.png) [@sgo](https://community.auth0.com/u/sgo)\ **Post date:** [March 2, 2021, 5:28pm UTC](https://community.auth0.com/t/how-to-obtain-an-accesstoken-for-accessing-my-api-containing-current-users-information/58627/3 "2021-03-02T17:28:04Z")
Hi @clubbing, welcome to the community! You would want to register your API within your Auth0 tenant, this will allow you to make `/authorize` requests with the API’s identifier as the audience. When you provide an audience, Auth0 will provide a token that is supposed to be consumed by that API. - [Register APIs](https://auth0.com/docs/get-started/set-up-apis) As you are using a SPA, the recommended flow is Authorization Code with PKCE: - [Authorization Code Flow with Proof Key for Code Exchange (PKCE)](https://auth0.com/docs/flows/authorization-code-flow-with-proof-key-for-code-exchange-pkce) - [Call Your API Using the Authorization Code Flow with PKCE](https://auth0.com/docs/flows/call-your-api-using-the-authorization-code-flow-with-pkce) You can then use the access token your user gained from the above flow to control what the user can and cannot do on your API, by sending it as a bearer token in their requests to your API endpoints, and the user in question should appear as the `sub` (subject) claim of the token - [Use Access Tokens](https://auth0.com/docs/tokens/access-tokens/use-access-tokens) - [Validate Access Tokens](https://auth0.com/docs/tokens/access-tokens/validate-access-tokens) You can also further customise what claims appear in the access tokens beyond the standard; either through Rules, our built in Role Based Access Control (RBAC), or a combination of the two: **Custom claims:** - [Create Custom Claims](https://auth0.com/docs/tokens/create-namespaced-custom-claims) - [Sample Use Cases: Scopes and Claims](https://auth0.com/docs/scopes/sample-use-cases-scopes-and-claims) **RBAC:** - [Role-Based Access Control](https://auth0.com/docs/authorization/rbac) - [https://auth0.com/docs/authorization/how-to-use-auth0s-core-authorization-feature-set](https://auth0.com/docs/authorization/how-to-use-auth0s-core-authorization-feature-set) - [Enable Role-Based Access Control for APIs](https://auth0.com/docs/authorization/rbac/enable-role-based-access-control-for-apis) I hope that helps with your implementation! ---
**Author:** ![konrad.sopala](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/konrad.sopala/32/13516_2.png) [@konrad.sopala](https://community.auth0.com/u/konrad.sopala)\ **Post date:** [March 3, 2021, 12:04pm UTC](https://community.auth0.com/t/how-to-obtain-an-accesstoken-for-accessing-my-api-containing-current-users-information/58627/4 "2021-03-03T12:04:19Z")
Thanks Steve for providing that detailed write-up! ---
**Author:** ![system](https://global.discourse-cdn.com/auth0/original/3X/b/5/b560f266932fcce5d57f09a6595bd50518cae3f3.jpeg) [@system](https://community.auth0.com/u/system)\ **Post date:** [March 18, 2021, 12:04pm UTC](https://community.auth0.com/t/how-to-obtain-an-accesstoken-for-accessing-my-api-containing-current-users-information/58627/5 "2021-03-18T12:04:32Z")
This topic was automatically closed 15 days after the last reply. New replies are no longer allowed.