# How to secure API endpoints?

**URL:** <https://community.auth0.com/t/how-to-secure-api-endpoints/92359>\
**Category:** Get Help\
**Created:** [October 13, 2022, 5:19pm UTC](https://community.auth0.com/t/how-to-secure-api-endpoints/92359 "2022-10-13T17:19:17Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![wurkzen](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/wurkzen/32/12814_2.png) [@wurkzen](https://community.auth0.com/u/wurkzen)\
**Post date:** [October 13, 2022, 5:19pm UTC](https://community.auth0.com/t/how-to-secure-api-endpoints/92359/1 "2022-10-13T17:19:17Z")

</div>

Hi all,  
Our app is using Auth0.  
Currently we created the users during the signup user and create the user in Auth0.  
The issue is that when signing in, the token that is provided can access EVERYTHING in our api.

We have built out our API route to start with: /v1/client/{id}  
after the client\_id we obviously have all of our endpoints /customers /locations /orders etc

We need the token that is generated to ONLY have access to the client\_id of the user requesting so if they belong to client\_id 2 they could access /v1/client/2/customers and NOT /v1/client/5/customers specifically on the GET endpoints.

What is the best way to do this?

---

<div class="post-metadata">

**Author:** ![ty.frith](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/ty.frith/32/58484_2.png) [@ty.frith](https://community.auth0.com/u/ty.frith)\
**Post date:** [October 28, 2022, 1:25am UTC](https://community.auth0.com/t/how-to-secure-api-endpoints/92359/2 "2022-10-28T01:25:56Z")

</div>

Hello @wurkzen welcome back to the community, and apologize for the delayed response!

> [@wurkzen](#):
>
> We need the token that is generated to ONLY have access to the client\_id of the user requesting so if they belong to client\_id 2 they could access /v1/client/2/customers and NOT /v1/client/5/customers specifically on the GET endpoints.
> 
> What is the best way to do this?

This sounds like a fairly standard use cases for permissions/scopes in general - Perhaps even [RBAC](https://auth0.com/docs/manage-users/access-control/rbac) if you have groups of users that should be able to access specific resources and not others. Here are some resources that should give you some ideas:

> **[Solution Overview (SPAs + API)](https://auth0.com/docs/get-started/architecture-scenarios/spa-api/part-1)**
>
> Solution overview for the SPA + API architecture scenario

> **[APIs](https://auth0.com/docs/get-started/apis)**
>
> Explore key topics related to working with APIs.

Hope this helps!

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/auth0/original/3X/b/5/b560f266932fcce5d57f09a6595bd50518cae3f3.jpeg) [@system](https://community.auth0.com/u/system)\
**Post date:** [December 22, 2022, 12:29am UTC](https://community.auth0.com/t/how-to-secure-api-endpoints/92359/4 "2022-12-22T00:29:44Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.