# How to specify scopes in an authorize call

**URL:** <https://community.auth0.com/t/how-to-specify-scopes-in-an-authorize-call/132388>\
**Category:** Get Help\
**Tags:** users, management-api\
**Created:** [April 19, 2024, 12:30pm UTC](https://community.auth0.com/t/how-to-specify-scopes-in-an-authorize-call/132388 "2024-04-19T12:30:16Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![o.d](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/o.d/32/54233_2.png) [@o.d](https://community.auth0.com/u/o.d)\
**Post date:** [April 19, 2024, 12:30pm UTC](https://community.auth0.com/t/how-to-specify-scopes-in-an-authorize-call/132388/1 "2024-04-19T12:30:16Z")

</div>

Hello, Auth0 community,

Warning: I’m new to Auth0 so be prepared for stupid questions.

I have the following problem and I don’t understand what I’m doing wrong so maybe you can help.

At login I need to retrieve the user’s roles so I follow the documentation here: [Auth0 Management API v2](https://auth0.com/docs/api/management/v2/users/get-user-roles)

…which says that I need the scopes “read:users read:roles read:role\_members”

So my authorize request contains these scopes as you can see below

[https://mytenant.eu.auth0.com/authorize?client\_id=my\_client\_id&redirect\_uri=http%3A%2F%2Flocalhost%3A4000%2Fauth%2Fauth0%2Fcallback&response\_type=code&scope=openid+profile+email+read%3Ausers+read%3Aroles+read%3Arole\_members&state=whatever\_state](https://mytenant.eu.auth0.com/authorize?client_id=my_client_id&redirect_uri=http%3A%2F%2Flocalhost%3A4000%2Fauth%2Fauth0%2Fcallback&response_type=code&scope=openid+profile+email+read%3Ausers+read%3Aroles+read%3Arole_members&state=whatever_state)

Still, in callback the scopes I’m getting are only “openid profile email”

What am I missing here?

Thanks in advance!

---

<div class="post-metadata">

**Author:** ![ty.frith](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/ty.frith/32/58484_2.png) [@ty.frith](https://community.auth0.com/u/ty.frith)\
**Post date:** [April 22, 2024, 9:16pm UTC](https://community.auth0.com/t/how-to-specify-scopes-in-an-authorize-call/132388/3 "2024-04-22T21:16:30Z")

</div>

Hey there @o.d welcome to the community!

> [@o.d](#):
>
> At login I need to retrieve the user’s roles so I follow the documentation here: [Auth0 Management API v2](https://auth0.com/docs/api/management/v2/users/get-user-roles?_gl=1*1q6fccr*_gcl_aw*R0NMLjE3MDk1ODk5NjcuQ2p3S0NBaUFfNVd2QmhCQUVpd0FadENVN3hESUt5bFR5UXlJcEs2RGxFLTYyZ1UxTWUzYlVMdmhQTEJkeUxuWHkxSWRiR2NvRkc3cG1Cb0NDdXNRQXZEX0J3RQ..*_gcl_au*MTU2NTk4NDMzLjE3MTM1MzM5NTA.*_ga*MTE0NzA5MjM0NC4xNjgxNzY4MTU4*_ga_QKMSDV5369*MTcxMzgxNDgyNC42ODIuMS4xNzEzODE5OTA1LjMzLjAuMA..)

Can you help me better understand your specific use case here? Typically, roles are added to tokens [by way of an Action](https://community.auth0.com/t/how-to-add-roles-and-permissions-to-the-id-token-using-actions/84506). If you are looking to get a user’s roles server-side then you will want to request a [Management API Access token](https://auth0.com/docs/secure/tokens/access-tokens/management-api-access-tokens/get-management-api-access-tokens-for-production) for use against the Management API.

The more details you can provide about your use case the better 🙂

---

<div class="post-metadata">

**Author:** ![o.d](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/o.d/32/54233_2.png) [@o.d](https://community.auth0.com/u/o.d)\
**Post date:** [April 23, 2024, 8:12am UTC](https://community.auth0.com/t/how-to-specify-scopes-in-an-authorize-call/132388/4 "2024-04-23T08:12:09Z")

</div>

Thanks for answering!

In the meanwhile the things got a bit more clear for me and I hope I can explain better.

I’m using Auth0 from Elixir and this is why in my question I didn’t show any library calls, because it’s not a popular language and what matters in the end is the HTTP requests sent to Auth0.

What I need to do is to get the user roles from Auth0. I understand that I need to make a call to [Auth0 Management API Get-user-roles](https://auth0.com/docs/api/management/v2/users/get-user-roles) with the token in the “Authentication” header as a “Bearer ”.

The problem is that when I do so I get a **403 Forbidden error** with the message “Insufficient scope, expected any of: read:users,read:roles,read:role\_members”. If I decode the token on [jwt.io](http://jwt.io) I see this:

```auto
{
  "iss": "https://mytenant.eu.auth0.com/",
  "sub": "auth0|66223049b368c7956fdfeabd",
  "aud": [
    "https://mytenant.eu.auth0.com/api/v2/",
    "https://mytenant.eu.auth0.com/userinfo"
  ],
  "iat": 1713786790,
  "exp": 1713873190,
  "scope": "openid profile email",
  "azp": "S1MDQ0d0vXHNOspBV0LwUeYPWrQHUSV8"
}

```

…for which is pretty obvious that it doesn’t have the required scope.

If I look at the authentication call that was made to Auth0 and I see that the call is specifying the correct scopes:

```auto
https://mytenant.eu.auth0.com/authorize?
audience=https%3A%2F%2Fmytenant.eu.auth0.com%2Fapi%2Fv2%2F&
client_id=myclient_id&
redirect_uri=http%3A%2F%2Fmy_url.com%3A4000%2Fauth%2Fauth0%2Fcallback&
response_type=code&
scope=openid+profile+email+read%3Ausers+read%3Aroles+read%3Arole_members&
state=J2S_OE79vKpxAkGBz9M1oySI

```

Also, please note that I’ve give permissions for my application to call the management API with the scopes read:users,read:roles,read:role\_members in Dashboard → Applications → APIs → Auth0 Management API → Settings → Machine to machine applications

And here is where I got blocked. What am I missing here? Why doesn’t the token contain the requested scopes?

Thanks,  
ovidiu

---

<div class="post-metadata">

**Author:** ![ty.frith](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/ty.frith/32/58484_2.png) [@ty.frith](https://community.auth0.com/u/ty.frith)\
**Post date:** [April 24, 2024, 12:30am UTC](https://community.auth0.com/t/how-to-specify-scopes-in-an-authorize-call/132388/5 "2024-04-24T00:30:49Z")

</div>

No problem, I’m happy to help!

> [@o.d](#):
>
> Also, please note that I’ve give permissions for my application to call the management API with the scopes read:users,read:roles,read:role\_members in Dashboard → Applications → APIs → Auth0 Management API → Settings → Machine to machine applications

The issue seems to be that you are using an access token of a user as opposed to a Management API Access token - The authorize request shared is that of a interactive (user-involved) flow as opposed to non-interactive (machine to machine). In general, you won’t be able to use a user’s access token against the Management API except for a very limited set of use cases due to security implications (see [public vs. confidential clients](https://auth0.com/docs/get-started/applications/confidential-and-public-applications)). A Management API access token when decoded will look something like:

 ![Screenshot 2024-04-23 at 5.19.14 PM](https://global.discourse-cdn.com/auth0/original/3X/d/4/d410dd9bce4934a507e841f1a6b971de37d3527b.png)

You’ll need to handle requesting a Management API access token on your backend as an entirely separate process to getting a user’s access token. For testing purposes, you can navigate to Applications → APIs → Management AP → Test and choose the relevant application. This will provide you with an example access token for the M2M app which you can use against the Management API to get a user’s roles.

This should help outline the idea at a high level:

[https://community.auth0.com/t/how-can-i-enable-users-to-change-their-email-address-from-a-spa-or-native-app/44064](https://community.auth0.com/t/how-can-i-enable-users-to-change-their-email-address-from-a-spa-or-native-app/44064)

Hope this helps!

---

<div class="post-metadata">

**Author:** ![o.d](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/o.d/32/54233_2.png) [@o.d](https://community.auth0.com/u/o.d)\
**Post date:** [April 24, 2024, 12:26pm UTC](https://community.auth0.com/t/how-to-specify-scopes-in-an-authorize-call/132388/6 "2024-04-24T12:26:07Z")

</div>

This solved my problem.

So, instead of using the “user access token” received in the OAuth callback, I had to use a “Management API access token”, which is obtained by calling the [get-token endpoint of the Authentication API](https://auth0.com/docs/api/authentication#get-token)

Thanks a lot for the help!

---

<div class="post-metadata">

**Author:** ![ty.frith](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/ty.frith/32/58484_2.png) [@ty.frith](https://community.auth0.com/u/ty.frith)\
**Post date:** [April 24, 2024, 3:52pm UTC](https://community.auth0.com/t/how-to-specify-scopes-in-an-authorize-call/132388/7 "2024-04-24T15:52:27Z")

</div>

No problem! Thanks for following up 🙂

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/auth0/original/3X/b/5/b560f266932fcce5d57f09a6595bd50518cae3f3.jpeg) [@system](https://community.auth0.com/u/system)\
**Post date:** [May 8, 2024, 3:53pm UTC](https://community.auth0.com/t/how-to-specify-scopes-in-an-authorize-call/132388/8 "2024-05-08T15:53:18Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.