# How to use express-oauth2-jwt-bearer with Apollo-server and graphql?

**URL:** <https://community.auth0.com/t/how-to-use-express-oauth2-jwt-bearer-with-apollo-server-and-graphql/85966>\
**Category:** Get Help\
**Tags:** nodejs, graphql, express\
**Created:** [June 27, 2022, 8:53am UTC](https://community.auth0.com/t/how-to-use-express-oauth2-jwt-bearer-with-apollo-server-and-graphql/85966 "2022-06-27T08:53:53Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![marclovesjazz](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/marclovesjazz/32/33197_2.png) [@marclovesjazz](https://community.auth0.com/u/marclovesjazz)\
**Post date:** [June 27, 2022, 8:53am UTC](https://community.auth0.com/t/how-to-use-express-oauth2-jwt-bearer-with-apollo-server-and-graphql/85966/1 "2022-06-27T08:53:53Z")

</div>

Hi,

I want to secure my API server (nodejs/apollo-server-express 3.x/graphql) and tried to use the recently published express-oauth2-jwt-bearer SDK from Auth0.  
Authentication seems to be working fine but when it comes to authorization, which has to be done on the resolver level, I don’t know how to do this. The library has e.g. a requiredScopes handler but how and where can I use this?  
The tutorial only mentions the usual REST API, but doesn’t mention a graphql solution. Would be great if such an example would be added to the tutorial!

Thanks for any hints or solutions!

---

<div class="post-metadata">

**Author:** ![brett2](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/brett2/32/22642_2.png) [@brett2](https://community.auth0.com/u/brett2)\
**Post date:** [June 30, 2022, 7:09pm UTC](https://community.auth0.com/t/how-to-use-express-oauth2-jwt-bearer-with-apollo-server-and-graphql/85966/2 "2022-06-30T19:09:48Z")

</div>

We put our rolls and permissions in user context, read from the request when it comes in and use that at the resolver level where it is accessible

`property: (parent, args, context, info) =\> {},

one resource: [Authentication and authorization - Apollo GraphQL Docs](https://www.apollographql.com/docs/apollo-server/security/authentication/)  
[Resolvers - Apollo GraphQL Docs](https://www.apollographql.com/docs/apollo-server/data/resolvers/)

---

<div class="post-metadata">

**Author:** ![marclovesjazz](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/marclovesjazz/32/33197_2.png) [@marclovesjazz](https://community.auth0.com/u/marclovesjazz)\
**Post date:** [July 1, 2022, 9:24am UTC](https://community.auth0.com/t/how-to-use-express-oauth2-jwt-bearer-with-apollo-server-and-graphql/85966/3 "2022-07-01T09:24:33Z")

</div>

Thanks brett2,  
I was already looking at this solution and this confirms it’s ok! 😉

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/auth0/original/3X/b/5/b560f266932fcce5d57f09a6595bd50518cae3f3.jpeg) [@system](https://community.auth0.com/u/system)\
**Post date:** [November 14, 2024, 12:30am UTC](https://community.auth0.com/t/how-to-use-express-oauth2-jwt-bearer-with-apollo-server-and-graphql/85966/4 "2024-11-14T00:30:38Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.