# Id Token vs Access Token

**URL:** <https://community.auth0.com/t/id-token-vs-access-token/76821>\
**Category:** Get Help\
**Tags:** token, id\_token, access-token, auth0, login\
**Created:** [January 21, 2022, 4:24pm UTC](https://community.auth0.com/t/id-token-vs-access-token/76821 "2022-01-21T16:24:17Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![kris.macgillivray](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/kris.macgillivray/32/33436_2.png) [@kris.macgillivray](https://community.auth0.com/u/kris.macgillivray)\
**Post date:** [January 21, 2022, 4:24pm UTC](https://community.auth0.com/t/id-token-vs-access-token/76821/1 "2022-01-21T16:24:17Z")

</div>

Trying to understand where to use Access Token vs ID token.

Auth0 is setup as the SP for on Application. We have configured a SAML connection to our IDp (which is connected to our Internal Active Directory).

The internal users will have certain defined roles in the application which we are passing as attributes to Auth0 via the saml connection. (Depending on the Active Directory Groups they are a member of)

We are adding the roles via rules in Auth0 to during authentication.

Should these roles be part of the Access Token, ID Token, both ?

---

<div class="post-metadata">

**Author:** ![sgo](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/sgo/32/13789_2.png) [@sgo](https://community.auth0.com/u/sgo)\
**Post date:** [January 21, 2022, 4:59pm UTC](https://community.auth0.com/t/id-token-vs-access-token/76821/2 "2022-01-21T16:59:46Z")

</div>

Hi @kris.macgillivray ,

[ID Tokens](https://auth0.com/docs/secure/tokens/id-tokens) should never be used to obtain direct access to APIs or to make authorization decisions. Therefore I would recommend putting the role information into your [Access Tokens](https://auth0.com/docs/secure/tokens/access-tokens).

Any actual decisions made with respect to a user’s roles should be done from the information in the Access Token. Think of an ID token as a cache for the user’s profile, useful for populating a UI with their name etc, but not to be used for any authorization purposes.

---

<div class="post-metadata">

**Author:** ![dmytro.demakov](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/dmytro.demakov/32/34723_2.png) [@dmytro.demakov](https://community.auth0.com/u/dmytro.demakov)\
**Post date:** [January 27, 2022, 1:56pm UTC](https://community.auth0.com/t/id-token-vs-access-token/76821/3 "2022-01-27T13:56:29Z")

</div>

Just wondered yesterday 🙂  
Found this video extra helpful [ID Tokens vs Access Tokens - Do you know the difference?! - YouTube](https://www.youtube.com/watch?v=M4JIvUIE17c)

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/auth0/original/3X/b/5/b560f266932fcce5d57f09a6595bd50518cae3f3.jpeg) [@system](https://community.auth0.com/u/system)\
**Post date:** [February 11, 2022, 1:57pm UTC](https://community.auth0.com/t/id-token-vs-access-token/76821/4 "2022-02-11T13:57:01Z")

</div>

This topic was automatically closed 15 days after the last reply. New replies are no longer allowed.