# Insufficient scope but JWT has correct scopes on Node

**URL:** <https://community.auth0.com/t/insufficient-scope-but-jwt-has-correct-scopes-on-node/24760>\
**Category:** Get Help\
**Created:** [May 2, 2019, 4:41pm UTC](https://community.auth0.com/t/insufficient-scope-but-jwt-has-correct-scopes-on-node/24760 "2019-05-02T16:41:30Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![weber93](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/weber93/32/22318_2.png) [@weber93](https://community.auth0.com/u/weber93)\
**Post date:** [May 2, 2019, 4:41pm UTC](https://community.auth0.com/t/insufficient-scope-but-jwt-has-correct-scopes-on-node/24760/1 "2019-05-02T16:41:30Z")

</div>

I double checked the access token, it has scopes. My code is directly from

> **[Protect Your Express.js API - Auth0 Docs](https://auth0.com/docs/quickstart/backend/nodejs)**
>
> This guide demonstrates how to protect Express.js API endpoints using JWT access tokens with the express-oauth2-jwt-bearer SDK.

The Private and Public Routes work as expected but my Scoped Route does not. I have checked the API permissions and they are there. Tried read:test as well as read:message.

 ![image](https://global.discourse-cdn.com/auth0/original/2X/a/a1504e1c6cdc6c4383d72f47ab17ad5ca8f03c23.png)

 ![image](https://global.discourse-cdn.com/auth0/original/2X/a/a3212d3657f2e6e46fa845438584dbad5d5d8ff1.png)

 ![image](https://global.discourse-cdn.com/auth0/original/2X/0/0ad35d29f84432ad9562b386fcff5d601da09eab.png)

 ![image](https://global.discourse-cdn.com/auth0/original/2X/b/bfbfaa6ba20d049791c1c444cbabd10ad061d669.png)

---

<div class="post-metadata">

**Author:** ![weber93](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/weber93/32/22318_2.png) [@weber93](https://community.auth0.com/u/weber93)\
**Post date:** [May 4, 2019, 10:00pm UTC](https://community.auth0.com/t/insufficient-scope-but-jwt-has-correct-scopes-on-node/24760/2 "2019-05-04T22:00:36Z")

</div>

Bumping since no ones answered my support ticket.

---

<div class="post-metadata">

**Author:** ![thameera](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/thameera/32/13430_2.png) [@thameera](https://community.auth0.com/u/thameera)\
**Post date:** [May 6, 2019, 5:16am UTC](https://community.auth0.com/t/insufficient-scope-but-jwt-has-correct-scopes-on-node/24760/3 "2019-05-06T05:16:00Z")

</div>

@weber93 Based on the screenshot, the scope seems to be in the `permissions` claim and not the `scope` claim in the access token. The quickstart expects it to be in `scope`.

Can you change the authorization request which you use to get the access token to include this scope? If you currently use something like `"scope": "openid"`, it should change to `"scope": "openid read:messages"`.

(I just responded to the support ticket as well)

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/auth0/original/3X/b/5/b560f266932fcce5d57f09a6595bd50518cae3f3.jpeg) [@system](https://community.auth0.com/u/system)\
**Post date:** [June 21, 2019, 5:15pm UTC](https://community.auth0.com/t/insufficient-scope-but-jwt-has-correct-scopes-on-node/24760/4 "2019-06-21T17:15:32Z")

</div>

This topic was automatically closed 15 days after the last reply. New replies are no longer allowed.