Is it safe to only use React with Auth0?

There are a few ways to get information in your backend API.

First, you can send data inside of the token. Access tokens have a bit of user information in them by default, and you can add Custom Claims if you want to keep everything in the token.

You can also exchange an Access Token for the user’s profile via the userinfo endpoint.

Finally, you could send this info in a request from your front end, with an access token in the header to prove the request is legitimate.

Typically, the front end will send the access token with a request for a user’s data, and the backend will use the user’s ID (stored in the token as the sub claim) to retrieve the data from a database, and will respond with the requested data or deny the request.