Is the only way to obtain a Management API token via copy and paste?

[tyf]

Hello @robliou01!

@robliou01

Upon further research, it would appear that for SPA’s, Auth0 has put a strict limitation on the Management API. Essentially, it can only be obtained manually and then copied and pasted afterward!

There are indeed limitations on how a SPA can use the Management API, but that is primarily just that it’s limited to certain scopes related to the currently logged in user.

It’s hard to know exactly what could be going on in your specific case, but I’ve found the following topic to be super helpful in outlining the options available in this scenario:

Calling management API to update user meta data from SPA

Glad to hear it is working for you! An alternative approach would be to handle the calls to the Management API in your backend. You would register your API as a custom API and use its identifier as the audience in the SPA. You would then create a Machine-to-Machine application for your backend and authorize it to use the Management API. Your backend could use one of the Auth0 SDKs to validate the Access Token and return data from the Management API for the SPA. That way any Access Tokens for th…