# Laravel middleware route Authorize Auth0

**URL:** <https://community.auth0.com/t/laravel-middleware-route-authorize-auth0/80776>\
**Category:** Get Help\
**Tags:** jwt, auth0\
**Created:** [March 30, 2022, 7:52am UTC](https://community.auth0.com/t/laravel-middleware-route-authorize-auth0/80776 "2022-03-30T07:52:37Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![corentin.couzigou](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/corentin.couzigou/32/34169_2.png) [@corentin.couzigou](https://community.auth0.com/u/corentin.couzigou)\
**Post date:** [March 30, 2022, 7:52am UTC](https://community.auth0.com/t/laravel-middleware-route-authorize-auth0/80776/1 "2022-03-30T07:52:37Z")

</div>

hello, I present to you the starting postulate:  
I made a front application in angular with the auth0 SDK. It returns a token with the interceptors to my back application in laravel. I made this api with also the auth0 SDK.  
I made a front application in angular with the auth0 SDK. It returns a token with the interceptors to my back application in laravel. I made this api with also the auth0 SDK.  
I then perform on my private route a verification of my token:

Route::get(‘/private/scoped/userslist’, [MainController::class, ‘getAllUsers’])-\>middleware([‘auth0.authorize:read:users’]);

End of my token acces :  
“scope”: “openid profile email”,  
“permissions”: [  
“read:users”  
]  
However, access is denied. I don’t really understand how authr0 middleware works and is it scalable? Thanks you for your help.

---

<div class="post-metadata">

**Author:** ![dan.woda](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/dan.woda/32/18340_2.png) [@dan.woda](https://community.auth0.com/u/dan.woda)\
**Post date:** [March 31, 2022, 3:21pm UTC](https://community.auth0.com/t/laravel-middleware-route-authorize-auth0/80776/3 "2022-03-31T15:21:15Z")

</div>

Hi @corentin.couzigou,

Welcome to the Auth0 Community!

It looks like the middleware may be expecting the `read:users` string in the `scope` claim. You can configure this by turning _off_ the \* **Add Permissions in the Access Token** \* toggle in the API settings.

Here is a link that shows how it would look in the dashboard. **Add Permissions in the Access Token**

Let me know if that resolves it!

---

<div class="post-metadata">

**Author:** ![dan.woda](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/dan.woda/32/18340_2.png) [@dan.woda](https://community.auth0.com/u/dan.woda)\
**Post date:** [April 21, 2022, 11:58pm UTC](https://community.auth0.com/t/laravel-middleware-route-authorize-auth0/80776/4 "2022-04-21T23:58:47Z")

</div>