Management API get token throws "User is not authorized to the audience for those scopes"

[shahzad.adil]

I have to call the Management API from one of our services. The first question is, can we use password grant to get tokens for Management API?
Though I have been successful in authenticating and getting token back for Management API using password credentials, I have used the client id and client secret from a regular Web Application and not an M2M account. But when I try to get the access token with “read:users” scope using a username/password and client id/secret from the Web App, it throws User is not authorized to the audience for those scopes
I am not sure why is that. In the dashboard I can see that the Management API has the necessary access to the Web App and scopes under that.

[karen.bermudez]

Hello @shahzad.adil!

You can use password grant to get tokens for Management API ONLY from a highly-trusted application, that can not do redirects.

About:

@shahzad.adil

But when I try to get the access token with “read:users” scope using a username/password and client id/secret from the Web App, it throws User is not authorized to the audience for those scopes

Have you tried configuring the Application to be able to access the Management API scopes?

If you haven’t, you can try going to your Dashboard > APIs > Select the Management API > Machine to Machine Applications > look for the desired application and turn the toggle on > you will be able to select the needed scopes and update it.

Thank you!

[shahzad.adil]

Hey @karen.bermudez,
As stated above, I am able to get a token. And the Application is also authorized to access the API with all the necessary scopes.

But I am still facing this issue.

And how does Auth0 detect for the app being a highly-trusted application?

[karen.bermudez]

Hello!

Could you please send me a screenshot of your authorized application?

Thanks in advance!

[shahzad.adil]

@karen.bermudez Please find the screenshots below showing the UI App and the API with access to the app

[karen.bermudez]

Hello!

Are you still having this issue?

Thanks!

[mathiasconradt]

Please see my comment in this thread, it’s very similar:

Both spa and auth.js SDKs in a React app

Ok, I see. So, you just want to update user_metadata, none of the root attributes (email, name, etc.). Available scopes are limited as per your linked docs You can ask for the following scopes: read:current_user update:current_user_identities create:current_user_metadata update:current_user_metadata delete:current_user_metadata … so, for example, scope update:users isn’t. Yes, I guess then it should be possible. TBH I haven’t tested it out myself yet with the older Auth0.js. but wit…

But when I try to get the access token with “read:users” scope using a username/password and client id/secret from the Web App

Can you specify which grant type (Authorization Code Grant, Resource Owner Password Grant, etc.) you’re using?

If you’re not using Client Credentials Grant (M2M) but requesting it on behalf of a user, which I assume, the scopes you can request are limited, as per my linked thread above.