# Management API with SPA + custom API **URL:** \ **Category:** Get Help\ **Tags:** client-grants, management-api\ **Created:** [August 16, 2023, 5:26am UTC](https://community.auth0.com/t/management-api-with-spa-custom-api/113724 "2023-08-16T05:26:53Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![chinmay.pant](https://upload.wikimedia.org/wikipedia/commons/thumb/7/7c/User_font_awesome.svg/768px-User_font_awesome.svg.png) [@chinmay.pant](https://community.auth0.com/u/chinmay.pant)\ **Post date:** [August 16, 2023, 5:26am UTC](https://community.auth0.com/t/management-api-with-spa-custom-api/113724/1 "2023-08-16T05:26:53Z")
I am using React for my frontend and Node.js for my Backend On frontend, I have protected routes based on the roles of the User. To get the roles, I need to call the management API and with SPA I need to do this from backend to prevent my credentials from leaking. In my Node backend, I want to get access tokens for management API but I cant use client\_credentials method as my application is SPA and not Machine to Machine. How can I get Management API Access Tokens from backend? ---
**Author:** ![ty.frith](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/ty.frith/32/58484_2.png) [@ty.frith](https://community.auth0.com/u/ty.frith)\ **Post date:** [August 17, 2023, 12:48am UTC](https://community.auth0.com/t/management-api-with-spa-custom-api/113724/3 "2023-08-17T00:48:07Z")
Hey there @chinmay.pant ! > [@chinmay.pant](#): > > To get the roles, I need to call the management API and with SPA I need to do this from backend to prevent my credentials from leaking. Have you considered [adding roles to tokens](https://community.auth0.com/t/how-to-add-roles-and-permissions-to-the-id-token-using-actions/84506)? This is the standard approach. > [@chinmay.pant](#): > > In my Node backend, I want to get access tokens for management API but I cant use client\_credentials method as my application is SPA and not Machine to Machine. > > How can I get Management API Access Tokens from backend? You _should_ be able to store client credentials safely in a node backend - Typically, any action using the Management API (except for a [limited set of options](https://auth0.com/docs/secure/tokens/access-tokens/get-management-api-tokens-for-single-page-applications)) from a SPA should be proxied through a backend as outlined in the following FAQ: [https://community.auth0.com/t/how-can-i-enable-users-to-change-their-email-address-from-a-spa-or-native-app/44064](https://community.auth0.com/t/how-can-i-enable-users-to-change-their-email-address-from-a-spa-or-native-app/44064) Auth0 offers a Node Management Client [library](https://github.com/auth0/node-auth0) handle getting, storing and using Management API access tokens. Hope this helps! ---
**Author:** ![chinmay.pant](https://upload.wikimedia.org/wikipedia/commons/thumb/7/7c/User_font_awesome.svg/768px-User_font_awesome.svg.png) [@chinmay.pant](https://community.auth0.com/u/chinmay.pant)\ **Post date:** [August 17, 2023, 10:36am UTC](https://community.auth0.com/t/management-api-with-spa-custom-api/113724/4 "2023-08-17T10:36:32Z")
Thanks @ty.frith. From the references you shared, I just figured out that the backend and frontend needn’t share the same application. I created another M2M application for backend and configured through it. Its working like a charm now. Just one more advice I needed, should I get a new access token for every request? Or I should use the fetched token until it expires? ---
**Author:** ![ty.frith](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/ty.frith/32/58484_2.png) [@ty.frith](https://community.auth0.com/u/ty.frith)\ **Post date:** [August 17, 2023, 10:16pm UTC](https://community.auth0.com/t/management-api-with-spa-custom-api/113724/5 "2023-08-17T22:16:54Z")
No problem, I’m happy to help! > [@chinmay.pant](#): > > I created another M2M application for backend and configured through it. Its working like a charm now. This is great news! > [@chinmay.pant](#): > > Just one more advice I needed, should I get a new access token for every request? > Or I should use the fetched token until it expires? You should definitely use the same token until it’s expired and you need to request a new one. Hope this helps! ---
**Author:** ![system](https://global.discourse-cdn.com/auth0/original/3X/b/5/b560f266932fcce5d57f09a6595bd50518cae3f3.jpeg) [@system](https://community.auth0.com/u/system)\ **Post date:** [August 31, 2023, 10:17pm UTC](https://community.auth0.com/t/management-api-with-spa-custom-api/113724/6 "2023-08-31T22:17:15Z")
This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.