Management API with SPA + custom API

[tyf]

Hey there @chinmay.pant !

@chinmay.pant

To get the roles, I need to call the management API and with SPA I need to do this from backend to prevent my credentials from leaking.

Have you considered adding roles to tokens? This is the standard approach.

@chinmay.pant

In my Node backend, I want to get access tokens for management API but I cant use client_credentials method as my application is SPA and not Machine to Machine.

How can I get Management API Access Tokens from backend?

You should be able to store client credentials safely in a node backend - Typically, any action using the Management API (except for a limited set of options) from a SPA should be proxied through a backend as outlined in the following FAQ:

How can I enable users to change their email address from a SPA or native app?

Question: How can I enable users to change their email address from a SPA or native app? Answer: Public clients (like SPAs and native applications) are restricted from requesting tokens for the management API with the proper scopes for updating a user’s email. These types of applications are limited to a few specific scopes. Because of these limitations, email change requests from public clients must flow through a backend or proxy API. This could be a serverless function with the sole purpose…

Auth0 offers a Node Management Client library handle getting, storing and using Management API access tokens.

Hope this helps!