Merge scope and permissions in scope in a rule

[mathiasconradt]

Related, however I’m marking Nicolas answer as solution for now, since it solved the OP problem:

Permissions: claim or scopes

I am a little confused on best practices in dealing with API permissions. I understand that in the API within Auth0, I can configure it to always attach the permissions claim to the access token. I am confused because I was under the understanding that the spec defines the scopes claim as the place to define a users permissions. My objective is to have the permissions always included in the access token. I would think you ca achieve this with a rule to automatically add them (although it looks …

How can I get permissions into my scope in the access token?

I am using an AWS HTTP API with a JWT Authorizer. The JWT Authorizer can check the “scope” part of the access token to allow execution of the HTTP API endpoint. The scopes defined in the authorizer check the “scope” portion of the access token - if it finds the scope in the access token it allows the client to executed the endpoint. My Auth0 user has a set of permissions - are they “scopes”? It’s not clear, but these permissions do show up in the access token as an array in the “permissions” pa…