# Multiple Auth0 APIs **URL:** \ **Category:** Get Help\ **Tags:** api, machine-to-machine\ **Created:** [September 29, 2021, 12:32am UTC](https://community.auth0.com/t/multiple-auth0-apis/70449 "2021-09-29T00:32:02Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![mmbmf1](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/mmbmf1/32/26154_2.png) [@mmbmf1](https://community.auth0.com/u/mmbmf1)\ **Post date:** [September 29, 2021, 12:32am UTC](https://community.auth0.com/t/multiple-auth0-apis/70449/1 "2021-09-29T00:32:02Z")
Hello, I have a single Auth0 application that will be assigned scopes when requesting an access token. The machines requesting this token will _all_ use the _same_ client id and secret from the application. The only difference is the Auth0 API audience - there will be a different Auth0 API for each machine requesting the token. Is this the proper way to assign scopes on the access token? Or, should each machine use a different Auth0 application (with different client ids and secrets) and be granted an access token using a single Auth0 API (audience)? Is one more secure than the other? ---
**Author:** ![john.gateley](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/john.gateley/32/10879_2.png) [@john.gateley](https://community.auth0.com/u/john.gateley)\ **Post date:** [September 29, 2021, 1:44pm UTC](https://community.auth0.com/t/multiple-auth0-apis/70449/2 "2021-09-29T13:44:23Z")
Hi @mmbmf1 I need a different type of info to help with this. You are providing the implementation details. But I need the overall use case. What does a machine represent? Is there a user involved? What happens if one machine tries to impersonate another? John ---
**Author:** ![mmbmf1](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/mmbmf1/32/26154_2.png) [@mmbmf1](https://community.auth0.com/u/mmbmf1)\ **Post date:** [September 29, 2021, 2:22pm UTC](https://community.auth0.com/t/multiple-auth0-apis/70449/3 "2021-09-29T14:22:26Z")
Hi, @john.gateley thanks for reaching out. A machine, in this case, represents a customer using their API to request an access token to hit our endpoint. There are multiple customers that would need a token with different scopes. There are no users that would login. > What happens if one machine tries to impersonate another? Not exactly sure what you mean, but I think this is what I am asking. If each customer have the same client id and client secret, and only a unique audience when requesting a token, would it be easier for impersonation? Thanks again! ---
**Author:** ![john.gateley](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/john.gateley/32/10879_2.png) [@john.gateley](https://community.auth0.com/u/john.gateley)\ **Post date:** [September 30, 2021, 2:28pm UTC](https://community.auth0.com/t/multiple-auth0-apis/70449/4 "2021-09-30T14:28:39Z")
Hi @mmbmf1 So, with no users to log in, this is the client credentials flow. Instead of scopes, each of your customers need their own client credentials application, which gives them their own client ID and secret. You should NOT have customers sharing client IDs and secrets. John ---
**Author:** ![mmbmf1](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/mmbmf1/32/26154_2.png) [@mmbmf1](https://community.auth0.com/u/mmbmf1)\ **Post date:** [September 30, 2021, 3:51pm UTC](https://community.auth0.com/t/multiple-auth0-apis/70449/5 "2021-09-30T15:51:03Z")
Hey @john.gateley, Thanks for the follow-up and clarification! ---
**Author:** ![konrad.sopala](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/konrad.sopala/32/13516_2.png) [@konrad.sopala](https://community.auth0.com/u/konrad.sopala)\ **Post date:** [October 6, 2021, 11:55am UTC](https://community.auth0.com/t/multiple-auth0-apis/70449/6 "2021-10-06T11:55:28Z")
We are here for you! ---
**Author:** ![konrad.sopala](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/konrad.sopala/32/13516_2.png) [@konrad.sopala](https://community.auth0.com/u/konrad.sopala)\ **Post date:** [October 6, 2021, 11:55am UTC](https://community.auth0.com/t/multiple-auth0-apis/70449/7 "2021-10-06T11:55:30Z")