Need urgent help. Proxy a request

[benjamin203]

I need to let the users of my SPA change their metadata. But it is not reccomended to store Access API Token on the front end. In the following post: SPA - User update own user metadata

A response said the following could be an alternative:

“Alternatively, you can proxy the request in your own API. You would set up a machine-to-machine application for your API so that it could obtain an Access Token from the Management API using the client credentials grant.”

Can someone please specify how to go about this? There is no tutorial or resource.

[tyf]

Hi there @benjamin203!

@benjamin203

Can someone please specify how to go about this? There is no tutorial or resource

While I’m unaware of a step by step guide for this specific use case, however this post outlines what you are looking for:

Calling management API to update user meta data from SPA

Glad to hear it is working for you! An alternative approach would be to handle the calls to the Management API in your backend. You would register your API as a custom API and use its identifier as the audience in the SPA. You would then create a Machine-to-Machine application for your backend and authorize it to use the Management API. Your backend could use one of the Auth0 SDKs to validate the Access Token and return data from the Management API for the SPA. That way any Access Tokens for th…

Some more resources that may be helpful:

Register Machine-to-Machine Applications

Solution Overview (Server Apps + API)

Using Machine to Machine (M2M) Authorization

Hope this helps at least get you going in the right direction!