# Next.js API Routes RBAC **URL:** \ **Category:** Get Help\ **Tags:** nextjs\ **Created:** [June 20, 2022, 5:47pm UTC](https://community.auth0.com/t/next-js-api-routes-rbac/85540 "2022-06-20T17:47:05Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![valentin.vad.sh](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/valentin.vad.sh/32/38223_2.png) [@valentin.vad.sh](https://community.auth0.com/u/valentin.vad.sh)\ **Post date:** [June 20, 2022, 5:47pm UTC](https://community.auth0.com/t/next-js-api-routes-rbac/85540/1 "2022-06-20T17:47:06Z")
How to handle Roles and Permissions using Next.js API Routes? How to decode authToken or what is best practice to get user roles / permissions ? [jwt.io](http://jwt.io) says it is A256GCM encryption, and I am not sure what is the key to decrypt it ---
**Author:** ![dan.woda](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/dan.woda/32/18340_2.png) [@dan.woda](https://community.auth0.com/u/dan.woda)\ **Post date:** [June 27, 2022, 5:33pm UTC](https://community.auth0.com/t/next-js-api-routes-rbac/85540/3 "2022-06-27T17:33:52Z")
Hi @valentin.vad.sh, Welcome to the Auth0 Community! You are seeing an opaque token because you are not passing an audience parameter. More on that here: [Why is my access token not a JWT? (Opaque Token)](https://community.auth0.com/t/why-is-my-access-token-not-a-jwt-opaque-token/31028) As for RBAC; you can add the user’s roles to the token. There is an example here: > **[Login Flow](https://auth0.com/docs/customize/actions/flows-and-triggers/login-flow#add-user-roles-to-id-and-access-tokens)** > > Learn about the Actions Login Flow and the post-login Action trigger, which is executed after a user logs in and when a Refresh Token is requested. ---
**Author:** ![konrad.sopala](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/konrad.sopala/32/13516_2.png) [@konrad.sopala](https://community.auth0.com/u/konrad.sopala)\ **Post date:** [December 22, 2022, 9:26am UTC](https://community.auth0.com/t/next-js-api-routes-rbac/85540/4 "2022-12-22T09:26:09Z")