# NextJs Auth0 - getAccessToken M2M Quota Limits?

**URL:** <https://community.auth0.com/t/nextjs-auth0-getaccesstoken-m2m-quota-limits/84736>\
**Category:** Get Help\
**Tags:** m2m, jwt, nextjs, auth0\
**Created:** [June 7, 2022, 2:05pm UTC](https://community.auth0.com/t/nextjs-auth0-getaccesstoken-m2m-quota-limits/84736 "2022-06-07T14:05:44Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![stefano.brandoli23](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/stefano.brandoli23/32/37863_2.png) [@stefano.brandoli23](https://community.auth0.com/u/stefano.brandoli23)\
**Post date:** [June 7, 2022, 2:05pm UTC](https://community.auth0.com/t/nextjs-auth0-getaccesstoken-m2m-quota-limits/84736/1 "2022-06-07T14:05:44Z")

</div>

- **Which SDK this is regarding:** “@auth0/nextjs-auth0”: “1.9.0”

Hi there,  
I’m setting up a NextJs application that will use Auth0 to login/signup, social logins included.  
This app needs to call our backend with information about the logged user.

I’m following the example provided to setup a **Next Js Regular web application** from the Auth0 Dashboard.

In particular I’m interesting in the following:  
[https://github.com/auth0/nextjs-auth0/blob/main/EXAMPLES.md#access-an-external-api-from-an-api-route](https://github.com/auth0/nextjs-auth0/blob/main/EXAMPLES.md#access-an-external-api-from-an-api-route)

After the user succesfully logs in, I can see the nextjs-auth0 SDK creates an `appSession` cookie, which is encripted.

I managed to get an `accessToken` (JWT) from the appSession using the following example:

```auto
export default withApiAuthRequired(async function products(req, res) {
  // If your Access Token is expired and you have a Refresh Token
  // `getAccessToken` will fetch you a new one using the `refresh_token` grant
  const { accessToken } = await getAccessToken(req, res, {
    scopes: ['read:products']
  });
  const response = await fetch('https://api.example.com/products', {
    headers: {
      Authorization: `Bearer ${accessToken}`
    }
  });
  const products = await response.json();
  res.status(200).json(products);
});

```

I need to have the access token to call our backend APIs with information about the logged user identity.

My questions are the following:

1. If I use **as Audience** the default **Auth0 Management API** under Dashboard → Applications → APIs, and call `getAccessToken` as above, will this result in a consumption of **M2M Token Quota limits**?  
My understanding is that it should not, since the accessToken returned is related to the user.  
In particular I am referring to [Pricing](https://auth0.com/pricing) → Compare Plans, which links to the following documentation for **M2M Token Quota** ([Client Credentials Flow](https://auth0.com/docs/get-started/authentication-and-authorization-flow/client-credentials-flow))

2. Same question as 1), what happens if instead of using the default **Auth0 Management API** , **I use as Audience a custom API** created under Dashboard → Applications → APIs? M2M Quota limits are impacted by the call to `getAccessToken`?

3. The same example in the NextJsAuth0 SDK refers to refresh tokens. In particular, if `offline_access` is provided as scope, it seems I can get a refresh token with the access token.  
(as read here: [add support for refresh token · Issue #4 · auth0/nextjs-auth0 · GitHub](https://github.com/auth0/nextjs-auth0/issues/4)). By calling `getAccessToken` with `refresh: true`, the code states the following:

```auto
/**
   * If set to true, a new Access Token will be requested with the Refresh Token grant, regardless of whether
   * the Access Token has expired or not.
   */
  refresh?: boolean

```

The question also in this case is: by using getAppSession with `refresh: true` (refresh tokens), I am impacting M2M Quota limits?

Hope to have some clarifications/reply soon.  
Have a nice day

---

<div class="post-metadata">

**Author:** ![b.abakzahedi7141](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/b.abakzahedi7141/32/34072_2.png) [@b.abakzahedi7141](https://community.auth0.com/u/b.abakzahedi7141)\
**Post date:** [June 9, 2022, 5:14am UTC](https://community.auth0.com/t/nextjs-auth0-getaccesstoken-m2m-quota-limits/84736/2 "2022-06-09T05:14:25Z")

</div>

I value and respect your opinion[!](https://my-accountaccess.com/)

---

<div class="post-metadata">

**Author:** ![stefano.brandoli23](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/stefano.brandoli23/32/37863_2.png) [@stefano.brandoli23](https://community.auth0.com/u/stefano.brandoli23)\
**Post date:** [June 9, 2022, 8:44am UTC](https://community.auth0.com/t/nextjs-auth0-getaccesstoken-m2m-quota-limits/84736/3 "2022-06-09T08:44:48Z")

</div>

I’ve digged more into the question.

What I’ve found is this [https://community.auth0.com/t/get-details-of-authentication-calls/38981/2](https://community.auth0.com/t/get-details-of-authentication-calls/38981/2).

Basically M2M calls that are accounted in the quota should be those marked in the logs as `seccft` events (Client credentials exchange).  
It seems also that M2M token quota is impacted only by Client Credentials exchanges that are not related to the user (access tokens related to social logins, standard logins should be excluded).

From the logs I see in my dashboard, after a successful login on my NextJs website and the retrieval of an access token using `getAccessToken`, the following events appear in the log:

1. event of type “s”: Successful login
2. event of “type”: “seacft” → “description”: “Authorization Code for Access Token”

My understanding thus is that getAccessToken for the logged user does not count for the M2M Quota.  
Anyhow, I would like a confirmation about this from the Auth0 Team.

Have a nice day

---

<div class="post-metadata">

**Author:** ![ty.frith](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/ty.frith/32/58484_2.png) [@ty.frith](https://community.auth0.com/u/ty.frith)\
**Post date:** [June 10, 2022, 12:15am UTC](https://community.auth0.com/t/nextjs-auth0-getaccesstoken-m2m-quota-limits/84736/5 "2022-06-10T00:15:50Z")

</div>

Hi there @stefano.brandoli23 welcome to the community and thanks for following up with your findings!

> [@stefano.brandoli23](#):
>
> It seems also that M2M token quota is impacted only by Client Credentials exchanges that are not related to the user (access tokens related to social logins, standard logins should be excluded).

This is correct M2M (machine to machine) tokens and thus the quota are only related to M2M apps/tokens where there is no user involved.

> [@stefano.brandoli23](#):
>
> My understanding thus is that getAccessToken for the logged user does not count for the M2M Quota.

This is correct - These types of access tokens do not apply towards the M2M quota, and neither do management API tokens. Some more on that here:

[https://community.auth0.com/t/do-management-api-tokens-count-towards-my-m2m-token-quota/43822](https://community.auth0.com/t/do-management-api-tokens-count-towards-my-m2m-token-quota/43822)

Hope this helps!

---

<div class="post-metadata">

**Author:** ![ty.frith](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/ty.frith/32/58484_2.png) [@ty.frith](https://community.auth0.com/u/ty.frith)\
**Post date:** [June 25, 2022, 12:16am UTC](https://community.auth0.com/t/nextjs-auth0-getaccesstoken-m2m-quota-limits/84736/6 "2022-06-25T00:16:40Z")

</div>

This topic was automatically closed 15 days after the last reply. New replies are no longer allowed.