Nextjs-auth0 read:users not being returning in access token

[daniel.vinihan]

• Which SDK this is regarding: e.g. auth0-node
• SDK Version: e.g. 2.29.0
• Platform Version: e.g. Node 12.19.0
• Code Snippets/Error Messages/Supporting Details/Screenshots:

I’m using the @auth0/nextjs-auth0 library, and despite having poured over the docs and forum topics, I cannot get my Nextjs app to retrieve an access token with the read:users scope granted.

I believe I’ve configured my app as described in the docs, and I’ve added the read:users scope to my Auth0 Management API on the Auth0 dashboard. I’ve even tried adding an AUTH0_AUDIENCE (although I’m still not sure if that’s needed?).

Does anyone have any advice on what I might possibly be doing wrong?
I have the following configured in my .env.local:

AUTH0_SECRET=<secret>
AUTH0_BASE_URL=http://localhost:3000
AUTH0_ISSUER_BASE_URL=https://<my url>.us.auth0.com
AUTH0_CLIENT_ID=<client id>
AUTH0_CLIENT_SECRET=<secret>
AUTH0_AUDIENCE=<identifier from Auth0 dashboard>

And in pages/api/auth/[…auth0].ts, I have this:

import { handleAuth, handleLogin } from '@auth0/nextjs-auth0';
import { NextApiRequest, NextApiResponse } from 'next';

export default handleAuth({
  login: async (req: NextApiRequest, res: NextApiResponse) => {
    try {
      await handleLogin(req, res, {
        authorizationParams: {
          audience: process.env.AUTH0_AUDIENCE,
          scope: 'openid profile email read:users',
        },
      });
    } catch (error) {
      res.status(error.status || 400).end(error.message);
    }
  },
});

I’ve even tried specifically requesting the scope when I get the access token that I will use for the management API call:

  const { accessToken } = await getAccessToken(req, res, {
    scopes: ['read:users'],
  });

Any help or guidance would be appreciated!

[dan.woda]

Hi @daniel.vinihan,

Welcome to the Auth0 Community!

The next js SDK is not meant to be a Management API client. You can get management API tokens with limited scopes, but will want to use the node-auth0 management client with a client credentials grant to get a management API token.

There is an example in this doc that includes how to do it:

Get Management API Access Tokens for Production

[daniel.vinihan]

Thanks Dan. I did eventually figure this out on my own. I had assumed the nextjs-auth0 library would handle this, when in fact it did not- and there was my mistake. Thank you!

[dan.woda]

Great. Thanks for following up!