I am a little confused on best practices in dealing with API permissions. I understand that in the API within Auth0, I can configure it to always attach the permissions claim to the access token. I am confused because I was under the understanding that the spec defines the scopes claim as the place …

Auth0 introduced the TOKEN_DIALECT which helps to populate the scope with the requested permissions as long as the user has the required permission or the associated role. The rule isn’t necessary anymore to populate the scope unless the requirements are more complex and the out of the box behavior…

Permissions: claim or scopes

Get Help

system Closed September 21, 2019, 9:55pm 10

This topic was automatically closed 15 days after the last reply. New replies are no longer allowed.

Topic		Replies	Views
Scopes vs Permissions confusion Get Help	10	16150	December 8, 2020
RBAC permissions for SPA app and API Get Help rbac	1	5464	September 12, 2019
Why are scopes/permissions are duplicated in JWT tokens issued by Auth0? Get Help	2	599	April 29, 2024
Scopes vs API permissions Get Help security-question-concern , security-compliance	2	2044	April 6, 2023
Merge scope and permissions in scope in a rule Get Help rules	4	6181	April 1, 2020

Permissions: claim or scopes

Related topics