# Permissions in JWT always empty

**URL:** <https://community.auth0.com/t/permissions-in-jwt-always-empty/65113>\
**Category:** Get Help\
**Tags:** jwt\
**Created:** [June 26, 2021, 4:11am UTC](https://community.auth0.com/t/permissions-in-jwt-always-empty/65113 "2021-06-26T04:11:38Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![pinalto](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/pinalto/32/25478_2.png) [@pinalto](https://community.auth0.com/u/pinalto)\
**Post date:** [June 26, 2021, 4:11am UTC](https://community.auth0.com/t/permissions-in-jwt-always-empty/65113/1 "2021-06-26T04:11:38Z")

</div>

Hi there,  
i’m trying to secure my API with RBAC.

On Auth0 dashboard i’ve created an Web-App and an API, authorize the App to use this API,  
added some permissions to the API and enabled RBAC Setting,  
 ![image](https://global.discourse-cdn.com/auth0/original/3X/1/c/1c8eea00b97ce6fefd7b9a46e410af6d0e0a0f0e.png)  
created a role with a permission of the API,  
assigned this role to a user,  
logged in to the App with this user.  
As this App retrieved a token for this API from endpoint /oauth/token with params:

```auto
{
  "client_id":"<app-id>",
  "client_secret":"<app-secret>",
  "audience":"https://test.app/api/test",
  "grant_type":"client_credentials"
}

```

, the permissions claim of the returned JWT is empty. What is wrong or is any configuration missing?

The JWT is like this:

```auto
{
  "alg": "RS256",
  "typ": "JWT",
  "kid": " ********"

  "iss": "https://***.auth0.com/",
  "sub": " ************** @clients",
  "aud": "https://test.app/api/test",
  "iat": 1624679108,
  "exp": 1624679168,
  "azp": " **************",
  "gty": "client-credentials",
  "permissions": []
}

```

---

<div class="post-metadata">

**Author:** ![dan.woda](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/dan.woda/32/18340_2.png) [@dan.woda](https://community.auth0.com/u/dan.woda)\
**Post date:** [June 28, 2021, 7:54pm UTC](https://community.auth0.com/t/permissions-in-jwt-always-empty/65113/3 "2021-06-28T19:54:26Z")

</div>

Hi @pinalto,

Welcome to the Community!

When you request a token with the _client credentials grant_, you are not requesting the token on behalf of a user. That grant is used for machine-to-machine (M2M) access.

To get the permissions associated with the user’s roles in the token, you will need to log in as the user. Try logging in as the user with [one of our sample apps](https://auth0.com/docs/quickstarts).

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/auth0/original/3X/b/5/b560f266932fcce5d57f09a6595bd50518cae3f3.jpeg) [@system](https://community.auth0.com/u/system)\
**Post date:** [July 13, 2021, 7:55pm UTC](https://community.auth0.com/t/permissions-in-jwt-always-empty/65113/4 "2021-07-13T19:55:00Z")

</div>

This topic was automatically closed 15 days after the last reply. New replies are no longer allowed.