Hi There,
I am currently following both the SPA+API tutorial (https://auth0.com/docs/architecture-scenarios/application/spa-api/part-3) and the golang getting started one. (Auth0 Go SDK Quickstarts: Login).
Ultimately, I’m working towards a SPA that can request specific urls from the api depending on scopes.
As stated in the SPA guide:
To access secured resources from your API, the authenticated user’s access_token needs to be included in requests that are sent to it. This is accomplished by sending the access_token in an Authorization header using the Bearer scheme.
I am therefore making a request as follows from my React App.
axios.get('/api/private-scoped', { headers: { Authorization:Bearer ${localStorage.getItem(‘access_token’)} } }).then(resp=>resp).catch(err=>err)
My api is a mimic of the one in the golang example, and my authorisation request was made with the request scopes to get a response.
However, I get this response from my api:
token contains an invalid number of segments
I believe this is because my access token is not a JWT but the golang example is trying to pull claims off of it. That aren’t there. If I try and send my id_token instead it gets a little further through the api call but then it doesn’t have any scopes on it at all.
I am clearly missing something but can’t find the documentation for what I am meant to do here. I would really appreciate any help.
thanks.