# Refresh Token does not include org and permission **URL:** \ **Category:** Get Help\ **Tags:** refresh-token-rotate, refresh-tokens, auth0\ **Created:** [January 6, 2022, 4:01pm UTC](https://community.auth0.com/t/refresh-token-does-not-include-org-and-permission/75924 "2022-01-06T16:01:22Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![ralemy](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/ralemy/32/34236_2.png) [@ralemy](https://community.auth0.com/u/ralemy)\ **Post date:** [January 6, 2022, 4:01pm UTC](https://community.auth0.com/t/refresh-token-does-not-include-org-and-permission/75924/1 "2022-01-06T16:01:22Z")
In a React-Express node application, I have refresh-token rotation enabled ```auto useRefreshTokens={true} cacheLocation="localstorage" scope="offline_access" ``` everything works, except that when I don’t use refresh tokens, my claim contains org\_id and permissions, but when I do, the claim does not contain any of those: Without refresh-token rotation I get: ```auto tokenClaims { iss: 'https://xxxxxxx.xx.auth0.com/', sub: 'auth0|61b7a9402cxxxxxxxxx', aud: ['xxxxxx-api', 'https://xxxxxxx.auth0.com/userinfo'], iat: 1641422999, exp: 1641509399, azp: 'lBYPRJVdFfg0voLjPvdj0VgqdxeJfLYh', scope: 'openid profile email', org_id: 'org_xxxxxx', permissions: ['read:organizations', 'update:organizations'] } ``` with it, I get: ```auto tokenClaims { iss: 'https://xxxxxx.auth0.com/', sub: 'auth0|61b7a9402c31aa0071b045f1', aud: ['xxxxx-api', 'https://xxxxxxxxx.auth0.com/userinfo'], iat: 1641423171, exp: 1641509571, azp: 'lBYPRJVdFfg0voLjPvdj0VgqdxeJfLYh', scope: 'openid profile email offline_access', permissions: [] } ``` Can someone help with how to get org\_id and permissions in the refresh token, please? ---
**Author:** ![rueben.tiow](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/rueben.tiow/32/11646_2.png) [@rueben.tiow](https://community.auth0.com/u/rueben.tiow)\ **Post date:** [January 6, 2022, 5:44pm UTC](https://community.auth0.com/t/refresh-token-does-not-include-org-and-permission/75924/3 "2022-01-06T17:44:45Z")
Hi @ralemy, Thanks for reaching out to the Auth0 Community! I understand that you have issues with your claims when using a refresh token to get your access tokens. I have just tested this myself and did not find the same observations. Instead, I was able to get the organization ID and permissions both in my initial request and the request when I used the refresh token to get my new tokens. Given that, could you please share your `/authorize` request with me? Thank you. ---
**Author:** ![ralemy](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/ralemy/32/34236_2.png) [@ralemy](https://community.auth0.com/u/ralemy)\ **Post date:** [January 7, 2022, 9:14pm UTC](https://community.auth0.com/t/refresh-token-does-not-include-org-and-permission/75924/4 "2022-01-07T21:14:29Z")
Thank you @rueben.tiow for your quick response. I am not sure if I understand correctly, but here is my /authorize request. If it is not what you wanted, kindly elaborate and I will get it done: https://MY\_DOMAIN.us.auth0.com/authorize?response\_type=code&client\_id=MY\_CLIENT\_ID&redirect\_uri=[http://localhost:3000/login&scope=offline\_access](http://localhost:3000/login&scope=offline_access) email openid profile&audience=MYAUDIANCE&state=MYSTATE it forwards me to my callbackpage, with my access token set to a JWT token when logged in. the payload of that JWT token is the same as I mentioned in my original post. It does not have permissions and orgId in it. ---
**Author:** ![ralemy](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/ralemy/32/34236_2.png) [@ralemy](https://community.auth0.com/u/ralemy)\ **Post date:** [January 7, 2022, 9:16pm UTC](https://community.auth0.com/t/refresh-token-does-not-include-org-and-permission/75924/5 "2022-01-07T21:16:34Z")
@rueben.tiow , do you happen to know of a sample app somewhere that works, so that I can compare it what I have and find out what the problem is? ---
**Author:** ![rueben.tiow](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/rueben.tiow/32/11646_2.png) [@rueben.tiow](https://community.auth0.com/u/rueben.tiow)\ **Post date:** [January 7, 2022, 11:27pm UTC](https://community.auth0.com/t/refresh-token-does-not-include-org-and-permission/75924/6 "2022-01-07T23:27:19Z")
Hi @ralemy, Thank you for your responses. Yes, the `/authorize` request you provided is helpful. After looking closely, I found that your request is missing the organization parameter. In this case, could you try the following `/authorize` request to get the code to then pass to the `/oauth/token` endpoint: ```auto https://YOUR_DOMAIN/authorize? response_type=code& client_id=YOUR_CLIENT_ID& redirect_uri=https://YOUR_APP/callback& scope=SCOPE& audience=API_AUDIENCE& state=STATE& organization=ORG_ID ``` Lastly, please don’t forget to enable the _Add Permissions in the Access Token_ switch on your API settings. ![image](https://global.discourse-cdn.com/auth0/original/3X/5/d/5dd51ed767b72c040775fe91776276118d95cfea.jpeg) I have tested this and confirm that the access token returns the organization ID and permissions. Please let me know how this goes for you. Thank you. ---
**Author:** ![system](https://global.discourse-cdn.com/auth0/original/3X/b/5/b560f266932fcce5d57f09a6595bd50518cae3f3.jpeg) [@system](https://community.auth0.com/u/system)\ **Post date:** [January 22, 2022, 11:27pm UTC](https://community.auth0.com/t/refresh-token-does-not-include-org-and-permission/75924/7 "2022-01-22T23:27:27Z")
This topic was automatically closed 15 days after the last reply. New replies are no longer allowed.