# Scope doesnt assign to access token on React

**URL:** <https://community.auth0.com/t/scope-doesnt-assign-to-access-token-on-react/110748>\
**Category:** Get Help\
**Tags:** users, management-api\
**Created:** [July 7, 2023, 9:21am UTC](https://community.auth0.com/t/scope-doesnt-assign-to-access-token-on-react/110748 "2023-07-07T09:21:56Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Xepobopa](https://upload.wikimedia.org/wikipedia/commons/thumb/7/7c/User_font_awesome.svg/768px-User_font_awesome.svg.png) [@Xepobopa](https://community.auth0.com/u/Xepobopa)\
**Post date:** [July 7, 2023, 9:21am UTC](https://community.auth0.com/t/scope-doesnt-assign-to-access-token-on-react/110748/1 "2023-07-07T09:21:56Z")

</div>

I want to get a user role, so i make this request: `https://${domain}/api/v2/users/${sub}/roles`. But i have an error: `Insufficient scope, expected any of: read:users,read:roles,read:role_members`  
For this request i must provide an access token with folowing scope: read:users read:roles read:role\_members.  
I provided scope in Auth0Provider:

`<Auth0Provider domain="_" clientId="_" authorizationParams={{ redirect_uri: window.location.origin, audience: "_", scope: "read:current_user update:current_user_metadata read:users read:roles read:role_members" }}> <App/> </Auth0Provider>`

But scope in token is:  
`"scope": "openid read:current_user update:current_user_metadata"`. So how can i assign scope to the token?

---

<div class="post-metadata">

**Author:** ![ty.frith](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/ty.frith/32/58484_2.png) [@ty.frith](https://community.auth0.com/u/ty.frith)\
**Post date:** [July 7, 2023, 11:38pm UTC](https://community.auth0.com/t/scope-doesnt-assign-to-access-token-on-react/110748/3 "2023-07-07T23:38:17Z")

</div>

Hello @Xepobopa welcome to the community!

A Management API Access Token () obtained by the SPA is [limited](https://auth0.com/docs/secure/tokens/access-tokens/get-management-api-tokens-for-single-page-applications#available-scopes-and-endpoints) in the scopes it can have - Instead, you’ll need to utilize a backend of sorts to get and use a properly scoped access token. The following article outlines this flow:

[https://community.auth0.com/t/how-can-i-enable-users-to-change-their-email-address-from-a-spa-or-native-app/44064](https://community.auth0.com/t/how-can-i-enable-users-to-change-their-email-address-from-a-spa-or-native-app/44064)

Alternatively (and easiest route), you can add a user’s roles as a claim to an Access Token and get them that way:

[https://community.auth0.com/t/how-to-add-roles-and-permissions-to-the-id-token-using-actions/84506](https://community.auth0.com/t/how-to-add-roles-and-permissions-to-the-id-token-using-actions/84506)

Hope this helps!

---

<div class="post-metadata">

**Author:** ![Xepobopa](https://upload.wikimedia.org/wikipedia/commons/thumb/7/7c/User_font_awesome.svg/768px-User_font_awesome.svg.png) [@Xepobopa](https://community.auth0.com/u/Xepobopa)\
**Post date:** [July 9, 2023, 10:11am UTC](https://community.auth0.com/t/scope-doesnt-assign-to-access-token-on-react/110748/4 "2023-07-09T10:11:51Z")

</div>

Hello! Thanks for your reply. I tried to use [Login Flow](https://auth0.com/docs/customize/actions/flows-and-triggers/login-flow#add-user-roles-to-id-and-access-tokens) from your reply. Here is my code:

```ts
exports.onExecutePostLogin = async (event, api) => {
  const namespace = 'https://dev-tyu80romro64bab1.us.auth0.com/api/v2/';
  if (event.authorization) {
    api.idToken.setCustomClaim(`${namespace}/roles`, event.authorization.roles);
    api.accessToken.setCustomClaim(`${namespace}/roles`, event.authorization.roles);
  }

```

But code from the link don’t work. My access token don’t contain any role.  
Also i tried to pass default values, but it didn’t work too:

```ts
api.idToken.setCustomClaim(`value`, "key");
api.accessToken.setCustomClaim(`value`, "key");

```

access token:

```ts
{
  "iss": "https://dev-tyu80romro64bab1.us.auth0.com/",
  "sub": "auth0|64aa6b4142cc3032718b8da0",
  "aud": [
    "https://dev-tyu80romro64bab1.us.auth0.com/api/v2/",
    "https://dev-tyu80romro64bab1.us.auth0.com/userinfo"
  ],
  "iat": 1688896803,
  "exp": 1688983203,
  "azp": "ldJvP8jc3TJedTVViILgUWKqKDFjRDMB",
  "scope": "openid read:current_user update:current_user_metadata"
}

```

(I described in more detail here [reactjs - Unable to scope access token - Stack Overflow](https://stackoverflow.com/questions/76642823/unable-to-scope-access-token))

---

<div class="post-metadata">

**Author:** ![ty.frith](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/ty.frith/32/58484_2.png) [@ty.frith](https://community.auth0.com/u/ty.frith)\
**Post date:** [July 12, 2023, 12:12am UTC](https://community.auth0.com/t/scope-doesnt-assign-to-access-token-on-react/110748/5 "2023-07-12T00:12:13Z")

</div>

Hey @Xepobopa happy to help, apologize for the delayed response!

> [@Xepobopa](#):
>
> ` const namespace = 'https://dev-tyu80romro64bab1.us.auth0.com/api/v2/';`

Auth0 domains [aren’t allowed](https://auth0.com/docs/secure/tokens/json-web-tokens/create-custom-claims#namespaced-guidelines) in custom namespaces so I believe it’s just being ignored in this case - The roles should be added if you use anything else (outside of [restricted claims](https://auth0.com/docs/secure/tokens/json-web-tokens/create-custom-claims#general-restrictions)).

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/auth0/original/3X/b/5/b560f266932fcce5d57f09a6595bd50518cae3f3.jpeg) [@system](https://community.auth0.com/u/system)\
**Post date:** [July 26, 2023, 12:12am UTC](https://community.auth0.com/t/scope-doesnt-assign-to-access-token-on-react/110748/6 "2023-07-26T00:12:51Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.