Scope in JWT not verified by jwtAuthz

[ekl]

I’ve just recently started using Auth0 - I followed this tutorial pretty closely while getting set up.

I just finished setting up my api endpoint

I then tried calling it using the token generated by getAccessTokenSilently

The JWT does contain the correct scope, and the endpoint is set up correctly (I tested it without securing the endpoint) but for some reason jwtAuthz won’t recognize it.

Thank you!

[ekl]

I fixed it using the solution from this thread

Insufficient Scope but my token contains required permissions

In my case, I needed to provide “customScopeKey” and “customUserKey” as the default key is “user”, but in the “expressjwt 6.x.x” it was changed to “auth”. (GitHub - auth0/express-jwt: connect/express middleware that validates a JsonWebToken (JWT) and set the req.user with the attributes) jwtAuthz(['read:company'], { customScopeKey: 'permissions', customUserKey: 'auth' })