# Scope in JWT not verified by jwtAuthz

**URL:** <https://community.auth0.com/t/scope-in-jwt-not-verified-by-jwtauthz/103816>\
**Category:** Get Help\
**Tags:** user-profile, user-management\
**Created:** [March 31, 2023, 8:03am UTC](https://community.auth0.com/t/scope-in-jwt-not-verified-by-jwtauthz/103816 "2023-03-31T08:03:06Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![ekl](https://upload.wikimedia.org/wikipedia/commons/thumb/7/7c/User_font_awesome.svg/768px-User_font_awesome.svg.png) [@ekl](https://community.auth0.com/u/ekl)\
**Post date:** [March 31, 2023, 8:03am UTC](https://community.auth0.com/t/scope-in-jwt-not-verified-by-jwtauthz/103816/1 "2023-03-31T08:03:06Z")

</div>

I’ve just recently started using Auth0 - I followed [this tutorial](https://auth0.com/docs/get-started/architecture-scenarios/spa-api/api-implementation-nodejs#2-secure-the-api-endpoints) pretty closely while getting set up.

I just finished setting up my api endpoint

 ![image](https://global.discourse-cdn.com/auth0/original/3X/f/7/f7e60e06826a13c2812e468c5b01d35cca0d08fb.png)

I then tried calling it using the token generated by getAccessTokenSilently

 ![image](https://global.discourse-cdn.com/auth0/original/3X/2/1/21e267b8c0e15c6a48256791b98f21d43081cd0e.png)

The JWT does contain the correct scope, and the endpoint is set up correctly (I tested it without securing the endpoint) but for some reason jwtAuthz won’t recognize it.

Thank you!

---

<div class="post-metadata">

**Author:** ![ekl](https://upload.wikimedia.org/wikipedia/commons/thumb/7/7c/User_font_awesome.svg/768px-User_font_awesome.svg.png) [@ekl](https://community.auth0.com/u/ekl)\
**Post date:** [March 31, 2023, 5:18pm UTC](https://community.auth0.com/t/scope-in-jwt-not-verified-by-jwtauthz/103816/2 "2023-03-31T17:18:47Z")

</div>

I fixed it using the solution from this thread

> [@Insufficient Scope but my token contains required permissions](https://community.auth0.com/t/insufficient-scope-but-my-token-contains-required-permissions/33710/10):
>
> In my case, I needed to provide “customScopeKey” and “customUserKey” as the default key is “user”, but in the “expressjwt 6.x.x” it was changed to “auth”. ([GitHub - auth0/express-jwt: connect/express middleware that validates a JsonWebToken (JWT) and set the req.user with the attributes](https://github.com/auth0/express-jwt#migration-from-v6)) jwtAuthz(['read:company'], { customScopeKey: 'permissions', customUserKey: 'auth' })

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/auth0/original/3X/b/5/b560f266932fcce5d57f09a6595bd50518cae3f3.jpeg) [@system](https://community.auth0.com/u/system)\
**Post date:** [April 14, 2023, 5:19pm UTC](https://community.auth0.com/t/scope-in-jwt-not-verified-by-jwtauthz/103816/3 "2023-04-14T17:19:30Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.