Scopes vs Permissions confusion

[mathiasconradt]

Hi @chrisj2,

here are some related threads on this:

Difference between scopes and permissions in access token

Hello, im not sure if i misunderstood something or if i chose the wrong implementation for my use case. I will try to explain my problem. I have configured a SPA in Auth0. Users log in and get back an access token which the SPA uses to call an API on behalf of the user. The API is also configured in Auth0 and implemented by me. I enabled RBAC in the Auth0 dashboard´s API and configured a role with two permissions which i assigned to the test-user. If the test-user logs in to the SPA with ‘aud’…

Permissions: claim or scopes

I am a little confused on best practices in dealing with API permissions. I understand that in the API within Auth0, I can configure it to always attach the permissions claim to the access token. I am confused because I was under the understanding that the spec defines the scopes claim as the place to define a users permissions. My objective is to have the permissions always included in the access token. I would think you ca achieve this with a rule to automatically add them (although it looks …