# Should I send the id token from my SPA to my rest backend?

**URL:** <https://community.auth0.com/t/should-i-send-the-id-token-from-my-spa-to-my-rest-backend/9203>\
**Category:** Get Help\
**Tags:** rest-api, id-token, openidconnect, authentication\
**Created:** [January 15, 2018, 11:04pm UTC](https://community.auth0.com/t/should-i-send-the-id-token-from-my-spa-to-my-rest-backend/9203 "2018-01-15T23:04:36Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![liavzi](https://upload.wikimedia.org/wikipedia/commons/thumb/7/7c/User_font_awesome.svg/768px-User_font_awesome.svg.png) [@liavzi](https://community.auth0.com/u/liavzi)\
**Post date:** [January 15, 2018, 11:04pm UTC](https://community.auth0.com/t/should-i-send-the-id-token-from-my-spa-to-my-rest-backend/9203/1 "2018-01-15T23:04:36Z")

</div>

I have a SPA app which is backed by a rest api server.

I use Auth0 for authentication and authorization using the implicit grant flow.  
All the examples I read explain that i should send the access token which I receive to the api for authorization purpose. For example :

> **[Why You Should Always Use Access Tokens to Secure an API](https://auth0.com/blog/why-should-use-accesstokens-to-secure-an-api/)**
>
> We explain the difference between access token and ID token and why the latter should never be used to secure an API.

On the other hand, I read that access token cannot be used as a proof for authentication:  
[http://www.thread-safe.com/2012/01/problem-with-oauth-for-authentication.html](http://www.thread-safe.com/2012/01/problem-with-oauth-for-authentication.html) [End User Authentication with OAuth 2.0 — OAuth](https://oauth.net/articles/authentication/)

That means, I cannot trust the sub claim on my access token to be sure that this is indeed the user and not another client that send its access token. Meaning, if i would use facebook as the IDP, another web app could send an access token issued to its use by the user to my server and because access tokens don’t have an aud claim, my server would think that the user is authenticated in my web app. Moreover , I see that google sign in indeed guide the spa to send an id token to the server: [Authenticate with a backend server &nbsp;|&nbsp; Web guides &nbsp;|&nbsp; Google for Developers](https://developers.google.com/identity/sign-in/web/backend-auth)

So : Should I send both the id token(for authetication) and the access token(for authorization) to my server ?

---

<div class="post-metadata">

**Author:** ![James.Morrison](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/james.morrison/32/13507_2.png) [@James.Morrison](https://community.auth0.com/u/James.Morrison)\
**Post date:** [December 14, 2018, 5:45pm UTC](https://community.auth0.com/t/should-i-send-the-id-token-from-my-spa-to-my-rest-backend/9203/2 "2018-12-14T17:45:12Z")

</div>

As it has been more than a few months since this topic was opened, and there has been no reply or further information provided as to the existence of the issue, we are closing this topic. Please don’t hesitate to create a new topic if this issue is still present, we would be happy to work with you to help find a resolution.

---

<div class="post-metadata">

**Author:** ![James.Morrison](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/james.morrison/32/13507_2.png) [@James.Morrison](https://community.auth0.com/u/James.Morrison)\
**Post date:** [December 14, 2018, 5:45pm UTC](https://community.auth0.com/t/should-i-send-the-id-token-from-my-spa-to-my-rest-backend/9203/3 "2018-12-14T17:45:14Z")

</div>