# Should I use a Regular Web Application or a Machine To Machine app to communicate with Auth0 Management API?

**URL:** <https://community.auth0.com/t/should-i-use-a-regular-web-application-or-a-machine-to-machine-app-to-communicate-with-auth0-management-api/46071>\
**Category:** Get Help\
**Created:** [July 10, 2020, 12:01am UTC](https://community.auth0.com/t/should-i-use-a-regular-web-application-or-a-machine-to-machine-app-to-communicate-with-auth0-management-api/46071 "2020-07-10T00:01:21Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![to.jontan](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/to.jontan/32/21820_2.png) [@to.jontan](https://community.auth0.com/u/to.jontan)\
**Post date:** [July 10, 2020, 12:01am UTC](https://community.auth0.com/t/should-i-use-a-regular-web-application-or-a-machine-to-machine-app-to-communicate-with-auth0-management-api/46071/1 "2020-07-10T00:01:21Z")

</div>

As the title says, I have a NextJS webapp, and I’m trying to call the Auth0 Management API to get user roles.

The NextJS webapp is an Auth0 REGULAR WEB APPLICATION and I am able to get an Auth0 Management API token. Is there a best practice to this kind of use case?

Will be happy to provide more information

---

<div class="post-metadata">

**Author:** ![dan.woda](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/dan.woda/32/18340_2.png) [@dan.woda](https://community.auth0.com/u/dan.woda)\
**Post date:** [July 10, 2020, 5:33pm UTC](https://community.auth0.com/t/should-i-use-a-regular-web-application-or-a-machine-to-machine-app-to-communicate-with-auth0-management-api/46071/3 "2020-07-10T17:33:28Z")

</div>

Hi @to.jontan,

Can I propose an alternate solution? You can add the roles to the ID/access token in a rule and save the extra requests 😄

> **[Sample Use Cases: Rules with Authorization](https://auth0.com/docs/manage-users/access-control/sample-use-cases-rules-with-authorization)**
>
> Learn how to use rules with roles-based access control (RBAC). For use with our Authorization Core feature set.

If that doesn’t cover it let me know,  
Dan

---

<div class="post-metadata">

**Author:** ![to.jontan](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/to.jontan/32/21820_2.png) [@to.jontan](https://community.auth0.com/u/to.jontan)\
**Post date:** [July 15, 2020, 3:33am UTC](https://community.auth0.com/t/should-i-use-a-regular-web-application-or-a-machine-to-machine-app-to-communicate-with-auth0-management-api/46071/4 "2020-07-15T03:33:30Z")

</div>

Thanks Dan.

Is it also possible to pass the access token from the rule as well?  
Currently it’s always empty {}

---

<div class="post-metadata">

**Author:** ![dan.woda](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/dan.woda/32/18340_2.png) [@dan.woda](https://community.auth0.com/u/dan.woda)\
**Post date:** [July 15, 2020, 7:20pm UTC](https://community.auth0.com/t/should-i-use-a-regular-web-application-or-a-machine-to-machine-app-to-communicate-with-auth0-management-api/46071/5 "2020-07-15T19:20:37Z")

</div>

Pass it where? The access token isn’t issued until after rules are completed, since rules could change the claims of the token.

From our docs, about what `context.accessToken` is:

> An object representing the options defined on the Access Token. You can use this object to [add custom namespaced claims](https://auth0.com/docs/scopes/current/sample-use-cases#add-custom-claims-to-a-token) to the Access Token. `context.accessToken.scope` can be used to [change the Access Token’s returned scopes](https://auth0.com/docs/rules/references/samples#modify-scope-of-access-token). When provided, it is an array containing permissions in string format. Custom claims will be included in the Access Token after all rules have run.

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/auth0/original/3X/b/5/b560f266932fcce5d57f09a6595bd50518cae3f3.jpeg) [@system](https://community.auth0.com/u/system)\
**Post date:** [July 30, 2020, 7:23pm UTC](https://community.auth0.com/t/should-i-use-a-regular-web-application-or-a-machine-to-machine-app-to-communicate-with-auth0-management-api/46071/6 "2020-07-30T19:23:49Z")

</div>

This topic was automatically closed 15 days after the last reply. New replies are no longer allowed.