# Trusting the id\_token sent to API from a SPA

**URL:** <https://community.auth0.com/t/trusting-the-id-token-sent-to-api-from-a-spa/8081>\
**Category:** Get Help\
**Tags:** access\_token, spa, id\_token\
**Created:** [September 4, 2017, 6:46pm UTC](https://community.auth0.com/t/trusting-the-id-token-sent-to-api-from-a-spa/8081 "2017-09-04T18:46:47Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![edi](https://upload.wikimedia.org/wikipedia/commons/thumb/7/7c/User_font_awesome.svg/768px-User_font_awesome.svg.png) [@edi](https://community.auth0.com/u/edi)\
**Post date:** [September 4, 2017, 6:46pm UTC](https://community.auth0.com/t/trusting-the-id-token-sent-to-api-from-a-spa/8081/1 "2017-09-04T18:46:47Z")

</div>

Hello,  
  
  
  
I’m building a single page app that makes requests to an API endpoint.  
  
  
I followed [this](https://auth0.com/docs/architecture-scenarios/application/spa-api) tutorial and implemented a login screen with auth0.WebAuth in JS.  
  
  
After a successful login, I attach the access\_token to all subsequent requests to my API server.  
  
  
However, the API server needs to know the roles of the user. The recommendation is to make a request to /userinfo from the server with the passed acces\_token in order to get the id\_token.  
  
  
Why can’t I just pass the id\_token from the SPA inside the request and use its contents? This way I can avoid unnecessary requests to Auth0.  
  
  
  
Thanks,  
  
  
Edi Buslovich.

---

<div class="post-metadata">

**Author:** ![edi](https://upload.wikimedia.org/wikipedia/commons/thumb/7/7c/User_font_awesome.svg/768px-User_font_awesome.svg.png) [@edi](https://community.auth0.com/u/edi)\
**Post date:** [September 4, 2017, 7:18pm UTC](https://community.auth0.com/t/trusting-the-id-token-sent-to-api-from-a-spa/8081/2 "2017-09-04T19:18:18Z")

</div>

Finally, according to the answer here [Get user data server side - Auth0 Community](http://community.auth0.com/questions/6761/get-user-data-server-side?childToView=6795#answer-6795)  
, I created a rule to insert the user roles into the access token:

```
    function (user, context, callback) {
      var namespace = 'https://mydomain.com/';
      context.accessToken[namespace + 'roles'] = user.app_metadata.roles;
      callback(null, user, context);
    }

```

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/auth0/original/3X/b/5/b560f266932fcce5d57f09a6595bd50518cae3f3.jpeg) [@system](https://community.auth0.com/u/system)\
**Post date:** [March 2, 2018, 5:56am UTC](https://community.auth0.com/t/trusting-the-id-token-sent-to-api-from-a-spa/8081/3 "2018-03-02T05:56:19Z")

</div>