# Universal Login (lock v11) custom scope **URL:** \ **Category:** Get Help\ **Tags:** scopes, lock\ **Created:** [January 13, 2020, 11:54am UTC](https://community.auth0.com/t/universal-login-lock-v11-custom-scope/36213 "2020-01-13T11:54:34Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![davideberdin](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/davideberdin/32/18468_2.png) [@davideberdin](https://community.auth0.com/u/davideberdin)\ **Post date:** [January 13, 2020, 11:54am UTC](https://community.auth0.com/t/universal-login-lock-v11-custom-scope/36213/1 "2020-01-13T11:54:34Z")
Howdy 🤠 ! Thank you very much for this awesome product! I am having troubles in setting up the Lock from the Auth0 page for retrieving `user_metadata`. I followed the instructions on the documentation and set the `params` variable. However, the Login process keeps returning `access_denied`. This is the settings of my Auth0 page for the Lock ``` Sign In with Auth0 ``` As you can see from the code above, I set the `params` with a specific scope of `user_medata` and `app_metadata`. I need both of them for my application. The signup page works fine and the values get stored correctly, but the login `redirect` returns the following error: `{"statusCode":403,"description":"Invalid state","name":"AnomalyDetected","code":"access_denied"}` Final question: from the code above, how can I write into the `app_metadata`? Thank you very much in advance 😄 ---
**Author:** ![mathiasconradt](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/mathiasconradt/32/12758_2.png) [@mathiasconradt](https://community.auth0.com/u/mathiasconradt)\ **Post date:** [January 13, 2020, 12:22pm UTC](https://community.auth0.com/t/universal-login-lock-v11-custom-scope/36213/2 "2020-01-13T12:22:44Z")
> [@davideberdin](#): > > Final question: from the code above, how can I write into the `app_metadata` ? You cannot do this with an access token issued to a user. Only `user_metadata` are meant to be set by a user him/herself. `app_metadata` requires a call to the management API, and thus an M2M approach. You’d need to setup a backend as M2M client application that calls the Auth0 Management API and handles the change requests. > **[Understand How Metadata Works in User Profiles](https://auth0.com/docs/manage-users/user-accounts/metadata)** > > Describes Auth0 user, application, and client metadata. Learn how you can use metadata to store information that does not originate from an identity provider. ---
**Author:** ![davideberdin](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/davideberdin/32/18468_2.png) [@davideberdin](https://community.auth0.com/u/davideberdin)\ **Post date:** [January 13, 2020, 12:30pm UTC](https://community.auth0.com/t/universal-login-lock-v11-custom-scope/36213/3 "2020-01-13T12:30:09Z")
Thank you for this answer! I’ll do the set of `app_metadata` from my backend. On the other hand, I still have the same problem even removing the `app_metadata` from my scope. Any idea? I attached a screenshot to clarify a bit. The Signup works fine but not the `redirect` login ![Screenshot 2020-01-13 at 13.34.41](https://global.discourse-cdn.com/auth0/original/3X/a/6/a6d7e725fdfbceee6b2129be1ff58983a52d1b0a.png) ---
**Author:** ![mathiasconradt](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/mathiasconradt/32/12758_2.png) [@mathiasconradt](https://community.auth0.com/u/mathiasconradt)\ **Post date:** [January 13, 2020, 2:47pm UTC](https://community.auth0.com/t/universal-login-lock-v11-custom-scope/36213/4 "2020-01-13T14:47:50Z")
That seems unrelated to the scopes, I suggest to search in the forum for anomaly detection (haven’t checked all posts myself yet): [Search results for 'AnomalyDetected' - Auth0 Community](http://community.auth0.com/search?q=AnomalyDetected)