# Use API access token to Authorize in .net Core MVC?

**URL:** <https://community.auth0.com/t/use-api-access-token-to-authorize-in-net-core-mvc/71446>\
**Category:** Get Help\
**Created:** [October 17, 2021, 4:14am UTC](https://community.auth0.com/t/use-api-access-token-to-authorize-in-net-core-mvc/71446 "2021-10-17T04:14:24Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![asepdf](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/asepdf/32/32373_2.png) [@asepdf](https://community.auth0.com/u/asepdf)\
**Post date:** [October 17, 2021, 4:14am UTC](https://community.auth0.com/t/use-api-access-token-to-authorize-in-net-core-mvc/71446/1 "2021-10-17T04:14:24Z")

</div>

I’m using Auth0 SDK for .net core. I’m trying to use a permissions based approach on authorizing my users in my controllers.

I tried adding claims based on the permissions I got in the accesstoken using the code below but the claims are not persisting throughout the application so when I put [Authorize(Roles = “CustomRole”)] users are redirected to access denied page.

```auto
public void AssignRole(ClaimsPrincipal user, string accessToken)
        {
            var handler = new JwtSecurityTokenHandler();
            var token = handler.ReadJwtToken(accessToken);
            var permissionsClaims = token.Claims.FirstOrDefault(c => c.Type.Equals("permissions"));

            if (permissionsClaims != null && permissionsClaims.Value.Contains("customPermission"))
            {
                var claim = new Claim(ClaimTypes.Role.ToString(), "CustomRole");
                var identity = (ClaimsIdentity)user.Identity;
                identity.AddClaim(claim);
            }
        }

```

Here’s what I have in the startup.cs

```auto
services.AddAuth0WebAppAuthentication(options =>
            {
                options.Domain = Configuration["Auth0:Domain"];
                options.ClientId = Configuration["Auth0:ClientId"];
                options.ClientSecret = Configuration["Auth0:ClientSecret"];
            })
            .WithAccessToken(options =>
            {
                options.Audience = Configuration["Auth0:Audience"];
                options.UseRefreshTokens = true;
                
            });

```

I’m fairly new with Auth0 so I’m not sure what’s the best approach for this.  
I also tried this but doesn’t work:

> **[Permission-Based Security for ASP.NET Web APIs](https://auth0.com/blog/permission-based-security-aspnet-webapi/#Checking-Permissions-in-an-API)**
>
> How to check user permissions to have more control over access to your ASP.NET Web API.

```auto
 services.AddAuthorization(options =>
      {
        options.AddPolicy("WriteAccess", policy => 
                          policy.RequireClaim("permissions", "create:term", "update:term"));
        options.AddPolicy("DeleteAccess", policy => 
                          policy.RequireClaim("permissions", "delete:term"));
      });

```

---

<div class="post-metadata">

**Author:** ![asepdf](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/asepdf/32/32373_2.png) [@asepdf](https://community.auth0.com/u/asepdf)\
**Post date:** [October 17, 2021, 6:31am UTC](https://community.auth0.com/t/use-api-access-token-to-authorize-in-net-core-mvc/71446/2 "2021-10-17T06:31:23Z")

</div>

I figured it out. I added this on the configureservices method for auth0

```auto
 services.AddAuth0WebAppAuthentication(options =>
            {
                options.Domain = Configuration["Auth0:Domain"];
                options.ClientId = Configuration["Auth0:ClientId"];
                options.ClientSecret = Configuration["Auth0:ClientSecret"]; 
                options.OpenIdConnectEvents = new OpenIdConnectEvents
                {
                    OnTokenValidated = (context) =>
                    {
                        var accessToken = context.TokenEndpointResponse.AccessToken;

                        var handler = new JwtSecurityTokenHandler();
                        var token = handler.ReadJwtToken(accessToken);
                        var permissionsClaims = token.Claims.FirstOrDefault(c => c.Type.Equals("permissions"));
                        if (permissionsClaims != null && permissionsClaims.Value.Contains("customPermission"))
                        {
                            var claim = new Claim(ClaimTypes.Role.ToString(), "CustomRole");
                            (context.Principal.Identity as ClaimsIdentity).AddClaim(claim);
                        }

                        return Task.CompletedTask;
                    }
                };
            })

```

---

<div class="post-metadata">

**Author:** ![konrad.sopala](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/konrad.sopala/32/13516_2.png) [@konrad.sopala](https://community.auth0.com/u/konrad.sopala)\
**Post date:** [October 18, 2021, 9:03am UTC](https://community.auth0.com/t/use-api-access-token-to-authorize-in-net-core-mvc/71446/3 "2021-10-18T09:03:11Z")

</div>

Woohoo perfect! Glad you have figured it out and thanks for sharing it with the rest of community!

---

<div class="post-metadata">

**Author:** ![konrad.sopala](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/konrad.sopala/32/13516_2.png) [@konrad.sopala](https://community.auth0.com/u/konrad.sopala)\
**Post date:** [October 28, 2021, 12:45pm UTC](https://community.auth0.com/t/use-api-access-token-to-authorize-in-net-core-mvc/71446/4 "2021-10-28T12:45:59Z")

</div>