# User Authorization across different Authorization Code clients

**URL:** <https://community.auth0.com/t/user-authorization-across-different-authorization-code-clients/186148>\
**Category:** Get Help\
**Tags:** security-compliance, security-question-concern\
**Created:** [April 30, 2025, 3:45pm UTC](https://community.auth0.com/t/user-authorization-across-different-authorization-code-clients/186148 "2025-04-30T15:45:43Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![skatanski](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/skatanski/32/65094_2.png) [@skatanski](https://community.auth0.com/u/skatanski)\
**Post date:** [April 30, 2025, 3:45pm UTC](https://community.auth0.com/t/user-authorization-across-different-authorization-code-clients/186148/1 "2025-04-30T15:45:43Z")

</div>

Hi!

Does Auth0 provide a mechanism to limit potential cross-client access. Let me give you an example:

- we have 2 authorization code clients, one is a client used in one front-end product, the other client is used in another front-end product
- we have a user who has access to the first product (they can login through the client app, get a token and use that token to call APIs)
- is there any mechanism for blocking the user from being able to login through the other client application? (that application uses the same set of APIs under the hood).

I understand that the front-end can be considered public, and the token in one case and the other would give access to same set of resources. However I still am interested to having this sort of soft limitation - if it exists.

---

<div class="post-metadata">

**Author:** ![remus.ivan](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/remus.ivan/32/68771_2.png) [@remus.ivan](https://community.auth0.com/u/remus.ivan)\
**Post date:** [April 30, 2025, 5:45pm UTC](https://community.auth0.com/t/user-authorization-across-different-authorization-code-clients/186148/3 "2025-04-30T17:45:02Z")

</div>

Hi @skatanski,

Welcome back to the Auth0 Community!

The most straight forward way to achieve your described case would be implementing a Post-Login Action. In our documentation about the [Login Trigger](https://auth0.com/docs/customize/actions/explore-triggers/signup-and-login-triggers/login-trigger), the first mentioned example provides a snippet of code used to deny access to a user who is attempting to access an application:

```auto
exports.onExecutePostLogin = async (event, api) => {
  if (event.user.email && event.user.email.endsWith("@example.com") && event.client.name === "My SPA") {
    api.access.deny(`Access to ${event.client.name} is not allowed.`);
  }
};

```

Additionally you could also set up a flag in the [app\_metadata](https://auth0.com/docs/manage-users/user-accounts/metadata/metadata-fields-data) after a user’s first login and check against it to provide access to an application or not.

An alternative approach would also be creating an [Auth0 Organization](https://auth0.com/docs/manage-users/organizations), add your Application B to it and allow access to users only if they are a part of that Organization.

I hope this helps!  
Best regards,  
Remus

---

<div class="post-metadata">

**Author:** ![skatanski](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/skatanski/32/65094_2.png) [@skatanski](https://community.auth0.com/u/skatanski)\
**Post date:** [May 5, 2025, 4:38pm UTC](https://community.auth0.com/t/user-authorization-across-different-authorization-code-clients/186148/4 "2025-05-05T16:38:58Z")

</div>

Hi @remus.ivan thanks a lot for your response. Is it possible to store a userId to clientIds mapping somewhere (or an external API) and use that to define whether that given user can get a token or not? Could it be done in the PostLogin action as well? Thanks!

---

<div class="post-metadata">

**Author:** ![remus.ivan](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/remus.ivan/32/68771_2.png) [@remus.ivan](https://community.auth0.com/u/remus.ivan)\
**Post date:** [May 7, 2025, 7:05pm UTC](https://community.auth0.com/t/user-authorization-across-different-authorization-code-clients/186148/5 "2025-05-07T19:05:21Z")

</div>

Hi @skatanski,

To answer your question straight away, it’s a Yes.

> [@remus.ivan](#):
>
> Additionally you could also set up a flag in the [app\_metadata](https://auth0.com/docs/manage-users/user-accounts/metadata/metadata-fields-data) after a user’s first login and check against it to provide access to an application or not.

This is exactly what i was referring to earlier, meaning that you can also set up an array of allowed clientIDs for each user inside app\_metadata, since this type of metadata can not be modified by the user. This can also be accomplished using a PostLogin Action, as you are mentioning as well.

Kind regards,  
Remus

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/auth0/original/3X/b/5/b560f266932fcce5d57f09a6595bd50518cae3f3.jpeg) [@system](https://community.auth0.com/u/system)\
**Post date:** [May 21, 2025, 7:06pm UTC](https://community.auth0.com/t/user-authorization-across-different-authorization-code-clients/186148/6 "2025-05-21T19:06:17Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.