I have an API that needs to authorize access based on company_id. One way to do it is to maintain a mapping of the company ID and all the client IDs (M2M apps) it generates. I am wondering whether it’d be better/secure to just embed the company ID in the access token instead. Here is the workflow I …

Hi @gavin3466 , Thanks for reaching out to the Auth0 Community! [image] gavin3466: Will this work? Is that any security issue with this approach? Yes! Your proposed approach will work and will be a secure way to handle authorization. Here is a helpful FAQ resource I recommend reading: Addin…

Using App Metadata to customize access token per client for M2M applications

Get Help

system Closed January 20, 2023, 5:22pm 4

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.

Topic		Replies	Views
Implementing personal access token Get Help	10	3723	October 5, 2022
Client Credentials M2M Login customize token Get Help jwt , auth0 , rules , access-token	3	3806	May 11, 2020
Setting permissions per client for M2M applications Get Help	2	4049	August 27, 2020
Add uuid as custom claim to accesstoken Get Help jwt , auth0 , api , actions	6	4005	December 7, 2021
What is the correct method to protect client-facing API? Get Help access-token	5	2250	October 27, 2023

Using App Metadata to customize access token per client for M2M applications

Related topics