Using Custom API with Permission getting "Unauthorized"

[tyf]

That is correct, Management API Tokens obtained directly through a SPA are limited in scope by design.

@Gerarca

what is the better way to change the password??

The most common way of going about this is using a backend to serve as proxy for the SPA making calls against the management API:

How can I enable users to change their email address from a SPA or native app?

Question: How can I enable users to change their email address from a SPA or native app? Answer: Public clients (like SPAs and native applications) are restricted from requesting tokens for the management API with the proper scopes for updating a user’s email. These types of applications are limited to a few specific scopes. Because of these limitations, email change requests from public clients must flow through a backend or proxy API. This could be a serverless function with the sole purpose…

If you’re interested, here is an example of what this might look like in a Node backend - This extends our standard auth0-react sample app.