Using idToken to access internal API

JWT.io
6

I’ve got it working now with an access token. For anyone else who comes here:

  • You need to create a separate Application and API in Auth0.
  • Then in your mobile app, you set it up with the client ID of the Application but also pass the Identifier (not Id) of the API as the audience. For the react-native-auth0 package I couldn’t find this documented anywhere and I had to trawl through the source code to find the correct way to do it:
    auth0.webAuth
    .authorize({
      scope: 'openid profile email',
      audience: '<API Identifier>',
    })
  • Now the accessToken is an unencrypted JWT rather than the opaque JWE that you get by default. But it still doesn’t have any useful information in.
  • In order to get user details in the access token you have to create a Rule in Auth0. Rules are bits of custom JavaScript that run in Auth0 and modify your tokens before issue.

I would still really like to understand why it’s not OK to use the ID token for authentication in an API.

1 Like