# Using Management API from a Login of a SPA **URL:** \ **Category:** Get Help\ **Tags:** api, login, auth0\ **Created:** [May 10, 2021, 9:28pm UTC](https://community.auth0.com/t/using-management-api-from-a-login-of-a-spa/62539 "2021-05-10T21:28:26Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![pfranz](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/pfranz/32/16055_2.png) [@pfranz](https://community.auth0.com/u/pfranz)\ **Post date:** [May 10, 2021, 9:28pm UTC](https://community.auth0.com/t/using-management-api-from-a-login-of-a-spa/62539/1 "2021-05-10T21:28:26Z")
I am trying to get user metadata for a logged in user. Given that the login gives me an access token and not an id token. So I can’t add the user metadata that way and there does not seem to be a way to extend the information that is returned on the /userinfo API. I figure the only way to get the user metadata would be for the user to be able to user the Management API. So I attempted to user the access token to access the Management API and that is a no go. I am using the Auth0Client to do the login and get the access token and user information. If I am missing something, please tell me. Note: This is a SPA on a static website using HTML and Javascript (Node is not being used) ---
**Author:** ![stephanie.chamblee](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/stephanie.chamblee/32/26087_2.png) [@stephanie.chamblee](https://community.auth0.com/u/stephanie.chamblee)\ **Post date:** [May 11, 2021, 2:45pm UTC](https://community.auth0.com/t/using-management-api-from-a-login-of-a-spa/62539/3 "2021-05-11T14:45:01Z")
Hi @pfranz, Welcome to the Community! Your app should be issued an ID Token, but the user metadata is not included in ID Tokens by default ([Sample ID Token](https://auth0.com/docs/tokens/id-tokens/id-token-structure#sample-id-token)). If you are using `auth0-spa-js`, when you use `const user = await auth0.getUser();`, the user’s information is retrieved by decoding the ID Token. If you only need the user to view their metadata, then you can extend the ID Token by adding a custom claim: [https://auth0.com/docs/scopes/sample-use-cases-scopes-and-claims#add-custom-claims-to-a-token](https://auth0.com/docs/scopes/sample-use-cases-scopes-and-claims#add-custom-claims-to-a-token) If you need to allow the user to not only read, but also make persistent updates to their metadata, then you can do so by requesting the `update:current_user_metadata` and `read:current_user` when you initiate the `Auth0Client`. Also, the audience config should be `https://your-auth0-tenant-domain/api/v2`. Here are the docs for using the Management API in a SPA: > **[Get Management API Access Tokens for Single-Page Applications](https://auth0.com/docs/secure/tokens/access-tokens/get-management-api-tokens-for-single-page-applications)** > > Learn about available scopes and endpoints for Management API tokens for Single-page Applications (SPAs). Please consider the warning about updating metadata from a SPA: > Auth0 does not recommend putting Management API Tokens on the frontend that allow users to change user metadata. This can allow users to manipulate their own metadata in a way that could be detrimental to the functioning of the applications. It also allows a customer to do a DoS attack against someone’s management API by just spamming it and hitting rate limits. ---
**Author:** ![pfranz](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/pfranz/32/16055_2.png) [@pfranz](https://community.auth0.com/u/pfranz)\ **Post date:** [May 12, 2021, 2:33am UTC](https://community.auth0.com/t/using-management-api-from-a-login-of-a-spa/62539/4 "2021-05-12T02:33:55Z")
Ok. I see what the issue was. The name space custom claims requires that you specify a name space. That is that even if the new attribute will not collide with other attributes a name space is required for it to be added to the id token. The attribute is a read-only attribute which is a copy of an app metadata attribute that is copied via Login Custom Action. ---
**Author:** ![system](https://global.discourse-cdn.com/auth0/original/3X/b/5/b560f266932fcce5d57f09a6595bd50518cae3f3.jpeg) [@system](https://community.auth0.com/u/system)\ **Post date:** [May 27, 2021, 2:34am UTC](https://community.auth0.com/t/using-management-api-from-a-login-of-a-spa/62539/5 "2021-05-27T02:34:40Z")
This topic was automatically closed 15 days after the last reply. New replies are no longer allowed.