Using Management API

[KBar]

Hello!

I know that Management API tokens for SPAs have limitations, the most prominent one being the restriction of API operations to a single currently logged-in user.

I was wondering if there is a workaround for this. Is there a way to bypass this limitation and let certain users manage other users through Management API?

Thank you.

[tyf]

Hello there @KBar welcome to the community!

@KBar

I was wondering if there is a workaround for this. Is there a way to bypass this limitation and let certain users manage other users through Management API?

Unfortunately, there really isn’t a way to bypass this limitation directly - Instead the best way to go about this is to proxy calls to the Management API via your backend in a way that works for you. This type of architecture is outlined in the following FAQ:

How can I enable users to change their email address from a SPA or native app?

Question: How can I enable users to change their email address from a SPA or native app? Answer: Public clients (like SPAs and native applications) are restricted from requesting tokens for the management API with the proper scopes for updating a user’s email. These types of applications are limited to a few specific scopes. Because of these limitations, email change requests from public clients must flow through a backend or proxy API. This could be a serverless function with the sole purpose…

Let us know if you have any follow up questions to this!

[KBar]

Hello, @tyf and thank you!

After a bit more research, I settled on building an Express back-end for handling this. node-auth0 makes this super easy with its automatic token refresh. It was literally 5 lines of code and 3 pieces of middleware and it was ready to operate.

Huge props to the team behind the package!

[tyf]

Hey @KBar that’s awesome to hear! Thanks for following up with the community

[KBar]

Thanks, @tyf !

While we’re at it, I wanted to confirm that my understanding and implementation is correct. So node-auth0 is supposed to take care of token management, right? Does it always use the same token until it expires in 24 hours or do I have to configure my back-end in some form? Currently, these are the 5 lines of code my Express server runs that I talked about previously:

const api = require("auth0").ManagementClient;

const { users } = new api({
  domain: process.env.DOMAIN,
  clientId: process.env.CLIENT_ID,
  clientSecret: process.env.CLIENT_SECRET
});

As per the documentation, caching & refreshing tokens is done automatically behind the scenes. But how does it accomplish that? Does it just compare the current timestamp with the one recorded in expires_in before every call? Where is the cache stored? What happens if the server is restarted?