# \#access\_token **URL:** https://community.auth0.com/tag/access-token/171.md [Latest](https://community.auth0.com/latest.md) · [Categories](https://community.auth0.com/categories.md) · [Tags](https://community.auth0.com/tags.md) --- ## [Cookies vs. Access Tokens: Securing the Authorization Code Flow in Browser-Based Apps](https://community.auth0.com/t/cookies-vs-access-tokens-securing-the-authorization-code-flow-in-browser-based-apps/204001)
**Author:** [@christina.johnson](https://community.auth0.com/u/christina.johnson)\ **Replies:** 2\ **Last updated:** [October 7, 2026, 10:39pm UTC](https://community.auth0.com/t/cookies-vs-access-tokens-securing-the-authorization-code-flow-in-browser-based-apps/204001 "2026-10-07T22:39:58Z")
When architecting a Single Page Application (SPA) in frameworks like React, Angular, or Vue, developers inevitably reach a crossroads: Where should I store my access tokens once they are returned to the browser? This arc… --- ## [Use Custom Domain instead of Canonical Domain in Auth0 Dashboard API Test page](https://community.auth0.com/t/use-custom-domain-instead-of-canonical-domain-in-auth0-dashboard-api-test-page/202884)
**Author:** [@azure.aii](https://community.auth0.com/u/azure.aii)\ **Replies:** 3\ **Last updated:** [August 31, 2026, 9:08pm UTC](https://community.auth0.com/t/use-custom-domain-instead-of-canonical-domain-in-auth0-dashboard-api-test-page/202884 "2026-08-31T21:08:51Z")
We are using a custom domain for one of our Auth0 tenants. We have multiple APIs setup to consume m2m Auth0 Access Tokens. We need to use the custom domain for the m2m Auth0 Access Token (as the issuer). When using Po… --- ## [Expiration DateTime for Machine to Machine Applications (Client Credentials flow)](https://community.auth0.com/t/expiration-datetime-for-machine-to-machine-applications-client-credentials-flow/198664)
**Author:** [@aburck](https://community.auth0.com/u/aburck)\ **Replies:** 1\ **Last updated:** [April 30, 2026, 6:29pm UTC](https://community.auth0.com/t/expiration-datetime-for-machine-to-machine-applications-client-credentials-flow/198664 "2026-04-30T18:29:40Z")
Feature: Machine to Machine Application Expiration Use-case: We build and sell APIs. To grant customers access to our APIs, we create Machine to Machine (M2M) Applications for each customer and provide them with their C… --- ## [Five Myths About JWTs Debunked](https://community.auth0.com/t/five-myths-about-jwts-debunked/190296)
**Author:** [@andrea.chiarelli](https://community.auth0.com/u/andrea.chiarelli)\ **Replies:** 1\ **Last updated:** [August 7, 2025, 10:13am UTC](https://community.auth0.com/t/five-myths-about-jwts-debunked/190296 "2025-08-07T10:13:54Z")
There are many myths surrounding JSON Web Tokens. This article attempts to debunk five of them. Check them out! --- ## [OAuth 2.0 Access Tokens and the Principle of Least Privilege](https://community.auth0.com/t/oauth-2-0-access-tokens-and-the-principle-of-least-privilege/189310)
**Author:** [@andrea.chiarelli](https://community.auth0.com/u/andrea.chiarelli)\ **Replies:** 1\ **Last updated:** [July 17, 2025, 10:43am UTC](https://community.auth0.com/t/oauth-2-0-access-tokens-and-the-principle-of-least-privilege/189310 "2025-07-17T10:43:23Z")
How can you apply the Principle of Least Privilege when using OAuth 2.0 access tokens to protect your applications? Learn more through this blog post. --- ## [Enrich Auth0 Access Tokens with Auth0 FGA Data](https://community.auth0.com/t/enrich-auth0-access-tokens-with-auth0-fga-data/184063)
**Author:** [@robertino.calcaterra](https://community.auth0.com/u/robertino.calcaterra)\ **Replies:** 1\ **Last updated:** [March 18, 2025, 3:04pm UTC](https://community.auth0.com/t/enrich-auth0-access-tokens-with-auth0-fga-data/184063 "2025-03-18T15:04:24Z")
Supercharge your Auth0-issued access tokens with information, like organizations a user belongs to, from your Auth0 FGA decision engine. Read more… :writing\_hand:t2: Brought to you by @Sambego --- ## [Expire access token when Logout](https://community.auth0.com/t/expire-access-token-when-logout/61266)
**Author:** [@techtic.neel](https://community.auth0.com/u/techtic.neel)\ **Replies:** 2\ **Last updated:** [July 19, 2024, 12:50pm UTC](https://community.auth0.com/t/expire-access-token-when-logout/61266 "2024-07-19T12:50:34Z")
Hey all, I want to expire my access\_token when i click logout. We use the access token for api in jwt. Currently, after logout still i can access the dashboard with access\_token . --- ## [Add Organization metadata in token](https://community.auth0.com/t/add-organization-metadata-in-token/90610)
**Author:** [@bittu.anupam](https://community.auth0.com/u/bittu.anupam)\ **Replies:** 2\ **Last updated:** [September 15, 2022, 5:09am UTC](https://community.auth0.com/t/add-organization-metadata-in-token/90610 "2022-09-15T05:09:49Z")
Hi, Is it possible to add Organization’s meta\_data (key value pair) to the token in sigin in flow? If yes, how? I am looking for a scenarion where I want to store subscription tier information in the Organization’s met… --- ## [Expo Implementation. Invalid access\_token](https://community.auth0.com/t/expo-implementation-invalid-access-token/90204)
**Author:** [@forestman27](https://community.auth0.com/u/forestman27)\ **Replies:** 1\ **Last updated:** [September 9, 2022, 1:09am UTC](https://community.auth0.com/t/expo-implementation-invalid-access-token/90204 "2022-09-09T01:09:36Z")
The id\_token I get back seems to be working great. I can decode it or send it to my api however I believe using it in the authorization header is a bad practice. The problem is the access\_token I get back is invalid. I… --- ## [Resource Owner Password flow only works with headers removed](https://community.auth0.com/t/resource-owner-password-flow-only-works-with-headers-removed/84131)
**Author:** [@peter22](https://community.auth0.com/u/peter22)\ **Replies:** 1\ **Last updated:** [May 26, 2022, 8:59pm UTC](https://community.auth0.com/t/resource-owner-password-flow-only-works-with-headers-removed/84131 "2022-05-26T20:59:56Z")
Following up on this old thread here… I, too, needed to remove the header attribute (using the node.js with axios call format) that is referenced in several Auth0 docs that explain the Resource Owner Password flow - li… --- ## [Identity provider access tokens in actions](https://community.auth0.com/t/identity-provider-access-tokens-in-actions/76316)
**Author:** [@ftreesmilo](https://community.auth0.com/u/ftreesmilo)\ **Replies:** 8\ **Last updated:** [January 18, 2022, 3:18am UTC](https://community.auth0.com/t/identity-provider-access-tokens-in-actions/76316 "2022-01-18T03:18:11Z")
I’ve been looking around the forum and I can’t find the info I need. I need to be able to use the access tokens granted to the social connection that I’ve set up to let people log in with paypal/patreon etc. I found a … --- ## [/api/v2/users/{Auth0UserId} returning token invalid after successfully calling /oauth/token](https://community.auth0.com/t/api-v2-users-auth0userid-returning-token-invalid-after-successfully-calling-oauth-token/73694)
**Author:** [@Auth0\_user](https://community.auth0.com/u/Auth0_user)\ **Replies:** 4\ **Last updated:** [December 7, 2021, 4:30pm UTC](https://community.auth0.com/t/api-v2-users-auth0userid-returning-token-invalid-after-successfully-calling-oauth-token/73694 "2021-12-07T16:30:27Z")
Hi, I am calling the /oauth/token endpoint and successfully being returned an access token and I have verified it on jwt.io. I immediately then use that token in a GET request for user data but that request returns an in… --- ## [Get AccessToken to authorize API](https://community.auth0.com/t/get-accesstoken-to-authorize-api/70426)
**Author:** [@camediaonline](https://community.auth0.com/u/camediaonline)\ **Replies:** 4\ **Last updated:** [September 30, 2021, 6:26pm UTC](https://community.auth0.com/t/get-accesstoken-to-authorize-api/70426 "2021-09-30T18:26:06Z")
Hi there, I have just started with Auth0, got through some videos read the docs and made an small local nodejs client app (localhost:3000) that could authenticate using the forms from Auth0. Then i took a look howto pr… --- ## [Cannot Complete Silent Auth on Mobile Device: \`login\_required\`](https://community.auth0.com/t/cannot-complete-silent-auth-on-mobile-device-login-required/62279)
**Author:** [@brady](https://community.auth0.com/u/brady)\ **Replies:** 2\ **Last updated:** [May 6, 2021, 8:12am UTC](https://community.auth0.com/t/cannot-complete-silent-auth-on-mobile-device-login-required/62279 "2021-05-06T08:12:39Z")
Please include the following information in your post: Which SDK this is regarding: @auth0/auth0-spa-js SDK Version: 1.13.2 Platform Version: N/A Code Snippets/Error Messages/Supporting Details/Screenshots: … --- ## [App continuously sending access tokens](https://community.auth0.com/t/app-continuously-sending-access-tokens/60433)
**Author:** [@importhuman](https://community.auth0.com/u/importhuman)\ **Replies:** 3\ **Last updated:** [April 16, 2021, 9:40pm UTC](https://community.auth0.com/t/app-continuously-sending-access-tokens/60433 "2021-04-16T21:40:22Z")
Once I log in, the app keeps sending access tokens. While it doesn’t seem to lead to any issues in the functioning of the app, this seems to be new behaviour. I thought it’s been happening since the time I stopped using … --- ## [How to get JWT access token instead of opaque access token?](https://community.auth0.com/t/how-to-get-jwt-access-token-instead-of-opaque-access-token/60105)
**Author:** [@msontakke](https://community.auth0.com/u/msontakke)\ **Replies:** 8\ **Last updated:** [April 1, 2021, 7:09pm UTC](https://community.auth0.com/t/how-to-get-jwt-access-token-instead-of-opaque-access-token/60105 "2021-04-01T19:09:08Z")
I am using Auth0 WordPress plugin for SSO. The plugin works well. However, I would like to extend the requirement and so I am using the “auth0\_user\_login” action to get the access token of the user. But it returns the Op… --- ## [Using 'sub' as user id](https://community.auth0.com/t/using-sub-as-user-id/58306)
**Author:** [@ama](https://community.auth0.com/u/ama)\ **Replies:** 1\ **Last updated:** [February 22, 2021, 8:50pm UTC](https://community.auth0.com/t/using-sub-as-user-id/58306 "2021-02-22T20:50:15Z")
Hello, I am new to Auth0, I have an app that requires a unique user Id for a user to carry out certain tasks. I understand that I can create custom claims for the user id. My question is, can I use the ‘sub’ claim as a… --- ## [How to get Sub Claim from Access Token](https://community.auth0.com/t/how-to-get-sub-claim-from-access-token/57499)
**Author:** [@iltimas.doha](https://community.auth0.com/u/iltimas.doha)\ **Replies:** 7\ **Last updated:** [February 10, 2021, 2:45pm UTC](https://community.auth0.com/t/how-to-get-sub-claim-from-access-token/57499 "2021-02-10T14:45:29Z")
Hello, tl;dr I would like to understand how I can extract the User Sub claim from an Access Token. Context: We’re building an SPA that exclusively uses serverless function (from Vercel) to make authenticated calls to … --- ## [Id Token for backend API](https://community.auth0.com/t/id-token-for-backend-api/56555)
**Author:** [@tibor](https://community.auth0.com/u/tibor)\ **Replies:** 1\ **Last updated:** [January 21, 2021, 2:22pm UTC](https://community.auth0.com/t/id-token-for-backend-api/56555 "2021-01-21T14:22:06Z")
Hi, We have a SPA, where we only want let the user launch searches if they are authenticated (google, facebook or passwordless magic link). Once the user logged in, we really want him to stay logged in for even 365 days… --- ## [Verifying at\_hash on rs256 id token without access token](https://community.auth0.com/t/verifying-at-hash-on-rs256-id-token-without-access-token/39551)
**Author:** [@ApartmentTherapy](https://community.auth0.com/u/ApartmentTherapy)\ **Replies:** 0\ **Last updated:** [March 17, 2020, 7:51pm UTC](https://community.auth0.com/t/verifying-at-hash-on-rs256-id-token-without-access-token/39551 "2020-03-17T19:51:56Z")
Hi, I saw a couple of other similar questions to mine in the community db but no answers. Hoping someone can shed some light. I have a client app that’s using the node js library to authenticate a user. It receives and … --- ## [Access\_token using pkce](https://community.auth0.com/t/access-token-using-pkce/9522)
**Author:** [@rakesh\_agrawal](https://community.auth0.com/u/rakesh_agrawal)\ **Replies:** 1\ **Last updated:** [February 16, 2018, 11:35pm UTC](https://community.auth0.com/t/access-token-using-pkce/9522 "2018-02-16T23:35:19Z")
Hi, I am understanding the way to create access\_token using pkce. I found this link: Authorization Code Flow with Proof Key for Code Exchange (PKCE) - Auth0 Docs I notices that the access token which gets generated by… --- ## [Method to get new access\_token based on refresh\_token in PHP SDK](https://community.auth0.com/t/method-to-get-new-access-token-based-on-refresh-token-in-php-sdk/7721)
**Author:** [@patrick.brunmayr](https://community.auth0.com/u/patrick.brunmayr)\ **Replies:** 2\ **Last updated:** [February 9, 2018, 12:50pm UTC](https://community.auth0.com/t/method-to-get-new-access-token-based-on-refresh-token-in-php-sdk/7721 "2018-02-09T12:50:04Z")
Could not find any method in the PHP SDK that would generate a new access\_token based on the refresh\_token. Is there something missing ? How can i do that without doing manual CURL calls? --- ## [Strange access token returned by SAML](https://community.auth0.com/t/strange-access-token-returned-by-saml/7112)
**Author:** [@voodooless](https://community.auth0.com/u/voodooless)\ **Replies:** 2\ **Last updated:** [February 7, 2018, 8:05am UTC](https://community.auth0.com/t/strange-access-token-returned-by-saml/7112 "2018-02-07T08:05:48Z")
So I’ve set up and configured an SAML identity provider connection which connects to the system of a customer of ours. Using the “try it” button shows that it is correctly configured. We are using the /authorize endpoin… --- ## [401 when calling API (Spring) in a SPA (AngularJS)](https://community.auth0.com/t/401-when-calling-api-spring-in-a-spa-angularjs/9188)
**Author:** [@daniel.steger](https://community.auth0.com/u/daniel.steger)\ **Replies:** 2\ **Last updated:** [January 17, 2018, 9:44pm UTC](https://community.auth0.com/t/401-when-calling-api-spring-in-a-spa-angularjs/9188 "2018-01-17T21:44:53Z")
In my AngularJS SPA, the Implicit Grant flow is used. When a user logs in, the SPA gets an id\_token and an access\_token. When the SPA calls a simple Spring API that is protected, the header is set with the access\_token (… --- ## [Token verification on server side](https://community.auth0.com/t/token-verification-on-server-side/9076)
**Author:** [@priya.sharma.9362](https://community.auth0.com/u/priya.sharma.9362)\ **Replies:** 2\ **Last updated:** [December 28, 2017, 10:07pm UTC](https://community.auth0.com/t/token-verification-on-server-side/9076 "2017-12-28T22:07:26Z")
I am trying to verify access tokens from Auth0, using the Java SDK my question is whether it is fine to extract the Kid from the token itself and then get the public key based on that kid. Or we should store the kid lo… --- ## [Invalid certificate from jwks for signing JWT](https://community.auth0.com/t/invalid-certificate-from-jwks-for-signing-jwt/8908)
**Author:** [@justen](https://community.auth0.com/u/justen)\ **Replies:** 1\ **Last updated:** [December 28, 2017, 8:59pm UTC](https://community.auth0.com/t/invalid-certificate-from-jwks-for-signing-jwt/8908 "2017-12-28T20:59:34Z")
So this is for the situation where there is a change to the contents of the access\_token (eg. user updating name) which means i need to generate a new JWT access\_token. I have all the data for the new JWT I need to sig… --- ## [Setting scope in access\_token breaks id\_token](https://community.auth0.com/t/setting-scope-in-access-token-breaks-id-token/8965)
**Author:** [@gunnar.velle](https://community.auth0.com/u/gunnar.velle)\ **Replies:** 1\ **Last updated:** [December 21, 2017, 9:21pm UTC](https://community.auth0.com/t/setting-scope-in-access-token-breaks-id-token/8965 "2017-12-21T21:21:02Z")
I have a single page application and a backend application both registered as clients in Auth0. The SPA uses implicit grant to get id\_token and access\_token from Auth0. Kong validates the access\_token and sends the requ… --- ## [API calling return 401 when using access token return by Auth0.webAuth() login](https://community.auth0.com/t/api-calling-return-401-when-using-access-token-return-by-auth0-webauth-login/8904)
**Author:** [@haoyuant94718](https://community.auth0.com/u/haoyuant94718)\ **Replies:** 1\ **Last updated:** [December 7, 2017, 5:40pm UTC](https://community.auth0.com/t/api-calling-return-401-when-using-access-token-return-by-auth0-webauth-login/8904 "2017-12-07T17:40:22Z")
I follow the iOS quick start step by step to set up my app, and follow the quick start in the APIs section to create an API and set up my server. Then I try to follow this tutorial (https://auth0.com/docs/quickstart/nati… --- ## [AngularJS no longer getting back access token](https://community.auth0.com/t/angularjs-no-longer-getting-back-access-token/8828)
**Author:** [@samuel.duzett](https://community.auth0.com/u/samuel.duzett)\ **Replies:** 1\ **Last updated:** [November 27, 2017, 10:51pm UTC](https://community.auth0.com/t/angularjs-no-longer-getting-back-access-token/8828 "2017-11-27T22:51:46Z")
As of today, my AngularJS client’s .parseHash() function no longer gives me an accessToken (null), but it DOES give me an idToken. I don’t think I changed anything related to this, but am open to the possibility that som… --- ## [Do I need to store IDP access\_token + refresh\_token on my own, or I can use Auth0?](https://community.auth0.com/t/do-i-need-to-store-idp-access-token-refresh-token-on-my-own-or-i-can-use-auth0/8801)
**Author:** [@m.bellino](https://community.auth0.com/u/m.bellino)\ **Replies:** 1\ **Last updated:** [November 22, 2017, 7:27pm UTC](https://community.auth0.com/t/do-i-need-to-store-idp-access-token-refresh-token-on-my-own-or-i-can-use-auth0/8801 "2017-11-22T19:27:44Z")
After I successfully authenticate on an external IDP, I can use the Management API to retrieve the IDP access\_token and refresh\_token. Using the IDP access\_token I’ll be able to call the services provided by the IDP. A… [Next page](https://community.auth0.com/tag/access-token/171.md?match_all_tags=true&page=1&tags%5B%5D=access_token)