# \#oauth-2-0 **URL:** https://community.auth0.com/tag/oauth-2-0/2061.md [Latest](https://community.auth0.com/latest.md) · [Categories](https://community.auth0.com/categories.md) · [Tags](https://community.auth0.com/tags.md) --- ## [Unable to get a token on behalf of a user. "Client must be a Custom API Client with resource\_server\_id"](https://community.auth0.com/t/unable-to-get-a-token-on-behalf-of-a-user-client-must-be-a-custom-api-client-with-resource-server-id/200896)
**Author:** [@dave.natalie](https://community.auth0.com/u/dave.natalie)\ **Replies:** 1\ **Last updated:** [June 17, 2026, 5:35pm UTC](https://community.auth0.com/t/unable-to-get-a-token-on-behalf-of-a-user-client-must-be-a-custom-api-client-with-resource-server-id/200896 "2026-06-17T17:35:28Z")
I am following the documentation here. When I send the token request, I get the following response. { "error": "invalid\_request", "error\_description": "Client must be a Custom API Client with resource\_server\_… --- ## [JWKS Caching Strategy Recommendations](https://community.auth0.com/t/jwks-caching-strategy-recommendations/183415)
**Author:** [@FrostbyteApps](https://community.auth0.com/u/FrostbyteApps)\ **Replies:** 5\ **Last updated:** [March 27, 2025, 3:46pm UTC](https://community.auth0.com/t/jwks-caching-strategy-recommendations/183415 "2025-03-27T15:46:53Z")
When looking at the cache control headers for the JWKS endpoints of my project, I receive the following values… public, max-age=15, stale-while-revalidate=15, stale-if-error=86400 This cache control leads me to believe… --- ## [How to set audience in application M2M](https://community.auth0.com/t/how-to-set-audience-in-application-m2m/185162)
**Author:** [@renan.padilha](https://community.auth0.com/u/renan.padilha)\ **Replies:** 1\ **Last updated:** [April 8, 2025, 5:50pm UTC](https://community.auth0.com/t/how-to-set-audience-in-application-m2m/185162 "2025-04-08T17:50:19Z")
Hello, I am trying to configure an application M2M accessing a Resource Server configuring Spring 3.4.4 with Java 21. I am trying to implement oAuth2Client lib (spring-security-oauth2-client) of Spring, but there is no… --- ## [To visually verify RS256-signed tokens](https://community.auth0.com/t/to-visually-verify-rs256-signed-tokens/136592)
**Author:** [@martin617](https://community.auth0.com/u/martin617)\ **Replies:** 1\ **Last updated:** [June 26, 2024, 7:24pm UTC](https://community.auth0.com/t/to-visually-verify-rs256-signed-tokens/136592 "2024-06-26T19:24:38Z")
Hello, On the Auth0 documentation page ‘Validate JSON Web Tokens’ (https://auth0.com/docs/secure/tokens/json-web-tokens/validate-json-web-tokens), it would have saved me a few hours of time if the instruction steps in t… --- ## [Adding permissions in ID token](https://community.auth0.com/t/adding-permissions-in-id-token/130106)
**Author:** [@ahmed.mekliov](https://community.auth0.com/u/ahmed.mekliov)\ **Replies:** 5\ **Last updated:** [March 29, 2024, 8:43pm UTC](https://community.auth0.com/t/adding-permissions-in-id-token/130106 "2024-03-29T20:43:07Z")
Is it considered bad practice in terms of OAuth2 specification to add roles/permissions in ID token? --- ## [RFC for \`screen\_hint\` parameter](https://community.auth0.com/t/rfc-for-screen-hint-parameter/121590)
**Author:** [@jozefizso](https://community.auth0.com/u/jozefizso)\ **Replies:** 2\ **Last updated:** [November 29, 2023, 8:05pm UTC](https://community.auth0.com/t/rfc-for-screen-hint-parameter/121590 "2023-11-29T20:05:40Z")
Hi, I checked the screen\_hint parameter which is used for the Signup URLs. Is this parameter specified in some RFC and will it be documented in the OAuth parameters at OAuth Parameters ? --- ## [What's the difference between \`oauth2-token-exchange\`, \`oauth2-access-token\` and \`oauth2-refresh-token\`](https://community.auth0.com/t/whats-the-difference-between-oauth2-token-exchange-oauth2-access-token-and-oauth2-refresh-token/117398)
**Author:** [@Will956](https://community.auth0.com/u/Will956)\ **Replies:** 1\ **Last updated:** [September 29, 2023, 5:14pm UTC](https://community.auth0.com/t/whats-the-difference-between-oauth2-token-exchange-oauth2-access-token-and-oauth2-refresh-token/117398 "2023-09-29T17:14:24Z")
Hello :wave: I’m looking at the authentication protocol object from the post-login action and I’m wondering what is the difference between those 3 values: oauth2-refresh-token oauth2-access-token oauth2-token-exchange … --- ## [Redirecting Users to Different Web Applications After Universal Login](https://community.auth0.com/t/redirecting-users-to-different-web-applications-after-universal-login/114430)
**Author:** [@leonardo.lombardi](https://community.auth0.com/u/leonardo.lombardi)\ **Replies:** 1\ **Last updated:** [August 25, 2023, 4:22pm UTC](https://community.auth0.com/t/redirecting-users-to-different-web-applications-after-universal-login/114430 "2023-08-25T16:22:49Z")
Hello Auth0 Community, I have set up a single Auth0 tenant that serves two distinct web applications. These applications are hosted on different domains, let’s say app1.com and app2.com. I aim to implement a Universal … --- ## [Spa oauth flow without user authentication prompt](https://community.auth0.com/t/spa-oauth-flow-without-user-authentication-prompt/107398)
**Author:** [@tojeffraymond](https://community.auth0.com/u/tojeffraymond)\ **Replies:** 1\ **Last updated:** [May 19, 2023, 6:39pm UTC](https://community.auth0.com/t/spa-oauth-flow-without-user-authentication-prompt/107398 "2023-05-19T18:39:56Z")
HELLO, Our web application development partner for our company’s portal has developed an authentication middleware within the Netlity CDN to authenticate our SPA web application before it reaches the backend API via the… --- ## [Limit Client requests on Machine to Machine flow](https://community.auth0.com/t/limit-client-requests-on-machine-to-machine-flow/104083)
**Author:** [@niall](https://community.auth0.com/u/niall)\ **Replies:** 2\ **Last updated:** [April 4, 2023, 3:50pm UTC](https://community.auth0.com/t/limit-client-requests-on-machine-to-machine-flow/104083 "2023-04-04T15:50:47Z")
Customer is looking to limit the number of token requests on a client by client basis. The intention is to ensure no single client can consume the rate limit for a particular api. I can’t see any options to limit from t… --- ## [Verify RS256-signed JWT tokens](https://community.auth0.com/t/verify-rs256-signed-jwt-tokens/103303)
**Author:** [@igor.tretyakov](https://community.auth0.com/u/igor.tretyakov)\ **Replies:** 1\ **Last updated:** [March 29, 2023, 7:36pm UTC](https://community.auth0.com/t/verify-rs256-signed-jwt-tokens/103303 "2023-03-29T19:36:13Z")
Hi. The article (Validate JSON Web Tokens) says about Public Key. But this key is missing there. Also I checked the Signing Certificate and got OpenSSL::PKey::RSAError: Neither PUB key nor PRIV key: nested asn1 erro… --- ## [Get Token from API using Postman](https://community.auth0.com/t/get-token-from-api-using-postman/95647)
**Author:** [@murilo.gamboa.melo](https://community.auth0.com/u/murilo.gamboa.melo)\ **Replies:** 3\ **Last updated:** [December 8, 2022, 8:24pm UTC](https://community.auth0.com/t/get-token-from-api-using-postman/95647 "2022-12-08T20:24:57Z")
I’m trying to get the Bearer Token by using Postman, but after I’ve configured it, the only thing I keep receiving is a “Oops, something went wrong” message. Here’s my configuration: For my env variables, I just c…