# \#token **URL:** https://community.auth0.com/tag/token/2.md [Latest](https://community.auth0.com/latest.md) · [Categories](https://community.auth0.com/categories.md) · [Tags](https://community.auth0.com/tags.md) --- ## [Receiving JWE token instead of JWT in Next.js app session](https://community.auth0.com/t/receiving-jwe-token-instead-of-jwt-in-next-js-app-session/167855)
**Author:** [@rsacks](https://community.auth0.com/u/rsacks)\ **Replies:** 6\ **Last updated:** [July 7, 2026, 11:06am UTC](https://community.auth0.com/t/receiving-jwe-token-instead-of-jwt-in-next-js-app-session/167855 "2026-07-07T11:06:13Z")
Hi, We are expecting, a JWT token. We can’t figure out why we are getting a JWE token instead. The only option I can find that would cause this is a plugin that is off. My understanding is JWT should be the default. I a… --- ## [The Many Faces of OAuth 2.0 Token Exchange](https://community.auth0.com/t/the-many-faces-of-oauth-2-0-token-exchange/200512)
**Author:** [@andrea.chiarelli](https://community.auth0.com/u/andrea.chiarelli)\ **Replies:** 1\ **Last updated:** [June 3, 2026, 4:22pm UTC](https://community.auth0.com/t/the-many-faces-of-oauth-2-0-token-exchange/200512 "2026-06-03T16:22:48Z")
Token exchange is a pattern that has multiple use cases. Learn what they are and what is the best approach in your own scenario by reading The Many Faces of OAuth 2.0 Token Exchange --- ## [Protect Your Access Tokens with DPoP (Demonstrating Proof of Possession)](https://community.auth0.com/t/protect-your-access-tokens-with-dpop-demonstrating-proof-of-possession/191057)
**Author:** [@andrea.chiarelli](https://community.auth0.com/u/andrea.chiarelli)\ **Replies:** 1\ **Last updated:** [August 25, 2025, 7:35am UTC](https://community.auth0.com/t/protect-your-access-tokens-with-dpop-demonstrating-proof-of-possession/191057 "2025-08-25T07:35:55Z")
Did you know you can bind an access token to the client application, improving its security? DPoP allows you to do this. Read more here. --- ## [Five Myths About JWTs Debunked](https://community.auth0.com/t/five-myths-about-jwts-debunked/190296)
**Author:** [@andrea.chiarelli](https://community.auth0.com/u/andrea.chiarelli)\ **Replies:** 1\ **Last updated:** [August 7, 2025, 10:13am UTC](https://community.auth0.com/t/five-myths-about-jwts-debunked/190296 "2025-08-07T10:13:54Z")
There are many myths surrounding JSON Web Tokens. This article attempts to debunk five of them. Check them out! --- ## [How do refresh token works in auth0 angular12 using auth0/auth0-angular?](https://community.auth0.com/t/how-do-refresh-token-works-in-auth0-angular12-using-auth0-auth0-angular/70984)
**Author:** [@ifour.purvi](https://community.auth0.com/u/ifour.purvi)\ **Replies:** 3\ **Last updated:** [March 16, 2024, 12:31am UTC](https://community.auth0.com/t/how-do-refresh-token-works-in-auth0-angular12-using-auth0-auth0-angular/70984 "2024-03-16T00:31:45Z")
Hi, I’m trying to use refreshed token for calling the backend API when existing token gets expired with auth0 in angular12 SPA, But i’m not finding any proper explanation in any documentation. I’ve tried calling getTo… --- ## [Encoded JWT token is more readable when I put on JWT.io which is effecting security](https://community.auth0.com/t/encoded-jwt-token-is-more-readable-when-i-put-on-jwt-io-which-is-effecting-security/122273)
**Author:** [@viplav.dube](https://community.auth0.com/u/viplav.dube)\ **Replies:** 1\ **Last updated:** [December 4, 2023, 1:03pm UTC](https://community.auth0.com/t/encoded-jwt-token-is-more-readable-when-i-put-on-jwt-io-which-is-effecting-security/122273 "2023-12-04T13:03:12Z")
Respected community, If I inspect the element, my JWT token is easily available on the UI side as a bearer token. Coping that code on JWT.io shows lots of valuable information that is easy to read. How should I prevent … --- ## [Refresh token implementation](https://community.auth0.com/t/refresh-token-implementation/99767)
**Author:** [@IsoardiMarius](https://community.auth0.com/u/IsoardiMarius)\ **Replies:** 2\ **Last updated:** [February 14, 2023, 10:13am UTC](https://community.auth0.com/t/refresh-token-implementation/99767 "2023-02-14T10:13:42Z")
Hello everyone, I thank you in advance for your patience and for the time you give me. I’ll explain my problem to you, I’d like to set up a refresh token, because currently, when a user logs in, the lifespan of the toke… --- ## [Load profile for Autho token aquisitions](https://community.auth0.com/t/load-profile-for-autho-token-aquisitions/97785)
**Author:** [@rohit.pandey](https://community.auth0.com/u/rohit.pandey)\ **Replies:** 1\ **Last updated:** [January 10, 2023, 12:13am UTC](https://community.auth0.com/t/load-profile-for-autho-token-aquisitions/97785 "2023-01-10T00:13:01Z")
Hi all, I really want to understand the load profile for oauth/token endpoint. Generally for Auth0 private cloud deployment model , how many token aquisitions can happen in a second. Also is there any limits on Ma… --- ## [MFA Challenge 'server\_error' 'Unauthorized'](https://community.auth0.com/t/mfa-challenge-server-error-unauthorized/79199)
**Author:** [@cam71101](https://community.auth0.com/u/cam71101)\ **Replies:** 6\ **Last updated:** [November 4, 2022, 2:06pm UTC](https://community.auth0.com/t/mfa-challenge-server-error-unauthorized/79199 "2022-11-04T14:06:39Z")
I have been trying to implement a custom MFA workflow in Auth0 using the details described on this page: https://auth0.com/docs/mfa/authenticate-with-ropg-and-mfa/enroll-challenge-sms-voice-authenticators 5 I have succe… --- ## [What's the type of auth0 refresh token, jwe?](https://community.auth0.com/t/whats-the-type-of-auth0-refresh-token-jwe/93029)
**Author:** [@yurou.cheng](https://community.auth0.com/u/yurou.cheng)\ **Replies:** 1\ **Last updated:** [October 27, 2022, 11:03pm UTC](https://community.auth0.com/t/whats-the-type-of-auth0-refresh-token-jwe/93029 "2022-10-27T23:03:22Z")
seems the refresh token we got is not jwt token, is there any doc to describe the type of auth0 refresh token? --- ## [Add user's email to accessToken using m2m login](https://community.auth0.com/t/add-users-email-to-accesstoken-using-m2m-login/90428)
**Author:** [@barriaandradedaniel](https://community.auth0.com/u/barriaandradedaniel)\ **Replies:** 1\ **Last updated:** [September 21, 2022, 12:49am UTC](https://community.auth0.com/t/add-users-email-to-accesstoken-using-m2m-login/90428 "2022-09-21T00:49:07Z")
Hi, im trying to insert the email into de accessToken. I’m using a m2m application. I created a Client Credentials exchange hooks, but in the base script I can’t see a params that actually add the user’s email. Please … --- ## [Add email of the user to the access-token using rules](https://community.auth0.com/t/add-email-of-the-user-to-the-access-token-using-rules/84111)
**Author:** [@naman.chaturvedi](https://community.auth0.com/u/naman.chaturvedi)\ **Replies:** 10\ **Last updated:** [June 2, 2022, 7:53pm UTC](https://community.auth0.com/t/add-email-of-the-user-to-the-access-token-using-rules/84111 "2022-06-02T19:53:47Z")
I am trying to add email of the user in the access\_token using an inbuilt rule. It is working while trying the rule but not working with the API. And the access token that I get from oauth/token endpoint doesn’t contain … --- ## [Id Token vs Access Token](https://community.auth0.com/t/id-token-vs-access-token/76821)
**Author:** [@kris.macgillivray](https://community.auth0.com/u/kris.macgillivray)\ **Replies:** 2\ **Last updated:** [January 27, 2022, 1:56pm UTC](https://community.auth0.com/t/id-token-vs-access-token/76821 "2022-01-27T13:56:29Z")
Trying to understand where to use Access Token vs ID token. Auth0 is setup as the SP for on Application. We have configured a SAML connection to our IDp (which is connected to our Internal Active Directory). The inter… --- ## [Changing default Access Token API (oauth/token)](https://community.auth0.com/t/changing-default-access-token-api-oauth-token/76719)
**Author:** [@willy](https://community.auth0.com/u/willy)\ **Replies:** 1\ **Last updated:** [January 21, 2022, 5:58pm UTC](https://community.auth0.com/t/changing-default-access-token-api-oauth-token/76719 "2022-01-21T17:58:50Z")
Hello there, I have a problem when calling the token endpoint following a connection. By default, the URL called is ‘oauth/token’, however, the API I am calling does not use this URL by default, and only uses ‘token’. … --- ## [How to fetch new token after updating user\_metadata in React](https://community.auth0.com/t/how-to-fetch-new-token-after-updating-user-metadata-in-react/65784)
**Author:** [@m.kuo5](https://community.auth0.com/u/m.kuo5)\ **Replies:** 9\ **Last updated:** [July 29, 2021, 8:35am UTC](https://community.auth0.com/t/how-to-fetch-new-token-after-updating-user-metadata-in-react/65784 "2021-07-29T08:35:21Z")
Hi there, I am running React on the frontend and Node on the backend. I am updating my user\_metadata by a POST request to the backend and then updating user\_metadata with a patch method to the users endpoint with a Man… --- ## [Custom Parameters not available in Rules context while using gettokensilently()](https://community.auth0.com/t/custom-parameters-not-available-in-rules-context-while-using-gettokensilently/62885)
**Author:** [@harigovind2295](https://community.auth0.com/u/harigovind2295)\ **Replies:** 3\ **Last updated:** [May 21, 2021, 4:48pm UTC](https://community.auth0.com/t/custom-parameters-not-available-in-rules-context-while-using-gettokensilently/62885 "2021-05-21T16:48:07Z")
Hi Team, I am using auth0-spa-js library in my React app . Once after authenticating initially, I want to generate access tokens for other users as part of my requirement , for which I need to add different email addre… --- ## [MFA token expiry?](https://community.auth0.com/t/mfa-token-expiry/59901)
**Author:** [@thankfulpanda](https://community.auth0.com/u/thankfulpanda)\ **Replies:** 3\ **Last updated:** [April 2, 2021, 6:22pm UTC](https://community.auth0.com/t/mfa-token-expiry/59901 "2021-04-02T18:22:27Z")
Hello, community! I’m looking at the docs to obtain a MFA token: To call the MFA API to manage enrollments, you first need to obtain an access token for the MFA API … If you are building a user interface to manage aut… --- ## [Login via API with Custom Domains - invalid domain x for clientId y](https://community.auth0.com/t/login-via-api-with-custom-domains-invalid-domain-x-for-clientid-y/60042)
**Author:** [@Fenio](https://community.auth0.com/u/Fenio)\ **Replies:** 2\ **Last updated:** [March 25, 2021, 10:44am UTC](https://community.auth0.com/t/login-via-api-with-custom-domains-invalid-domain-x-for-clientid-y/60042 "2021-03-25T10:44:07Z")
Hi!, I have introduced custom domain in Auth0. For the sake of the discussion, let’s say that my auth0 domain was: rafal.eu.auth0.com and custom domain is login.rafal.com Before custom domains, I used ${auth0.domain… --- ## [Auth0-react won't refresh access tokens in mobile Safari with refresh tokens enabled](https://community.auth0.com/t/auth0-react-wont-refresh-access-tokens-in-mobile-safari-with-refresh-tokens-enabled/58065)
**Author:** [@bayuser](https://community.auth0.com/u/bayuser)\ **Replies:** 8\ **Last updated:** [February 22, 2021, 9:00pm UTC](https://community.auth0.com/t/auth0-react-wont-refresh-access-tokens-in-mobile-safari-with-refresh-tokens-enabled/58065 "2021-02-22T21:00:13Z")
Please include the following information in your post: Which SDK this is regarding: e.g. auth0-node auth0-react SDK Version: e.g. 2.29.0 1.2.0 Platform Version: e.g. Node 12.19.0 Browser (Mobile Safari, iOS 14) C… --- ## ["Default" API with auto-generated client - curl 401](https://community.auth0.com/t/default-api-with-auto-generated-client-curl-401/57087)
**Author:** [@Gobelet](https://community.auth0.com/u/Gobelet)\ **Replies:** 1\ **Last updated:** [February 2, 2021, 3:44pm UTC](https://community.auth0.com/t/default-api-with-auto-generated-client-curl-401/57087 "2021-02-02T15:44:02Z")
Hi, I’ve created a free account to test and have an overview on Auth0. To do that I’ve simply created a new API. From what I saw it automatically created a new client (test) for my API. When I go on that client → “Qu… --- ## [Reload Angular page causes user to login again](https://community.auth0.com/t/reload-angular-page-causes-user-to-login-again/55733)
**Author:** [@tom.schreck](https://community.auth0.com/u/tom.schreck)\ **Replies:** 2\ **Last updated:** [January 5, 2021, 10:38pm UTC](https://community.auth0.com/t/reload-angular-page-causes-user-to-login-again/55733 "2021-01-05T22:38:04Z")
I’m using @auth0/auth0-angular v ^1.3.1 to implement Auth0 inside my Angular SPA. I’m trying to make the user’s session sticky so if the app reloads the user is not taken to login. I found a similar question below: I… --- ## [Session not persisting using cacheLocation: localstorage](https://community.auth0.com/t/session-not-persisting-using-cachelocation-localstorage/55364)
**Author:** [@garym](https://community.auth0.com/u/garym)\ **Replies:** 3\ **Last updated:** [December 31, 2020, 9:07pm UTC](https://community.auth0.com/t/session-not-persisting-using-cachelocation-localstorage/55364 "2020-12-31T21:07:34Z")
I have authentication with claims working except sessions are not persisting when refreshing the browser. I’m using auth0-spa-js with vanlilla JS (well, Svelte actually), I have cacheLocation: "localstorage" when calli… --- ## [Is RFC 8693 OAuth 2.0 Token Exchange coming?](https://community.auth0.com/t/is-rfc-8693-oauth-2-0-token-exchange-coming/51434)
**Author:** [@mschenk](https://community.auth0.com/u/mschenk)\ **Replies:** 2\ **Last updated:** [October 14, 2020, 2:18pm UTC](https://community.auth0.com/t/is-rfc-8693-oauth-2-0-token-exchange-coming/51434 "2020-10-14T14:18:12Z")
This topic from the beginning of this year indicated support for RFC 8693 was in progress, but I haven’t seen any update or announcement about it since then. Is it still coming? --- ## [Calling internal API services from public API service with user context](https://community.auth0.com/t/calling-internal-api-services-from-public-api-service-with-user-context/45753)
**Author:** [@Beezlabs](https://community.auth0.com/u/Beezlabs)\ **Replies:** 0\ **Last updated:** [July 3, 2020, 9:46am UTC](https://community.auth0.com/t/calling-internal-api-services-from-public-api-service-with-user-context/45753 "2020-07-03T09:46:56Z")
Hi We are having a microservice based architecture for our application which has a single frontend. This frontend will always talk to a single backend service, which provides a public API. So, the frontend and the backe… --- ## [Refresh API Management Token on NodeJS](https://community.auth0.com/t/refresh-api-management-token-on-nodejs/38157)
**Author:** [@hugo.delacruz](https://community.auth0.com/u/hugo.delacruz)\ **Replies:** 1\ **Last updated:** [February 20, 2020, 8:12pm UTC](https://community.auth0.com/t/refresh-api-management-token-on-nodejs/38157 "2020-02-20T20:12:27Z")
Hello guys, I am looking for a way to programmatically refresh/renew my token on the backend. I have the following situation: When a user is created on the backend of my platform, I call the API Management of Auth0 to c… --- ## [Migrating user identities from one domain to another](https://community.auth0.com/t/migrating-user-identities-from-one-domain-to-another/24064)
**Author:** [@AuthR](https://community.auth0.com/u/AuthR)\ **Replies:** 3\ **Last updated:** [April 19, 2019, 10:04pm UTC](https://community.auth0.com/t/migrating-user-identities-from-one-domain-to-another/24064 "2019-04-19T22:04:43Z")
Hi, I’m considering using Auth0 to manage identities of all users on my website (let us call it x.com). Later, if I wish to migrate my users to a new website (say y.com), I’d like the process to be relatively straightfo… --- ## [Create User then Login returns 401](https://community.auth0.com/t/create-user-then-login-returns-401/12862)
**Author:** [@jt.turner](https://community.auth0.com/u/jt.turner)\ **Replies:** 2\ **Last updated:** [July 6, 2018, 4:26pm UTC](https://community.auth0.com/t/create-user-then-login-returns-401/12862 "2018-07-06T16:26:11Z")
I am just playing around with adding Auth0 into an existing app. Since we are going through our own backend I was using the management API to create a user. Then I turn around and log them in using the authentication API… --- ## [Verifying RS256 token using downloaded certificate](https://community.auth0.com/t/verifying-rs256-token-using-downloaded-certificate/8135)
**Author:** [@patrickrainier](https://community.auth0.com/u/patrickrainier)\ **Replies:** 7\ **Last updated:** [February 12, 2018, 4:51pm UTC](https://community.auth0.com/t/verifying-rs256-token-using-downloaded-certificate/8135 "2018-02-12T16:51:58Z")
I am able to successfully verify a RS256 token using the public key I extracted from the certificate which I downloaded on the clients page then I just passed that in my app as the secret. I am aware that the standard fo… --- ## [Session maintenance at Auth0](https://community.auth0.com/t/session-maintenance-at-auth0/9009)
**Author:** [@priya.sharma.9362](https://community.auth0.com/u/priya.sharma.9362)\ **Replies:** 7\ **Last updated:** [January 31, 2018, 4:17pm UTC](https://community.auth0.com/t/session-maintenance-at-auth0/9009 "2018-01-31T16:17:26Z")
I am working with the JAVA SDK for triggering login and other operations. I would like to know whether every new login request triggers the creation of a new session at Auth0 or it just picks something from the existing… --- ## [How does a SAML token look like? How to add some information to it?](https://community.auth0.com/t/how-does-a-saml-token-look-like-how-to-add-some-information-to-it/9281)
**Author:** [@manuelgr77](https://community.auth0.com/u/manuelgr77)\ **Replies:** 1\ **Last updated:** [December 14, 2018, 6:11pm UTC](https://community.auth0.com/t/how-does-a-saml-token-look-like-how-to-add-some-information-to-it/9281 "2018-12-14T18:11:14Z")
Hi guys In the project I’m currently working on we are developing a web application which uses Auth0 to authenticate its users. We want to add a external Identity Provider to authenticate users with Auth0 operating as a… [Next page](https://community.auth0.com/tag/token/2.md?match_all_tags=true&page=1&tags%5B%5D=token)