Setting Custom Permissions for an Auth0 Management API Access Token
Last Updated:
Overview
Auth0 does not support adding custom permissions to the Auth0 Management API because administrators must use the Management API token only against Auth0 endpoints. Creating a separate API in the Auth0 Dashboard with a custom audience allows administrators to utilize custom permissions.
Applies To
- Auth0
- Application Programming Interface (API)
- Management API
- Custom Scopes
- Custom Permissions
Solution
How are custom permissions set for an API access token?
The Auth0 Management API is a dedicated API service that manages the Auth0 tenant. Auth0 does not support adding custom permissions to this API. Administrators must use the token issued for the Management API only against Auth0 endpoints. Auth0 ignores any requested unsupported scopes during authentication.
To implement custom permissions for a custom API server, create a separate new API with a different audience. Creating a separate API enables the addition of custom permissions tailored to specific API server requirements.
