Using the node-auth0 package, had connections working properly, but am now attempting to do some work with roles and have added the read:roles scope, which now results in an error.

Minimal code below:

const ManagementClient = require('auth0').ManagementClient;
const auth0 = new ManagementClient(
    {
        domain: process.env.AUTH0_DOMAIN,
        clientId: process.env.AUTH0_CLIENT_ID,
        clientSecret: process.env.AUTH0_CLIENT_SECRET,
        scope: 'read:users update:users read:roles'
    });

// both these calls fail
const auth0_roles = auth0.roles.getAll();
const auth0_tester = auth0.users.create(data);

Now the calls to EITHER roles or users fail with this error:

{"error":"access_denied","error_description":"Client has not been granted scopes: read:roles"}

If I remove read:roles from the scope, the create user call succeeds (but obviously the roles.getAll fails)

I've checked my API permissions in the dashboard (APIs => Auth0 Management API => Permissions), and it appears to include everything:

(NOTE: there's a message at the top of the permissions that indicates Important: Permission Management is not available for APIs representing Auth0 Resources. - and I am NOT able to change permissions )

Using the node-auth0 package, had connections working properly, but am now attempting to do some work with roles and have added the read:roles scope, which now results in an error.

Minimal code below:

const ManagementClient = require('auth0').ManagementClient;
const auth0 = new ManagementClient(
    {
        domain: process.env.AUTH0_DOMAIN,
        clientId: process.env.AUTH0_CLIENT_ID,
        clientSecret: process.env.AUTH0_CLIENT_SECRET,
        scope: 'read:users update:users read:roles'
    });

// both these calls fail
const auth0_roles = auth0.roles.getAll();
const auth0_tester = auth0.users.create(data);

Now the calls to EITHER roles or users fail with this error:

{"error":"access_denied","error_description":"Client has not been granted scopes: read:roles"}

If I remove read:roles from the scope, the create user call succeeds (but obviously the roles.getAll fails)

I've checked my API permissions in the dashboard (APIs => Auth0 Management API => Permissions), and it appears to include everything:

(NOTE: there's a message at the top of the permissions that indicates Important: Permission Management is not available for APIs representing Auth0 Resources. - and I am NOT able to change permissions )

• javascript
• node.js
• auth0

2 Answers 2

Per my comment to Shayan's excellent answer, I'd actually been in that area of the Auth0 dashboard many times and had missed the magic link.

The image below shows where you have to click in order to set the client grants you want the application to have.

You cannot change add/edit/remove permissions for your Management API resource because as the dashboard message says: It is an Auth0 resource server with the identifier/audience as https://YOUR_DOMAIN.REGION.auth0.com/api/v2/. The scopes are managed by Auth0. You can however modify what scopes are granted to your Server-side Clients i.e Machine-to-Machine or Web Application client types, and limit what they can request when using Client Credentials grant to request an Access Token for an API.

In the same section under Management API resource settings, besides the "Permissions" tab, you can open "Machine to Machine Applications" tab, find your clientID and make sure it is authorized to request the scopes it requires for that API resource (eg. the read:roles scope). These are called Client Grants and you can manage them from Dashboard or Management API: https://auth0.com/docs/api/management/v2#!/Client_Grants/get_client_grants

Auth0 has a Client Credential Hook you can utilize for more specific logic in your flow, read more here: https://auth0.com/docs/api-auth/tutorials/client-credentials/customize-with-hooks