Validate an Access Token
Authorization refers to the process of verifying what a user has access to. While often used interchangeably with authentication, authorization represents a fundamentally different function.
In authorization, a user or application is granted access to an API after the API determines the extent of the permissions that it should assign. Usually, authorization occurs after identity is successfully validated through authentication so that the API has some idea of what sort of access it should grant. For a comparison of authorization and authentication, see Authentication and Authorization.
Authorization can be determined through the use of policies and rules, which can be used with role-based access control (RBAC). Regardless of whether RBAC is used, requested access is transmitted to the API via JSON Web Token (JWT)scopes and granted access is returned in the issued scopesAccess Tokens.
Since only the API can know all of the possible actions that it can handle, it should have its own internal access control system in which it defines its own permissions. To determine a calling application's effective permissions, an API should combine incoming scopes with the permissions assigned within its own internal access control system and make access control decisions accordingly.
Opaque Access Tokens
Role-based access control in Auth0
Currently, we provide two ways of implementing role-based access control (RBAC), which you can use in place of or in combination with your API's own internal access control system:
We are expanding our Authorization Core feature set to match the functionality of the Authorization Extension and expect a final release in 2020. Our new core RBAC implementation improves performance and scalability and will eventually provide a more flexible RBAC system than the Authorization Extension.
For now, both implement the key features of RBAC and allow you to restrict the custom scopes defined for an API to those that have been assigned to the user as permissions. For a comparison, see Authorization Core vs. Authorization Extension.
JSON Web Token (JWT) Access Tokens
- Role-Based Access Control (RBAC)
- Authorization Policies
- Sample Use Cases: Role-Based Access Control
- Sample Use Cases: Rules with Authorization
- How to Use Auth0's Core Authorization Feature Set
- Authorization Core vs. Authorization Extension
- Authorization Extension
- Troubleshooting: Role-Based Access Control and Authorization