Check API Calls
Check Management API calls
Do you have a Management API Access Token?
Did the Access Token expire?
Did the Access Token contain the scopes needed for the call you made?
If a rule adjusts the scopes in the Access Token or checks whether specific users are allowed to have the scopes, have you checked the rule to make sure it is executing correctly?
If you are calling the Auth0 Management API from an application that authenticates with Client Credentials Flow, note that rules are not executed in this context. The Client Credentials Exchange Hook can be used in this context instead, for functionality similar to a rule.
Check other API calls
Check in the HAR file if the Access Token contains correct scopes to call the API.
Check if the response to the
/authorizeendpoint call contains a scopes object. If so, check if the returned scopes are different from the requested scopes.
Make sure your API can validate the Access Token. It should validate the audience, issuer, client (if any), signature algorithm, signature, claims and permissions.
If you experience errors with Access Token expiration, they could be caused by clock skew differences manifested across different systems or even different language libraries, such as Java and Node.js. This can be handled by running NTP on servers and configuring a clock skew tolerance in libraries used to validate tokens such as jwt.verify.