How to get a list of users in Auth0?

Essay97 0
Viewed 19

I am writing a REST API and I want to authenticate users with Auth0. I also wanted the users to be able to get a list of all the users registered in the tenant (just basic information, maybe even just username) and I saw that there is Management API for this.

I'm a bit confused about how to grant read access to the Management API to all the users, but I thought about a couple of possibilities:

  1. grant read access to each single user
  2. expose endpoints in my API to proxy requests towards Management API, so that I can use client credentials grant
  3. use a post login action that adds basic user information to my private database (I don't like this, I'm foreshadowing sync issues)

Which one should I use (or maybe a further one)? I'd also appreciate basic guidance on the solution that you suggest. Thanks!

auth0 authentication
1 Answers

You should not need to grant your users access to your management api. Instead you should use your client credentials to get an auth token to use for this. In fact, the Auth0 docs have recommendations about how to use the management api in your application.

If you wanted to add user authorization on the routes that use the management, you can simply verify tokens and user roles as you do on other routes of your API. But you (typically) shouldn't use the user tokens as your tokens to access the management api.

tim1170
Related