Check API Calls

Do you have a Management API Access Token?

Did the access token expire?

Did the access token contain the scopes needed for the call you made?

If a rule adjusts the scopes in the access token or checks whether specific users are allowed to have the scopes, have you checked the rule to make sure it is executing correctly?

Get the access token from a HAR file and test it in the Auth0 Management API Explorer to see if it works there.

If you are calling the Auth0 Management API from an application that authenticates with Client Credentials Flow, note that rules are not executed in this context. For functionality similar to a Rule, an Action in the Machine to Machine Flow on the credentials-exchange trigger can be used in this context instead.

Check in the HAR file if the access token contains correct scopes to call the API.

Check if the response to the /authorize endpoint call contains a scopes object. If so, check if the returned scopes are different from the requested scopes.

Make sure your API can validate the Access Token. It should validate the audience, issuer, client (if any), signature algorithm, signature, claims and permissions.

If you experience errors with access token expiration, they could be caused by clock skew differences manifested across different systems or even different language libraries, such as Java and Node.js. This can be handled by running NTP on servers and configuring a clock skew tolerance in libraries used to validate tokens such as jwt.verify.