A Developer's Guide to API Access Policies in Auth0

Summary

Auth0 API Access Policies for Applications control whether an application can obtain an access token for a registered API, separately for user-delegated and client access. The FinFlow example separates a browser application that should reach both APIs from a machine-to-machine Risk Engine restricted to the Payments API. Policies provide three choices—allow_all, require_client_grant, and deny_all—while client grants specify an application's audience and permitted scopes, with the audience determining which API policy is evaluated. The guide shows Dashboard and Management API configuration, including subject_type_authorization settings and grants for user and client access. It also explains that third-party applications still require grants under allow_all, while default third-party grants establish a baseline and per-application grants take precedence for exceptions.

Takeaways

1. 1

   require_client_grant allows token issuance only when a matching client grant exists, while deny_all rejects access regardless of grants and allow_all skips grant checks for user access.

2. 2

   In the FinFlow configuration, the Risk Engine receives a client grant for the Payments API, the web app receives a user grant for that API, and client access to the Market Data API is denied.

3. 3

   A default third-party client grant can establish baseline scopes for partner applications, while a per-application grant takes precedence when an individual partner needs different permissions.