---
title: "A Developer's Guide to API Access Policies in Auth0"
description: "Auth0 API Access Policies for Applications control whether an application can obtain an access token for a registered API, separately for user-delegated and client access. The FinFlow example separates a browser application that should reach both APIs from a machine-to-machine Risk Engine restricted to the Payments API. Policies provide three choices—allow_all, require_client_grant, and deny_all—while client grants specify an application's audience and permitted scopes, with the audience determining which API policy is evaluated. The guide shows Dashboard and Management API configuration, including subject_type_authorization settings and grants for user and client access. It also explains that third-party applications still require grants under allow_all, while default third-party grants establish a baseline and per-application grants take precedence for exceptions."
---

# A Developer's Guide to API Access Policies in Auth0

[Auth0](https://yomu.fyi/company/auth0) · Madhuri Ravindra Mohan · Sep 11, 2026

**Type:** Tutorial

## Summary

Auth0 API Access Policies for Applications control whether an application can obtain an access token for a registered API, separately for user-delegated and client access. The FinFlow example separates a browser application that should reach both APIs from a machine-to-machine Risk Engine restricted to the Payments API. Policies provide three choices—allow\_all, require\_client\_grant, and deny\_all—while client grants specify an application's audience and permitted scopes, with the audience determining which API policy is evaluated. The guide shows Dashboard and Management API configuration, including subject\_type\_authorization settings and grants for user and client access. It also explains that third-party applications still require grants under allow\_all, while default third-party grants establish a baseline and per-application grants take precedence for exceptions.

## Context

FinFlow needs to control which of its browser and machine-to-machine applications can access two APIs with different sensitivity levels, while distinguishing user-delegated access from client access.

## Approach / What changed

Configure per-API user and client policies through the Auth0 Dashboard or Management API, then create client grants that authorize applications, audiences, access types, and scopes. Default third-party grants can provide a baseline, with per-application grants overriding that baseline.

## Takeaways

- require\_client\_grant allows token issuance only when a matching client grant exists, while deny\_all rejects access regardless of grants and allow\_all skips grant checks for user access.
- In the FinFlow configuration, the Risk Engine receives a client grant for the Payments API, the web app receives a user grant for that API, and client access to the Market Data API is denied.
- A default third-party client grant can establish baseline scopes for partner applications, while a per-application grant takes precedence when an individual partner needs different permissions.

**Tags:** [API](https://yomu.fyi/topic/api), [Auth0](https://yomu.fyi/topic/auth0), [Authentication](https://yomu.fyi/topic/authentication), [OAuth 2.0](https://yomu.fyi/topic/oauth-2-0)

- Source: [Auth0](https://auth0.com/blog/developers-guide-api-access-policies-auth0)
- Source URL: https://auth0.com/blog/developers-guide-api-access-policies-auth0
- Ingested by Yomu: 2026-09-11T16:01:02.150Z

[Read original post](https://auth0.com/blog/developers-guide-api-access-policies-auth0)