---
title: "Auth0 Metadata Explained: user_metadata vs app_metadata"
description: "Auth0’s user_metadata and app_metadata define a security boundary: user_metadata is writable by users through the update:current_user_metadata scope, while app_metadata requires privileged scopes available only to confidential clients via the client credentials grant. Post-login Actions reading authorization data like subscription plans or feature flags from user_metadata allow users to escalate privileges by modifying their own metadata, for example setting plan to enterprise and beta_access to true. Writing to app_metadata demands a server-side M2M application with update:users_app_metadata scope, which no public client or user token can obtain. The correct practice is to store access-control data such as roles, tenant membership, and IP allowlists in app_metadata, and non-sensitive preferences like theme or language in user_metadata. A third field, client_metadata, holds application-level properties readable via event.client.metadata in Actions."
---

# Auth0 Metadata Explained: user\_metadata vs app\_metadata

[Auth0](https://yomu.fyi/company/auth0) · Carla Urrea Stabile · Oct 5, 2026

**Type:** Explainer

## Summary

Auth0’s user\_metadata and app\_metadata define a security boundary: user\_metadata is writable by users through the update:current\_user\_metadata scope, while app\_metadata requires privileged scopes available only to confidential clients via the client credentials grant. Post-login Actions reading authorization data like subscription plans or feature flags from user\_metadata allow users to escalate privileges by modifying their own metadata, for example setting plan to enterprise and beta\_access to true. Writing to app\_metadata demands a server-side M2M application with update:users\_app\_metadata scope, which no public client or user token can obtain. The correct practice is to store access-control data such as roles, tenant membership, and IP allowlists in app\_metadata, and non-sensitive preferences like theme or language in user\_metadata. A third field, client\_metadata, holds application-level properties readable via event.client.metadata in Actions.

## Takeaways

- user\_metadata can be modified by users via the update:current\_user\_metadata scope obtained by public clients; app\_metadata cannot, as its write scopes (update:users, update:users\_app\_metadata) require the client credentials grant reserved for confidential clients.
- Storing authorization data such as subscription plans, feature flags, or IP allowlists in user\_metadata enables privilege escalation because users can update their own metadata without server-side approval.
- The correct architecture places access-control data in app\_metadata, updated only by server-side M2M applications, and non-sensitive user preferences in user\_metadata for user self-service.

## FAQ

### How can users modify their own metadata?

Users obtain a Management API token with the update:current\_user\_metadata scope, which Auth0 grants to public clients like SPAs or mobile apps. They then send a PATCH request to the /api/v2/users/{user\_id} endpoint with new user\_metadata values.

### Why shouldn't I store plan or feature flags in user\_metadata?

Because user\_metadata is writable by users. A user can change their plan to 'enterprise' or enable beta\_access themselves, and if your post-login Action reads from user\_metadata, the access token will include those elevated claims.

### How do I update app\_metadata from my backend?

Use a ManagementClient with client credentials from a server-side M2M application. The call requires the update:users or update:users\_app\_metadata scope, which is only available through the client credentials grant, not from user tokens.

**Tags:** [API](https://yomu.fyi/topic/api), [Auth0](https://yomu.fyi/topic/auth0), [Identity](https://yomu.fyi/topic/identity), [Security](https://yomu.fyi/topic/security)

- Source: [Auth0](https://auth0.com/blog/user-metadata-vs-app-metadata)
- Source URL: https://auth0.com/blog/user-metadata-vs-app-metadata
- Ingested by Yomu: 2026-10-05T18:00:10.448Z

[Read original post](https://auth0.com/blog/user-metadata-vs-app-metadata)