---
title: "Five Reasons Why Your Auth0 Permissions Are Not in your Access Token"
description: "Auth0 access tokens can lack a permissions claim despite apparently configured RBAC, and the post identifies five silent causes. The authorization request may omit the API audience, the API’s “Add Permissions in the Access Token” setting may be disabled, or a permission-bearing role may not be assigned to the user, including at the relevant organization level. Developers may also be decoding an ID token rather than the API access token, whose aud identifies the API. Client Credentials tokens represent applications rather than users and typically carry granted scopes instead of a permissions array. For custom Post-Login claims, the post advises using a namespaced claim rather than colliding with Auth0’s reserved permissions claim."
---

# Five Reasons Why Your Auth0 Permissions Are Not in your Access Token

[Auth0](https://yomu.fyi/company/auth0) · Carla Urrea Stabile · Sep 3, 2026

**Type:** Explainer

## Summary

Auth0 access tokens can lack a permissions claim despite apparently configured RBAC, and the post identifies five silent causes. The authorization request may omit the API audience, the API’s “Add Permissions in the Access Token” setting may be disabled, or a permission-bearing role may not be assigned to the user, including at the relevant organization level. Developers may also be decoding an ID token rather than the API access token, whose aud identifies the API. Client Credentials tokens represent applications rather than users and typically carry granted scopes instead of a permissions array. For custom Post-Login claims, the post advises using a namespaced claim rather than colliding with Auth0’s reserved permissions claim.

## Context

The problem is an empty or missing permissions array in an Auth0 token after RBAC, permissions, roles, and token requests appear to have been configured. The post notes that these causes are silent and can produce the same symptom, including differences between tenant and organization roles and between user-based and application-based flows.

## Approach / What changed

The post presents five diagnostic checks in order: verify the authorization audience, enable both API RBAC settings, confirm the role is assigned to the user in the relevant scope, distinguish the access token from the ID token, and handle Client Credentials tokens through scopes. It also recommends namespaced custom claims when permissions are added through a Post-Login Action.

## Takeaways

- An authorization request without an audience produces an opaque token; the audience must exactly match the Auth0 API Identifier, including any trailing slash.
- Client Credentials tokens represent applications, so M2M authorization uses API-granted scopes and a scope claim rather than user roles and a permissions array.
- Permissions added through a Post-Login Action should use an application-specific namespaced claim instead of Auth0’s reserved permissions claim.

**Tags:** [Auth0](https://yomu.fyi/topic/auth0), [Authentication](https://yomu.fyi/topic/authentication), [OAuth2](https://yomu.fyi/topic/oauth2)

- Source: [Auth0](https://auth0.com/blog/five-reasons-permissions-not-in-access-token)
- Source URL: https://auth0.com/blog/five-reasons-permissions-not-in-access-token
- Ingested by Yomu: 2026-09-03T16:00:47.358Z

[Read original post](https://auth0.com/blog/five-reasons-permissions-not-in-access-token)