title: FastApi Auth0 authrization with SinglePageApplications
body: <p>I managed to make it work getting the Token going into Auth0 Dashboard and copying it.</p>
  <p>However, I need to link the authentication to the LogIn Box that uses a SinglePageApplication (SPA).</p>
  <p>As far far as I understand, the Apis are accessed from SPA with the Implicit Grant but I don't know how to do it.</p>
  <p>The JWT that I get when I log into the LogIn Box (using a user in the Tenant Database) is bigger than the JWT in the 'Test Section' of the API.
  And when I do a POST request to my API endpoint with a Header 'Bearer JWTtoken' I get &quot;Invalid issuer&quot; and/or &quot;Invalid audience&quot;</p>
  <p>Any ideas?</p>
  <p>EDIT:</p>
  <p>app.py</p>
  <pre><code>STAGE = os.environ.get(&quot;STAGE&quot;)
  app = FastAPI(title=&quot;FastAPI x AWS Lambda&quot;)
  #######################################
  
  token_auth_scheme = HTTPBearer()
  async def authorize(token: str= Depends(token_auth_scheme)):
      result = VerifyToken(token.credentials).verify()
      if result.get(&quot;status&quot;):
          raise HTTPException(HTTPStatus.FORBIDDEN, detail=result)
  
  ############################################
  #Test endpoint
  @app.get(&quot;/hello&quot;)
  async def hello_api(name: str = &quot;World&quot;, token: str= Depends(token_auth_scheme)):
      result = VerifyToken(token.credentials).verify()  #  updated code
      if result.get(&quot;status&quot;):
          raise HTTPException(HTTPStatus.FORBIDDEN, detail=result)
      return {&quot;hello&quot;: name}
  
  </code></pre>
  <p>auth.py (copied from auth0 blog)</p>
  <pre><code>
  def set_up():
      &quot;&quot;&quot;Sets up configuration for the app&quot;&quot;&quot;
  
      env = os.getenv(&quot;ENV&quot;, &quot;.config&quot;)
  
      if env == &quot;.config&quot;:
          config = ConfigParser()
          config.read(&quot;.config&quot;)
          config = config[&quot;AUTH0&quot;]
      else:
          config = {
              &quot;DOMAIN&quot;: os.getenv(&quot;DOMAIN&quot;, &quot;your.domain.com&quot;),
              &quot;API_AUDIENCE&quot;: os.getenv(&quot;API_AUDIENCE&quot;, &quot;your.audience.com&quot;),
              &quot;ISSUER&quot;: os.getenv(&quot;ISSUER&quot;, &quot;https://your.domain.com/&quot;),
              &quot;ALGORITHMS&quot;: os.getenv(&quot;ALGORITHMS&quot;, &quot;RS256&quot;),
          }
      return config
  
  class VerifyToken():
      &quot;&quot;&quot;Does all the token verification using PyJWT&quot;&quot;&quot;
  
      def __init__(self, token):
          self.token = token
          self.config = set_up()
  
          # This gets the JWKS from a given URL and does processing so you can
          # use any of the keys available
          jwks_url = f'https://{self.config[&quot;DOMAIN&quot;]}/.well-known/jwks.json'
          self.jwks_client = jwt.PyJWKClient(jwks_url)
  
      def verify(self):
          # This gets the 'kid' from the passed token
          try:
              self.signing_key = self.jwks_client.get_signing_key_from_jwt(
                  self.token
              ).key
          except jwt.exceptions.PyJWKClientError as error:
              return {&quot;status&quot;: &quot;error&quot;, &quot;msg&quot;: error.__str__()}
          except jwt.exceptions.DecodeError as error:
              return {&quot;status&quot;: &quot;error&quot;, &quot;msg&quot;: error.__str__()}
  
          try:
              payload = jwt.decode(
                  self.token,
                  self.signing_key,
                  algorithms=self.config[&quot;ALGORITHMS&quot;],
                  audience=self.config[&quot;API_AUDIENCE&quot;],
                  issuer=self.config[&quot;ISSUER&quot;],
              )
          except Exception as e:
              return {&quot;status&quot;: &quot;error&quot;, &quot;message&quot;: str(e)}
  
          return payload
  </code></pre>
  <p>This code works perfectly if I use the Token generated by the Machine to machine that's connected to the API<a href="https://i.stack.imgur.com/V3uH6.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/V3uH6.png" alt="a" /></a></p>
  <p>However, (as you can see in the photo) the SPA don't need authorization like M2M apps. Instead they need the Implicit SPA grant.</p>
  <p>When you use the LogIn box provided by Auth0, it gives you a token after a successful log<a href="https://i.stack.imgur.com/D95Vg.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/D95Vg.png" alt="a" /></a>
  I want to use that token</p>
  <p>I hope I explained myself properly</p>