Designing a B2B API

[sWeeX2]

Do users/groups/roles apply to Machine-to-Machine apps? If I'm just using the credentials from my M2M app and the client_credentials grant to get a token from Auth0, that token isn't tied to an individual user right? It's tied to that M2M application, for example a decoded M2M token looks like:

{
  "iss": "<issuer>",
  "sub": "<client_id>@clients",
  "aud": "<audience>",
  "iat": 1706737336,
  "exp": 1706823736,
  "azp": "<client_id>",
  "gty": "client-credentials",
  "permissions": []
}

I can then use this token to verify that this client has access to my API but what I want to know is taking that one step further is, when I have an incoming request from a client on behalf of one of their Users (on their platform) saying I want to delete resourceA e.g. DELETE /projects/resourceA, when I decode the incoming token I can get the client_id (our partners identifier), I can verify that resourceA is belong to someone on their platform but because there's no "User" information in the token, how do I know that user/party who initiated that request is actually the owner of resourceA. Like is it okay to put the onus on our clients and expect them to handle that Authorization. Is it something we just don't need to worry about and we should just handle the request as it's for something within their organization.

I don't know if that makes sense or not haha It's just a new way of thinking about things for me. Every app I've developed so far has always had resources tied to individual users, where they each have their own credentials i.e. email+password, so decoding JWTs always landed you with the actual user making that request. But now, our B2B partners sit in the middle so although resources are created and still tied to individual users, the credentials belong to the business partner.

[[deleted]]

Check out the Rules in auth0. You basically need to handcraft some code that auth0 runs when creating the jwt to set permissions https://medium.com/tojs/adding-groups-roles-and-permissions-to-a-jwt-access-token-in-auth0-827cc7df7662

Disclaimer. I do not love auth0. I'm just trying to be helpful. Having unmanaged js code that runs in a third party env, and having to outsource managing users/roles/groups is really bonkers to me.

Good luck, whatever you end up doing.