TL;DR
- Auth0 provides API Authentication and Authorization as a means to secure access to API endpoints (see API Authentication and Authorization)
- For authorizing a user of a SPA, Auth0 supports the Implicit Grant (see Implicit Grant)
- Both the SPA and the API must be configured in the Auth0 Dashboard (see Auth0 Configuration)
- User Permissions can be enforced using the Authorization Extension (see Configure the Authorization Extension)
- The API will be secured by ensuring that a valid Access Token is passed in the HTTP Authorization header when calls are made to the API (see Implement the API)
- The Auth0.js library can be used to authorize the user of the SPA and obtain a valid Access Token which can be used to call the API (see Authorize the User)
- The SPA can pass the Access Token in the HTTP Authorization header when making calls to the API (see Call the API)
- The SPA can display UI elements conditionally based on scopes granted to user (see Display UI Elements Conditionally Based on Scope)