> ## Documentation Index
> Fetch the complete documentation index at: https://auth0.generaltranslation.app/llms.txt
> Use this file to discover all available pages before exploring further.

> Describes how to add scopes to your IdP connection.

# Add Scopes/Permissions to Call Identity Provider APIs

export const AuthCodeBlock = ({filename, icon, language, highlight, children}) => {
  const [processedChildren, setProcessedChildren] = useState(children);
  useEffect(() => {
    let unsubscribe = null;
    function init() {
      unsubscribe = window.autorun(() => {
        let processedChildren = children;
        for (const [key, value] of window.rootStore.variableStore.values.entries()) {
          processedChildren = processedChildren.replace(new RegExp(key, "g"), value);
        }
        setProcessedChildren(processedChildren);
      });
    }
    if (window.rootStore) {
      init();
    } else {
      window.addEventListener("adu:storeReady", init);
    }
    return () => {
      window.removeEventListener("adu:storeReady", init);
      unsubscribe?.();
    };
  }, [children]);
  return <CodeBlock filename={filename} icon={icon} language={language} lines highlight={highlight}>
      {processedChildren}
    </CodeBlock>;
};

Once a user is logged in, you can get their user profile and then the associated `accessToken` to call the <Tooltip tip="Identity Provider (IdP): Service that stores and manages digital identities." cta="View Glossary" href="/docs/glossary?term=Identity+Provider">Identity Provider</Tooltip> (IdP) APIs as described in [Call an Identity Provider API](/docs/authenticate/identity-providers/calling-an-external-idp-api).

However, if you are receiving `Access Denied` when calling the IdP API, you probably have not requested the correct permissions for the user during login. You can request the correct permissions in one of two ways.

## Change Identity Provider Settings

To configure the scopes/permissions needed from the user, go to [Auth0 Dashboard > Authentication > Social](https://manage.auth0.com/#/connections/social), and select an IdP. You can select the required permissions listed on the configuration screen.

For example, if you click the **Google / Gmail** connection, you can configure Google-specific permissions:

<Frame>
  <img src="https://mintcdn.com/generaltranslationinc/3E5d0TEwC25OF1Ek/docs/images/cdy7uua7fh8z/61ACa6hnMtO5aUjus0fCb7/31411373a18463f272107e1124445c60/dashboard-connections-social-create_google.png?fit=max&auto=format&n=3E5d0TEwC25OF1Ek&q=85&s=9f2eccaff4ee935d42b4241d504797d8" alt="Permissions for Google" width="904" height="655" data-path="docs/images/cdy7uua7fh8z/61ACa6hnMtO5aUjus0fCb7/31411373a18463f272107e1124445c60/dashboard-connections-social-create_google.png" />
</Frame>

## Pass Scopes to Authorize endpoint

You can also pass the scopes/permissions you wish to request as a comma-separated list in the `connection_scope` parameter when calling the [authorize endpoint](https://auth0.com/docs/api/authentication#login). For example, if you want to request the `https://www.googleapis.com/auth/contacts.readonly` and `https://www.googleapis.com/auth/analytics` scopes from Google, you can pass these along with the `connection` parameter to ensure the user logs in with their Google account:

export const codeExample = `https://{yourDomain}/authorize
  ?response_type=id_token
  &client_id={yourClientId}
  &redirect_uri={https://yourApp/callback}
  &scope=openid%20profile
  &connection=google-oauth2
  &connection_scope=https%3A%2F%2Fwww.googleapis.com%2Fauth%2Fanalytics%2Chttps%3A%2F%2Fwww.googleapis.com%2Fauth%2Fcontacts.readonly
  &nonce=abc`;

<AuthCodeBlock children={codeExample} language="sh" />

<Callout icon="file-lines" color="#0EA5E9" iconType="regular">
  Please note that in the example request above, the value of the `connection_scope` parameter is URL encoded. The decoded value that is passed to Google is `https://www.googleapis.com/auth/analytics, https://www.googleapis.com/auth/contacts.readonly`
</Callout>