# Customer's Scoped Access Tokens return "organization not found" on all calls **URL:** \ **Category:** Cloud\ **Created:** [March 26, 2017, 8:06pm UTC](https://community.particle.io/t/customers-scoped-access-tokens-return-organization-not-found-on-all-calls/30948 "2017-03-26T20:06:31Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![partTee](https://avatars.discourse-cdn.com/v4/letter/p/bcef8e/32.png) [@partTee](https://community.particle.io/u/partTee)\ **Post date:** [March 26, 2017, 8:06pm UTC](https://community.particle.io/t/customers-scoped-access-tokens-return-organization-not-found-on-all-calls/30948/1 "2017-03-26T20:06:31Z")
Dear All, I am getting back again with an issue I have been trying to solve for the last couple of days. The situation is as follows: I am building a web-app (two-legged auth) and have created a product, and linked devices to it. There are team members (with email and password), as well as customers (with email and NO password) registered. I have been testing all my function and variable calls, as well as retrieving information on devices and unclaiming devices with access\_tokens from my team members. This does work perfectly fine. As a next step I was testing this with my customers (who are only registered with an email in the [particle.io](http://particle.io) backend (as said above)). When using their scoped customer’s access\_token (which I renew at every login), the call give’s me a `{ "ok": false, "error": "Organization not found for user's role." }` Do you have any Idea why this might be the case? The renewal of the access token is done via: `curl -X POST -H "Content-Type: application/x-www-form-urlencoded" -H "Authorization: Basic %MYHASHEDUSERNAMEANDSECRET%" -H "Cache-Control: no-cache" -d 'grant_type=client_credentials&scope=customer=mailOfCustomer@host.com&client_id=%MYCLIENTID%&client_secret=%MYCLIENTSECRET%' "https://api.particle.io/oauth/token"` And it returns the desired access\_ and refresh\_tokens: `{ "token_type": "bearer", "access_token": "%THEACCESSTOKEN%", "expires_in": 7776000, "refresh_token": "%THEREFRESHTOKEN%", "scope": "customer=mailOfCustomer@host.com" }` Thus I did expect them to be working just as the ordinary access\_tokens from my team members. What am I doing wrong? I would like to avoid calling my backend from the app and then calling the [particle.io](http://particle.io) backend from mine (as this is just unnecessary calls and latency and ist just not neat… 😉 ). Including my “team-member token” in the javascript (which I can do now for testing) is obviously not a solution for the production phase. ---
**Author:** ![kennethlimcp](https://avatars.discourse-cdn.com/v4/letter/k/c0e974/32.png) [@kennethlimcp](https://community.particle.io/u/kennethlimcp)\ **Post date:** [March 27, 2017, 12:14am UTC](https://community.particle.io/t/customers-scoped-access-tokens-return-organization-not-found-on-all-calls/30948/2 "2017-03-27T00:14:12Z")
@jeiden ---
**Author:** ![jeiden](https://sea2.discourse-cdn.com/flex026/user_avatar/community.particle.io/jeiden/32/15439_2.png) [@jeiden](https://community.particle.io/u/jeiden)\ **Post date:** [March 27, 2017, 6:56pm UTC](https://community.particle.io/t/customers-scoped-access-tokens-return-organization-not-found-on-all-calls/30948/3 "2017-03-27T18:56:08Z")
Hey @partTee, Thanks for the question, sorry you’re running into issues. One thing I notice that in your API call to create the token for the customer, you are passing `grant_type=client_credentials`. This instructs the Particle API to use an OAuth client credentials to authenticate the request. However, you are passing an access token in the `Authorization` header. Can you try creating an OAuth client scoped to your product (can be done either in the console UI or through [this endpoint](https://docs.particle.io/reference/api/#create-a-client)) and instead of passing an access token from a team member, passing the OAuth client ID and secret like this? ```auto $ curl -u my-org-client-1234:long-secret -d grant_type=client_credentials -d scope=customer=jane@example.com https://api.particle.io/oauth/token ``` For more info, please check out the docs: [https://docs.particle.io/reference/api/#generate-a-customer-scoped-access-token](https://docs.particle.io/reference/api/#generate-a-customer-scoped-access-token) ---
**Author:** ![partTee](https://avatars.discourse-cdn.com/v4/letter/p/bcef8e/32.png) [@partTee](https://community.particle.io/u/partTee)\ **Post date:** [March 27, 2017, 8:51pm UTC](https://community.particle.io/t/customers-scoped-access-tokens-return-organization-not-found-on-all-calls/30948/4 "2017-03-27T20:51:23Z")
Hey @jeiden! Thanks for helping me with this. Actually I am using an OAuth client (two legged, full-access) in the header for authorization. (Where I wrote `%MYHASHEDUSERNAMEANDSECRET%`) I have tried the call you posted (which is basically the same I am using, just without the (unnecessary `client_id`and `client_secret` in the message body). It also generates an access\_token and refresh\_token nicely. When using this token to in e.g. the following call: `curl -X GET -H “Content-Type: application/x-www-form-urlencoded” -H “Cache-Control: no-cache” “[https://api.particle.io/v1/products/%PRODUCT\_SLUG%/devices/�VICE\_ID%/?access\_token=�CESS\_TOKEN%](https://api.particle.io/v1/products/%25PRODUCT_SLUG%25/devices/%DEVICE_ID%25/?access_token=%ACCESS_TOKEN%25)”’ it returns the “Organization not found for user’s role.” message… If it should help I could provide you my product slug via private message? ---
**Author:** ![ruku](https://avatars.discourse-cdn.com/v4/letter/r/ed8c4c/32.png) [@ruku](https://community.particle.io/u/ruku)\ **Post date:** [May 12, 2017, 4:11am UTC](https://community.particle.io/t/customers-scoped-access-tokens-return-organization-not-found-on-all-calls/30948/5 "2017-05-12T04:11:13Z")
Hey @jeiden: I am facing the exact same issue as @partTee. Was this issue ever resolved? If so, can you point me to the resolution? ---
**Author:** ![Duesentrieb](https://avatars.discourse-cdn.com/v4/letter/d/2bfe46/32.png) [@Duesentrieb](https://community.particle.io/u/Duesentrieb)\ **Post date:** [May 12, 2017, 6:57am UTC](https://community.particle.io/t/customers-scoped-access-tokens-return-organization-not-found-on-all-calls/30948/6 "2017-05-12T06:57:57Z")
Hey @ruku! As I didn’t find a solution for the problem outlined above I am now routing all requests from my app through my backend. In the backend I keep keep the credentials of a team member account. So it appears to the particle backend like requests from a team member and not from the individual user. It’s kind of messy but it works for now and allows to test the system and move on with implementing further functions. Additionally I ave the advantage, that I can actually track every move the user makes. (sry for using a different account - seems like I got mixed up with my passwords for the forum…) ---
**Author:** ![ruku](https://avatars.discourse-cdn.com/v4/letter/r/ed8c4c/32.png) [@ruku](https://community.particle.io/u/ruku)\ **Post date:** [May 12, 2017, 1:45pm UTC](https://community.particle.io/t/customers-scoped-access-tokens-return-organization-not-found-on-all-calls/30948/7 "2017-05-12T13:45:02Z")
Thanks, @Duesentrieb! Based on some additional testing, I found that any of the API calls that include a `productIdOrSlug` in the URL will require an access token scoped to the product (i.e., an access token created with the clientId and secret, but without any scope specified). If you want to use a customer-scoped access token, you can call the devices endpoint without `productIdOrSlug`, i.e., `/v1/devices`. It will return the devices that belong to the user represented by the `access_token` specified. @jeiden: Can you confirm this? ---
**Author:** ![jeiden](https://sea2.discourse-cdn.com/flex026/user_avatar/community.particle.io/jeiden/32/15439_2.png) [@jeiden](https://community.particle.io/u/jeiden)\ **Post date:** [May 17, 2017, 4:35pm UTC](https://community.particle.io/t/customers-scoped-access-tokens-return-organization-not-found-on-all-calls/30948/8 "2017-05-17T16:35:35Z")
@ruku that is correct. I will make one small addition to what you said: > I found that any of the API calls that include a productIdOrSlug in the URL will require an access token scoped to the product (i.e., an access token created with the clientId and secret, but without any scope specified) In addition to "scopeless" access tokens generated by a client ID and secret, any access token generated by a Particle user belonging to the product team will also be accepted when authenticating with product-specific endpoints. This is how the Console calls API endpoints scoped to a product when you are logged in. If your Particle account is part of the product team, you can grab an access token to use by running `particle token list` in the CLI. Customers should use the non product-scoped endpoints when interacting with their devices, like `/v1/devices` or `/v1/devices/:deviceId` as you mentioned.