# Edit the current users profile without using API Token

**URL:** <https://devforum.okta.com/t/edit-the-current-users-profile-without-using-api-token/16220>\
**Category:** Questions\
**Created:** [September 19, 2021, 12:20am UTC](https://devforum.okta.com/t/edit-the-current-users-profile-without-using-api-token/16220 "2021-09-19T00:20:05Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![amcneilly](https://avatars.discourse-cdn.com/v4/letter/a/e56c9b/32.png) [@amcneilly](https://devforum.okta.com/u/amcneilly)\
**Post date:** [September 19, 2021, 12:20am UTC](https://devforum.okta.com/t/edit-the-current-users-profile-without-using-api-token/16220/1 "2021-09-19T00:20:05Z")

</div>

I want to allow a user to update profile information from a SPA.

I know I can do this using the OKTA API. I use an API Token from the backend API. However, this creates a security risk if my backend server is compromised.

Is it possible to modified a users profile data by using their JWT token ? i.e. frontend forwards the JWT token to the backend. The backend then updates the users Okta profile data for the application using the JKW for auth i.e. calling /api/v1/users/me.

Can you call “/api/v1/users/me” without using an API token or JWK ?

Does a user have permissions by default to edit all profile values?

---

<div class="post-metadata">

**Author:** ![phi1ipp](https://avatars.discourse-cdn.com/v4/letter/p/85f322/32.png) [@phi1ipp](https://devforum.okta.com/u/phi1ipp)\
**Post date:** [September 19, 2021, 6:53pm UTC](https://devforum.okta.com/t/edit-the-current-users-profile-without-using-api-token/16220/2 "2021-09-19T18:53:09Z")

</div>

> [@amcneilly](#):
>
> Does a user have permissions by default to edit all profile values?

Only those that are configured as writable in Okta

> [@amcneilly](#):
>
> Can you call “/api/v1/users/me” without using an API token or JWK ?

You can, if you have an Okta session cookie

---

<div class="post-metadata">

**Author:** ![amcneilly](https://avatars.discourse-cdn.com/v4/letter/a/e56c9b/32.png) [@amcneilly](https://devforum.okta.com/u/amcneilly)\
**Post date:** [September 19, 2021, 11:16pm UTC](https://devforum.okta.com/t/edit-the-current-users-profile-without-using-api-token/16220/3 "2021-09-19T23:16:27Z")

</div>

what the process for my backend API to call “/api/v1/users/me” on behalf of the user using the frontend users JWT token ?

i.e. user logs into react app using OIDC. They are assigned a JWT by the authorisation server. Now I want to update a profile value using the Users API “/api/v1/users/me”. However, I keep getting 401 errors.

---

<div class="post-metadata">

**Author:** ![andrea](https://sea1.discourse-cdn.com/oktadev/user_avatar/devforum.okta.com/andrea/32/2172_2.png) [@andrea](https://devforum.okta.com/u/andrea)\
**Post date:** [September 21, 2021, 5:41pm UTC](https://devforum.okta.com/t/edit-the-current-users-profile-without-using-api-token/16220/4 "2021-09-21T17:41:34Z")

</div>

The JWT will need to be issued by the Org Authorization Server (iss = [https://org.okta.com](https://org.okta.com)) and and have been granted the “okta.user.manage.self” scope, then you can use the token as bearer auth for your API call.

More details about using tokens against Okta endpoints found here: [Implement OAuth for Okta | Okta Developer](https://developer.okta.com/docs/guides/implement-oauth-for-okta/overview/)

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/oktadev/original/1X/589c4c5f80de422d01f47cee7185a7fb8227835c.png) [@system](https://devforum.okta.com/u/system)\
**Post date:** [February 8, 2024, 7:25pm UTC](https://devforum.okta.com/t/edit-the-current-users-profile-without-using-api-token/16220/5 "2024-02-08T19:25:13Z")

</div>

This topic was automatically closed 24 hours after the last reply. New replies are no longer allowed.