# Getting groups scope when using response\_type=code **URL:** \ **Category:** Questions\ **Created:** [January 24, 2019, 2:46pm UTC](https://devforum.okta.com/t/getting-groups-scope-when-using-response-type-code/4018 "2019-01-24T14:46:01Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![mgolebiowski](https://avatars.discourse-cdn.com/v4/letter/m/aca169/32.png) [@mgolebiowski](https://devforum.okta.com/u/mgolebiowski)\ **Post date:** [January 24, 2019, 2:46pm UTC](https://devforum.okta.com/t/getting-groups-scope-when-using-response-type-code/4018/1 "2019-01-24T14:46:01Z")
Hey, I am trying to obtain `groups` info about user when he/she logs into app. On `/v1/authorize` I send `scope: openid groups` and `response_type=code` in queries and then ask for `/v1/token` to obtain id\_token but it doesn’t include groups list. I already added proper groups claim expression and it sends me the list when I am using [https://okta-oidc-fun.herokuapp.com/](https://okta-oidc-fun.herokuapp.com/) and use `response_type=id_token`. Can I obtain groups list when using code as response\_type? ---
**Author:** ![mgolebiowski](https://avatars.discourse-cdn.com/v4/letter/m/aca169/32.png) [@mgolebiowski](https://devforum.okta.com/u/mgolebiowski)\ **Post date:** [January 25, 2019, 11:12am UTC](https://devforum.okta.com/t/getting-groups-scope-when-using-response-type-code/4018/2 "2019-01-25T11:12:40Z")
Hey, I prepared a gist with code I am using in PHP: > ---
**Author:** ![mkay](https://avatars.discourse-cdn.com/v4/letter/m/5fc32e/32.png) [@mkay](https://devforum.okta.com/u/mkay)\ **Post date:** [December 19, 2019, 1:40pm UTC](https://devforum.okta.com/t/getting-groups-scope-when-using-response-type-code/4018/3 "2019-12-19T13:40:42Z")
Hi [mgolebiowski](https://devforum.okta.com/u/mgolebiowski), did you ever get this solved? I have the exact same issue, responseType=id\_token works, the groups are there, but with responseType=code I exchange that for an id\_token, which has no groups. ---
**Author:** ![mkay](https://avatars.discourse-cdn.com/v4/letter/m/5fc32e/32.png) [@mkay](https://devforum.okta.com/u/mkay)\ **Post date:** [December 19, 2019, 1:42pm UTC](https://devforum.okta.com/t/getting-groups-scope-when-using-response-type-code/4018/4 "2019-12-19T13:42:35Z")
Hi @dragos maybe you know? Sorry for pinging you so directly, saw you in the other thread – maybe you know 🙂 ---
**Author:** ![dragos](https://sea1.discourse-cdn.com/oktadev/user_avatar/devforum.okta.com/dragos/32/1313_2.png) [@dragos](https://devforum.okta.com/u/dragos)\ **Post date:** [December 23, 2019, 1:48am UTC](https://devforum.okta.com/t/getting-groups-scope-when-using-response-type-code/4018/5 "2019-12-23T01:48:07Z")
Hi @mkay If both ID token and access token are requested, then the ID token gets automatically minified and the rest of the claims, including the `groups` claim, are available through a separate request to `/userinfo` endpoint. Here is a cURL example ```auto curl --location --request GET 'https://dragos.oktapreview.com/oauth2/v1/userinfo' \ --header 'Accept: application/json' \ --header 'Authorization: Bearer {{accessToken}}' ``` If you have the [API Access Management](https://developer.okta.com/docs/concepts/api-access-management/) feature enabled on your Okta org (available under Admin \>\> Security \>\> API \>\> Authorization Servers), then you can hardcode the groups claim to be displayed always inside the ID token, rather than being displayed only on /userinfo. ---
**Author:** ![mkay](https://avatars.discourse-cdn.com/v4/letter/m/5fc32e/32.png) [@mkay](https://devforum.okta.com/u/mkay)\ **Post date:** [January 29, 2020, 10:49am UTC](https://devforum.okta.com/t/getting-groups-scope-when-using-response-type-code/4018/6 "2020-01-29T10:49:39Z")
Hi @dragos I got it working using the /userinfo endpoint, thank you. I was using the Sign-In widget, but now I’m trying out the “redirect method” (as described here [https://developer.okta.com/docs/guides/implement-auth-code/use-flow/](https://developer.okta.com/docs/guides/implement-auth-code/use-flow/)). Even if I set the scope=‘openid email groups’ in the link that I use do direct the user to the login form hosted on my okta domain, then later I am not able to get the groups from the /userirfo endpoint. Does the redirect work differently somehow than the Sign-In widget when asking for scopes? Thanks! ---
**Author:** ![system](https://global.discourse-cdn.com/oktadev/original/1X/589c4c5f80de422d01f47cee7185a7fb8227835c.png) [@system](https://devforum.okta.com/u/system)\ **Post date:** [January 23, 2024, 8:12pm UTC](https://devforum.okta.com/t/getting-groups-scope-when-using-response-type-code/4018/7 "2024-01-23T20:12:13Z")
This topic was automatically closed 24 hours after the last reply. New replies are no longer allowed.