# Getting user profile with okta-auth-js

**URL:** <https://devforum.okta.com/t/getting-user-profile-with-okta-auth-js/23778>\
**Category:** OAuth/OIDC\
**Created:** [March 27, 2023, 9:25pm UTC](https://devforum.okta.com/t/getting-user-profile-with-okta-auth-js/23778 "2023-03-27T21:25:46Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Mike.Cowan](https://avatars.discourse-cdn.com/v4/letter/m/d78d45/32.png) [@Mike.Cowan](https://devforum.okta.com/u/Mike.Cowan)\
**Post date:** [March 27, 2023, 9:25pm UTC](https://devforum.okta.com/t/getting-user-profile-with-okta-auth-js/23778/1 "2023-03-27T21:25:46Z")

</div>

We have a react application and we’re trying use okta-auth-js for as much as possible. All of our users belong to an application using “Password + Email or SMS” Authentication policy, so authentication uses

oktaClient.idx.authenticate({ username, password })

on our username / password page, followed by

oktaClient.idx.authenticate({ verificationCode: code })

for multi-factor authentication.

After the username/password, but before the MFA, we might want to perform some operations based on the user’s profile. Is this possibly solely with okta-auth-js, or would we need to use the API functions in our backend? I’ve made some adjustments to claims, but those values only return after the MFA step, not before.

---

<div class="post-metadata">

**Author:** ![erik](https://avatars.discourse-cdn.com/v4/letter/e/b5ac83/32.png) [@erik](https://devforum.okta.com/u/erik)\
**Post date:** [March 27, 2023, 11:31pm UTC](https://devforum.okta.com/t/getting-user-profile-with-okta-auth-js/23778/2 "2023-03-27T23:31:40Z")

</div>

Hello,

You would need to use one of the Okta Management SDKs or the API directly.

If you plan to do this from a public application with XHR calls (React), the Okta Management API endpoints will not set the needed CORS headers to allow you to use an `API Token` from a public application.

You can use an access\_token with the `okta.MyAccount.*` scopes to manage a users profile, but this requires going through full authentication to get tokens.

Thank you

---

<div class="post-metadata">

**Author:** ![andrea](https://sea1.discourse-cdn.com/oktadev/user_avatar/devforum.okta.com/andrea/32/2172_2.png) [@andrea](https://devforum.okta.com/u/andrea)\
**Post date:** [February 13, 2024, 11:38pm UTC](https://devforum.okta.com/t/getting-user-profile-with-okta-auth-js/23778/3 "2024-02-13T23:38:50Z")

</div>