Skip to content
Scalekit Docs

Assign application roles to users

B2B applications often require different levels of access for different users. Roles are a powerful way to manage these permissions and ensure that users can only access the features and data appropriate for them.

For example, you might have roles like:

  • Admin: Can access all features, including billing and user management.
  • Editor: Can create and edit content, but cannot manage users or settings.
  • Viewer: Can only view content, but cannot make any changes.

Scalekit provides a flexible role-based access control (RBAC) system that allows you to define custom roles and assign them to users, helping you build a secure and scalable application.

How roles work

Section titled “How roles work”

By default, Scalekit provides two roles: admin and member. When the first user signs up and creates an organization, they are automatically assigned the admin role. Any subsequent users who join the organization are assigned the member role by default.

Managing roles

Section titled “Managing roles”

You can manage roles, including creating custom ones, from the Scalekit dashboard:

  1. Navigate to User Management > Roles.
  2. You will see a list of existing roles. Click + Add Roles to create a new role.
  3. For each new role, you can define a Role Name, Key, and Description. The Key is what you will receive in the token and use in your application to control access.

Integrate with Scalekit Follow our quickstart guide to integrate Scalekit into your application and start managing user roles.

Accessing user roles

Section titled “Accessing user roles”

Once a user is authenticated, their assigned roles are included in the idToken and accessToken. You can use this information in your application’s backend to control access to different resources.

While the roles claim is an array, Scalekit currently supports a single role per user within an organization.

Here’s an example of a decoded idToken containing the roles claim:

{
  "amr": [
    "conn_123456789012345678"
  ],
  "at_hash": "QwertyUioP",
  "aud": [
    "skc_987654321098765432"
  ],
  "azp": "skc_987654321098765432",
  "c_hash": "A1b2C3d4E5",
  "client_id": "skc_987654321098765432",
  "email": "john.doe@example.com",
  "email_verified": true,
  "exp": 1753441845,
  "family_name": "Doe",
  "given_name": "John",
  "iat": 1750849845,
  "iss": "http://example.localhost:8889",
  "name": "John Doe",
  "oid": "org_987654321098765432",
  "roles": [
    "member"
  ],
  "sid": "ses_987654321098765432",
  "sub": "usr_987654321098765432"
}

With the role information readily available in the tokens, you can implement fine-grained access control in your application logic.