# API to check if user token has roles for a particular resource

**URL:** https://forum.keycloak.org/t/api-to-check-if-user-token-has-roles-for-a-particular-resource/3848
**Category:** Securing applications
**Created:** [July 19, 2020, 3:51pm UTC](https://forum.keycloak.org/t/api-to-check-if-user-token-has-roles-for-a-particular-resource/3848 "2020-07-19T15:51:24Z")
**Posts on this page:** 2
**Page:** 1

<div class="post-metadata">

### Author: ![anand](https://avatars.discourse-cdn.com/v4/letter/a/ecd19e/32.png) [@anand](https://forum.keycloak.org/u/anand)
#### Post date: [July 19, 2020, 3:51pm UTC](https://forum.keycloak.org/t/api-to-check-if-user-token-has-roles-for-a-particular-resource/3848/1 "2020-07-19T15:51:24Z")

</div>

I have a keycloak server setup. I am using the token endpoint: `http://localhost:8080/auth/realms/demo/protocol/openid-connect/token` to authenticate a user and generate a token. This token I understand can be used in subsequent calls to verify if it is a valid user.

However, I am not sure how do I use this to authorize the user? ie verify if this user has the roles to access a resource.

I see that it is possible to configure a resource URI under the client section. But once that is done, I want to be able to read the token and verify if this user has the roles to access this resource.

Right now, this is what I am doing: I have used spring boot here.

```auto
doSomething(String token)
{
 1. get token info using: http://localhost:8080/auth/realms/demo/protocol/openid-connect/userinfo
 2. from this get the roles the user has
 3. Manually check the roles required for the above function. (Right now, this is set in a simple switch statement)
 4. If the role obtained from step 2 matches what we get in step 3, go ahead. Else return failure.
}

```

I want to know if step 3 above can be done in a better way. I know taht you can set a resource in clients from the keycloak console. What I was hoping is we could replace the 4 steps above with something like:

```auto
keycloakAPIToAuthorizeToken(token,resource)

```

which would tell me whether this user has the roles (obtained from token) to access this resource.

Please suggest if this is doable.

Thanks in advance.  
Anand

---

<div class="post-metadata">

### Author: ![Robinyo](https://avatars.discourse-cdn.com/v4/letter/r/dec6dc/32.png) [@Robinyo](https://forum.keycloak.org/u/Robinyo)
#### Post date: [July 19, 2020, 9:06pm UTC](https://forum.keycloak.org/t/api-to-check-if-user-token-has-roles-for-a-particular-resource/3848/2 "2020-07-19T21:06:59Z")

</div>

> [@anand](#):
>
> However, I am not sure how do I use this to authorize the user?

See:

- [Angular, OAuth 2.0 and Keycloak](https://robferguson.org/blog/2019/12/31/angular-oauth2-keycloak/)
- [Flowable OAuth2 Resource Server](https://robferguson.org/blog/2020/02/05/flowable-oauth2-resource-server/)