I think it might have something to do with the scopes in auth0, but I'm still trying to figure it out.