In our app, we use the client credentials so that the client can request the user list from Auth0. I should change this so the API uses its own access to get the list.