how to handle/manage a lot of permissions in access-token? what's the best approach?

Question

I'm getting a "Request header is too long" error when i was trying to access my API and send token in header. How we can manage a permissions in access-token because i have a lot of permissions in access-token it's approximately 15kb in size. I know it's not recommended to store permissions in access-token then what's the best approach to authenticate and authorize the users on API side?

We are getting all the permissions in access token but now permissions are getting large as we have lot of modules. What is the other way to access user permissions in asp.net core API instead of keeping it in access token?

    {
  "roles": [
    "Admin"
  ],
  "iss": "Issuer",
  "sub": "sub",
  "aud": [
    "https://example.com/api",
    "https://example.com/userinfo"
  ],
  "iat": 1666198659,
  "exp": 1666205859,
  "azp": "azp",
  "scope": "openid profile email offline_access",
  "org_id": "company1",
  "permissions": [
    "permission.1",
    "permission.2",
    ........
    "permission.150",
]
}

Answer 1

This could be a solution: https://fga.dev/. There's also the open source version: https://openfga.dev/

Basically, since every user has a lot of permissions, you don't store them in the token anymore; you can call this service which stores them for you.

Disclaimer: I am part of the team building this solution :)