title: How to implement role-based Authorization for Python REST API?
body: <p>The basic architecture of my application is React front-end consuming a RESTful API sitting on top of a polyglot storage layer. </p>
  
  <p><strong>Front-end:</strong><br />
  React consuming APIs</p>
  
  <p><strong>Back-end:</strong><br />
  Python<br />
  Flask<br /></p>
  
  <p><strong><em>Authentication</em></strong><br />
  Auth0+OKTA</p>
  
  <p>Everything is working great. However, I need to have different roles for the users. In other words, I need to control the actions that a user can perform on a resource based on the role. </p>
  
  <p><strong>Example:</strong><br />
  <em>-User A wants to add a new user</em><br />
  <em>-He has a token in his request, so I know User A is Authenticated</em><br />
  <em>-Now I need to make sure he can in fact add users base on his role.</em></p>
  
  <p>I don't want to hard-code the user roles as suggested in other solutions, and I would like to allow for custom roles to be added. </p>
  
  <p>Also, I want to be respectful of people's time, so if there is a resource that addresses my concern, please feel free to point me to it. </p>
  
  <p><strong>These are my questions:</strong><br />
   1. Are there any best practices for implementing what I am trying to accomplish?<br />
   2. Could you point me to examples or tutorials discussing authorization(not authentication)?<br />
   3. Do I check at each service call if the authenticated user can also perform the action or do I provide the roles in some form after authorization, so a service request contains both the authentication and authorization token?(this seems pretty easy to hack so I am guessing no...)<br /></p>
  
  <p>If I sound confused on the topic of authorization, it is because I am. Please feel free to point me to any resource that have been helpful to you.</p>
  
  <p>Thank you in advance for taking the time to help! I really appreciate it.</p>