title: How to manage users on backend when using Auth0 Lock?
body: <p>I am creating a frontend with React and a backend with Node. I would like to manage user information using <a href="https://auth0.com/lock" rel="noreferrer">Auth0 Lock</a> - sending a JWT with each request to the API.</p>
  
  <p>What if I need to do one of the following things?</p>
  
  <ul>
  <li>Store a blog post with an author ID</li>
  </ul>
  
  <p>The Auth0 unique identifier is <code>user_id</code>, which is not an integer and therefore cannot be used as an ID/key. How would I handle this on a server-side user store?</p>
  
  <ul>
  <li>Have a users table to store a "profile about" or other similar information</li>
  </ul>
  
  <p>Do I read the JWT on each API request, determine if that user exists, and then create a new user if it doesn't, or relate it to a pre-existing user if it does. Is it performant to check the user database on every single API request?</p>
  
  <p>I am unsure how to handle general flow with JWT-based API and Auth0.</p>
  
  <p>Edit:</p>
  
  <p>My thoughts after some research and reflection: Auth0's unique user identifier is provided by them as <code>user_id</code>. The problem here is that it is not an integer. Therefore it should not be used as the key for the <code>users</code> table in a database.</p>
  
  <p>It seems as if you shouldn't check the user database on each request, but this may be incorrect. One idea would be to callback to the backend on initial login, if the account doesn't exist, create it, if the account does exist, move on. Then just trust the Auth0 JWT (if it verifies on the backend) on each following request after the user has logged in on the frontend.</p>
  
  <p>From the very few descriptions of this process I have seen online, it seems like the way I described was the normal way. But there are some situations where it doesn't make sense. What if a user was to be banned? They could still access the server functionality with their active JWT until it expires due to time.</p>
  
  <p>So, if it is normal/performant to check the user store on each API request, how do I relate Auth0's string id, <code>user_id</code>, to an integer ID in the datastore to do queries? I am using a SQL variant.</p>