# Ability to 'obtain' the access\_token JWT within a rule? **URL:** \ **Category:** JWT.io\ **Tags:** jwt, login\ **Created:** [April 4, 2018, 6:16pm UTC](https://community.auth0.com/t/ability-to-obtain-the-access-token-jwt-within-a-rule/10641 "2018-04-04T18:16:19Z")\ **Posts on this page:** 2\ **Page:** 1
**Author:** ![Joe\_Tillotson](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/joe_tillotson/32/12709_2.png) [@Joe\_Tillotson](https://community.auth0.com/u/Joe_Tillotson)\ **Post date:** [April 4, 2018, 6:16pm UTC](https://community.auth0.com/t/ability-to-obtain-the-access-token-jwt-within-a-rule/10641/1 "2018-04-04T18:16:19Z")
Pretty simple question I think: is it possible, within a rule, to get ones hands on the access\_token (JWT) that is going to be sent to the client (e.g. using the Implicit Flow?) To make a long story short, there is a scenario where I am redirecting a user to a client _other than_ the one they are intending to log into. This is a special ‘wizard client’ where we allow our users to migrate from a username to an email-based login. So, I want to make this redirect ‘tamper proof’, and I had the idea: "I’ll pass along the JWT access\_token in the redirect, so that the Wizard client can make use of it, and ensure that the human user does not try to ‘spoof’ the client by simply updating the URL ‘by hand’. I discovered however that the “context.accessToken” object (available in a rule) isn’t the JWT however, it’s simply an object that contains key/value pairs containing any custom claims that are being added to the JWT that will be returned to the client that is logging in. Is it possible for me to get to the ‘real JWT’ within a rule? Thanks ---
**Author:** ![kimcodes](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/kimcodes/32/81052_2.png) [@kimcodes](https://community.auth0.com/u/kimcodes)\ **Post date:** [July 17, 2018, 7:15pm UTC](https://community.auth0.com/t/ability-to-obtain-the-access-token-jwt-within-a-rule/10641/2 "2018-07-17T19:15:51Z")