# Access Hook-created app\_metadata (Javascript)

**URL:** <https://community.auth0.com/t/access-hook-created-app-metadata-javascript/18538>\
**Category:** Get Help\
**Tags:** app\_metadata, hooks, javascript\
**Created:** [November 30, 2018, 7:50am UTC](https://community.auth0.com/t/access-hook-created-app-metadata-javascript/18538 "2018-11-30T07:50:07Z")\
**Posts on this page:** 10\
**Page:** 1

<div class="post-metadata">

**Author:** ![chisnallio](https://upload.wikimedia.org/wikipedia/commons/thumb/7/7c/User_font_awesome.svg/768px-User_font_awesome.svg.png) [@chisnallio](https://community.auth0.com/u/chisnallio)\
**Post date:** [November 30, 2018, 7:50am UTC](https://community.auth0.com/t/access-hook-created-app-metadata-javascript/18538/1 "2018-11-30T07:50:07Z")

</div>

So I created a pre-registration hook:

> ```
> module.exports = function (user, context, cb) {
> 
> ```
> 
> var response = {};  
> // External packages  
> uniqid = require(‘uniqid’);  
> keygen = require(‘keygenerator’);  
> // Add app metadata to the newly created user  
> response.user = {  
> app\_metadata: { id: uniqid.time(), key: keygen.session\_id() }  
> };  
> // Return to callback  
> cb(null, response);  
> };

Which works:

 ![Screenshot_1](https://global.discourse-cdn.com/auth0/original/2X/9/9e26b76b4cfd2dcd1f666e2c65ef64c27c4f6ccd.png)

But for the life of me, I cannot figure out how to get that data in my app:

> handleAuthentication () {  
> webAuth.parseHash(async (err, authResult) =\> {  
> console.debug(authResult)  
> }  
> })

Which outputs:

 ![Screenshot_2](https://global.discourse-cdn.com/auth0/original/2X/8/88cc9b768467484ee63a60bf22214ddfead8c71c.png)

I feel like a mad man going through the docs for Auth0. What am I doing wrong?

---

<div class="post-metadata">

**Author:** ![chisnallio](https://upload.wikimedia.org/wikipedia/commons/thumb/7/7c/User_font_awesome.svg/768px-User_font_awesome.svg.png) [@chisnallio](https://community.auth0.com/u/chisnallio)\
**Post date:** [November 30, 2018, 12:46pm UTC](https://community.auth0.com/t/access-hook-created-app-metadata-javascript/18538/2 "2018-11-30T12:46:21Z")

</div>

I solved the problem by creating a rule as follows:

> function (user, context, callback) {  
> context.idToken[‘[https://id](https://id)’] = user.app\_metadata.id;  
> context.idToken[‘[https://key](https://key)’] = user.app\_metadata.key;  
> callback(null, user, context);  
> }

Read more about the issue (and why you need to prepend http) here:  
[https://auth0.com/docs/api-auth/tutorials/adoption/scope-custom-claims](https://auth0.com/docs/api-auth/tutorials/adoption/scope-custom-claims)

I feel this is a bit hack-y, so would still like a better way if there is one.

---

<div class="post-metadata">

**Author:** ![charsleysa](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/charsleysa/32/9722_2.png) [@charsleysa](https://community.auth0.com/u/charsleysa)\
**Post date:** [December 2, 2018, 6:25am UTC](https://community.auth0.com/t/access-hook-created-app-metadata-javascript/18538/3 "2018-12-02T06:25:20Z")

</div>

Hi @chisnallio

Custom claims in JWTs should be namespaced and is enforced by Auth0 (so you won’t see your data if it’s not namespaced).

The recommendation is to use something like your domain as the namespace so the rule would be something like:

```auto
function (user, context, callback) {
    context.idToken['https://mydomain.com/id'] = user.app_metadata.id;
    context.idToken['https://mydomain.com/key'] = user.app_metadata.key;
    callback(null, user, context);
}

```

In our system we use the API host as our namespace as you can have custom claims namespaced per API (e.g. `https://api1.mydomain.com/id`)

---

<div class="post-metadata">

**Author:** ![chisnallio](https://upload.wikimedia.org/wikipedia/commons/thumb/7/7c/User_font_awesome.svg/768px-User_font_awesome.svg.png) [@chisnallio](https://community.auth0.com/u/chisnallio)\
**Post date:** [December 2, 2018, 11:28pm UTC](https://community.auth0.com/t/access-hook-created-app-metadata-javascript/18538/4 "2018-12-02T23:28:58Z")

</div>

Thanks for the reply. My exclusion of the actual domain was on account of having this on a test server so it will change. I did try and add a context property to automate this, but couldn’t quite get it to work (I think because the property I was using had auth0 as the domain which is ignored).  
Somethings like:

> function (user, context, callback) {  
> context.idToken[context.SOMETHING + ‘/id’] = user.app\_metadata.id;  
> context.idToken[context.SOMETHING + ‘/key’] = user.app\_metadata.key;  
> callback(null, user, context);  
> }

That way, my app could always access it even if I reused the code elsewhere… I hate having strings like that to update when I reuse code.

---

<div class="post-metadata">

**Author:** ![charsleysa](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/charsleysa/32/9722_2.png) [@charsleysa](https://community.auth0.com/u/charsleysa)\
**Post date:** [December 2, 2018, 11:51pm UTC](https://community.auth0.com/t/access-hook-created-app-metadata-javascript/18538/5 "2018-12-02T23:51:37Z")

</div>

You were on the right track though you’ve made one small mistake which in my opinion is very easy to make as you have to read the docs very carefully, I made the same mistake as well.

The configuration properties do not live in the context object but instead live in a goal configuration object.

To show you what I mean here’s a simple rule from our system that adds the user’s email to the access\_token:

```auto
function addEmailToAccessToken(user, context, callback) {
    context.accessToken[configuration.AUTH_NAMESPACE + '/email'] = user.email;
    return callback(null, user, context);
}

```

Note the use of `configuration` and not `context` when building the claim name.

---

<div class="post-metadata">

**Author:** ![chisnallio](https://upload.wikimedia.org/wikipedia/commons/thumb/7/7c/User_font_awesome.svg/768px-User_font_awesome.svg.png) [@chisnallio](https://community.auth0.com/u/chisnallio)\
**Post date:** [December 3, 2018, 6:11am UTC](https://community.auth0.com/t/access-hook-created-app-metadata-javascript/18538/6 "2018-12-03T06:11:05Z")

</div>

Hmm, if you attach to `idToken` instead of `accessToken`, `configuration.AUTH_NAMESPACE` comes out as `undefined` which is a funny little quirk I came across in testing before because it does work. For some reason, unidentified is allowed through even through it doesn’t begin with https://

> undefined/id: “jp3pbgcx”  
> undefined/key: “sGe27EjeDPa1Yoova0F6RXUwHmS3e6ab”

Incase this gets fixed, it’s a less preferable hack.

I couldn’t test the `accessToken` though because it wasn’t attached to the result from `webAuth.parseHash()`? How do you read that?

---

<div class="post-metadata">

**Author:** ![charsleysa](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/charsleysa/32/9722_2.png) [@charsleysa](https://community.auth0.com/u/charsleysa)\
**Post date:** [December 3, 2018, 6:28am UTC](https://community.auth0.com/t/access-hook-created-app-metadata-javascript/18538/7 "2018-12-03T06:28:30Z")

</div>

To answer your query about getting the access token, your request should have the `responseType` set to `token id_token`

In regards to the value coming our as `undefined`, have you made sure to add a configuration property to your rules? (The `AUTH_NAMESPACE` is not an inbuilt value, it’s a custom value)

You can do this in the Settings section of the [Rules](https://manage.auth0.com/#/rules) page in the Management dashboard.

Here’s a screenshot of some of our configurations that we have in our staging environment:

 ![image](https://global.discourse-cdn.com/auth0/original/2X/0/025002aa18785bb131e1499d93c281abfd82c3df.png)

---

<div class="post-metadata">

**Author:** ![chisnallio](https://upload.wikimedia.org/wikipedia/commons/thumb/7/7c/User_font_awesome.svg/768px-User_font_awesome.svg.png) [@chisnallio](https://community.auth0.com/u/chisnallio)\
**Post date:** [December 3, 2018, 7:41am UTC](https://community.auth0.com/t/access-hook-created-app-metadata-javascript/18538/8 "2018-12-03T07:41:56Z")

</div>

Great. Thanks. Not quite as automated as I want, but I will use those constants when I settle on the domain name!

---

<div class="post-metadata">

**Author:** ![konrad.sopala](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/konrad.sopala/32/13516_2.png) [@konrad.sopala](https://community.auth0.com/u/konrad.sopala)\
**Post date:** [December 6, 2018, 12:02pm UTC](https://community.auth0.com/t/access-hook-created-app-metadata-javascript/18538/9 "2018-12-06T12:02:52Z")

</div>

Thanks a lot @charsleysa for bringing so much valuable contribution to this thread!  
👏🏼

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/auth0/original/3X/b/5/b560f266932fcce5d57f09a6595bd50518cae3f3.jpeg) [@system](https://community.auth0.com/u/system)\
**Post date:** [January 5, 2019, 12:02pm UTC](https://community.auth0.com/t/access-hook-created-app-metadata-javascript/18538/10 "2019-01-05T12:02:54Z")

</div>

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.