Add custom scopes in the access token ( Authorization code flow with OIDC provider)

Hello, @arokde,

Once the token has been generated, you should not be tampering with the scopes. You can add metadata, but tampering with the scopes takes away all the security benefits of this specific part of the flow.

On the other hand, you list accessTokem when the correct object is accessToken, and you are not namespacing your claims. Make sure that you follow the document step by step in order to achieve the intended results.