Add custom scopes to a Refresh Token request

Knowledge Solutions
, , , ,
1

Problem statement

We have an M2M application, though we are not using an Auth0 SDK. We have already added the user-granted scopes to the JWT. It shows as empty when using the refresh token. But if making the same request using Postman, the scopes appear nicely.
Is there a way to add it?

Symptoms

The refresh token does not contain the expected custom scope if the request was made via a Rule/Action.

Solution

This is a limitation of the current product. The below Github link describes a possible workaround.

Question: refresh token call and custom rules · Issue #896 · auth0/auth0-spa-js · GitHub

" … you want access to these values in a Rule to run your own custom logic, you’re better just putting these values into a custom parameter that you can then pick up inside a rule. That way they don’t interfere with the OAuth flow while still being able to participate in your own custom logic."