# Add email of the user to the access-token using rules **URL:** \ **Category:** Get Help\ **Tags:** email, api, rules, token, access-token, auth0\ **Created:** [May 26, 2022, 11:33am UTC](https://community.auth0.com/t/add-email-of-the-user-to-the-access-token-using-rules/84111 "2022-05-26T11:33:21Z")\ **Posts on this page:** 12\ **Page:** 1
**Author:** ![naman.chaturvedi](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/naman.chaturvedi/32/37646_2.png) [@naman.chaturvedi](https://community.auth0.com/u/naman.chaturvedi)\ **Post date:** [May 26, 2022, 11:33am UTC](https://community.auth0.com/t/add-email-of-the-user-to-the-access-token-using-rules/84111/1 "2022-05-26T11:33:21Z")
I am trying to add email of the user in the access\_token using an inbuilt rule. It is working while trying the rule but not working with the API. And the access token that I get from oauth/token endpoint doesn’t contain the email address. This is how I have defined the rule: ![rule 1](https://global.discourse-cdn.com/auth0/original/3X/9/0/90d430fb6df41107ddb5c705a7ce17f40f79b678.jpeg) And in the try this rule feature the email gets added to the output:- ![rule2](https://global.discourse-cdn.com/auth0/original/3X/6/8/684aac58c221d42f123b996c93faf9e5168dad71.jpeg) And this is how I am fetching the token:- ![rule 3](https://global.discourse-cdn.com/auth0/original/3X/2/7/27198558d223245ef0aa074ecde25d1554d0526e.jpeg) But in the decoded access token there is no email:- ![rule 4](https://global.discourse-cdn.com/auth0/original/3X/1/1/11911735fa9f42de071e934cafd0c81361ffa387.jpeg) I have also tried using the /userInfo endpoint to fetch the user details but it gives the response as ‘Unauthorized’. Please help me as soon as possible. Any insights would be greatly appreciated. ---
**Author:** ![john.gateley](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/john.gateley/32/10879_2.png) [@john.gateley](https://community.auth0.com/u/john.gateley)\ **Post date:** [May 26, 2022, 1:17pm UTC](https://community.auth0.com/t/add-email-of-the-user-to-the-access-token-using-rules/84111/2 "2022-05-26T13:17:18Z")
Hi @naman.chaturvedi A few things: Make sure you are using the right tenant. If you are using a different tenant, the rule won’t be there of course. You should change your client secret, since it is in the screenshot you included. Try the real time webtask logs extension (available in your dashboard’s extension tab) and put some console.log statements in. I think you will find that the rule is not being executed when you invoke from the API, and this is almost always due to it being the wrong tenant. John ---
**Author:** ![naman.chaturvedi](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/naman.chaturvedi/32/37646_2.png) [@naman.chaturvedi](https://community.auth0.com/u/naman.chaturvedi)\ **Post date:** [May 26, 2022, 5:55pm UTC](https://community.auth0.com/t/add-email-of-the-user-to-the-access-token-using-rules/84111/3 "2022-05-26T17:55:01Z")
Hi @john.gateley Thanks for your reply. I only have one tenant which I created while signing up on Auth0. So there is no chance that the tenant would be different. I have changed the client secret. Thanks for pointing it out. I tried webtask logs extension but it doesn’t show much information when I generate a token, as you can see: ![webtask log](https://global.discourse-cdn.com/auth0/original/3X/4/c/4ca9dfa91f8f2632e46f3899d0bd90a78227deca.jpeg) I also want to point out that the application that I am using is a machine to machine application. And I checked Monitoring\> Logs section there and it looked like this: { “date”: “2022-05-26T17:39:40.244Z”, “type”: “seccft”, “description”: “Client Credentials for Access Token”, “connection\_id”: “”, “client\_id”: “VfwvxS1############MMd0G”, “client\_name”: “icar (Test Application)”, “ip”: “49.#######.125”, “user\_agent”: “Other 0.0.0 / Other 0.0.0”, “details”: { “actions”: { “executions”: [ “TqSNq8DKR#############MjIwNTI2” ] } }, “hostname”: “[dev-a2z9f75t.us.auth0.com](http://dev-a2z9f75t.us.auth0.com)”, “user\_id”: “”, “user\_name”: “”, “audience”: “[https://i-car/api](https://i-car/api)”, “scope”: null, “log\_id”: “90020220526173944733###########34572255890636818”, “\_id”: “900202205261739447332#############11534572255890636818”, “isMobile”: false } And in the Action Details tab I saw that the action that I created to do the same thing got executed but in the Access token email is still not available. The action I created looked like this: ![action flow](https://global.discourse-cdn.com/auth0/original/3X/8/9/897a367f3e624ce4915a4acbcb9d18c93a9a645a.jpeg) ![action](https://global.discourse-cdn.com/auth0/original/3X/c/2/c278716f5dd0d4714f2ad22a9f0f64673cba59d1.jpeg) And in the login fow I can see Rules(Legacy) but not in M2M flow. So can any of this be the reason that I can’t see email in Access token? ---
**Author:** ![john.gateley](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/john.gateley/32/10879_2.png) [@john.gateley](https://community.auth0.com/u/john.gateley)\ **Post date:** [May 31, 2022, 2:31pm UTC](https://community.auth0.com/t/add-email-of-the-user-to-the-access-token-using-rules/84111/4 "2022-05-31T14:31:10Z")
Hi @naman.chaturvedi With M2M/Client credentials, the rules don’t fire. Instead you must use the Client Credentials hook (or the equivalent in Auth0 Actions). But there is no user associated with M2M, so you cannot get an email address. So I am confused on what you are trying to do. John ---
**Author:** ![jpm-homebug](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/jpm-homebug/32/20203_2.png) [@jpm-homebug](https://community.auth0.com/u/jpm-homebug)\ **Post date:** [May 31, 2022, 3:55pm UTC](https://community.auth0.com/t/add-email-of-the-user-to-the-access-token-using-rules/84111/5 "2022-05-31T15:55:16Z")
This is really interesting as I am hitting the exact same issue. I’m using all these methods to authenticate users: - [auth0-vue/vue2-login.md at main · auth0/auth0-vue · GitHub](https://github.com/auth0/auth0-vue/blob/main/tutorial/vue2-login.md) - [GitHub - auth0/auth0-vue: Auth0 authentication SDK for Vue.js apps](https://github.com/auth0/auth0-vue) - [Call Your API Using Resource Owner Password Flow](https://auth0.com/docs/get-started/authentication-and-authorization-flow/call-your-api-using-resource-owner-password-flow) My SPA makes many calls to my backend. The data returned depends on the logged in user. So I need to know the email address of the user. For scalability’s sake I do not want to make a call to auth0 every time a call is made to my api. How is my backend supposed to identify the user accessing my api? ---
**Author:** ![john.gateley](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/john.gateley/32/10879_2.png) [@john.gateley](https://community.auth0.com/u/john.gateley)\ **Post date:** [June 1, 2022, 2:18pm UTC](https://community.auth0.com/t/add-email-of-the-user-to-the-access-token-using-rules/84111/6 "2022-06-01T14:18:28Z")
Hi @jpm-homebug I don’t think you are hitting the same issue - you are not using client credentials as far as I can tell. When you have a user, you use Auth Code, Auth Code + PKCE or ROPG (not recommended). That looks like what you are using. It should be no issue to have the email there. However, your user’s email should not be the key used by the back end to look up info. While emails must be unique within a single Auth0 connection, if you have multiple connections, you can have duplicate emails: an email can refer to two distinct users. John ---
**Author:** ![jpm-homebug](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/jpm-homebug/32/20203_2.png) [@jpm-homebug](https://community.auth0.com/u/jpm-homebug)\ **Post date:** [June 1, 2022, 2:48pm UTC](https://community.auth0.com/t/add-email-of-the-user-to-the-access-token-using-rules/84111/7 "2022-06-01T14:48:55Z")
Hi John, thanks for the answer. You are indeed correct, my issue was elsewhere. The Golang library didn’t parse the custom claims from the access token: > > > \### Describe the problem > > Decoded access token does not contain custom claims.… > > \### What was the expected behavior? > > I want to see the custom claims that were added by the auth0 actions. > > \### Reproduction > > I have an access token that looks like this: > \`\`\`eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCIsImtpZCI6IjdOU1ZEMHpoMnJmSG9JWjM3YjBqWiJ9.eyJodHRwczovL2F1dGguZWJ1Zy5jby56YS9lbWFpbCI6ImpwbWVpamVyc0Bob21lYnVnLmNvLnphIiwiaHR0cHM6Ly9hdXRoLmVidWcuY28uemEvZW1haWxfdmVyaWZpZWQiOnRydWUsImlzcyI6Imh0dHBzOi8vYXV0aC5lYnVnLmNvLnphLyIsInN1YiI6ImF1dGgwfDEyMTEiLCJhdWQiOiJodHRwczovL2FwaS5lYnVnLmNvLnphIiwiaWF0IjoxNjU0MDE0MDM2LCJleHAiOjE2NTQxMDA0MzYsImF6cCI6InFyZGJkeGllZGtTQVBtbHhVckw0OTJVSjR3WHRWajVBIiwic2NvcGUiOiJlbWFpbCIsImd0eSI6InBhc3N3b3JkIiwicGVybWlzc2lvbnMiOltdfQ.MvKzvEbmmZRgOOGvG35npCkS3FfDmEJt1dpc\_uRey5MZLvuO\_a2Z8L-Z7TizVBkWhIHWL8mxopzjI9PLx\_VzeexL8XKt7mrg0eiabu6sLlky29pXGjfh1SDDMhV4MTWMc\_G94riNs-LfSZ7sevZMOn2TyCGEcSwJf5uW-xbcBQLeHIDMIhm1vAqFvJj\_qsE68KFO2O0g1JZbSjakRBUq\_aL0CsSpOScKXKk9Bi19L0U\_mjYeUxYD24sMyZ6wbOot5\_OPgIV3ouBUEuLR8RA0itGj7n22flRdzTR6inAB-KJdQZ7reFcP7YrKzTyrKA5p3nb245sJhvGPGmYIaZSBvw\`\`\` > > I call the golang API which prints out the json marshalled claims: > \`\`\` > func TestUserAuthedRoute(w http.ResponseWriter, r \*http.Request) { > claims := r.Context().Value(jwtmiddleware.ContextKey{}).(\*validator.ValidatedClaims) > log.Println(claims.RegisteredClaims.Subject) > > payload, err := json.Marshal(claims) > if err != nil { > http.Error(w, err.Error(), http.StatusInternalServerError) > return > } > > w.Header().Set("Content-Type", "application/json") > w.Write(payload) > } > \`\`\` > > The result is: > \`\`\` > { > "CustomClaims": { > "scope": "email" > }, > "RegisteredClaims": { > "iss": "https://auth.ebug.co.za/", > "sub": "auth0|1211", > "aud": \[ > "https://api.ebug.co.za" > \], > "exp": 1654100251, > "iat": 1654013851 > } > } > \`\`\` > > I am expecting to see the custom claims, like jwt.io shows when decoding this same access token: > \`\`\` > { > "https://auth.ebug.co.za/email": "jpmeijers@homebug.co.za", > "https://auth.ebug.co.za/email\_verified": true, > "iss": "https://auth.ebug.co.za/", > "sub": "auth0|1211", > "aud": "https://api.ebug.co.za", > "iat": 1654014036, > "exp": 1654100436, > "azp": "qrdbdxiedkSAPmlxUrL492UJ4wXtVj5A", > "scope": "email", > "gty": "password", > "permissions": \[\] > } > \`\`\` > > \### Environment > > \- \*\*Version of \`go-jwt-middleware\` used:\*\* github.com/auth0/go-jwt-middleware/v2 v2.0.1 > \- \*\*Other modules/plugins/libraries that might be involved:\*\* > [@john.gateley](#): > > However, your user’s email should not be the key used by the back end to look up info. How would you suggest I identify users? The only unique value I see is the `sub` field. If I have a database where I need to give specific users access to specific lines in a table (many-to-many), I was thinking of having a table of email addresses, linked to the specifc foreign keys. Should I rather use the value in the `sub` field to do this linking? When using the email address I can grant permissions before a user registered. If I use the `sub` field I would require the user to log in at least once so I can store the `sub` value. Storing email addresses in my table seems cleaner than storing `sub` values. ---
**Author:** ![john.gateley](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/john.gateley/32/10879_2.png) [@john.gateley](https://community.auth0.com/u/john.gateley)\ **Post date:** [June 1, 2022, 3:22pm UTC](https://community.auth0.com/t/add-email-of-the-user-to-the-access-token-using-rules/84111/8 "2022-06-01T15:22:25Z")
There are two basic approaches: - Use the sub field and store that value in your DB - Use your internal user ID, and store that value in the user’s app metadata in Auth0 and return it in the access and ID tokens Using email addresses will introduce security risks if you ever have more than one connection. Consider: you have a Facebook social connection and an email/password connection: 1. User [john@example.com](mailto:john@example.com) signs in to your app for the first time with a facebook login 2. Your app creates an entry for user “[john@example.com](mailto:john@example.com)” 3. Evil hacker signs up for your app using email and password, with email “[john@example.com](mailto:john@example.com)” 4. Your app backend adds that to your existing entry for “[john@example.com](mailto:john@example.com)” 5. Evil hacker has now compromised that account. Granting permissions before you have identified a user sounds dangerous to me - since you haven’t identified the user, you are not sure who you are granting permissions to. John ---
**Author:** ![jpm-homebug](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/jpm-homebug/32/20203_2.png) [@jpm-homebug](https://community.auth0.com/u/jpm-homebug)\ **Post date:** [June 2, 2022, 8:06am UTC](https://community.auth0.com/t/add-email-of-the-user-to-the-access-token-using-rules/84111/9 "2022-06-02T08:06:55Z")
Ahh really interesting. But doesn’t the whole “verify email” prevent this scenario? In other words if I verified the email, I can trust the user has access to the email account, and therefore it is not a hacker. ---
**Author:** ![john.gateley](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/john.gateley/32/10879_2.png) [@john.gateley](https://community.auth0.com/u/john.gateley)\ **Post date:** [June 2, 2022, 1:57pm UTC](https://community.auth0.com/t/add-email-of-the-user-to-the-access-token-using-rules/84111/10 "2022-06-02T13:57:52Z")
No, verification isn’t sufficient. The owner of the email account gets an email saying “is this your account”, and probably clicks “yes it is”, since it really is. This is a pernicious attack, and it is worthwhile setting up your system to not be vulnerable at the beginning. John ---
**Author:** ![ervinjelvos9](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/ervinjelvos9/32/34923_2.png) [@ervinjelvos9](https://community.auth0.com/u/ervinjelvos9)\ **Post date:** [June 2, 2022, 7:53pm UTC](https://community.auth0.com/t/add-email-of-the-user-to-the-access-token-using-rules/84111/11 "2022-06-02T19:53:47Z")
When you have a user, you use Auth Code, Auth Code + PKCE or ROPG (not recommended). That looks like what you are using. It should be no issue to have the email there. [![download alight motion on ios or mac](https://global.discourse-cdn.com/auth0/original/3X/8/0/80f1a80e640419eb7bbb46f7f4fb626863f7ffe1.jpeg)](https://alightmotionapk.co/mod-for-ios/) However, your user’s email should not be the key used by the back end to look up info. While emails must be unique within a single Auth0 connection, if you have multiple connections, you can have duplicate emails: an email can refer to two distinct users. ---
**Author:** ![ty.frith](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/ty.frith/32/58484_2.png) [@ty.frith](https://community.auth0.com/u/ty.frith)\ **Post date:** [October 17, 2022, 6:45pm UTC](https://community.auth0.com/t/add-email-of-the-user-to-the-access-token-using-rules/84111/12 "2022-10-17T18:45:53Z")