# Adding Additional Scopes in a Rule

**URL:** <https://community.auth0.com/t/adding-additional-scopes-in-a-rule/89374>\
**Category:** Get Help\
**Tags:** rules, scopes\
**Created:** [August 24, 2022, 2:01pm UTC](https://community.auth0.com/t/adding-additional-scopes-in-a-rule/89374 "2022-08-24T14:01:10Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![mike.edwards](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/mike.edwards/32/37952_2.png) [@mike.edwards](https://community.auth0.com/u/mike.edwards)\
**Post date:** [August 24, 2022, 2:01pm UTC](https://community.auth0.com/t/adding-additional-scopes-in-a-rule/89374/1 "2022-08-24T14:01:10Z")

</div>

I have a rule to add a custom scope if a certain condition is met, the code looks like this:

```auto
function (user, context, callback) {
    
 	

if(something == true){

  		var scopes = context.accessToken.scope ? context.accessToken.scope : "";    					
  		scopes += user.app_metadata && user.app_metadata.scopes ? " "+user.app_metadata.scopes : "";
  		scopes += "customScope"; //we add in a default scope
  		context.accessToken.scope = scopes;
    
     
 	}
  
   
  	return callback(null, user, context);
}

```

However if I set this custom scope, in this manner, all other scopes are removed. This includes any scope (permissions) assigned directly to the user or assigned via roles.

How can I add an additional scope, while still allowing for any additional scopes to be handled by Auth0 as normal?

---

<div class="post-metadata">

**Author:** ![ty.frith](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/ty.frith/32/58484_2.png) [@ty.frith](https://community.auth0.com/u/ty.frith)\
**Post date:** [August 25, 2022, 10:13pm UTC](https://community.auth0.com/t/adding-additional-scopes-in-a-rule/89374/4 "2022-08-25T22:13:49Z")

</div>

Hey there @mike.edwards!

> [@mike.edwards](#):
>
> How can I add an additional scope, while still allowing for any additional scopes to be handled by Auth0 as normal?

As far as I’m aware, this is expected behavior due to the fact that scopes shouldn’t be altered once the authorize request has already been made - In this case you are attempting to append a scope to a token which has already been created.

Instead, you might look into adding a [custom claim](https://community.auth0.com/t/adding-custom-claims-to-tokens/84590) using the same metadata. This way you can be sure. it’s not interfering with anything else.

Hope this helps!

---

<div class="post-metadata">

**Author:** ![ty.frith](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/ty.frith/32/58484_2.png) [@ty.frith](https://community.auth0.com/u/ty.frith)\
**Post date:** [September 9, 2022, 10:14pm UTC](https://community.auth0.com/t/adding-additional-scopes-in-a-rule/89374/5 "2022-09-09T22:14:29Z")

</div>

This topic was automatically closed 15 days after the last reply. New replies are no longer allowed.