# Adding custom information to Auth0 access token in Next.js

**URL:** <https://community.auth0.com/t/adding-custom-information-to-auth0-access-token-in-next-js/190172>\
**Category:** Get Help\
**Tags:** sessions, access-token\
**Created:** [August 5, 2025, 1:55pm UTC](https://community.auth0.com/t/adding-custom-information-to-auth0-access-token-in-next-js/190172 "2025-08-05T13:55:35Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![elian](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/elian/32/60703_2.png) [@elian](https://community.auth0.com/u/elian)\
**Post date:** [August 5, 2025, 1:55pm UTC](https://community.auth0.com/t/adding-custom-information-to-auth0-access-token-in-next-js/190172/1 "2025-08-05T13:55:35Z")

</div>

Hi Auth0 Community,

I’m building a Next.js application with Auth0 and I have two questions:

1. _Adding custom information to the access token_

2. _Best practice for retrieving the access token in Next.js_

Any guidance, code samples, or links to relevant documentation would be greatly appreciated. Thanks in advance!

---

<div class="post-metadata">

**Author:** ![teodor.andrei](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/teodor.andrei/32/75320_2.png) [@teodor.andrei](https://community.auth0.com/u/teodor.andrei)\
**Post date:** [August 6, 2025, 8:22am UTC](https://community.auth0.com/t/adding-custom-information-to-auth0-access-token-in-next-js/190172/3 "2025-08-06T08:22:37Z")

</div>

Hi @elian, and welcome back to the Auth0 Community!

I will be looking into your question, and I’ll provide you with an answer as soon as possible.

Thank you for your patience!  
Teodor.

---

<div class="post-metadata">

**Author:** ![elian](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/elian/32/60703_2.png) [@elian](https://community.auth0.com/u/elian)\
**Post date:** [August 6, 2025, 11:19am UTC](https://community.auth0.com/t/adding-custom-information-to-auth0-access-token-in-next-js/190172/4 "2025-08-06T11:19:27Z")

</div>

Thank you! I look forward to hearing from you. We are having difficulties with this implementation and would greatly appreciate your advice.

---

<div class="post-metadata">

**Author:** ![teodor.andrei](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/teodor.andrei/32/75320_2.png) [@teodor.andrei](https://community.auth0.com/u/teodor.andrei)\
**Post date:** [August 6, 2025, 12:45pm UTC](https://community.auth0.com/t/adding-custom-information-to-auth0-access-token-in-next-js/190172/5 "2025-08-06T12:45:42Z")

</div>

Hi again @elian, and thank you for your patience!

For your first question, yes, it’s absolutely possible to include extra claims in the Access Token. The recommended way to do that is through actions.

A critical security practice here is to use a **namespaced claim**. Any custom claims you add should be prefixed with a unique URI to prevent them from colliding with standard OIDC claims. For example, use `https://myapp.example.com/roles` instead of just `roles`. Here is a link to our [docs](https://auth0.com/docs/secure/tokens/json-web-tokens/create-custom-claims#namespaced-guidelines:~:text=zoneinfo-,Namespaced%20guidelines,-The%20Auth0%20URN) that explains the guidelines for namespaces.

Here’s how to create an Action to add a user’s roles to an access token.

1. **Navigate to the Actions Library:**

- Go to your Auth0 Dashboard.
- On the left menu, go to **Actions \> Library**.

1. **Create a New Action:**

- Click **Build Custom**.
- Give it a name, like “Add Roles to Access Token”.
- Select the “Login / Post Login” trigger.
- Choose the Node.js version you prefer.
- Click **Create**.

1. **Add the Action Code**

Here is an example of an action that adds a custom **roles** claim:

```auto
exports.onExecutePostLogin = async (event, api) => {
  const namespace = 'https://my-app.example.com';
  if (event.authorization) {
    api.accessToken.setCustomClaim(`${namespace}/roles`, event.authorization.roles);
  }
}

```

I will also link you the [docs](https://auth0.com/docs/secure/tokens/json-web-tokens/create-custom-claims) for adding custom claims, in case you still need more help.

As for your 2nd question, the recommended pattern is to keep access tokens on the server and use Next.js API routes as a proxy between your frontend and your external resource API.

So you will retrieve the Access Token on the server with the [getAccessToken](https://auth0.github.io/nextjs-auth0/classes/server.Auth0Client.html#getaccesstoken:~:text=Methods-,getAccessToken,-getAccessToken) method of the nextjs-auth0 SDK:

```auto
import { getAccessToken, withApiAuthRequired } from '@auth0/nextjs-auth0';

export const GET = withApiAuthRequired(async function products(req) {
  try {
    // 1. Get the Access Token from the user's session.
    const { accessToken } = await getAccessToken();

    // 2. Use the token to call your external API.
    const response = await fetch('https://my-external-api.com/products', {
      headers: {
        Authorization: `Bearer ${accessToken}`
      }
    });

    if (!response.ok) {
      return new Response('Failed to fetch from external API', { status: response.status });
    }

    const data = await response.json();
    return Response.json(data);

  } catch (error) {
    return new Response(error.message, { status: 500 });
  }
});

```

I hope this clarifies your questions!  
Teodor.

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/auth0/original/3X/b/5/b560f266932fcce5d57f09a6595bd50518cae3f3.jpeg) [@system](https://community.auth0.com/u/system)\
**Post date:** [August 20, 2025, 12:46pm UTC](https://community.auth0.com/t/adding-custom-information-to-auth0-access-token-in-next-js/190172/6 "2025-08-20T12:46:22Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.