You can use the OIDC scopes (email profile
) to influence the contents of the ID token, not the contents of the ACCESS token.
In a scenario where you have an independent API what you actually send to the API is the access token so that’s why I mentioned custom claims.
However, my mention of custom claims is in the context of an access token; not the ID token. Something like:
context.accessToken["http://claims.example.com/email"] = user.email;
You can get an email
claim automatically in the ID token by using the email
scope, but since you’re using an access token to call the API this would be mostly irrelevant.