# Custom Access Token

**URL:** <https://community.auth0.com/t/custom-access-token/113025>\
**Category:** Get Help\
**Tags:** apis, application\
**Created:** [August 7, 2023, 12:47pm UTC](https://community.auth0.com/t/custom-access-token/113025 "2023-08-07T12:47:18Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![mikeymike](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/mikeymike/32/33331_2.png) [@mikeymike](https://community.auth0.com/u/mikeymike)\
**Post date:** [August 7, 2023, 12:47pm UTC](https://community.auth0.com/t/custom-access-token/113025/1 "2023-08-07T12:47:18Z")

</div>

Hi.

We are working on transitioning from legacy IdP to Auth0.  
However, the problem is in the custom APIs to which the Access Token is sent at the moment.  
This token is self-contained, however it is not JWT standard.  
Is it possible to modify the AT token returned by Auth0 under its own format, or is it JWT only?  
Is there another way to achieve integration without refactoring the API? At the moment it works on the basis that the API knows the key used to encrypt the token.

Alternatively, could integration with this legacy IdP solve the problem? I.e. authentication and authorization would be handled by Auth0, and the legacy IdP would generate Access Tokens.

---

<div class="post-metadata">

**Author:** ![rueben.tiow](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/rueben.tiow/32/11646_2.png) [@rueben.tiow](https://community.auth0.com/u/rueben.tiow)\
**Post date:** [August 7, 2023, 4:17pm UTC](https://community.auth0.com/t/custom-access-token/113025/3 "2023-08-07T16:17:10Z")

</div>

Hi @mikeymike,

Yes, it is possible to have a different format for your Access tokens. If you did not pass in an `audience` parameter in your `/authorize` request, then you will get an opaque access token.

Including the `audience` parameter, will generate a JWT access token.

I recommend reading the following documentation for more information.

> **[Access Tokens](https://auth0.com/docs/secure/tokens/access-tokens#jwt-access-tokens)**
>
> Describes how access tokens are used in token-based authentication to allow an application to access an API after a user successfully authenticates and authorizes access.

 ![image](https://global.discourse-cdn.com/auth0/original/3X/8/f/8fdc9087755aec6ce17fe72b90dd21e2a2e5ee11.png)  
(Reference: [Get Access Tokens](https://auth0.com/docs/secure/tokens/access-tokens/get-access-tokens#control-access-token-audience))

Please let me know how this goes for you.

Thanks,  
Rueben

---

<div class="post-metadata">

**Author:** ![mikeymike](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/mikeymike/32/33331_2.png) [@mikeymike](https://community.auth0.com/u/mikeymike)\
**Post date:** [August 8, 2023, 6:30am UTC](https://community.auth0.com/t/custom-access-token/113025/4 "2023-08-08T06:30:32Z")

</div>

Thanks for the answer.  
However, as far as I know, these opaque tokens are returned in JWE format. Moreover, they can only be used to call endpoint /userinfo.

Unfortunately, the current legacy IdP returns ATs in a format that is not JSON. And so does the legacy API use these legacy ATs.

---

<div class="post-metadata">

**Author:** ![rueben.tiow](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/rueben.tiow/32/11646_2.png) [@rueben.tiow](https://community.auth0.com/u/rueben.tiow)\
**Post date:** [August 8, 2023, 4:28pm UTC](https://community.auth0.com/t/custom-access-token/113025/5 "2023-08-08T16:28:16Z")

</div>

Hi @mikeymike,

Thanks for following up.

These access tokens you mentioned may be an opaque JWE if an `audience` is not specified in the authentication request. Which, as you have discovered, will only work with the `/userinfo` endpoint.

To use the access token for your custom API, you must specify the audience identifier you set when you created your API on the Dashboard.

Could you please give it a try and let me know if you get a JWT access token?

If not, could you please [capture the login events in a HAR file](https://auth0.com/docs/troubleshoot/har) and send them to me as a direct message to look into this further?

Thanks,  
Rueben

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/auth0/original/3X/b/5/b560f266932fcce5d57f09a6595bd50518cae3f3.jpeg) [@system](https://community.auth0.com/u/system)\
**Post date:** [August 31, 2023, 12:16am UTC](https://community.auth0.com/t/custom-access-token/113025/6 "2023-08-31T00:16:00Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.