# Custom Claim not showing after token refresh

**URL:** <https://community.auth0.com/t/custom-claim-not-showing-after-token-refresh/190760>\
**Category:** Get Help\
**Tags:** configuration, application\
**Created:** [August 19, 2025, 12:49am UTC](https://community.auth0.com/t/custom-claim-not-showing-after-token-refresh/190760 "2025-08-19T00:49:32Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Rama](https://upload.wikimedia.org/wikipedia/commons/thumb/7/7c/User_font_awesome.svg/768px-User_font_awesome.svg.png) [@Rama](https://community.auth0.com/u/Rama)\
**Post date:** [August 19, 2025, 12:49am UTC](https://community.auth0.com/t/custom-claim-not-showing-after-token-refresh/190760/1 "2025-08-19T00:49:32Z")

</div>

I’m using the latest version of auth0-nextjs.

Here’s the Custom Action we use to add the claims required by our backend:

```typescript
exports.onExecutePostLogin = async (event, api) => {
  // Add the authenticated user's email address to the access token
  const namespace = 'https://ourapp.com/';
  api.accessToken.setCustomClaim(namespace + 'email', event.user.email);

  if (event.request.query["org_id"] != null) {
    api.accessToken.setCustomClaim(namespace + 'org_id', event.request.query["org_id"]);
  }
};

```

My client setup is the default:

```typescript
export const auth0 = new Auth0Client({
  authorizationParameters: {
    scope: process.env.AUTH0_SCOPE,
    audience: process.env.AUTH0_AUDIENCE,
  },

  // Added this based on:
  // https://community.auth0.com/t/custom-claims-not-showing-up-in-nextjs-session/190622/3
  async beforeSessionSaved(session) {
    return session;
  },
});

```

My middleware is also pretty standard, but this is how I send the `org_id` query when needed:

```typescript
if (!session) {
  const basePath = process.env.APP_BASE_PATH ?? '';
  const loginUrl = new URL(`${basePath}/auth/login`, process.env.APP_BASE_URL);

  if (orgId) {
    loginUrl.searchParams.set('org_id', orgId);
  }

  return NextResponse.redirect(loginUrl);
}

```

This setup works fine initially: the first token correctly includes the `org_id` claim.

**The problem** comes when the token expires.  
When I call `auth0.getAccessToken()` to get a new token using the refresh token, the new access token no longer includes the custom claim.

From what I understand, this happens because the `org_id` query is not included when the SDK requests a new token from `/oauth/token`.

👉 My question: **How can I pass the `org_id` (or ensure the claim is preserved) when refreshing the token using `getAccessToken()`?**

Thanks

---

<div class="post-metadata">

**Author:** ![nik.baleca](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/nik.baleca/32/68749_2.png) [@nik.baleca](https://community.auth0.com/u/nik.baleca)\
**Post date:** [August 19, 2025, 4:41pm UTC](https://community.auth0.com/t/custom-claim-not-showing-after-token-refresh/190760/3 "2025-08-19T16:41:52Z")

</div>

Hi @Rama

Thank you for creating another post regarding addressing the issue that you are experiencing.

As mentioned in the previous [post](https://community.auth0.com/t/custom-claims-not-showing-up-in-nextjs-session/190622), have you tried using the `useUser()` hook for your application? Claims such as `org_id` and `email` should be displayed by default without needing to add them as custom claims, unless your users do not register using an email initially. Also, for the` beforeSessionSaved()` hook, can you also pass `idToken` as a parameter to see if it changes anything at all? If not, let me know!

Kind Regards,  
Nik

---

<div class="post-metadata">

**Author:** ![Rama](https://upload.wikimedia.org/wikipedia/commons/thumb/7/7c/User_font_awesome.svg/768px-User_font_awesome.svg.png) [@Rama](https://community.auth0.com/u/Rama)\
**Post date:** [August 19, 2025, 5:24pm UTC](https://community.auth0.com/t/custom-claim-not-showing-after-token-refresh/190760/4 "2025-08-19T17:24:09Z")

</div>

Hi @nik.baleca, thanks for your reply.

I tried adding `idToken` as a parameter in `beforeSessionSaved()`, but unfortunately nothing changed.

Let me clarify the issue we’re facing:

- The `org_id` is a dynamic UUID that the user selects before login.
- We add this `org_id` as a custom claim (`NAMESPACE/org_id`) in the access token, since our backend uses it to verify user permissions for a given organization (users can belong to multiple orgs with different levels of access).
- The first generated token has the custom claim and everything works fine.
- However, once the token expires and we request a new one using `getAccessToken()`, the refreshed token no longer includes the `NAMESPACE/org_id`. Because of this, the new token is invalid for backend calls.

Right now, our only workaround is to also expire the session after 5 minutes to force a re-login, but that’s obviously not a viable solution. We’re trying to find a way to make the custom claim persist in the refreshed token.

You also mentioned the `useUser()` hook, but since this is a server-side context, hooks aren’t applicable. In any case, I don’t see the `org_id` claim in either the `user` object or the `idToken` payload.

Kind Regards,  
Rama

---

<div class="post-metadata">

**Author:** ![nik.baleca](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/nik.baleca/32/68749_2.png) [@nik.baleca](https://community.auth0.com/u/nik.baleca)\
**Post date:** [August 21, 2025, 3:50pm UTC](https://community.auth0.com/t/custom-claim-not-showing-after-token-refresh/190760/5 "2025-08-21T15:50:56Z")

</div>

Hi again!

As far as I have checked with your implementation regarding the matter, it appears that the issue and as you have stated, the issue most definitely is being caused buy the fact that the `org_id` parameter is not being passed to the request that the SDK is making. Since the SDK makes a direct request to the /`oauth/token` endpoint, you are unable to pass that parameter.

Regarding the solutions for your current implementation, I would advise to force re-authentication for these users( which might not be ideal) or adapt your action so that the `org_id` is being added as `app_metadata` of the user in the initial login. Basically, the code would look something like this:

```auto
exports.onExecutePostLogin = async (event, api) => {
  const namespace = 'https://ourapp.com/';
  let orgId;

  // 1. Check for the query parameter on initial login
  if (event.request.query["org_id"]) {
    orgId = event.request.query["org_id"];
    // 2. Persist the org_id to app_metadata for future use
    api.user.setAppMetadata('org_id', orgId);
  } else {
    // 3. If no query parameter, get it from app_metadata (for token refresh)
    orgId = event.user.app_metadata.org_id;
  }

  // Add the org_id claim to the access token if it exists
  if (orgId) {
    api.accessToken.setCustomClaim(namespace + 'org_id', orgId);
  }
  api.accessToken.setCustomClaim(namespace + 'email', event.user.email);
};

```

Let me know if the proposed solution is suitable or if you have any other questions regarding the matter!

Kind Regards,  
Nik

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/auth0/original/3X/b/5/b560f266932fcce5d57f09a6595bd50518cae3f3.jpeg) [@system](https://community.auth0.com/u/system)\
**Post date:** [September 4, 2025, 3:51pm UTC](https://community.auth0.com/t/custom-claim-not-showing-after-token-refresh/190760/6 "2025-09-04T15:51:28Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.