Custom claims are not setting up in case of magic link

Get Help
,
1

Custom claims are not coming through with access token. I am using passwordless authentication(magic-link). below is my post login flow

exports.onExecutePostLogin = async (event, api) => {
if (event.connection.name === ‘email’) {
const now = new Date();
const ttlMinutes = 5;

const existingSessionExpires = event.user.app_metadata?.sessionExpires;

const assigned_tenant = event.request.query.assigned_tenant || "default1";


if (!existingSessionExpires || new Date(existingSessionExpires) < now) {
  const sessionExpires = new Date(now.getTime() + ttlMinutes * 60 * 1000).toISOString();
  api.user.setAppMetadata('isTemporary', true);
  api.user.setAppMetadata('sessionExpires', sessionExpires);
  api.user.setAppMetadata('isValid', true);
  api.user.setAppMetadata('linkUsed', true);
  api.user.setAppMetadata('assigned_tenant', assigned_tenant);

  api.accessToken.setCustomClaim('https://autoverify-stage.eu.auth0.com/is_temporary', true);
  api.accessToken.setCustomClaim('https://autoverify-stage.eu.auth0.com/session_expires', sessionExpires);

  api.idToken.setCustomClaim('https://autoverify-stage.eu.auth0.com/is_temporary', true);
  api.idToken.setCustomClaim('https://autoverify-stage.eu.auth0.com/session_expires', sessionExpires);
} else {
  api.user.setAppMetadata('isValid', false);
  api.accessToken.setCustomClaim('https://autoverify-stage.eu.auth0.com/is_temporary', false);
}

}
};

everything else is working fine appmetadata is setting up alright but i am not getting custom claims

3

Hi @fahad.amin

Welcome to the Auth0 Community!

I have tested the action on my personal tenant and I was running into the same issues.

However, I managed to set the custom claims by changing the namespace you have set to something different:

  api.accessToken.setCustomClaim("https://test.com/is_temporary", true);
  api.accessToken.setCustomClaim("https://test.com/session_expires", sessionExpires);

  api.idToken.setCustomClaim("https://test.com/is_temporary", true);
  api.idToken.setCustomClaim("https://test.com/session_expires", sessionExpires);

As mentioned in our documentation, I believe the namespaces you have used go against our guidelines.

*Use any non-Auth0 HTTP or HTTPS URL as a namespace identifier. Auth0 domains cannot be used as namespace identifiers, and include:

If you have any other questions, feel free to leave a reply!

Kind Regards,
Nik