# How to add user meta data and app meta data in access token?

**URL:** <https://community.auth0.com/t/how-to-add-user-meta-data-and-app-meta-data-in-access-token/79575>\
**Category:** Get Help\
**Tags:** api, rules, auth0\
**Created:** [March 9, 2022, 1:21pm UTC](https://community.auth0.com/t/how-to-add-user-meta-data-and-app-meta-data-in-access-token/79575 "2022-03-09T13:21:39Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![selvi](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/selvi/32/33945_2.png) [@selvi](https://community.auth0.com/u/selvi)\
**Post date:** [March 9, 2022, 1:21pm UTC](https://community.auth0.com/t/how-to-add-user-meta-data-and-app-meta-data-in-access-token/79575/1 "2022-03-09T13:21:39Z")

</div>

1. I am trying to get app metadata and user metadata using accesstoken by UserNameAndPassword authentication.
2. But I am getting role information alone, While decoding my access token.
3. Added below rule script

```auto

function (user, context, callback) {
  const namespace = 'https://myapp.example.com';
  const assignedRoles = (context.authorization || {}).roles;

  let idTokenClaims = context.idToken || {};
  let accessTokenClaims = context.accessToken || {};

  idTokenClaims[`${namespace}/role`] = assignedRoles;
  accessTokenClaims[`${namespace}/role`] = assignedRoles;

  context.idToken = idTokenClaims;
  context.accessToken = accessTokenClaims;
  if (context.idToken && user.user_metadata) {
     context.idToken[namespace + 'user_metadata'] = user.user_metadata;
   }
   if (context.idToken && user.app_metadata) {
     context.idToken[namespace + 'app_metadata'] = user.app_metadata;
   }

 return callback(null, user, context);
}

```

1. Curl command  
curl --request POST   
–url ‘[https://domain/oauth/token](https://domain/oauth/token)’   
–header ‘content-type: application/x-www-form-urlencoded’   
–data grant\_type=password   
–data [username=sample@gmail.com](mailto:username=sample@gmail.com)   
–data password=pwd  
–data audience=[https://domain/api/v2/](https://domain/api/v2/)   
–data ‘client\_id=bdskjafdf’   
–data scope=openid profile email phone   
–data client\_secret=nfnkdfndndfn

2. decode sample response

{  
“[https://myapp.example.com/role](https://myapp.example.com/role)”: [  
“role-a”,  
“role-b”  
],  
“iss”: “[https://domain.com/](https://domain.com/)”,  
“sub”: “auth0|00000000070688462”,  
“aud”: [  
“[https://domain/api/v2/](https://domain/api/v2/)”,  
“[https://domain/userinfo](https://domain/userinfo)”  
],  
“iat”: 164650,  
“exp”: 1646050,  
“azp”: “sbdkjbskjkn”,  
“scope”: “openid profile email address phone read:current\_user update:current\_user\_metadata delete:current\_user\_metadata create:current\_user\_metadata create:current\_user\_device\_credentials delete:current\_user\_device\_credentials update:current\_user\_identities”,  
“gty”: “password”  
}

1. **Need clarification What url need to be passed on rule const namespace = ‘[https://myapp.example.com](https://myapp.example.com)’;**

---

<div class="post-metadata">

**Author:** ![ty.frith](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/ty.frith/32/58484_2.png) [@ty.frith](https://community.auth0.com/u/ty.frith)\
**Post date:** [March 14, 2022, 11:41pm UTC](https://community.auth0.com/t/how-to-add-user-meta-data-and-app-meta-data-in-access-token/79575/3 "2022-03-14T23:41:14Z")

</div>

Hello @selvi welcome to the community!

> [@selvi](#):
>
> 1. **Need clarification What url need to be passed on rule const namespace = ‘[https://myapp.example.com](https://myapp.example.com)’;**

You can read more about namespaced claims [here](https://auth0.com/docs/secure/tokens/json-web-tokens/create-namespaced-custom-claims), but the namespace is more or less simply to ensure that claims don’t collide with reserved claims nor claims from other resources.

> [@selvi](#):
>
> ```auto
> context.idToken = idTokenClaims;
> context.accessToken = accessTokenClaims;
> if (context.idToken && user.user_metadata) {
> context.idToken[namespace + 'user_metadata'] = user.user_metadata;
> }
> if (context.idToken && user.app_metadata) {
> context.idToken[namespace + 'app_metadata'] = user.app_metadata;
> }
> 
> ```

It looks like you’re adding these claims to the ID Token here whereas you shared what seems to be an access token. Can you confirm whether or not they exist in the ID Token?

Let us know!

---

<div class="post-metadata">

**Author:** ![ty.frith](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/ty.frith/32/58484_2.png) [@ty.frith](https://community.auth0.com/u/ty.frith)\
**Post date:** [March 28, 2022, 3:00pm UTC](https://community.auth0.com/t/how-to-add-user-meta-data-and-app-meta-data-in-access-token/79575/4 "2022-03-28T15:00:54Z")

</div>

This topic was automatically closed after 9 days. New replies are no longer allowed.