# Is it possible to modify a JWT and re-sign it from server side?

**URL:** <https://community.auth0.com/t/is-it-possible-to-modify-a-jwt-and-re-sign-it-from-server-side/107431>\
**Category:** Get Help\
**Tags:** user-profile, user-management\
**Created:** [May 19, 2023, 10:56pm UTC](https://community.auth0.com/t/is-it-possible-to-modify-a-jwt-and-re-sign-it-from-server-side/107431 "2023-05-19T22:56:39Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![fernandom](https://upload.wikimedia.org/wikipedia/commons/thumb/7/7c/User_font_awesome.svg/768px-User_font_awesome.svg.png) [@fernandom](https://community.auth0.com/u/fernandom)\
**Post date:** [May 19, 2023, 10:56pm UTC](https://community.auth0.com/t/is-it-possible-to-modify-a-jwt-and-re-sign-it-from-server-side/107431/1 "2023-05-19T22:56:39Z")

</div>

Hi, this is my use case:

- Users can join to several channels (channel\_id1, channel\_id2, …)
- A user can leave a channel and join any other channel at any time.

I would like to include the channel\_id in the JWT (and change its value as many times a user enter/leave a channel).

1. Is it possible to do this form server side?
2. Is there any way to modify a JWT and resign it dynamically?

Thanks in advance.

---

<div class="post-metadata">

**Author:** ![ty.frith](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/ty.frith/32/58484_2.png) [@ty.frith](https://community.auth0.com/u/ty.frith)\
**Post date:** [May 20, 2023, 12:17am UTC](https://community.auth0.com/t/is-it-possible-to-modify-a-jwt-and-re-sign-it-from-server-side/107431/3 "2023-05-20T00:17:59Z")

</div>

Hi there @fernandom welcome to the community!

> [@fernandom](#):
>
> - Is it possible to do this form server side?
> - Is there any way to modify a JWT and resign it dynamically?

You won’t be able to modify and re-sign tokens, but you could request new tokens with the new claim - To do this you may want to look into triggering [silent authentication](https://auth0.com/docs/authenticate/login/configure-silent-authentication) as a means to request new tokens for a user that has an existing session. Silent auth will run any [Actions](https://auth0.com/docs/customize/actions) you have configured to add the additional/new claim. The only pitfall I see here is [rate limiting](https://auth0.com/docs/troubleshoot/customer-support/operational-policies/rate-limit-policy/authentication-api-endpoint-rate-limits) which could happen rather quickly if many users are switching channels frequently.

You could use a backend to interact with the Management API and update user or app [metadata](https://auth0.com/docs/manage-users/user-accounts/metadata) with a `channel_id` and add that as a custom claim using an Action. Basically you would update the metadata for a user with the new `channel_id` when necessary, and then trigger silent auth - The new metatadata will be pulled into the resulting tokens as a custom claim.

For example, the [node management client](https://github.com/auth0/node-auth0) provides an [updateUserMetadata](https://auth0.github.io/node-auth0/ManagementClient.html#updateUserMetadata) and [updateAppMetadata](https://auth0.github.io/node-auth0/ManagementClient.html#updateAppMetadata) function - An action to add metadata to tokens might look like:

```auto
exports.onExecutePostLogin = async (event, api) => {
  const namespace = 'https://my-app.example.com';
  if (event.authorization) {
    api.idToken.setCustomClaim(`${namespace}/user_metadata`, event.user.user_metadata);
    api.idToken.setCustomClaim(`${namespace}/app_metadata`, event.client.metadata);
  }
};

```

Hope this helps at least give you an idea of what’s possible!

---

<div class="post-metadata">

**Author:** ![fernandom](https://upload.wikimedia.org/wikipedia/commons/thumb/7/7c/User_font_awesome.svg/768px-User_font_awesome.svg.png) [@fernandom](https://community.auth0.com/u/fernandom)\
**Post date:** [May 20, 2023, 12:26am UTC](https://community.auth0.com/t/is-it-possible-to-modify-a-jwt-and-re-sign-it-from-server-side/107431/4 "2023-05-20T00:26:16Z")

</div>

Thank you very much for clarifying and such a detailed answer.

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/auth0/original/3X/b/5/b560f266932fcce5d57f09a6595bd50518cae3f3.jpeg) [@system](https://community.auth0.com/u/system)\
**Post date:** [June 3, 2023, 12:26am UTC](https://community.auth0.com/t/is-it-possible-to-modify-a-jwt-and-re-sign-it-from-server-side/107431/5 "2023-06-03T00:26:40Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.