# Is it safe to add Auth0 user\_id in the access token custom claims?

**URL:** <https://community.auth0.com/t/is-it-safe-to-add-auth0-user-id-in-the-access-token-custom-claims/128493>\
**Category:** Get Help\
**Tags:** security-compliance, security-question-concern\
**Created:** [February 28, 2024, 11:25am UTC](https://community.auth0.com/t/is-it-safe-to-add-auth0-user-id-in-the-access-token-custom-claims/128493 "2024-02-28T11:25:24Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Kada](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/kada/32/52736_2.png) [@Kada](https://community.auth0.com/u/Kada)\
**Post date:** [February 28, 2024, 11:25am UTC](https://community.auth0.com/t/is-it-safe-to-add-auth0-user-id-in-the-access-token-custom-claims/128493/1 "2024-02-28T11:25:24Z")

</div>

I’m using a post-login Auth0 action to call my application backend, passing the Auth0 internal user\_id in the body

My backend returns the corresponding database\_user\_id (the ID for this user in our database)

Then I add both the Auth0 internal user\_id and database\_user\_id as custom claims in the access token:

```javascript
// Auth0 post-login action

// .. call our backend

if (response.data.database_user_id) {

   api.user.setAppMetadata("database_user_id", response.data.database_user_id);

   api.accessToken.setCustomClaim("https://myapp.com/database_user_id", 
      response.data.database_user_id);
         
   api.accessToken.setCustomClaim("https://myapp.com/auth0_user_id", event.user.user_id);

    } else {
        api.access.deny()
}

```

The reason is that I can then ensure the token is valid in our backend middlewares, and also easily extract the user\_id and database\_user\_id

But I’m wondering if this is safe to do?

---

<div class="post-metadata">

**Author:** ![marcelina.barycka](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/marcelina.barycka/32/56162_2.png) [@marcelina.barycka](https://community.auth0.com/u/marcelina.barycka)\
**Post date:** [February 29, 2024, 5:36pm UTC](https://community.auth0.com/t/is-it-safe-to-add-auth0-user-id-in-the-access-token-custom-claims/128493/3 "2024-02-29T17:36:08Z")

</div>

Hi @Kada , thank you for posting!

The sub claim (a user id to which the access token has been issued by the authorization server) is a standard oauth2.0 claim an access token consists of. The custom claim you attach is of the same kind of information and also land in the token payload. This makes me think that, as long as you keep your database safe, you’re good.

Generally speaking, the recommendation is to avoid attaching user’s sensitive data to the access token payload. At the same time, resource servers need to know the user id in order to grant relevant, user’s scope-based resources.

If you didn’t have a chance before, you can learn more here - [Token Best Practices](https://auth0.com/docs/secure/tokens/token-best-practices).

If there are more questions you would like to discuss, please let us know!

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/auth0/original/3X/b/5/b560f266932fcce5d57f09a6595bd50518cae3f3.jpeg) [@system](https://community.auth0.com/u/system)\
**Post date:** [March 14, 2024, 5:36pm UTC](https://community.auth0.com/t/is-it-safe-to-add-auth0-user-id-in-the-access-token-custom-claims/128493/4 "2024-03-14T17:36:36Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.