Permissions from event.authorization.permissions become empty in custom JWT generated inside Post Login Action

JWT.io
, , , ,
1

I am using a Post Login Action in Auth0 to generate a custom PAT JWT using jsonwebtoken.sign().

RBAC is enabled and “Add Permissions in Access Token” is enabled for my API.

The Auth0-issued access token correctly contains:

"permissions": [
  "users:create",
  "users:delete",
  "users:read",
  "users:update"
]

I am also passing the API audience during login.

Inside the Action, I read permissions using:

const permissions =
  event.authorization?.permissions || [];

However, after generating my custom JWT:

const payload = {
  permissions
};

the generated PAT contains:

"permissions": []

Other fields in the payload are preserved correctly.

Is there any known limitation, issue, or mutation behavior in Auth0 Actions when signing custom JWTs using jsonwebtoken?