Post Login Action - Claims Missing in JWT

[3dyuval]

Hi everyone,

I’ve searched extensively on this topic and found it brought up multiple times, but haven’t come across a clear solution.

I’m trying to set custom claims in the JWT idToken and accessToken using a Post Login Action in Auth0. Here’s what I’ve done so far:

1. Created a Post Login Action with the following code:

exports.onExecutePostLogin = async (event, api) => { 
    const namespace = 'namespace-preffix';
 
    if (event.authorization) { 
        console.log(event.authorization.roles); // Successfully logs the roles
        api.idToken.setCustomClaim(`${namespace}/roles`, event.authorization.roles); 
        api.accessToken.setCustomClaim(`${namespace}/roles`, event.authorization.roles); 
    } 
};

2. Bound the Action to the appropriate Post Login flow in the Triggers section.

Despite this setup:

• The roles are successfully logged in the Action Logs (event.authorization.roles logs correctly).
• However, the custom claims never show up in the JWT idToken or accessToken.

I expect the custom claim (namespace/roles) to appear in the token payload, but it’s consistently missing.

Has anyone encountered this issue or know of any steps I might be missing? Any guidance would be greatly appreciated!

[sumansaurav]

Hi @3dyuval ,

Would you mind sharing:

• The format of your roles NOT real data data when it’s logged?

Try explicitly converting it to an array if needed:

api.idToken.setCustomClaim(`${namespace}/roles`, Array.from(event.authorization.roles));

You can also check the guidelines to use namespace identifier here:

Create Custom Claims

You also need to verify your client application is configured to receive these custom claims:

• Check if the client’s “Token Endpoint Authentication Method” is properly set
• Verify that the necessary scopes are included in your authentication request

[dawid.matuszczyk]

Hi @3dyuval

Welcome to the Auth0 Community!

Thank you for posting your question. The Action code for adding the claims looks good, and I successfully tested a similar code a few minutes ago. Could you check if your application is passing the audience in the request? I’m guessing that you could be getting an opaque token, not a valid JWT → Why Access Token Is Not a JWT (Opaque Token)

Thanks
Dawid