# \[Rules\] Is it possible to access the signed JWT token values within rules after they are serialized?

**URL:** <https://community.auth0.com/t/rules-is-it-possible-to-access-the-signed-jwt-token-values-within-rules-after-they-are-serialized/15886>\
**Category:** Get Help\
**Tags:** jwt, rules\
**Created:** [September 25, 2018, 11:28am UTC](https://community.auth0.com/t/rules-is-it-possible-to-access-the-signed-jwt-token-values-within-rules-after-they-are-serialized/15886 "2018-09-25T11:28:02Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![coreyh](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/coreyh/32/8810_2.png) [@coreyh](https://community.auth0.com/u/coreyh)\
**Post date:** [September 25, 2018, 11:28am UTC](https://community.auth0.com/t/rules-is-it-possible-to-access-the-signed-jwt-token-values-within-rules-after-they-are-serialized/15886/1 "2018-09-25T11:28:02Z")

</div>

[Rules] Is it possible to access the signed JWT token values within rules after they are serialized?

So I can use the value when calling a 3rd party api to get a federated identity to put in the Auth0 auth result when it’s sent to the client.

I am not sure this is possible and I may need to handle it in my app code if not.

I’ve tried this

> [@Jwt.sign within rule generates invalid token frequently](http://community.auth0.com/t/jwt-sign-within-rule-generates-invalid-token-frequently/8006):
>
> We have a rule in place that calls an API to enrich the final token given to the user during the authentication flow. Using jwt.sign within the rule fails about half the time (meaning the generated value is not a valid token). function enrichTokenWithCtxUserRef(user, context, callback) { // if this is not an authentication for an api or this client // doesn't provide a signing\_secret and me\_endpoint then get out. if (!context.request.query.audience || !context.clientMetadata.signing\_…

but I get this error when trying the rule

`ERROR: Cannot read property 'signing_secret' of undefined`

Thanks.

---

<div class="post-metadata">

**Author:** ![coreyh](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/coreyh/32/8810_2.png) [@coreyh](https://community.auth0.com/u/coreyh)\
**Post date:** [September 25, 2018, 11:54am UTC](https://community.auth0.com/t/rules-is-it-possible-to-access-the-signed-jwt-token-values-within-rules-after-they-are-serialized/15886/2 "2018-09-25T11:54:21Z")

</div>

I got it 🙂

In the testing harness the clientsecret has to be specified in the payload duh.

```
var jwt = require('jsonwebtoken@7.1.9');
  var request = require('request@2.56.0');

  var userInfoToken = jwt.sign(
    {
      email: user.email,
      iat: Math.floor(Date.now() / 1000) - 2
    },
    'MyClientSecret',
    {
      expiresIn: 4,
      audience: context.request.query.audience,
      issuer: 'https://' + context.request.hostname + '/'
    }
  );

```

I was able to do a quick test by putting the secret in the Auth0 rule and it outputted the JWT so this solution works.

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/auth0/original/3X/b/5/b560f266932fcce5d57f09a6595bd50518cae3f3.jpeg) [@system](https://community.auth0.com/u/system)\
**Post date:** [October 25, 2018, 11:54am UTC](https://community.auth0.com/t/rules-is-it-possible-to-access-the-signed-jwt-token-values-within-rules-after-they-are-serialized/15886/3 "2018-10-25T11:54:21Z")

</div>

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.