You might also need to select a default directory for your tenant. This setting is located in the top-right dropdown menu. Click Settings and under “API Authorization Settings”, enter “Username-Password-Authentication” for Default Directory
also can a user access_token contain the “user_metadata”: { “TaxId”:“1234567” }
Yes, you can add user metadata properties to the Access Token or ID Token using Rules. You may want to be careful about adding any sensitive information within a JWT because the payload is base64 encoded and easy to decode.
Here is an example of adding custom claims to an Access Token and an ID Token:
You can use the id_token value you receive from the /OAuth/token response to get user profile information.
You can decode the token using a JWT verification library (example ID Token).
The ID token’s payload contains the sub claim, which is the token subject. The value for this claim will be <connection identifier | user ID, for example google-oauth2|123456789 or auth0|123456789