# Unable to add custom claim to access token **URL:** \ **Category:** Get Help\ **Tags:** rules\ **Created:** [April 21, 2021, 6:59am UTC](https://community.auth0.com/t/unable-to-add-custom-claim-to-access-token/61459 "2021-04-21T06:59:22Z")\ **Posts on this page:** 9\ **Page:** 1
**Author:** ![johnwp](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/johnwp/32/26939_2.png) [@johnwp](https://community.auth0.com/u/johnwp)\ **Post date:** [April 21, 2021, 6:59am UTC](https://community.auth0.com/t/unable-to-add-custom-claim-to-access-token/61459/1 "2021-04-21T06:59:22Z")
This simple rule seems to be executing upon user login, but I’m not able to see the custom claim in the user’s access token obtained from `POST /oauth/token`. Is there something I’m missing? ``` function (user, context, callback) { context.accessToken['http://example.com/email'] = 'test@example.com'; console.log('Appears in logger extension upon login', context); callback(null, user, context); } ``` ---
**Author:** ![stephanie.chamblee](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/stephanie.chamblee/32/26087_2.png) [@stephanie.chamblee](https://community.auth0.com/u/stephanie.chamblee)\ **Post date:** [April 21, 2021, 11:24am UTC](https://community.auth0.com/t/unable-to-add-custom-claim-to-access-token/61459/3 "2021-04-21T11:24:17Z")
Hi @johnwp, Welcome to the Community! Your code looks like it is adding the custom claim correctly. I tested out the rule in my own tenant, and after logging in, the decoded JWT Access Token looks like this: ```auto { "http://example.com/email": "test@example.com", "iss": "https://my-domain.us.auth0.com/", "sub": "google-oauth2|115088824167938831773", "aud": [ "https://test.com", "https://my-domain.us.auth0.com/userinfo" ], "iat": 1619003783, "exp": 1619003803, "azp": "iTAbnWQtk4voRjZyOp0ZHYL24s101ppB", "scope": "openid profile email", "permissions": [] } ``` When you decode the Access Token at [https://jwt.io/](https://jwt.io/), does it look similar (but missing the `http://example.com/email` claim)? ---
**Author:** ![johnwp](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/johnwp/32/26939_2.png) [@johnwp](https://community.auth0.com/u/johnwp)\ **Post date:** [April 21, 2021, 4:00pm UTC](https://community.auth0.com/t/unable-to-add-custom-claim-to-access-token/61459/4 "2021-04-21T16:00:00Z")
Hi @stephanie.chamblee, thanks so much for your help. Here’s the decoded JWT Access Token that I’m getting. This is obtained using `` from npm package `@auth0/auth0-react` I do have a custom database connection enabled. Do you think that could be interfering with this process? Thanks again! ``` { "nickname": "John", "name": "", "picture": "https://s.gravatar.com/avatar/73a4bedfdfd2929d20852b173b8e6f71?s=480&r=pg&d=https%3A%2F%2Fcdn.auth0.com%2Favatars%2Fjp.png", "updated_at": "2021-04-21T15:49:39.157Z", "iss": "https://.us.auth0.com/", "sub": "auth0|1", "aud": "", "iat": 1619020180, "exp": 1619056180, "nonce": "bFYydE94QXNBbkFTUThwaFQ5aHM4d20xbm44bzc3WVA2TGRCczE5bmZZUQ==" } ``` ---
**Author:** ![stephanie.chamblee](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/stephanie.chamblee/32/26087_2.png) [@stephanie.chamblee](https://community.auth0.com/u/stephanie.chamblee)\ **Post date:** [April 21, 2021, 4:39pm UTC](https://community.auth0.com/t/unable-to-add-custom-claim-to-access-token/61459/5 "2021-04-21T16:39:42Z")
Ah, okay! When you make the `POST /oauth/token` request, you should receive two tokens, an ID Token and an Access Token. The ID Token is used for your frontend to get basic profile info about the user. The Access Token is for your frontend to send to your API as a bearer token. The token you have shared looks like an ID Token. If you’d like to add a custom claim to the ID Token, you’d adjust the rule like so: ```auto function (user, context, callback) { context.idToken['http://example.com/email'] = 'test@example.com'; console.log('Appears in logger extension upon login', context); callback(null, user, context); } ``` To get the Access Token instead of the ID Token, you can use the `getAccessTokenSilently` hook: ```auto const { getAccessTokenSilently } = useAuth0(); const token = await getAccessTokenSilently(); ``` > **[Tokens](https://auth0.com/docs/secure/tokens)** > > Describes the types of tokens related to identity and authentication and how they are used by Auth0. ---
**Author:** ![johnwp](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/johnwp/32/26939_2.png) [@johnwp](https://community.auth0.com/u/johnwp)\ **Post date:** [April 21, 2021, 5:37pm UTC](https://community.auth0.com/t/unable-to-add-custom-claim-to-access-token/61459/6 "2021-04-21T17:37:43Z")
Hmm, very interesting. It looks like the values I’m getting for `access_token` and `id_token` might be swapped. Here’s what the response looks like for `POST /oauth/token`. `access_token` is a short token and `id_token` is the JWT that I posted decoded above. ``` { "access_token": "ZXIrU2bPPgsHtFNJVZVk--TM<...truncated>", "id_token": "eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCIsImtpZCI6IjBqa1p6RnllNzdIQ0QxenZRYVFZZiJ9.eyJuaWNrbmFtZSI6IkpvaG4gUG91Y2hhayIsIm5hbWUiOiIiLCJwaWN0dXJlIjoiaHR0cHM6Ly9zLmdyYXZhdGFyLmNvbS9hdmF0YXIvNzNhNGJlZGZkZmQyOTI5ZDIwODUyYjE3M2I4ZTZmNzE_cz00ODAmcj1wZyZkPWh0dHBzJTNBJTJGJTJGY2RuLmF1dGgwLmNvbSUyRmF2YXRhcnMlMkZqcC5wbmciLCJ1cGRhdGVkX2F0IjoiMjAyMS0wNC0yMVQxNTo0OTozOS4xNTdaIiwiaXNzIj<...truncated>", "scope": "openid profile email", "expires_in": 86400, "token_type": "Bearer" } ``` Also, when using: ``` const { getAccessTokenSilently } = useAuth0(); const token = await getAccessTokenSilently(); ``` I get a non-JWT short token that looks like what’s assigned to `access_token` in my example response above. Does that seem right? ---
**Author:** ![stephanie.chamblee](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/stephanie.chamblee/32/26087_2.png) [@stephanie.chamblee](https://community.auth0.com/u/stephanie.chamblee)\ **Post date:** [April 21, 2021, 6:12pm UTC](https://community.auth0.com/t/unable-to-add-custom-claim-to-access-token/61459/7 "2021-04-21T18:12:13Z")
It sounds like your app may be receiving an opaque token. An opaque token is returned when an `audience` is not specified in the `Auth0Provider`. The audience should be your API’s identifier: ```auto ReactDOM.render( , document.getElementById("root") ); ``` The API identifier is created when you register your API: [Register APIs](https://auth0.com/docs/get-started/set-up-apis) > **[Access Tokens](https://auth0.com/docs/secure/tokens/access-tokens?_ga=2.20798392.1632123162.1618830090-1595415333.1607347674)** > > Describes how access tokens are used in token-based authentication to allow an application to access an API after a user successfully authenticates and authorizes access. ---
**Author:** ![johnwp](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/johnwp/32/26939_2.png) [@johnwp](https://community.auth0.com/u/johnwp)\ **Post date:** [April 21, 2021, 7:15pm UTC](https://community.auth0.com/t/unable-to-add-custom-claim-to-access-token/61459/8 "2021-04-21T19:15:03Z")
Adding `audience` worked for me. Thank you again for your all your help! ---
**Author:** ![stephanie.chamblee](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/stephanie.chamblee/32/26087_2.png) [@stephanie.chamblee](https://community.auth0.com/u/stephanie.chamblee)\ **Post date:** [April 21, 2021, 7:16pm UTC](https://community.auth0.com/t/unable-to-add-custom-claim-to-access-token/61459/9 "2021-04-21T19:16:13Z")
Great! Glad you were able to find your solution! ---
**Author:** ![system](https://global.discourse-cdn.com/auth0/original/3X/b/5/b560f266932fcce5d57f09a6595bd50518cae3f3.jpeg) [@system](https://community.auth0.com/u/system)\ **Post date:** [May 6, 2021, 7:16pm UTC](https://community.auth0.com/t/unable-to-add-custom-claim-to-access-token/61459/10 "2021-05-06T19:16:22Z")
This topic was automatically closed 15 days after the last reply. New replies are no longer allowed.