# Update Access Token custom claims with Refresh Token **URL:** \ **Category:** Get Help\ **Tags:** custom-claims, claims, refresh-tokens\ **Created:** [April 25, 2022, 3:10pm UTC](https://community.auth0.com/t/update-access-token-custom-claims-with-refresh-token/82336 "2022-04-25T15:10:47Z")\ **Posts on this page:** 1\ **Showing post:** 3
**Author:** ![rueben.tiow](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/rueben.tiow/32/11646_2.png) [@rueben.tiow](https://community.auth0.com/u/rueben.tiow)\ **Post date:** [April 25, 2022, 5:25pm UTC](https://community.auth0.com/t/update-access-token-custom-claims-with-refresh-token/82336/3 "2022-04-25T17:25:32Z")
Hi @hector, Welcome to the Auth0 Community! > [@hector](#): > > This means the new access tokens returned are causing invalid API calls (this claim is required). > > How can we pass cusomt values to the refresh process to the new access token can be generated like it is during login? Firstly, I believe that the current approach of passing a query parameter to the authentication page is not ideal for passing custom claims to grant access to your APIs. Moreover, as you observed, calling the `getAccessTokenSilently()` method will not be able to pass a query parameter. Instead, I recommend that you configure RBAC (Role-Based Access Control) to grant your users specific `scopes` (Permissions) for your API. This way, you can specify the scopes in your `getAccessTokenSilently()` method to allow your users can make valid API calls only if they have the correct `scopes` granted to them. See our [Configure Core Authorization Features for Role-Based Access Control](https://auth0.com/docs/manage-users/access-control/configure-core-rbac) doc to learn more. Please let me know if you have any questions. Thank you. --- _[View the full topic](https://community.auth0.com/t/update-access-token-custom-claims-with-refresh-token/82336)._