/userinfo endpoint

[tyf]

Hi there @Jaydeeps03!

@Jaydeeps03

So, my question here is that, can we expect the custom claim in ‘/userinfo’ endpoint which added into access token through rule based on above mentioned updates or this applies only for Id Token and not for access token?

The data returned by the userinfo endpoint will be specific to the ID token (including custom claims) and not the Access token. Custom claims added to an AT via extensibility will only be available in the token itself. In order for an AT to be non-opaque, an audience will need to be included - Some more on that here:

What is the Audience?

Question: What is the Audience? Answer: The audience parameter exists as part of the OAuth2.0 protocol. You can read more information from the specification here. What is it? The audience (presented as the aud claim in the access token) defines the intended consumer of the token. This is typically the resource server (API, in the dashboard) that a client (Application) would like to access. It can be added to the request to authorize i.e. audience: 'https://test-api' Here is an example where …

Hope this helps!