# Where to find app\_metadata in OIDC Conformant tokens & Express

**URL:** <https://community.auth0.com/t/where-to-find-app-metadata-in-oidc-conformant-tokens-express/8971>\
**Category:** Get Help\
**Tags:** oidc-conformant, express-jwt, express\
**Created:** [December 13, 2017, 11:37pm UTC](https://community.auth0.com/t/where-to-find-app-metadata-in-oidc-conformant-tokens-express/8971 "2017-12-13T23:37:44Z")\
**Posts on this page:** 9\
**Page:** 1

<div class="post-metadata">

**Author:** ![stephen.jensen.ihi](https://upload.wikimedia.org/wikipedia/commons/thumb/7/7c/User_font_awesome.svg/768px-User_font_awesome.svg.png) [@stephen.jensen.ihi](https://community.auth0.com/u/stephen.jensen.ihi)\
**Post date:** [December 13, 2017, 11:37pm UTC](https://community.auth0.com/t/where-to-find-app-metadata-in-oidc-conformant-tokens-express/8971/1 "2017-12-13T23:37:44Z")

</div>

Hi everyone,  
I’m having some troubles connecting the dots for how to get app\_metadata from a jwt token with Auth0. I am using Auth0 with an express app. I added to flollowing lines to a rule that I had in the auth0 dashboard:

```
  var namespace = 'company';
  if('company' in user.app_metadata) {
    context.idToken[namespace]=user.app_metadata.company || "";
  }

```

In my express app, I take a look at my request and response, and I can’t find anything with the the namespace “company”. Where should I be looking for this? I do use a jwt package that will take the jwt, verify it and add the decoded token info under req.user:

```
import jwt from 'express-jwt';
import jwksRsa from 'jwks-rsa';
app.use(jwt({
  secret: jwksRsa.expressJwtSecret({
    cache: true,
    rateLimit: true,
    jwksRequestsPerMinute: 5,
    jwksUri: 'https://zzz.auth0.com/.well-known/jwks.json',
  }),
  audience: 'http://localhost:5000',
  issuer: 'https://zzz.auth0.com/',
  credentialsRequired: false,
  algorithms: 'RS256'],
}));

```

My question is what am I missing here? I did enforce OIDC Conformant so I know the metadata won’t be in the token itself, but I just can’t figure out where to look.

Thanks!

---

<div class="post-metadata">

**Author:** ![gunnar.velle](https://upload.wikimedia.org/wikipedia/commons/thumb/7/7c/User_font_awesome.svg/768px-User_font_awesome.svg.png) [@gunnar.velle](https://community.auth0.com/u/gunnar.velle)\
**Post date:** [December 14, 2017, 5:02am UTC](https://community.auth0.com/t/where-to-find-app-metadata-in-oidc-conformant-tokens-express/8971/2 "2017-12-14T05:02:13Z")

</div>

The namespace should be on the form [http://your.domain/company](http://your.domain/company) to avoid collisions with other claims.

```
   var namespace = 'http://your.domain/company';
   if('company' in user.app_metadata) {
     context.idToken[namespace]=user.app_metadata.company || "";
   }

```

---

<div class="post-metadata">

**Author:** ![stephen.jensen.ihi](https://upload.wikimedia.org/wikipedia/commons/thumb/7/7c/User_font_awesome.svg/768px-User_font_awesome.svg.png) [@stephen.jensen.ihi](https://community.auth0.com/u/stephen.jensen.ihi)\
**Post date:** [December 15, 2017, 2:41am UTC](https://community.auth0.com/t/where-to-find-app-metadata-in-oidc-conformant-tokens-express/8971/3 "2017-12-15T02:41:06Z")

</div>

Thanks for the feedback, I changed the namespace to my domain but I still can’t figure out where to find that field in either the req or res part of my express app.

Looking at my req headers, I see this:  
![alt text][1]

Looking through the rest of those two objects, there isn’t an obviously a field that has the new namespace that I created. I bet I am just looking in the wrong spot, but I’d love to find out where I need to be looking. Thanks!

---

<div class="post-metadata">

**Author:** ![gunnar.velle](https://upload.wikimedia.org/wikipedia/commons/thumb/7/7c/User_font_awesome.svg/768px-User_font_awesome.svg.png) [@gunnar.velle](https://community.auth0.com/u/gunnar.velle)\
**Post date:** [December 21, 2017, 8:03pm UTC](https://community.auth0.com/t/where-to-find-app-metadata-in-oidc-conformant-tokens-express/8971/4 "2017-12-21T20:03:46Z")

</div>

It is inside the token. Copy the authorization header, excluding Bearer, and head over to [jwt.io](http://jwt.io) and decode the token there.

---

<div class="post-metadata">

**Author:** ![stephen.jensen.ihi](https://upload.wikimedia.org/wikipedia/commons/thumb/7/7c/User_font_awesome.svg/768px-User_font_awesome.svg.png) [@stephen.jensen.ihi](https://community.auth0.com/u/stephen.jensen.ihi)\
**Post date:** [December 15, 2017, 2:41am UTC](https://community.auth0.com/t/where-to-find-app-metadata-in-oidc-conformant-tokens-express/8971/5 "2017-12-15T02:41:06Z")

</div>

Thanks for the feedback, I changed the namespace to my domain but I still can’t figure out where to find that field in either the req or res part of my express app.

Looking at my req headers, I see this:  
![alt text][1]

Looking through the rest of those two objects, there isn’t an obviously a field that has the new namespace that I created. I bet I am just looking in the wrong spot, but I’d love to find out where I need to be looking. Thanks!

---

<div class="post-metadata">

**Author:** ![gunnar.velle](https://upload.wikimedia.org/wikipedia/commons/thumb/7/7c/User_font_awesome.svg/768px-User_font_awesome.svg.png) [@gunnar.velle](https://community.auth0.com/u/gunnar.velle)\
**Post date:** [December 21, 2017, 8:03pm UTC](https://community.auth0.com/t/where-to-find-app-metadata-in-oidc-conformant-tokens-express/8971/6 "2017-12-21T20:03:46Z")

</div>

It is inside the token. Copy the authorization header, excluding Bearer, and head over to [jwt.io](http://jwt.io) and decode the token there.

---

<div class="post-metadata">

**Author:** ![stephen.jensen.ihi](https://upload.wikimedia.org/wikipedia/commons/thumb/7/7c/User_font_awesome.svg/768px-User_font_awesome.svg.png) [@stephen.jensen.ihi](https://community.auth0.com/u/stephen.jensen.ihi)\
**Post date:** [February 13, 2018, 5:09am UTC](https://community.auth0.com/t/where-to-find-app-metadata-in-oidc-conformant-tokens-express/8971/7 "2018-02-13T05:09:47Z")

</div>

Sorry for the long delay but I’m still having issues with this. I modified the rule to the following, and when I log in, I see that idToken is being set in my context when I use the Real-time Webtask Logs in Auth0. When I go to my express webserver, I get a token in my header that does not include this new field when I decode it on [jwt.io](http://jwt.io). I also do not see any additional fields coming back in my header. The namespace here matches the audience I am using for auth0. How exactly do I add that field to the jwt token? Thanks for your help!

```
  getPolicy(user, context, function(err, res, data) {
    if (err) {
      console.log('Error from Authorization Extension:', err);
      return callback(new UnauthorizedError('Authorization Extension: ' + err.message));
    }

    if (res.statusCode !== 200) {
      console.log('Error from Authorization Extension:', res.body || res.statusCode);
      return callback(
        new UnauthorizedError('Authorization Extension: ' + ((res.body && (res.body.message || res.body) || res.statusCode)))
      );
    }
    console.log(user.app_metadata);
    var namespace = 'http://localhost:5000';
    if('company' in user.app_metadata) {
      context.idToken[namespace]=user.app_metadata.company || "";
    }
    console.log(context);

    // Update the user object.
    user.groups = data.groups;

    return callback(null, user, context);
  });

```

---

<div class="post-metadata">

**Author:** ![gunnar.velle](https://upload.wikimedia.org/wikipedia/commons/thumb/7/7c/User_font_awesome.svg/768px-User_font_awesome.svg.png) [@gunnar.velle](https://community.auth0.com/u/gunnar.velle)\
**Post date:** [February 13, 2018, 3:10pm UTC](https://community.auth0.com/t/where-to-find-app-metadata-in-oidc-conformant-tokens-express/8971/8 "2018-02-13T15:10:31Z")

</div>

According to [this page](https://auth0.com/docs/api-auth/tutorials/adoption/scope-custom-claims) , Auth0 will exclude non-namespaced claims. Could it be [http://localhost:5000](http://localhost:5000) is not approved as a namespace since it is not unique? And you should probably have a name in addition to the url as key.

```
     if('company' in user.app_metadata) {
       context.idToken'http://localhost:5000/company']=user.app_metadata.company || "";
     }

```

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/auth0/original/3X/b/5/b560f266932fcce5d57f09a6595bd50518cae3f3.jpeg) [@system](https://community.auth0.com/u/system)\
**Post date:** [March 2, 2018, 5:57am UTC](https://community.auth0.com/t/where-to-find-app-metadata-in-oidc-conformant-tokens-express/8971/9 "2018-03-02T05:57:47Z")

</div>