Add custom claims in tokens

Add custom claims to OAuth2 access and ID tokens using overrides

Overview

If you want to add custom properties in the token payloads you can do this by using overrides.

Add claims in the OAuth2 Access Token

Override the buildAccessTokenPayload function to include the custom claims.

Override the build_access_token_payload function to include the custom claims.

import OAuth2Provider from "supertokens-node/recipe/oauth2provider";

OAuth2Provider.init({
  override: {
    functions: (originalImplementation) => ({
      ...originalImplementation,
      buildAccessTokenPayload: async (input) => {
        const addedInfo: Record<string, any> = {};
        if (input.scopes.includes("profile")) {
          addedInfo.profile = "custom-value";
        }
        return {
          ...(await originalImplementation.buildAccessTokenPayload(input)),
          ...addedInfo,
        };
      },
    }),
  },
});

from supertokens_python import init, InputAppInfo, SupertokensConfig
from supertokens_python.recipe import oauth2provider
from supertokens_python.recipe.oauth2provider.oauth2_client import OAuth2Client
from supertokens_python.recipe.oauth2provider.interfaces import RecipeInterface
from supertokens_python.types import User
from typing import Dict, List, Any, Optional

def override_oauth2provider_functions(original_implementation: RecipeInterface):
  original_build_access_token_payload = original_implementation.build_access_token_payload

  async def build_access_token_payload(
        user: Optional[User],
        client: OAuth2Client,
        session_handle: Optional[str],
        scopes: List[str],
        user_context: Dict[str, Any],
    ) -> Dict[str, Any]:
    added_info = {}
    if "profile" in scopes:
        added_info['profile'] = "custom-value"

    original_payload = await original_build_access_token_payload(
      user, client, session_handle, scopes, user_context
    )
    return {**original_payload, **added_info}

  original_implementation.build_access_token_payload = build_access_token_payload
  return original_implementation


init(
    framework="...",
    app_info=InputAppInfo(
        app_name="...",
        api_domain="...",
        website_domain="...",
    ),
    supertokens_config=SupertokensConfig(
        connection_uri="...",
        api_key="..."
    ),
    recipe_list=[
        oauth2provider.init(
          override=oauth2provider.InputOverrideConfig(functions=override_oauth2provider_functions)
        )
    ],
)

Add claims in the ID Token

Override the buildIdTokenPayload function to include the custom claims.

Override the build_id_token_payload function to include the custom claims.

import OAuth2Provider from "supertokens-node/recipe/oauth2provider";

OAuth2Provider.init({
  override: {
    functions: (originalImplementation) => ({
      ...originalImplementation,
      buildIdTokenPayload: async (input) => {
        const addedInfo: Record<string, any> = {};
        if (input.scopes.includes("profile")) {
          addedInfo.profile = "custom-value";
        }
        return {
          ...(await originalImplementation.buildIdTokenPayload(input)),
          ...addedInfo,
        };
      },
    }),
  },
});

from supertokens_python import init, InputAppInfo, SupertokensConfig
from supertokens_python.recipe import oauth2provider
from supertokens_python.recipe.oauth2provider.oauth2_client import OAuth2Client
from supertokens_python.recipe.oauth2provider.interfaces import RecipeInterface
from supertokens_python.types import User
from typing import Dict, List, Any, Optional

def override_oauth2provider_functions(original_implementation: RecipeInterface):
  original_build_id_token_payload = original_implementation.build_id_token_payload

  async def build_id_token_payload(
        user: Optional[User],
        client: OAuth2Client,
        session_handle: Optional[str],
        scopes: List[str],
        user_context: Dict[str, Any],
    ) -> Dict[str, Any]:
    added_info = {}
    if "profile" in scopes:
        added_info['profile'] = "custom-value"

    original_payload = await original_build_id_token_payload(
      user, client, session_handle, scopes, user_context
    )
    return {**original_payload, **added_info}

  original_implementation.build_id_token_payload = build_id_token_payload
  return original_implementation


init(
    framework="...",
    app_info=InputAppInfo(
        app_name="...",
        api_domain="...",
        website_domain="...",
    ),
    supertokens_config=SupertokensConfig(
        connection_uri="...",
        api_key="..."
    ),
    recipe_list=[
        oauth2provider.init(
          override=oauth2provider.InputOverrideConfig(functions=override_oauth2provider_functions)
        )
    ],
)