# Requesting Custom Claims on your Access Token

### Use Case

Let's say you have a user with attributes: 

```javascript
{
    "username": "helloworld",
    "role": "admin"
}
```

And you want to include this in Cotter's Access Token so that you can quickly access them in your API Middleware, you can now do this by calling an API request.

## Request Custom Claims on Cotter's Access Token

<mark style="color:green;">`POST`</mark> `https://www.cotter.app/api/v0/token/custom`

Add Custom Claims to Cotter's original Access Token that you get when the user logs in.

#### Headers

| Name             | Type   | Description         |
| ---------------- | ------ | ------------------- |
| API\_KEY\_ID     | string | Your API Key ID     |
| API\_SECRET\_KEY | string | Your API Secret Key |
| Content-Type     | string | application/json    |

#### Request Body

| Name               | Type   | Description                                                                                                                                                                  |
| ------------------ | ------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| refresh\_token     | string | A valid refresh token. **If given**, this endpoint will return a special refresh token where if used, will return access token and id token that have the custom attributes. |
| custom\_attributes | object | a Dictionary of custom attributes that you want to add to the original token                                                                                                 |
| token              | string | Cotter's original access token (or id token)                                                                                                                                 |

{% tabs %}
{% tab title="200 The new access token with the additional attributes" %}

```javascript
{
  "token": "eyJhbGciOiJFUzI1NiIsImtpZCI6IlNQ..."
}

// OR, if refresh_token was included in the request body:
{
  "token": "eyJhbGciOiJFUzI1NiIsImtpZCI6IlNQ...",
  "refresh_tokenn": "1231:gawgawgaw4yaw....."
}
```

{% endtab %}
{% endtabs %}

#### Example Request

```http
POST https://www.cotter.app/api/v0/token/custom
Content-Type: application/json
API_KEY_ID: <API KEY ID>
API_SECRET_KEY: <API SECRET KEY>

 {
    "token": "eyJhbGciOiJFUzI1NiIsImtpZCI6I...", // The access token that you get when the user login with Cotter
    "custom_attributes": {                       // Additional attributes that you want to add to the original token
      "username": "helloworld",
      "role": "admin",
      "user_id": 125
    },
    "refresh_token": "1234:wfawgaw4gaw4gaw....." // (Optional) A valid refresh token, if given, will generate a new refresh token that will attach the custom attributes to new access tokens / id tokens   
 }
```

### Persisting the Custom Claims

When you called this API with a `refresh_token` , the returned `refresh_token` can be used to generate new `access_token` and `id_token` that have the custom claims. This custom claims also persists through [refresh token rotation](https://docs.cotter.app/api-reference/oauth-tokens-api/..#refresh-token-rotation) that originates from the `refresh_token` that you receive from this API call.

**To use this with the JS SDK,** you can update the `refresh_token` stored in the user's browser using the JS SDK: [Update Refresh Token (for Custom Claims)](https://docs.cotter.app/sdk-reference/web/getting-access-token-and-logged-in-user-info#update-refresh-token-for-custom-claims) &#x20;

## Try it out at JWT.io

#### Request Body with the Original Access Token

{% tabs %}
{% tab title="Request Body" %}

```javascript
{
  "token": "eyJhbGciOiJFUzI1NiIsImtpZCI6IlNQQUNFX0pXVF9QVUJMSUM6NkNFRTRBMEUtM0M0Ny00ODk1LUFCNjYtRjhFMDc2MTE1MzJGIiwidHlwIjoiSldUIn0.eyJhdWQiOiJhNDQ3MTc5NC04ZWU4LTRkODgtYjMyMS01ZjdhMjI4MDNkNDMiLCJhdXRoZW50aWNhdGlvbl9tZXRob2QiOiJTT0NJQUxfTE9HSU4iLCJjbGllbnRfdXNlcl9pZCI6IjU1MjIyNjFhLWFjN2UtNGQ2ZS1iMDU2LTk1OWY2MTJmYjM0YSIsImV4cCI6MTU5OTE4MTIwMywiaWF0IjoxNTk5MTc3NjAzLCJpZGVudGlmaWVyIjoicHV0cmlAY290dGVyLmFwcCIsImlzcyI6Imh0dHBzOi8vd3d3LmNvdHRlci5hcHAiLCJqdGkiOiJkNDAzOWM2YS1kMWNiLTQ0YTItYjA0OC0xOGU1YmMxZTIxNmIiLCJzY29wZSI6ImFjY2VzcyIsInN1YiI6IjU1MjIyNjFhLWFjN2UtNGQ2ZS1iMDU2LTk1OWY2MTJmYjM0YSIsInR5cGUiOiJjbGllbnRfYWNjZXNzX3Rva2VuIn0.U0Qz0ezHN04QrGnPzn7WlYsR-5_94dQ0K4ovMhcUF4qhJMhEdGODkZGcaJ4ylCT7JqDP5REO2nK3W9mj6uAj5w",
  "custom_attributes": {                  
    "username": "helloworld",
    "role": "admin",
    "user_id": 125
  }   
}
```

{% endtab %}

{% tab title="Decoded Token" %}

```javascript
{
  "aud": "a4471794-8ee8-4d88-b321-5f7a22803d43",
  "authentication_method": "SOCIAL_LOGIN",
  "client_user_id": "5522261a-ac7e-4d6e-b056-959f612fb34a",
  "exp": 1599181203,
  "iat": 1599177603,
  "identifier": "putri@cotter.app",
  "iss": "https://www.cotter.app",
  "jti": "d4039c6a-d1cb-44a2-b048-18e5bc1e216b",
  "scope": "access",
  "sub": "5522261a-ac7e-4d6e-b056-959f612fb34a",
  "type": "client_access_token"
}
```

{% endtab %}
{% endtabs %}

#### Response with the new Custom Attributes

{% tabs %}
{% tab title="JavaScript" %}

```javascript
{
  "token": "eyJhbGciOiJFUzI1NiIsImtpZCI6IlNQQUNFX0pXVF9QVUJMSUM6NkNFRTRBMEUtM0M0Ny00ODk1LUFCNjYtRjhFMDc2MTE1MzJGIiwidHlwIjoiSldUIn0.eyJhdWQiOlsiYTQ0NzE3OTQtOGVlOC00ZDg4LWIzMjEtNWY3YTIyODAzZDQzIl0sImV4cCI6MTU5OTE4MTIwMywiaWF0IjoxNTk5MTc3NjAzLCJpc3MiOiJodHRwczovL3d3dy5jb3R0ZXIuYXBwIiwianRpIjoiZDQwMzljNmEtZDFjYi00NGEyLWIwNDgtMThlNWJjMWUyMTZiIiwicm9sZSI6ImFkbWluIiwic3ViIjoiNTUyMjI2MWEtYWM3ZS00ZDZlLWIwNTYtOTU5ZjYxMmZiMzRhIiwidXNlcl9pZCI6MTI1LCJ1c2VybmFtZSI6ImhlbGxvd29ybGQifQ.O8te8naeRuYcXG6mLRc7FJ4a3TrBJlaJutzUCqJA8ncItAK9BKedV0TykLOhw_AmCAr-fz8bhbwi3XNUJmN8SQ"
}
```

{% endtab %}

{% tab title="Decoded Token" %}

```javascript
{
  "aud": "a4471794-8ee8-4d88-b321-5f7a22803d43",
  "authentication_method": "SOCIAL_LOGIN",
  "client_user_id": "5522261a-ac7e-4d6e-b056-959f612fb34a",
  "exp": 1599181203,
  "iat": 1599177603,
  "identifier": "putri@cotter.app",
  "iss": "https://www.cotter.app",
  "jti": "d4039c6a-d1cb-44a2-b048-18e5bc1e216b",
  "role": "admin",
  "scope": "access",
  "sub": "5522261a-ac7e-4d6e-b056-959f612fb34a",
  "type": "client_access_token",
  "user_id": 125,
  "username": "helloworld"
}
```

{% endtab %}
{% endtabs %}