Cotter
  • 🚀Getting Started
  • Features & Concepts
    • 💬Sign In with Email/Phone Number
    • 🔐Sign In with Device
      • How it works
    • 🧬Sign In with WebAuthn
  • 📌Quickstart Guides
    • All Guides & Tutorials
    • HTML – Sign in with Email/Phone
    • React – Sign in with Email/Phone
    • React – WebAuthn
    • ▲ Next.js
    • Angular
    • Webflow
    • Bubble.io
    • Python SDK for a CLI
    • React Native – Sign in with Device
    • iOS – Sign in with Device
    • Flutter – Sign in with Device
  • 📘SDK Reference
    • Web
      • Sign In with Email/Phone Number
        • Customize the Form
        • Checking the email or phone before sending a verification code
        • Sending Code or Link via WhatsApp
        • Styling
        • Older SDK
          • Customize the Form
      • Sign in with Social Login
        • Getting Access Tokens from Social Login Providers
        • Github Instructions
        • Google Instructions
      • Sign In with WebAuthn
        • Register WebAuthn for a logged-in user
      • Sign In with Device
        • Steps for Pop Up Authentication Prompt
        • Advanced Customization for Login Form
        • Advanced Customization for Pop Up Authentication Prompt
      • Getting Access Token and Logged-In User Info
      • Sending Successful Form Submission
      • FAQ & Troubleshooting
    • React Native
      • Installation
      • Sign In with Device
        • Add Email/Phone Verification
        • Authenticate from a Non-Trusted Device
        • Add a new Trusted Device
        • Remove Trusted Device
      • Sign In with Email/Phone Number
      • Getting Stored OAuth Tokens and User Information
      • FAQ
      • Older SDK Versions
        • Sign in with Email/Phone
        • Sending Code via WhatsApp
        • Sign In with Device
          • Authenticate from a Non-Trusted Device
          • Add a new Trusted Device
          • Customization
    • Flutter
      • Sign In with Device
        • Add Email/Phone Verification
        • Authenticate from a Non-Trusted Device
      • Sign in with Email/Phone Number
      • Getting the Logged-in User
      • Getting OAuth Tokens
      • Signing a User Out
    • iOS
      • Sign In with Email/Phone Number
      • Sign In with Device
        • Authenticate from a Non-Trusted Device
        • Push Notification
        • Check if Trusted Device is Enrolled
        • Add a New Trusted Device
        • Remove Trusted Device
      • Older Versions
        • Biometric/Pin
    • Android
      • Sign In with Device
        • Authenticate from a Non-Trusted Device
        • Check if Trusted Device is Enrolled
        • Add a new Trusted Device
        • Remove Trusted Device
        • Customization
      • Sign In with Email/Phone Number
      • Biometric/Pin
        • Advanced Methods
        • Customization
        • Setting Strings
        • Styling
      • Older SDK Version
        • Sign In with Device
          • Authenticate from a Non-Trusted Device
    • Python (for CLI)
    • API for Other Mobile Apps or CLI
      • Verify Email/Phone Number
        • Handling URL Scheme
    • Backend: Handling Response
  • 🛡️ Protecting Your Account
    • Only Allow Your Website/App to Use Your API Key
    • Rate Limit
    • Enable reCAPTCHA to Protect Against Automated Abuse
  • 🗝️ Getting Access Token
    • Cotter's OAuth 2.0 Tokens Specification
    • Getting the Tokens
      • Get Tokens during Authentication
      • Using the Refresh Token
    • Storing and Removing Tokens
    • Renewing Expired Tokens
    • Verifying JWT Tokens
    • Requesting Custom Fields on your JWT Token
    • Older API
      • Using HTTP Requests
      • Getting the Tokens
        • During Authentication
          • During Email/Phone Verification
        • During enrolling Trusted Devices
  • 🔌API Reference
    • User API
      • User Object
    • OAuth Tokens API
      • Verify JWT Token using API (serverless)
      • Requesting Custom Claims on your Access Token
      • Older API
    • OAuth Tokens from Social Login
    • Event Object
    • Reset PIN API
  • Older API
    • Validating Cotter's Identity Token
    • Validating Cotter's Event Response
Powered by GitBook
On this page
  • Use Case
  • Request Custom Claims on Cotter's Access Token
  • Persisting the Custom Claims
  • Try it out at JWT.io
  1. API Reference
  2. OAuth Tokens API

Requesting Custom Claims on your Access Token

You can now add your own custom fields on the access token that your receive from Cotter

Use Case

Let's say you have a user with attributes:

{
    "username": "helloworld",
    "role": "admin"
}

And you want to include this in Cotter's Access Token so that you can quickly access them in your API Middleware, you can now do this by calling an API request.

Request Custom Claims on Cotter's Access Token

POST https://www.cotter.app/api/v0/token/custom

Add Custom Claims to Cotter's original Access Token that you get when the user logs in.

Headers

Name
Type
Description

API_KEY_ID

string

Your API Key ID

API_SECRET_KEY

string

Your API Secret Key

Content-Type

string

application/json

Request Body

Name
Type
Description

refresh_token

string

A valid refresh token. If given, this endpoint will return a special refresh token where if used, will return access token and id token that have the custom attributes.

custom_attributes

object

a Dictionary of custom attributes that you want to add to the original token

token

string

Cotter's original access token (or id token)

{
  "token": "eyJhbGciOiJFUzI1NiIsImtpZCI6IlNQ..."
}

// OR, if refresh_token was included in the request body:
{
  "token": "eyJhbGciOiJFUzI1NiIsImtpZCI6IlNQ...",
  "refresh_tokenn": "1231:gawgawgaw4yaw....."
}

Example Request

POST https://www.cotter.app/api/v0/token/custom
Content-Type: application/json
API_KEY_ID: <API KEY ID>
API_SECRET_KEY: <API SECRET KEY>

 {
    "token": "eyJhbGciOiJFUzI1NiIsImtpZCI6I...", // The access token that you get when the user login with Cotter
    "custom_attributes": {                       // Additional attributes that you want to add to the original token
      "username": "helloworld",
      "role": "admin",
      "user_id": 125
    },
    "refresh_token": "1234:wfawgaw4gaw4gaw....." // (Optional) A valid refresh token, if given, will generate a new refresh token that will attach the custom attributes to new access tokens / id tokens   
 }

Persisting the Custom Claims

Try it out at JWT.io

Request Body with the Original Access Token

{
  "token": "eyJhbGciOiJFUzI1NiIsImtpZCI6IlNQQUNFX0pXVF9QVUJMSUM6NkNFRTRBMEUtM0M0Ny00ODk1LUFCNjYtRjhFMDc2MTE1MzJGIiwidHlwIjoiSldUIn0.eyJhdWQiOiJhNDQ3MTc5NC04ZWU4LTRkODgtYjMyMS01ZjdhMjI4MDNkNDMiLCJhdXRoZW50aWNhdGlvbl9tZXRob2QiOiJTT0NJQUxfTE9HSU4iLCJjbGllbnRfdXNlcl9pZCI6IjU1MjIyNjFhLWFjN2UtNGQ2ZS1iMDU2LTk1OWY2MTJmYjM0YSIsImV4cCI6MTU5OTE4MTIwMywiaWF0IjoxNTk5MTc3NjAzLCJpZGVudGlmaWVyIjoicHV0cmlAY290dGVyLmFwcCIsImlzcyI6Imh0dHBzOi8vd3d3LmNvdHRlci5hcHAiLCJqdGkiOiJkNDAzOWM2YS1kMWNiLTQ0YTItYjA0OC0xOGU1YmMxZTIxNmIiLCJzY29wZSI6ImFjY2VzcyIsInN1YiI6IjU1MjIyNjFhLWFjN2UtNGQ2ZS1iMDU2LTk1OWY2MTJmYjM0YSIsInR5cGUiOiJjbGllbnRfYWNjZXNzX3Rva2VuIn0.U0Qz0ezHN04QrGnPzn7WlYsR-5_94dQ0K4ovMhcUF4qhJMhEdGODkZGcaJ4ylCT7JqDP5REO2nK3W9mj6uAj5w",
  "custom_attributes": {                  
    "username": "helloworld",
    "role": "admin",
    "user_id": 125
  }   
}
{
  "aud": "a4471794-8ee8-4d88-b321-5f7a22803d43",
  "authentication_method": "SOCIAL_LOGIN",
  "client_user_id": "5522261a-ac7e-4d6e-b056-959f612fb34a",
  "exp": 1599181203,
  "iat": 1599177603,
  "identifier": "putri@cotter.app",
  "iss": "https://www.cotter.app",
  "jti": "d4039c6a-d1cb-44a2-b048-18e5bc1e216b",
  "scope": "access",
  "sub": "5522261a-ac7e-4d6e-b056-959f612fb34a",
  "type": "client_access_token"
}

Response with the new Custom Attributes

{
  "token": "eyJhbGciOiJFUzI1NiIsImtpZCI6IlNQQUNFX0pXVF9QVUJMSUM6NkNFRTRBMEUtM0M0Ny00ODk1LUFCNjYtRjhFMDc2MTE1MzJGIiwidHlwIjoiSldUIn0.eyJhdWQiOlsiYTQ0NzE3OTQtOGVlOC00ZDg4LWIzMjEtNWY3YTIyODAzZDQzIl0sImV4cCI6MTU5OTE4MTIwMywiaWF0IjoxNTk5MTc3NjAzLCJpc3MiOiJodHRwczovL3d3dy5jb3R0ZXIuYXBwIiwianRpIjoiZDQwMzljNmEtZDFjYi00NGEyLWIwNDgtMThlNWJjMWUyMTZiIiwicm9sZSI6ImFkbWluIiwic3ViIjoiNTUyMjI2MWEtYWM3ZS00ZDZlLWIwNTYtOTU5ZjYxMmZiMzRhIiwidXNlcl9pZCI6MTI1LCJ1c2VybmFtZSI6ImhlbGxvd29ybGQifQ.O8te8naeRuYcXG6mLRc7FJ4a3TrBJlaJutzUCqJA8ncItAK9BKedV0TykLOhw_AmCAr-fz8bhbwi3XNUJmN8SQ"
}
{
  "aud": "a4471794-8ee8-4d88-b321-5f7a22803d43",
  "authentication_method": "SOCIAL_LOGIN",
  "client_user_id": "5522261a-ac7e-4d6e-b056-959f612fb34a",
  "exp": 1599181203,
  "iat": 1599177603,
  "identifier": "putri@cotter.app",
  "iss": "https://www.cotter.app",
  "jti": "d4039c6a-d1cb-44a2-b048-18e5bc1e216b",
  "role": "admin",
  "scope": "access",
  "sub": "5522261a-ac7e-4d6e-b056-959f612fb34a",
  "type": "client_access_token",
  "user_id": 125,
  "username": "helloworld"
}
PreviousVerify JWT Token using API (serverless)NextOlder API

Last updated 4 years ago

When you called this API with a refresh_token , the returned refresh_token can be used to generate new access_token and id_token that have the custom claims. This custom claims also persists through that originates from the refresh_token that you receive from this API call.

To use this with the JS SDK, you can update the refresh_token stored in the user's browser using the JS SDK:

🔌
refresh token rotation
Update Refresh Token (for Custom Claims)