Skip to main content
Hooks will reach end of life (EOL) on April 30, 2027.
  • As of October 16, 2023, Hooks are no longer available in newly created tenants.
  • As of November 18, 2024, Hooks are read-only. Active Hooks still run, and you can enable or disable them and change their configuration values and secrets. You can’t edit their code in the Dashboard, the Management API, or tools that use it, such as the Auth0 CLI, Deploy CLI, Terraform, and Agent Skills.
  • After April 30, 2027, Hooks stop running and are removed.
Use Actions to extend Auth0:
You can change scopes and add custom claims in the tokens issued through the Client Credentials Flow by adding Hooks. Hooks allow you to customize the behavior of Auth0 using Node.js code. They are secure, self-contained functions associated with specific extensibility points of the Auth0 platform (like the Client Credentials flow). Auth0 invokes the Hooks at runtime to execute your custom logic. You can manage Hooks using the or the .
Although you may create multiple hooks for any given extensibility point, each extensibility point may have only one enabled hook at a time. Any subsequent hooks you create for that extensibility point are automatically disabled, so you must explicitly enable them. The enabled hook will be executed for all applications and APIs.

​
Prerequisites

Before beginning this tutorial, you must:

​
Steps

  1. Create Hook: Create a hook that will customize your token.
  2. Test Hook: Test your new hook by running a Client Credentials Flow and decoding the access token.

​
Create a Hook

In this example, you will:
  • add an arbitrary claim (https://foo.com/claim) to the Access Token
  • add an extra permission to your configured API
Create a Hook to customize your token. When asked to choose an extensibility point, select Client Credentials Exchange, and add the following code in the editor:
Auth0 returns profile information in a structured claim format as defined by the OpenID Connect (OIDC) specification. This means that custom claims added to ID tokens or access tokens must conform to guidelines and restrictions to avoid possible collisions.

​
Test your Hook

To test the hook you just created you need to run a Client Credentials exchange, get the , decode it, and review its contents.

​
Get token

To get a token, make a POST call to the Client Credentials Flow endpoint. Be sure to replace CLIENT_ID, CLIENT_SECRET, and API_IDENTIFIER placeholder values with your application’s , your application’s , and your API’s Identifier, respectively. You can find the Client ID and Client Secret in your Application settings and the API Identifier in your API settings. A successful response will include:
  • an access_token,
  • its expiration time in seconds (expires_in),
  • the token’s type set as Bearer (token_type), and
  • an extra permission (scope) (which was added by your Hook)

​
Decode token

The easiest way to decode the access token and review its contents is to use the JWT.io Debugger. Copy your access token and paste it into the editor. The is decoded automatically and its contents are displayed. Note that the last two items of the Payload have both been set by your hook:
  • "scope": "extra"
  • "https://foo.com/claim": "bar"

​
Learn more