how can you add custom claims to Id Tokens?

[mscurtescu]

Depending on what scopes are present, is it possible to add custom claims to an Id Token? Similarly for UserInfo output?

[vinckr]

Check out this Frequently Asked Question:
https://www.ory.sh/hydra/docs/faq#how-can-i-store-custom-data-

Let me know if that helps 🐝

[mscurtescu]

That answer has nothing to do with my question.

[gi-wg2]

You can set those as part of the login flow. We do include the user's phone number if the scope phone is set.

That is the result you are looking for?

[mscurtescu]

phone number is a standard claim, can you set custom claims part of the login flow?

[gi-wg2]

Yep, you can see all requested and granted scopes, and set any claims you want.

[mscurtescu]

Good to know it is possible. Can you please point to the API and/or sample code showing how this is done?

[gi-wg2]

Just to clarify, I am just a normal user of Hydra so just sharing how I do it.

In the consent flow, you are redirected to your configured consent endpoint. From there, we do a POST to our endpoint with the scopes the user has accepted.

From that endpoint, we do a POST to accept the consent request as in https://www.ory.sh/hydra/docs/next/reference/api/#operation/acceptConsentRequest.

If the list of accepted scope contains phone, we do include the claim phone_number and phone_number_verified by setting the following in the accept consent request:

session: {
  id_token: {
    phone_number: "(..."),
    phone_number_verified: "(...")
  }
}

We do also fetch the consent again for some extra checks, but that ain't really needed in this example (https://www.ory.sh/hydra/docs/next/reference/api/#operation/getConsentRequest).