Inject custom claims into auth0 jwt token using a rule

Add metadata to a client

Go the settings page/section: Clients > ClientABC > Advanced Settings > advanced > Application Metadata

And add the metadata, e.g. Key: tenantId, Value: "tenant123"

Checking claim in client

Include the scope "app_metadata" when calling auth0.login e.g. scope: 'openid offline_access app_metadata'

The tenantId is stored alongside the standard claims e.g.

{
  "claims": {
    "iss": ...,
    "aud": ...,
    "app_metadata": {
      "tenantId": "tenant123"
    }
  }
}

The auth0 rule

function (user, context, callback) {
  user.app_metadata = user.app_metadata || {};
  user.app_metadata.tenantId = context.clientMetadata.tenantId;
  callback(null, user, context);
}