<commit_before>---
description: How to use Hooks to change the scopes and add custom claims to the tokens you got using Client Credentials Grant.
toc: true
---

# Using Hooks with Client Credentials Grant

You can now add [Hooks](/hooks) into your [client credentials](/api-auth/grant/client-credentials) flow. This way you can change the scopes and add custom claims to the tokens issued by Auth0.

## Overview

Hooks allow you to customize the behavior of Auth0 using Node.js code.

They are actually [Webtasks](https://webtask.io/), associated with specific extensibility points of the Auth0 platform (like the Client Credentials grant). Auth0 invokes the Hooks at runtime to execute your custom logic.

You can manage Hooks using the [Auth0 Dashboard](/hooks/dashboard) or the [Auth0 Command Line Interface (CLI)](/hooks/cli). In this article we will see how you can do either.

## Before you start

Please ensure that:

- You have created an [API defined with the appropriate scopes](${manage_url}/#/apis)
- You have created a [non-interactive client](${manage_url}/#/clients) that is authorized to use the API created in the previous step

If you haven't done these yet, refer to these docs for details:
- How to set up a Client Credentials Grant:
  - [Using the Dashboard](/api-auth/config/using-the-auth0-dashboard)
  - [Using the Management API](/api-auth/config/using-the-management-api)
- [How to execute a Client Credentials Grant](/api-auth/config/asking-for-access-tokens)

## Use the Dashboard

1. Go to [the Hooks page of the Dashboard](${manage_url}/#/hooks).

  ![Dashboard Hooks](/media/articles/api-auth/hooks/dashboard-hooks.png)

2. Click the __+ Create New Hook__ button. On the _New Hook_ pop-up window, set the __Hook__ dropdown to `Client Credentials Exchange` and set a __Name__ for your hook. Click __Create__.

  ![New Client Credentials Hook](/media/articles/api-auth/hooks/new-cc-hook.png)

  At this point, you will see your newly-created Hook listed under the _Client Credentials Exchange_.

  <div class="alert alert-info">
    You can create more than one hooks per extensibility point but <strong>only one can be enabled</strong>. The enabled hook will then be executed for <strong>all</strong> clients and APIs.
  </div>

3. Click the __Pencil and Paper__ icon to the right of the Hook to open the Webtask Editor.

  ![Edit Client Credentials Hook](/media/articles/api-auth/hooks/edit-cc-hook.png)

4. Using the Webtask Editor, write your Node.js code. As an example, we will add an extra scope. The claim's name will be `https://foo.com/claim` and its value `bar`. Copy the sample code below and paste it in the Editor.

  ```js
  module.exports = function(client, scope, audience, context, cb) {
    var access_token = {};
    access_token['https://foo.com/claim'] = 'bar';
    access_token.scope = scope;
    access_token.scope.push('extra');
    cb(null, access_token);
  };
  ```

  This sample hook will:
  - add an arbitrary claim (`https://foo.com/claim`) to the `access_token`
  - add an `extra` scope to the default scopes configured on your [API](${manage_url}/#/apis).
<commit_msg>Add panel on namespaced claims<commit_after>---
description: How to use Hooks to change the scopes and add custom claims to the tokens you got using Client Credentials Grant.
toc: true
---

# Using Hooks with Client Credentials Grant

You can now add [Hooks](/hooks) into your [client credentials](/api-auth/grant/client-credentials) flow. This way you can change the scopes and add custom claims to the tokens issued by Auth0.

## Overview

Hooks allow you to customize the behavior of Auth0 using Node.js code.

They are actually [Webtasks](https://webtask.io/), associated with specific extensibility points of the Auth0 platform (like the Client Credentials grant). Auth0 invokes the Hooks at runtime to execute your custom logic.

You can manage Hooks using the [Auth0 Dashboard](/hooks/dashboard) or the [Auth0 Command Line Interface (CLI)](/hooks/cli). In this article we will see how you can do either.

## Before you start

Please ensure that:

- You have created an [API defined with the appropriate scopes](${manage_url}/#/apis)
- You have created a [non-interactive client](${manage_url}/#/clients) that is authorized to use the API created in the previous step

If you haven't done these yet, refer to these docs for details:
- How to set up a Client Credentials Grant:
  - [Using the Dashboard](/api-auth/config/using-the-auth0-dashboard)
  - [Using the Management API](/api-auth/config/using-the-management-api)
- [How to execute a Client Credentials Grant](/api-auth/config/asking-for-access-tokens)

## Use the Dashboard

1. Go to [the Hooks page of the Dashboard](${manage_url}/#/hooks).

  ![Dashboard Hooks](/media/articles/api-auth/hooks/dashboard-hooks.png)

2. Click the __+ Create New Hook__ button. On the _New Hook_ pop-up window, set the __Hook__ dropdown to `Client Credentials Exchange` and set a __Name__ for your hook. Click __Create__.

  ![New Client Credentials Hook](/media/articles/api-auth/hooks/new-cc-hook.png)

  At this point, you will see your newly-created Hook listed under the _Client Credentials Exchange_.

  <div class="alert alert-info">
    You can create more than one hooks per extensibility point but <strong>only one can be enabled</strong>. The enabled hook will then be executed for <strong>all</strong> clients and APIs.
  </div>

3. Click the __Pencil and Paper__ icon to the right of the Hook to open the Webtask Editor.

  ![Edit Client Credentials Hook](/media/articles/api-auth/hooks/edit-cc-hook.png)

4. Using the Webtask Editor, write your Node.js code. As an example, we will add an extra scope. The claim's name will be `https://foo.com/claim` and its value `bar`. Copy the sample code below and paste it in the Editor.

  ```js
  module.exports = function(client, scope, audience, context, cb) {
    var access_token = {};
    access_token['https://foo.com/claim'] = 'bar';
    access_token.scope = scope;
    access_token.scope.push('extra');
    cb(null, access_token);
  };
  ```

  This sample hook will:
  - add an arbitrary claim (`https://foo.com/claim`) to the `access_token`
  - add an `extra` scope to the default scopes configured on your [API](${manage_url}/#/apis).
  
  ::: panel-info Arbitrary claims namespaced format
  In order to improve compatibility for client applications, Auth0 now returns profile information in a [structured claim format as defined by the OIDC specification](https://openid.net/specs/openid-connect-core-1_0.html#StandardClaims). This means that in order to add custom claims to ID tokens or access tokens, they must conform to a namespaced format to avoid possible collisions with standard OIDC claims. For example, if you choose the namespace `https://foo.com/` and you want to add a custom claim named `claim`, you would name the claim `https://foo.com/claim`, instead of just `claim`.
  :::

{'fraction_non_alphanumeric': 0.09718817591925018, 'fraction_numerical': 0.003604902667627974, 'mean_word_length': 4.077598828696925, 'pattern_counts': {'":': 0, '<': 15, '<?xml version=': 0, '>': 15, 'https://': 11, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '6744859', 'n_tokens_mistral': 2042, 'n_tokens_neox': 1982, 'n_words': 871}