# Diagnose: custom claims missing
## Symptom
`api.idToken.setCustomClaim` / `api.accessToken.setCustomClaim` ran, but the claim is absent from the decoded token.
## Likely causes
1. Claim name not namespaced. Auth0 drops custom claims whose names are not namespaced (a URL like `https://YOUR-DOMAIN/[claim]`). `api.idToken.setCustomClaim("role", "admin")` silently does nothing; `("https://YOUR-DOMAIN/role", "admin")` works. Reserved OIDC names are also protected.
2. Action written but not DEPLOYED. Draft code never runs.
3. Action deployed but not attached to the login flow (Actions > Flows > Login). Deployment alone does nothing.
4. Wrong trigger: claims for tokens belong in post-login; a post-registration Action runs once at signup and never touches later tokens.
5. Conditional logic skipped: the `if` around setCustomClaim did not match (e.g. checking event.authorization.roles before roles load).
## Confirm
- Decode the access token AND the id token separately; claims set on one do not appear on the other.
- Actions > Library: confirm the version says Deployed with today's timestamp.
- Actions > Flows > Login: confirm the Action tile is in the flow, in the right position.
- Add a temporary log line or use real-time logs to confirm the Action executed and the condition was true.
## Fix
Namespace the claim, deploy, attach to the flow, in that order. Then log in fresh (existing tokens do not retroactively gain claims).
## Verify
Fresh login, decode the new token, claim present with the expected value. Keep a token-claim assertion in CI against a test tenant.