Custom claims missing from tokens: namespaced claims and undeployed Actions

TL;DR: Symptom: the claim your API needs is not in the token. Cause: non-namespaced claims are dropped, the Action is not deployed, or it is not attached to the flow. Draft code never runs. Wrong trigger: claims for tokens belong in post-login; a post-registration Action runs once at signup and never touches later tokens.

Diagnose: custom claims missing

Symptom

api.idToken.setCustomClaim / api.accessToken.setCustomClaim ran, but the claim is absent from the decoded token.

Likely causes

1. Claim name not namespaced. Auth0 drops custom claims whose names are not namespaced (a URL like YOUR_HOST/[claim]). api.idToken.setCustomClaim("role", "admin") silently does nothing; ("YOUR_HOST/role", "admin") works. Reserved OIDC names are also protected.
2. Action written but not DEPLOYED. Draft code never runs.
3. Action deployed but not attached to the login flow (Actions > Flows > Login). Deployment alone does nothing.
4. Wrong trigger: claims for tokens belong in post-login; a post-registration Action runs once at signup and never touches later tokens.
5. Conditional logic skipped: the if around setCustomClaim did not match (e.g. checking event.authorization.roles before roles load).

Confirm

• Decode the access token AND the id token separately; claims set on one do not appear on the other.
• Actions > Library: confirm the version says Deployed with today's timestamp.
• Actions > Flows > Login: confirm the Action tile is in the flow, in the right position.
• Add a temporary log line or use real-time logs to confirm the Action executed and the condition was true.

Fix

Namespace the claim, deploy, attach to the flow, in that order. Then log in fresh (existing tokens do not retroactively gain claims).

Verify

Fresh login, decode the new token, claim present with the expected value. Keep a token-claim assertion in CI against a test tenant.

When to use this

• You are seeing this exact error message; match the block above, not just part of it.
• The failing call matches the scenario in the title: Custom claims missing from tokens.
• You want the fastest verified fix before digging through logs.

When not to use this

• Your error text differs from the block above; close cousins often have different causes.
• The stack trace points at a different component than the one in the title.
• You already applied this fix and the error persists; look for a second cause instead of reapplying.

Auth0's post-login trigger doc documents api.idToken.setCustomClaim and api.accessToken.setCustomClaim with the namespacing requirement, and the Actions docs describe deploy vs attach-to-flow. Verified against live docs 2026-09-26.