**TL;DR:** Symptom: the claim your API needs is not in the token. Cause: non-namespaced claims are dropped, the Action is not deployed, or it is not attached to the flow. Draft code never runs. Wrong trigger: claims for tokens belong in post-login; a post-registration Action runs once at signup and never touches later tokens.

# Diagnose: custom claims missing

## Symptom

`api.idToken.setCustomClaim` / `api.accessToken.setCustomClaim` ran, but the claim is absent from the decoded token.

## Likely causes

1. Claim name not namespaced. Auth0 drops custom claims whose names are not namespaced (a URL like `YOUR_HOST/[claim]`). `api.idToken.setCustomClaim("role", "admin")` silently does nothing; `("YOUR_HOST/role", "admin")` works. Reserved OIDC names are also protected.
2. Action written but not DEPLOYED. Draft code never runs.
3. Action deployed but not attached to the login flow (Actions > Flows > Login). Deployment alone does nothing.
4. Wrong trigger: claims for tokens belong in post-login; a post-registration Action runs once at signup and never touches later tokens.
5. Conditional logic skipped: the `if` around setCustomClaim did not match (e.g. checking event.authorization.roles before roles load).

## Confirm

- Decode the access token AND the id token separately; claims set on one do not appear on the other.
- Actions > Library: confirm the version says Deployed with today's timestamp.
- Actions > Flows > Login: confirm the Action tile is in the flow, in the right position.
- Add a temporary log line or use real-time logs to confirm the Action executed and the condition was true.

## Fix

Namespace the claim, deploy, attach to the flow, in that order. Then log in fresh (existing tokens do not retroactively gain claims).

## Verify

Fresh login, decode the new token, claim present with the expected value. Keep a token-claim assertion in CI against a test tenant.

## When to use this

- You are seeing this exact error message; match the block above, not just part of it.
- The failing call matches the scenario in the title: Custom claims missing from tokens.
- You want the fastest verified fix before digging through logs.

## When not to use this

- Your error text differs from the block above; close cousins often have different causes.
- The stack trace points at a different component than the one in the title.
- You already applied this fix and the error persists; look for a second cause instead of reapplying.

---

## Vectle citations

- Exact version: <https://vectle.com/skills/skl_2tkVbgS7P8iNZo1TL30O0g/versions/skv_FcaR9bGIMSbegdu7cwigSg>
- Canonical HTML skill page: <https://vectle.com/skills/skl_2tkVbgS7P8iNZo1TL30O0g>
- Current Markdown URL: <https://vectle.com/skills/skl_2tkVbgS7P8iNZo1TL30O0g/markdown>

## Selected public attribution and original notices/references

```json
{
  "author": "issueatlas",
  "client": null,
  "notices_and_references": [
    "https://auth0.com/docs/customize/actions/triggers/post-login"
  ]
}
```