Skip to content

Commit

Permalink
fix: address review comments
Browse files Browse the repository at this point in the history
  • Loading branch information
sgal committed Mar 3, 2023
1 parent deb6737 commit d937177
Showing 1 changed file with 24 additions and 25 deletions.
49 changes: 24 additions & 25 deletions docs/hydra/guides/updating-claims-at-refresh.mdx
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
---
id: claims-at-refresh
title: Hook into the OAuth2 refresh token flow
title: Adding custom claims to tokens
sidebar_label: OAuth2 webhooks
---

Expand All @@ -19,38 +19,37 @@ The hook is called before any other logic is executed. If the hook execution fai

## Configuration

Use the Ory CLI with key `/oauth2/refresh_token_hook` to enable this feature:

```shell title="Enable the refresh token hook"
ory patch oauth2-config {project.id} \
--replace "/oauth2/refresh_token_hook=\"https://my-example.app/token-refresh-hook\"" \
--format yaml
```

### Grant types

The hooks feature is enabled for the following grant types:

- `authorization_code`
- `client_credentials`
- `refresh_token`
- `urn:ietf:params:oauth:client-assertion-type:jwt-bearer` - see [RFC7523](https://www.rfc-editor.org/rfc/rfc7523)
- `jwt-bearer` - see [RFC7523](https://www.rfc-editor.org/rfc/rfc7523)

To enable the token webhooks, configure the following keys in the Hydra configuration:
Use the Ory CLI with following keys to enable this feature:

```yaml
oauth2:
# authorization_code grant type
authorization_code_hook: https://my-example.app/authorization-code-hook
```shell title="Enable the authorization code hook"
ory patch oauth2-config {project.id} \
--replace "/oauth2/authorization_code_hook=\"https://my-example.app/authorization-code-hook\"" \
--format yaml
```

# client_credentials grant type
client_credentials_hook: https://my-example.app/client-credentials-hook
```shell title="Enable the client credentials token hook"
ory patch oauth2-config {project.id} \
--replace "/oauth2/client_credentials_hook=\"https://my-example.app/client-credentials-hook\"" \
--format yaml
```

# refresh_token grant type
refresh_token_hook: https://my-example.app/token-refresh-hook
```shell title="Enable the refresh token hook"
ory patch oauth2-config {project.id} \
--replace "/oauth2/refresh_token_hook=\"https://my-example.app/token-refresh-hook\"" \
--format yaml
```

# urn:ietf:params:oauth:client-assertion-type:jwt-bearer grant type
jwt_bearer_hook: https://my-example.app/jwt-bearer-hook
```shell title="Enable the jwt-bearer token hook"
ory patch oauth2-config {project.id} \
--replace "/oauth2/jwt_bearer_hook=\"https://my-example.app/jwt-bearer-hook\"" \
--format yaml
```

If you're running Hydra locally, you can set these values by exporting the token hook endpoint URLs as environment variables. Run
Expand Down Expand Up @@ -148,8 +147,8 @@ The token hook endpoint must accept the following payload format:

### Requester payload

For `client_credentials` and `urn:ietf:params:oauth:client-assertion-type:jwt-bearer` grant types, Hydra will also send an entire
payload that was sent to the `/token` endpoint by the client.
For `client_credentials` and `jwt-bearer` grant types, the entire payload that you send to the `/token` endpoint will also be sent
to the configured webhook URL.

Here's the format of the `requester.payload` field for each grant type:

Expand Down

0 comments on commit d937177

Please sign in to comment.