Retrieve Okta OIDC and OAuth Application Attributes as Claims in Tokens

Retrieve OpenID Connect (OIDC) and OAuth application attributes, such as the name or label, as claims within an ID token or access token by updating the application profile. After adding a custom attribute to the application profile and populating it via the Okta Admin Console or the Okta API, configure a custom claim in the authorization server to output the attribute in the token.

NOTE: This configuration is only supported when using a custom authorization server.

• Okta Classic Engine
• Okta Identity Engine (OIE)
• OpenID Connect (OIDC) and OAuth applications using a Custom Authorization Server

How is the application profile attribute populated via the Okta Admin Console?

Navigate to the application settings, access the General tab, and edit the Application profile attributes section to populate the custom attribute value.

1. Navigate to Applications > Applications.
2. Select the OpenID Connect or OAuth application.
3. Go to the General tab.
4. Scroll to the Application profile attributes section and select Edit. 

5. Enter the desired value for the custom attribute.  

   {
     "label": "Test App"
   }

6. Select Save.

How is the application profile attribute populated via the Okta API?

1. Make a GET /api/v1/apps/<appId> request to retrieve the current application model. The output of this request is required for the next step.
2. Update the application using a PUT /api/v1/apps/<appId> request to add a profile object with the label attribute. Replace the URLs and other variables with values for the specific environment. NOTE: If unfamiliar with curl, Okta recommends using Postman to help structure the request.

curl -X PUT https://org.okta.com/api/v1/apps/appId \
-H 'accept: application/json' \
-H 'Authorization: YOUR_API_KEY_HERE' \
-H 'cache-control: no-cache' \
-H 'content-type: application/json' \
-d '{
    "name": "oidc_client",
    "label": "Test Service App",
    "signOnMode": "OPENID_CONNECT",
    "credentials": {
    "oauthClient": {
          "client_id":"appId",
          "autoKeyRotation": true,
          "token_endpoint_auth_method": "client_secret_basic"
        }
      },
    "profile": {
        "label": "Test Service App"
    },
    "settings": {
        "oauthClient": {
            "client_uri": null,
            "logo_uri": null,
            "redirect_uris": [],
            "response_types": [
                "token"
            ],
            "grant_types": [
                "client_credentials"
            ],
            "application_type": "service",
            "consent_method": "REQUIRED",
            "issuer_mode": "ORG_URL",
            "idp_initiated_login": {
                "mode": "DISABLED",
                "default_scope": []
            },
            "wildcard_redirect": "DISABLED"
        }
    }
}'

What steps configure the custom claim using a custom authorization server?

Create a custom claim in the authorization server and generate a token to verify the claims.

1. Navigate to Security > API > Authorization Servers.
2. Select the custom authorization server.
3. Navigate to the Claims tab and select Add Claim.

4. Enter app.profile.label in the Value field and configure the remaining settings as needed.
5. Go to the Token Preview tab to generate the token and verify the claims.