Hey, I need to add an extra identifier to each application, so that the identifier is added to the JWT and that the value can only be added by that certain application. Our goal is to use Okta for storing integration client id/secrets using an application per customer, and we would want to get the actual customer id in the generated token.

I thought custom scopes would be a way of doing this, but I can't figure out how to deny other applications from granting access with that scope. Like managing Okta API Scopes but for my custom scope. Is this possible? If not, is there another way of adding custom attributes to Applications and mapping them to claims?