Skip to main content

Set an end user's stored custom claims (server-side admin)

PUT 
/auth/users/:user_id/claims

Secret-key-scoped upsert of the authoritative custom_claims for an end user. Set server-side only — clients cannot write these, which is what makes them safe for authorization (e.g. an account-type/admin flag). Claims are embedded into the user's JWTs on the next login/refresh. Max 4KB; reserved JWT/Zyphr claim names are rejected.

Each write bumps a monotonic claims_version (returned in the response). The change applies seamlessly on the user's next login or token refresh — a token carrying an older claims_version is rejected on verification and the client silently re-mints with the new claims, without a forced logout. For a hard cut-off (log the user out of all sessions immediately), call POST /auth/sessions/revoke-all after updating claims.

Request​

Responses​

Claims updated