Inspect access-token data
Read standard access-token claims such as aud or given_name during a server request.
Kinde · Module
getClaimValue
getClaimValue extracts the value of a named claim from the current session's access or ID token. It defaults to the access token unless you provide id_token.
How it works
getClaimValue extracts one named claim from a token in the current session and returns only that claim's value. It uses the access token by default; pass the optional token key to read the ID token instead.
Syntax
client.getClaimValue(sessionManager, claim, tokenKey?)Parameters
| Name | Type | Description |
|---|---|---|
sessionManager | SessionManager | Session manager for the current session. |
claim | string | Name of the claim to extract. |
tokenKey | ClaimTokenType | Optional token source: access_token or id_token. Defaults to access_token. |
Returns
The value of the requested claim from the selected token.
Key points
- The method reads one named claim from a token associated with the current session.
- The optional token selector supports access_token and id_token.
- A basic call retrieves the given_name value using the default token selection.
- Passing id_token as the third argument reads the email claim from the ID token.
Common mistakes
- If tokenKey is omitted, the method reads the access token rather than the ID token.
Example: Read an access-token claim value
const value = client.getClaimValue(sessionManager, "given_name");
console.log(value);Reads the given_name claim from the current session's access token and returns its value.
When to use it
Read ID-token identity claims
Retrieve identity claims that are present in the ID token.
Access application claims
Use custom claims exposed by Kinde in the selected token.
Interview questions
QWhat does getClaimValue return, and how does it differ from getClaim?
It extracts a named claim from the selected token in the current session and returns only the claim value. Unlike getClaim, it does not return an object containing the claim name.
Follow-up: How would you read a claim from the ID token? Pass "id_token" as the optional tokenKey argument.
QWhat arguments does getClaimValue accept?
The required inputs are a SessionManager and a string claim name. The optional tokenKey selects either access_token or id_token.
Follow-up: What happens when tokenKey is omitted? The access token is selected by default.
QShow how to retrieve a claim from the access token and from the ID token.
A call such as client.getClaimValue(sessionManager, "given_name") retrieves the given_name claim value from the current session. Supplying a third argument lets the call target the ID token.
Follow-up: How would you retrieve the email claim from the ID token? Use client.getClaimValue(sessionManager, "email", "id_token").
Related
getClaimSessionManagerClaimTokenType