---
title: "Customize OAuth access token claims"
method: POST
path: "/oauth/access-token-hook"
tags: ["OAuth Grants"]
---

# Customize OAuth access token claims

`POST /oauth/access-token-hook`

## Request

- Base URL: `https://api.presscart.com` (the document declares no server; this is the origin it was published from)
- URL: `https://api.presscart.com/oauth/access-token-hook`
- Auth: HTTP bearer

Supabase Custom Access Token Hook for Presscart OAuth grants; refuses token issuance for blocked users on every flow (sign-in, refresh, OAuth). Tokens issued to OAuth clients get a role and session_id that Supabase Auth, PostgREST and Realtime refuse.

## Response `200`

OAuth token claims customized successfully

- object
  - `claims` object, required
    - `sub` string
    - `exp` number
    - `client_id` string
    - `session_id` union
      - string, uuid
      - 'none'
    - `grant_id` string, uuid
    - `role` string

## Changes

- **2026-10-20** `2154581d845e`: 1 breaking, 2 info
  - the `claims/session_id` response's property type changed from `string` to no type, and format from `uuid` to no format for status `200`
  - added the optional property `claims/role` to the response with the `200` status
  - added `subschema #1, subschema #2` to the `claims/session_id` response property `anyOf` list for the response status `200`

[Operation history](https://skmtc.dev/presscart/apis/presscart-prod-api/changes/oauth/access-token-hook/post.md)

---

[API](https://skmtc.dev/presscart/apis/presscart-prod-api.md) · [All operations](https://skmtc.dev/presscart/apis/presscart-prod-api/llms.txt) · [OpenAPI document](https://skmtc.dev/presscart/apis/presscart-prod-api/revisions/2154581d845e?raw)