Skip to main content
The API object for the custom-token-exchange Actions trigger includes:

​
api.access

Modify the access of the token exchange request, such as rejecting the request.

​
api.access.deny(code, reason)

Mark the current token exchange as denied. If the request is being denied due to an invalid subject token, we recommend that api.access.rejectInvalidSubjectToken be used instead, to distinguish between brute force attempts on the subject token, and other reasons to deny the request.
​
code
string
The error code justifying the rejection of the token exchange. Can be invalid_request, server_error, or any custom code
​
reason
string
A human-readable explanation for rejecting the token exchange request.
exports.onExecuteCustomTokenExchange = async (event, api) => {

  // 1. Validate subject_token
  const subject_token = await validateToken(event.transaction.subject_token, jwksUri);

  // 2. Apply your authorization policy on the user
  const isAuthorized = await authorizeAccess(subject_token.sub);
  if (!isAuthorized) {
    api.access.deny('Unauthorized_login', 'User cannot login due to reason: X');
  }

  // if user is authorized, go on as indicated here

};

​
api.access.rejectInvalidSubjectToken(reason)

Mark the provided subject token from the request as invalid. This will cause the request to be rejected with an “invalid_request” error code. This will signal to the Attack Protection features that an invalid subject token has been provided, so that protections to prevent brute force attacks on the subject token can be applied.
​
reason
string
A human-readable explanation for rejecting the token exchange request.
exports.onExecuteCustomTokenExchange = async (event, api) => {

  try {
    // Validate subject_token
    const subject_token = await validateToken(event.transaction.subject_token, jwksUri);
    // set the user for the transaction
    api.authentication.setUserById(subject_token.id);

  } catch (error) {
    if (error.message === 'Invalid Token') {
      // If specifically the problem is the subject_token is invalid
      console.error('Invalid Token error');
      api.access.rejectInvalidSubjectToken('Invalid subject_token');
    } else {
      // if there is any other unexpected error, throw a server error
      throw error;
    }
  }

};

​
api.authentication

Indicate the result of the authentication of the subject token, to specify the user whom tokens will be issued for.

​
api.authentication.setUserById(user_id)

Indicate the user corresponding to the subject_token, by providing the userId. The token exchange request will issue tokens for this user. This must be an existing user. Note: Exactly one of api.authentication.setUserByConnection api.authentication.setUserById must be called by the Custom Token Exchange action.
​
user_id
string
The ID of the user; must be an existing user.
exports.onExecuteCustomTokenExchange = async (event, api) => {

  // 1. Validate subject_token
  const subject_token = await validateToken(event.transaction.subject_token, jwksUri);

  // 2. Apply your authorization policy on the user
  const isAuthorized = await authorizeAccess(subject_token.sub);
  if (!isAuthorized) {
    api.access.deny('Unauthorized_login', 'User cannot login due to reason: X');
  }

  // 3. Set the user for the transaction
  api.authentication.setUserById(subject_token.sub);

  return;
};

​
api.authentication.setUserByConnection(connection_name, user_attributes, options)

Indicate the user corresponding to the subject_token, by providing a connection and user attributes. The token exchange request will issue tokens for this user. This can be either an existing user, or a new user. If the user does not exist, it will be created. The user_id property of the user_profile will be used to determine if the user already exists. Note: Exactly one of api.authentication.setUserByConnection api.authentication.setUserById must be called by the Custom Token Exchange action.
​
connection_name
string
Name of the connection the user should be stored in.
​
user_attributes
setuserbyconnectionuserattributes
The user’s profile attributes, including user_id, and optionally other attributes such as email, name, etc.The user_id field is required, and should be the unique identifier of the user within the connection; this will be used to determine if the user exists or should be created. In existing users, this user_id can be found by inspecting the identities array of the normalized user profile.If the user already exists, the following user attributes cannot be updated: email, email_verified, phone, phone_verified, username. If these do not match the existing user, an error will be returned.
​
options
setuserbyconnectionoptions
Options to control the behavior of the setUserByConnection command.
  • creationBehavior - behavior to apply if no user with the specified user_id exists in the connection. Can be ‘create_if_not_exists’, which will cause a new user to be created using the supplied user attributes; or ‘none’, which will result in no user being created and an error being returned if no user exists.
  • updateBehavior - Behavior to apply if a user with specified user_id already exists in the connection. Can be ‘replace’, which results in the existing user’s attributes being replaced with the specified user attributes; or ‘none’ which means the existing user will not be modified.
Set user by connection with full profile attributes
exports.onExecuteCustomTokenExchange = async (event, api) => {

  // 1. Validate subject_token
  const subject_token = await validateToken(event.transaction.subject_token, jwksUri);

  // 2. Apply your authorization policy on the user
  const isAuthorized = await authorizeAccess(subject_token.sub);
  if (!isAuthorized) {
    api.access.deny('Unauthorized_login', 'User cannot login due to reason: X');
  }

  // 3. Set the user for the transaction
  api.authentication.setUserByConnection(
    'My Connection',
    {
      user_id: subject_token.sub,
      email: subject_token.email,
      email_verified: subject_token.email_verified,
      phone_number: subject_token.phone_number,
      phone_verified: subject_token.phone_number_verified,
      username: subject_token.preferred_username,
      name: subject_token.name,
      given_name: subject_token.given_name,
      family_name: subject_token.family_name,
      nickname: subject_token.nickname,
      verify_email: false
    },
    {
      creationBehavior: 'create_if_not_exists',
      updateBehavior: 'none'
    }
  );

  return;
};
Create a user without verifying email
exports.onExecuteCustomTokenExchange = async (event, api) => {

  // Validate subject_token
  const subject_token = await validateToken(event.transaction.subject_token, jwksUri);

  // Create a user but don't verify email
  api.authentication.setUserByConnection(
    'My Connection',
    {
      user_id: subject_token.sub,
      email: subject_token.email,
      email_verified: false,
      verify_email: false
    },
    {
      creationBehavior: 'create_if_not_exists',
      updateBehavior: 'none'
    }
  );

  return;
};

​
api.authentication.setOrganization(organization_id_or_name)

Set the organization for the user associated with the token exchange.
​
organization_id_or_name
string
The ID or name of the organization to set for the user.
exports.onExecuteCustomTokenExchange = async (event, api) => {

  // 1. Validate subject_token
  const subject_token = await validateToken(event.transaction.subject_token, jwksUri);

  // 2. Apply your authorization policy on the user
  const isAuthorized = await authorizeAccess(subject_token.sub);
  if (!isAuthorized) {
    api.access.deny('Unauthorized_login', 'User cannot login due to reason: X');
  }

  // 3. Set the organization for the transaction
  api.authentication.setOrganization('org_xS525r979AS33MSf');

  // 4. Set the user for the transaction. You may also use setUserByConnection()
  api.authentication.setUserById(subject_token.sub);

  return;
};

​
api.user

Request changes to the user corresponding to the subject token.

​
api.user.setAppMetadata(key, value)

Set application-specific metadata for the user corresponding to the subject token.
​
key
string
The metadata property to be set.
​
value
unknown
The value of the metadata property. This may be set to null to remove the metadata property.
exports.onExecuteCustomTokenExchange = async (event, api) => {
  // Validate subject_token
  const subject_token = await validateToken(event.transaction.subject_token, jwksUri);

  // set the user for the transaction
  api.authentication.setUserById(subject_token.id);

  // set user group based on info contained in subject_token
  api.user.setAppMetadata('group', subject_token.group);

  return;
};

​
api.user.setUserMetadata(key, value)

Set general metadata for the user corresponding to the subject token.
​
key
string
The metadata property to be set.
​
value
unknown
The value of the metadata property. This may be set to null to remove the metadata property.
exports.onExecuteCustomTokenExchange = async (event, api) => {
  // Validate subject_token
  const subject_token = await validateToken(event.transaction.subject_token, jwksUri);

  // set the user for the transaction
  api.authentication.setUserById(subject_token.id);

  // set user preferred_locale based on info contained in subject_token
  api.user.setUserMetadata('preferred_locale', subject_token.locale);

  return;
};

​
api.cache

Store and retrieve data that persists across executions.

​
api.cache.delete(key)

Delete a record describing a cached value at the supplied key if it exists.
​
key
string
The key of the cache record to delete.

​
api.cache.get(key)

Retrieve a record describing a cached value at the supplied key, if it exists. If a record is found, the cached value can be found at the value property of the returned object.
​
key
string
The key of the record stored in the cache.

​
api.cache.set(key, value, options)

Store or update a string value in the cache at the specified key. Values stored in this cache are scoped to the Trigger in which they are set. They are subject to the Actions Cache Limits. Values stored in this way will have lifetimes of up to the specified ttl or expires_at values. If no lifetime is specified, a default of lifetime of 24 hours will be used. Lifetimes may not exceed the maximum duration listed at Actions Cache Limits. Important: This cache is designed for short-lived, ephemeral data. Items may not be available in later transactions even if they are within their supplied their lifetime.
​
key
string
The key of the record to be stored.
​
value
string
The value of the record to be stored.
​
options
cachesetoptions
optional
Options for adjusting cache behavior.