I have a React application that uses Okta as the identity provider with the OKTA redirect flow for users to login.
I have implemented a Token Inline Hook to enrich the access token with additional claims. During the hook execution, my external webhook queries our database to retrieve user-specific information and patches those values into the access token.
I now have a new requirement.
Users can initiate the login flow from different pages within the application, and I need to know which page initiated the login. My idea was to pass a custom parameter (for example, pageId) in the Okta /authorize request. Then, when the Token Inline Hook is invoked, I would read that same pageId value from the inline hook request payload, use it to query additional data from my database, and patch the resulting information into the access token.
For example:
/authorize?...&pageId=abc123
However, after testing this approach, I noticed that although the custom parameter is included in the /authorize request, it does not appear in the Token Inline Hook request payload sent to my webhook.
My questions are:
- Is there a supported way to pass custom parameters from the
/authorizerequest to a Token Inline Hook? - Are custom authorization request parameters intentionally omitted from the inline hook payload?
- If this is not supported, what would be the recommended approach to provide request-specific context (such as a page ID) to the Token Inline Hook so that I can generate dynamic claims in the access token?
Any guidance or recommended patterns would be greatly appreciated.
Thank you!