# How to return entitlements in Access Token? **URL:** \ **Category:** API\ **Created:** [January 17, 2023, 3:41pm UTC](https://devforum.okta.com/t/how-to-return-entitlements-in-access-token/23065 "2023-01-17T15:41:09Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![SNAmigo](https://avatars.discourse-cdn.com/v4/letter/s/43a26b/32.png) [@SNAmigo](https://devforum.okta.com/u/SNAmigo)\ **Post date:** [January 17, 2023, 3:41pm UTC](https://devforum.okta.com/t/how-to-return-entitlements-in-access-token/23065/1 "2023-01-17T15:41:09Z")
We have a requirement where we need to return all the groups that user has access to? I have created below entitlement under claims for my authorization servers but I am not seeing any entitlements in access token when I unpack it using [JWT.IO](http://JWT.IO) ![image](https://global.discourse-cdn.com/oktadev/original/2X/8/88d9223e3201d46e117e09963748aa5b9f4a61c2.png) ---
**Author:** ![louie](https://avatars.discourse-cdn.com/v4/letter/l/c68b51/32.png) [@louie](https://devforum.okta.com/u/louie)\ **Post date:** [January 17, 2023, 5:06pm UTC](https://devforum.okta.com/t/how-to-return-entitlements-in-access-token/23065/2 "2023-01-17T17:06:16Z")
Hi @SNAmigo, are these groups Okta groups, or are they synced from AD? ---
**Author:** ![SNAmigo](https://avatars.discourse-cdn.com/v4/letter/s/43a26b/32.png) [@SNAmigo](https://devforum.okta.com/u/SNAmigo)\ **Post date:** [January 17, 2023, 6:59pm UTC](https://devforum.okta.com/t/how-to-return-entitlements-in-access-token/23065/4 "2023-01-17T18:59:24Z")
Okta groups that I have created manually. @louie ---
**Author:** ![sigama](https://sea1.discourse-cdn.com/oktadev/user_avatar/devforum.okta.com/sigama/32/5811_2.png) [@sigama](https://devforum.okta.com/u/sigama)\ **Post date:** [January 17, 2023, 8:29pm UTC](https://devforum.okta.com/t/how-to-return-entitlements-in-access-token/23065/5 "2023-01-17T20:29:28Z")
@SNAmigo did you set this up in your Okta Org Authorization Server - [Authorization servers | Okta Developer](https://developer.okta.com/docs/concepts/auth-servers/#org-authorization-server) or Custom Authorization Server Template called Default - [Authorization servers | Okta Developer](https://developer.okta.com/docs/concepts/auth-servers/#default-custom-authorization-server)? Perhaps you are calling the wrong server. It matters which server you are calling so that it is present in the token. ---
**Author:** ![SNAmigo](https://avatars.discourse-cdn.com/v4/letter/s/43a26b/32.png) [@SNAmigo](https://devforum.okta.com/u/SNAmigo)\ **Post date:** [January 18, 2023, 12:10am UTC](https://devforum.okta.com/t/how-to-return-entitlements-in-access-token/23065/6 "2023-01-18T00:10:53Z")
I am using the default custom authorization server, It is the only one that is active. Is there a way to test our configuration within the Okta console instead of calling an API? ---
**Author:** ![sigama](https://sea1.discourse-cdn.com/oktadev/user_avatar/devforum.okta.com/sigama/32/5811_2.png) [@sigama](https://devforum.okta.com/u/sigama)\ **Post date:** [January 18, 2023, 2:18am UTC](https://devforum.okta.com/t/how-to-return-entitlements-in-access-token/23065/7 "2023-01-18T02:18:56Z")
@SNAmigo unfortunately no Okta console but I recommend using this debugger tool - [https://oidcdebugger.com/](https://oidcdebugger.com/) be sure to add the redirect url to your OIDC Application in your Okta dashboard. Look out for common issues I explain here [Okta Authorization Servers for OpenID Connect and OAuth 2.0 Integrations - YouTube](https://www.youtube.com/watch?v=PASiA_2ChFU&t=443s). ---
**Author:** ![sigama](https://sea1.discourse-cdn.com/oktadev/user_avatar/devforum.okta.com/sigama/32/5811_2.png) [@sigama](https://devforum.okta.com/u/sigama)\ **Post date:** [January 18, 2023, 2:37am UTC](https://devforum.okta.com/t/how-to-return-entitlements-in-access-token/23065/8 "2023-01-18T02:37:02Z")
@SNAmigo your web app setup (for example) should look like this on Okta side: ![implicit](https://global.discourse-cdn.com/oktadev/original/2X/d/dd6f39ab6cf66a5c5845e977f82cdb4320b77c65.png) ![oidc-debugger](https://global.discourse-cdn.com/oktadev/original/2X/0/0cbfd99d80b095a96539270c6a9798f2759a5adc.png) OIDC Debugger tool side: ![oidc-debugger2](https://global.discourse-cdn.com/oktadev/original/2X/0/0e0e68e175fdd77e992a617ed693f5b5945eb713.png) Note: We are only using the implicit grant flow - skipping the code exchange step for testing purposes only; we don’t recommend using this flow in general so disable this on your OIDC app setup (Okta dashboard) when you are done testing. ---
**Author:** ![system](https://global.discourse-cdn.com/oktadev/original/1X/589c4c5f80de422d01f47cee7185a7fb8227835c.png) [@system](https://devforum.okta.com/u/system)\ **Post date:** [February 12, 2024, 11:08pm UTC](https://devforum.okta.com/t/how-to-return-entitlements-in-access-token/23065/9 "2024-02-12T23:08:07Z")
Closed on February 12, 2024, 11:08pm UTC This topic was automatically closed 24 hours after the last reply. New replies are no longer allowed.