# User Generated Token with Custom Claims

**URL:** <https://devforum.okta.com/t/user-generated-token-with-custom-claims/7510>\
**Category:** Questions\
**Created:** [January 3, 2020, 11:43am UTC](https://devforum.okta.com/t/user-generated-token-with-custom-claims/7510 "2020-01-03T11:43:20Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![tklohna](https://avatars.discourse-cdn.com/v4/letter/t/439d5e/32.png) [@tklohna](https://devforum.okta.com/u/tklohna)\
**Post date:** [January 3, 2020, 11:43am UTC](https://devforum.okta.com/t/user-generated-token-with-custom-claims/7510/1 "2020-01-03T11:43:20Z")

</div>

Hello everyone. I’m investigating a use case for Okta and I was wondering if a certain scenario is possible.  
Right now, Okta is used solely for authentication purposes (no custom claims, scopes or groups). Barebone as it gets.

Does Okta support generating access (or refresh) tokens for a specific user, through API?

Eq. User A has a CLI project and instead of giving a password to a coworker User B for authentication, he would like to generate a token with custom claim/scope (we would process the scope, we just need Okta to process and validate the request).  
Can that be done without admin stepping in and doing it manually?

---

<div class="post-metadata">

**Author:** ![Govner](https://sea1.discourse-cdn.com/oktadev/user_avatar/devforum.okta.com/govner/32/1099_2.png) [@Govner](https://devforum.okta.com/u/Govner)\
**Post date:** [January 5, 2020, 3:06pm UTC](https://devforum.okta.com/t/user-generated-token-with-custom-claims/7510/2 "2020-01-05T15:06:38Z")

</div>

Does your CLI project support OAuth/OIDC flow?

---

<div class="post-metadata">

**Author:** ![dragos](https://sea1.discourse-cdn.com/oktadev/user_avatar/devforum.okta.com/dragos/32/1313_2.png) [@dragos](https://devforum.okta.com/u/dragos)\
**Post date:** [January 6, 2020, 2:19am UTC](https://devforum.okta.com/t/user-generated-token-with-custom-claims/7510/3 "2020-01-06T02:19:30Z")

</div>

Hi @tklohna

Okta does not have this capability out of the box, however you can deploy an application that runs on the back-end channel and uses for example [Resource Owner Password Flow](https://developer.okta.com/docs/guides/implement-password/use-flow/) to retrieve an access token and pass it in the front-end channel.

---

<div class="post-metadata">

**Author:** ![tklohna](https://avatars.discourse-cdn.com/v4/letter/t/439d5e/32.png) [@tklohna](https://devforum.okta.com/u/tklohna)\
**Post date:** [January 6, 2020, 8:29am UTC](https://devforum.okta.com/t/user-generated-token-with-custom-claims/7510/4 "2020-01-06T08:29:29Z")

</div>

Thank you for the replies!

@Govner - We leverage OAuth

@dragos - I see. We already use this approach with our web app, but I was hoping that there might be a way to generate a custom one, with certain data, that is different from the Bearer token.  
It’s already possible to use just the access token we receive as you say and tell the user to use that in CLI configuration, but that would mean the user has to update this token as it has an expiration.  
We are also not able to give user token with only certain rights (read-only for example).

---

<div class="post-metadata">

**Author:** ![andrea](https://sea1.discourse-cdn.com/oktadev/user_avatar/devforum.okta.com/andrea/32/2172_2.png) [@andrea](https://devforum.okta.com/u/andrea)\
**Post date:** [January 23, 2024, 7:44pm UTC](https://devforum.okta.com/t/user-generated-token-with-custom-claims/7510/5 "2024-01-23T19:44:21Z")

</div>

Closed on January 23, 2024, 7:44pm UTC