Authorization context like plan tier, role, or region usually lives in your database, which means every request that needs it pays for a lookup. Custom session token claims embed that context directly in the JWT access tokens Scalekit issues at login and refresh, so your API reads it from the token it already validates.

Write organization.metadata.plan as a claim expression in the dashboard and every new session token carries the org's plan. The expression language handles real-world data: fallbacks like user.email ?? user.preferred_username, safe navigation like organization.metadata.billing?.tier ?? "free", and helpers such as split, trim, and filter.

How it works

• Define a claim key and a dot-path expression over user or organization data in the dashboard; reserved keys like sub, roles, and permissions cannot be overridden.
• The token preview panel resolves your claims against a real user and organization, so you see the exact JWT payload before it ships.
• Claims take effect on the next token issue or refresh, with no separate publish step and no deploy.
• A missing field omits the claim rather than failing the login, so a claim expression never blocks authentication.

Read the session token claims docs to set up your first claim.