You can send custom attributes to Hydra and use them in claims exchange by using OAuth2 webhooks. Here's how you can do it: 1. Register a webhook endpoint in your OAuth2 configuration: Before the token is issued to the client, Ory will call your HTTPS endpoint with information about the OAuth client requesting the token. You can register your webhook endpoint using the Ory CLI. Here's an example of how to do it:

bash ory patch oauth2-config $PROJECT_ID \     --add '/oauth2/token_hook/url="<https://my-example.app/token-hook>"' \     --add '/oauth2/token_hook/auth/type="api_key"' \     --add '/oauth2/token_hook/auth/config/in="header"' \     --add '/oauth2/token_hook/auth/config/name="X-API-Key"' \     --add '/oauth2/token_hook/auth/config/value="MY API KEY"' \     --format yaml

2. Handle the webhook in your endpoint: Use the request payload to decide how Ory should proceed in the token exchange with the client. To modify the claims of the issued tokens and instruct Hydra to proceed with the token exchange, return

200

with a JSON response body. Here's an example of how to do it:

json {     "session": {       "access_token": {         "your:custom:access-token-claim": "any value you like",         "your:second:access-token-claim": 124390123       },       "id_token": {         "your:custom:id-token-claim": "another value",         "your:second:id-token-claim": 2394123       }     }   }

3. Tokens issued by Ory to the OAuth2 client will contain the data from your webhook response. For more information, you can refer to the [Ory Hydra documentation](https://www.ory.sh/docs/hydra/guides/claims-at-refresh).

You can send custom data from your client to Hydra by including it in the OAuth2 Authorize URL. This data can then be retrieved along with the login request using the challenge code that Hydra creates. Here's how you can do it: 1. Include your custom data in the OAuth2 Authorize URL: The URL should look something like this:

/oauth2/auth?client_id=...&your_custom_param=...

. 2. Retrieve the custom data using the challenge code: Both Login and Consent Requests have a

request url

which contains the original OAuth2 Authorize URL. This URL is typically not needed, but might come in handy if you want to deal with additional request parameters. For more information, you can refer to the [Ory Hydra documentation](https://www.ory.sh/docs/hydra/faq#how-can-i-store-custom-data-).

The custom parameter is included in the OAuth2 Authorize URL, not in the token exchange request. When you initiate the OAuth2 Authorization Code or OAuth2 Implicit flow, you include your custom parameter in the URL. For example:

/oauth2/auth?client_id=...&your_custom_param=...

. This custom data can then be retrieved along with the login request using the challenge code that Hydra creates. It's not directly included in the token exchange request. For more details, please refer to the [Ory Hydra documentation](https://www.ory.sh/docs/hydra/faq#how-can-i-store-custom-data-).

Yes, the

login_challenge

is included in the token exchange request. When you initiate an OAuth2 flow (like the Authorization Code or Implicit flow), Hydra creates a

login_challenge

. This

login_challenge

is used to fetch information about the login request and is included in the token exchange request. For more information, you can refer to the [Ory Hydra documentation](https://www.ory.sh/docs/hydra/faq#how-can-i-store-custom-data-).

The

login_challenge

is not directly included in the token exchange request. Instead, it's used to fetch the login request from Hydra. Once you have the login request, you can use the

challenge

property of the

oauth2_login_request

object to get the

login_challenge

. Here's an example of how it's structured in the login request:

json 'oauth2_login_request': {   'properties': {     'challenge': {       'description': 'ID is the identifier ("login challenge") of the login request. It is used to identify the session.',       'type': 'string'     },     ...   } }

For more information, you can refer to the [Ory Kratos API documentation](https://www.ory.sh/docs/kratos/reference/api).