Unexpected Claims in the Client Credentials Access Token

Last Updated: Feb 20, 2026

Overview

When migrating over to using Actions instead of hooks, some unexpected claims are seen in the token:

"statusCode": 200,
"headers": {},
"status": "success",

Applies To

Hooks
Actions
Client credentials

Cause

This can be caused by passing an empty callback within a client credentials hook, for example, to attempt an early exit from the hook as part of the migration to Actions for a certain client ID.

E.g.

if (client.name === "<Client name being migrated here>") {        
   return cb();
}

Solution

The hook callback should pass null and access_token parameters. For example, an early exit could look like:

if (client.name === "<Client name being migrated here>") {
   let access_token = {
      scope: scope
   };
   return cb(null,access_token);
}

Actions are executed after hooks so they can be used to modify the access token further as required.