Configure custom claims on users

This document explains how to configure custom claims on users with Identity Platform. Custom claims are inserted into user tokens during authentication. Your app can use these claims to handle complex authorization scenarios, such as restricting a user's access to a resource based on their role.

Set up custom claims

To preserve security, set custom claims using the Admin SDK on your server:

If you haven't already, Install the Admin SDK .

Set the custom claim you want to use. In the following example, a custom claim is set on the user to describe that they're an administrator:

Node.js

 // Set admin privilege on the user corresponding to uid. 
 getAuth 
 () 
  
 . 
 setCustomUserClaims 
 ( 
 uid 
 , 
  
 { 
  
 admin 
 : 
  
 true 
  
 }) 
  
 . 
 then 
 (() 
  
 = 
>  
 { 
  
 // The new custom claims will propagate to the user's ID token the 
  
 // next time a new one is issued. 
  
 }); 
   custom_claims 
 . 
 js

Java

 // Set admin privilege on the user corresponding to uid. 
 Map<String 
 , 
  
 Object 
>  
 claims 
  
 = 
  
 new 
  
 HashMap 
<> (); 
 claims 
 . 
 put 
 ( 
 "admin" 
 , 
  
 true 
 ); 
 FirebaseAuth 
 . 
 getInstance 
 (). 
 setCustomUserClaims 
 ( 
 uid 
 , 
  
 claims 
 ); 
 // The new custom claims will propagate to the user's ID token the 
 // next time a new one is issued.  FirebaseAuthSnippets.java

# Set admin privilege on the user corresponding to uid. auth . set_custom_user_claims ( uid , { 'admin' : True }) # The new custom claims will propagate to the user's ID token the # next time a new one is issued.

index.py

// Get an auth client from the firebase.App client , err := app . Auth ( ctx ) if err != nil { log . Fatalf ( "error getting Auth client: %v\n" , err ) } // Set admin privilege on the user corresponding to uid. claims := map [ string ] interface {}{ "admin" : true } err = client . SetCustomUserClaims ( ctx , uid , claims ) if err != nil { log . Fatalf ( "error setting custom claims %v\n" , err ) } // The new custom claims will propagate to the user's ID token the // next time a new one is issued.

auth.go

// Set admin privileges on the user corresponding to uid. var claims = new Dictionary<string , object > () { { "admin" , true }, }; await FirebaseAuth . DefaultInstance . SetCustomUserClaimsAsync ( uid , claims ); // The new custom claims will propagate to the user's ID token the // next time a new one is issued.

FirebaseAuthSnippets.cs

// Verify the ID token first. getAuth () . verifyIdToken ( idToken ) . then (( claims ) = > { if ( claims . admin === true ) { // Allow access to requested admin resource. } });

custom_claims . js

// Verify the ID token first. FirebaseToken decoded = FirebaseAuth . getInstance (). verifyIdToken ( idToken ); if ( Boolean . TRUE . equals ( decoded . getClaims (). get ( "admin" ))) { // Allow access to requested admin resource. }

FirebaseAuthSnippets . java

# Verify the ID token first. claims = auth . verify_id_token ( id_token ) if claims [ 'admin' ] is True : # Allow access to requested admin resource. pass

index

. py

// Verify the ID token first. token , err := client . VerifyIDToken ( ctx , idToken ) if err != nil { log . Fatal ( err ) } claims := token . Claims if admin , ok := claims [ "admin" ]; ok { if admin .( bool ) { //Allow access to requested admin resource. } }

auth . go

// Verify the ID token first. FirebaseToken decoded = await FirebaseAuth . DefaultInstance . VerifyIdTokenAsync ( idToken ); object isAdmin ; if ( decoded . Claims . TryGetValue ( "admin" , out isAdmin )) { if (( bool ) isAdmin ) { // Allow access to requested admin resource. } }

FirebaseAuthSnippets . cs

// Lookup the user associated with the specified uid. getAuth () . getUser ( uid ) . then (( userRecord ) = > { // The claims can be accessed on the user record. console . log ( userRecord . customClaims [ 'admin' ]); });

custom_claims . js

// Lookup the user associated with the specified uid. UserRecord user = FirebaseAuth . getInstance (). getUser ( uid ); System . out . println ( user . getCustomClaims (). get ( "admin" ));

FirebaseAuthSnippets . java

# Lookup the user associated with the specified uid. user = auth . get_user ( uid ) # The claims can be accessed on the user record. print ( user . custom_claims . get ( 'admin' ))

index . py

// Lookup the user associated with the specified uid. user , err := client . GetUser ( ctx , uid ) if err != nil { log . Fatal ( err ) } // The claims can be accessed on the user record. if admin , ok := user . CustomClaims [ "admin" ]; ok { if admin .( bool ) { log . Println ( admin ) } }

auth . go

// Lookup the user associated with the specified uid. UserRecord user = await FirebaseAuth . DefaultInstance . GetUserAsync ( uid ); Console . WriteLine ( user . CustomClaims [ "admin" ]);

FirebaseAuthSnippets . cs

What's next

Learn more about blocking functions , which can also be used to set custom claims.

Learn more about Identity Platform custom claims in the Admin SDK reference documentation .

Except as otherwise noted, the content of this page is licensed under the Creative Commons Attribution 4.0 License , and code samples are licensed under the Apache 2.0 License . For details, see the Google Developers Site Policies . Java is a registered trademark of Oracle and/or its affiliates.

Last updated 2025-10-24 UTC.

Configure custom claims on users

Set up custom claims

Node.js

Java

Python

Go

C#

Node.js

Java

Python

Go

C#

Node.js

Java

Python

Go

C#

What's next