# Enrich SSO Token

div
div
SSO
> Allows adding custom data to the OIDC tokens


## Description

This step is used to add information that can be utilized by the relying party as part of the returned access or ID token. These pieces of information can be added as fully customizable key-value pairs, allowing you to gather relevant data about the SSO authentication process.

You can control where enriched claims appear in the token:

- Under a dedicated `custom_claims` object (default), which reduces the risk of collisions with standard JWT claims and provides a stable structure for token consumers.
- At the top level of the token payload, which is useful when migrating from another identity provider (for example, Okta or Auth0) or when downstream services expect claims like `tier` or `risk_level` directly at the token root.


For ID token enrichments, you can also choose to return the same claims from the [UserInfo endpoint](/openapi/user/oidc.openapi/other/oidcuserinfoget). .

## Configuration

div
| Field | Description |
|  --- | --- |
| **Token type** | Select the token to enrich. Values are: - **Access token**, - **ID token**- **Access Token And ID Token**. |
| **Token enrichment values** | List of claims to add to the selected token type. Set key-value pairs dynamically via the gear icon. Required. |
| **Return enriched ID token claims on UserInfo response as well** | Off by default. When enabled, it exposes the enrichment values via the [UserInfo endpoint](/openapi/user/oidc.openapi/other/oidcuserinfoget). |
| **Token Claims Placement** (when **Token type** is **Access token**) | Determines where to insert enriched claims in the token payload:- **The custom_claims object** (default): Inserts claims under the `custom_claims` object.- **Root**: Inserts claims at the top level of the token payload. |


Journey event data
This step can be configured to record step input and output data, or a custom payload, which is then surfaced in journey events in Journey Analytics for diagnostic purposes. For details, see [Additional data reporting](/guides/orchestration/getting-started/event_reporting).

## Example

Consider a scenario where you want downstream services to know the user's loyalty tier and risk level calculated during the SSO flow. By including these values as custom claims in the OIDC access and ID tokens, you can securely return additional information to the client application upon flow completion, providing context for authorization and business logic (for example, show premium perks for `loyalty_tier: "gold"` or require step-up actions when `risk_level` is high).

The following example uses `placement: custom_claims` and includes `loyalty_tier: "gold"` and `risk_level: "low"`:

```json
{
  "sub": "123",
  "iss": "https://userid.security",
  "custom_claims": {
    "loyalty_tier": "gold",
    "risk_level": "low"
  }
}
```

Note
When using `placement: root`, you must never overwrite [reserved JWT claims](/openapi/id_token_reference#default-claims) such as `iss`, `sub`, `aud`, `iat`, and `exp`.