# How to add arbitrary values to Token "scope" attribute

**URL:** <https://forum.keycloak.org/t/how-to-add-arbitrary-values-to-token-scope-attribute/18010>\
**Category:** Getting advice\
**Tags:** oidc\
**Created:** [October 20, 2022, 3:48am UTC](https://forum.keycloak.org/t/how-to-add-arbitrary-values-to-token-scope-attribute/18010 "2022-10-20T03:48:13Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![colmbrady](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/colmbrady/32/6838_2.png) [@colmbrady](https://forum.keycloak.org/u/colmbrady)\
**Post date:** [October 20, 2022, 3:48am UTC](https://forum.keycloak.org/t/how-to-add-arbitrary-values-to-token-scope-attribute/18010/1 "2022-10-20T03:48:13Z")

</div>

Hi,

Im looking into implementing a OIDC health care spec using Keycloak. The requirements of the spec suggest that I should be able to insert user permission scopes into the tokens “scope” attribute.

See the [Health Relationship Trust Profile for Fast Healthcare Interoperability Resources (FHIR) OAuth 2.0 Scopes](https://openid.net/specs/openid-heart-fhir-oauth2-1_0.html#rfc.section.5) for an example of a token response with the “scope” parameter including custom scopes. I want to insert permissions like these into the Keycloak Token response dynamically during an authentication workflow (e.g. Custom Auth Step), but am unsure of how to do so.

```auto
HTTP/1.1 200 OK
Date: Tue, 16 Dec 2014 03:00:14 GMT
Access-Control-Allow-Origin: *
Content-Type: application/json;charset=ISO-8859-1
Connection: close

{
   "access_token": "eyJhbGci...LWJu9grrA",
   "scope": "patient/*.* sens/ETH sens/PSY btg",
   "token_type": "Bearer",
   "aud": "https://resource.example.net/",
   "rec": "https://resource.example.net/patient/123141/"
}

```

I also notice there is code which seems to prevent using protocol mappers to map values into scope.

See code in OIDCAttributeMapperHelper.java #L131 (I cant link to it as Im a new discord user and can only include two links)

Ideally, I could interact with the ClientSessionContext and do something that influences the “scope” string? See below.

> <https://github.com/keycloak/keycloak/blob/25be07be17e0465500e475df41c96f35b1fb43ca/services/src/main/java/org/keycloak/protocol/oidc/TokenManager.java#L891>

Ive also reviewed this thread “how-to-add-value-to-the-jwt-tokens-scope-attribute/950” which seems like a last resort