How to get JWT token with roles inside scope with service account?

Original message was deleted

Rajat Singh•3/3/25, 11:30 AM

Hi @Porphyrion can I see your curl request?. Are you sending scope as urn:zitadel:iam:org:project:rolesurn:zitadel:iam:org:project:roles?.
Can you trying this scope urn:zitadel:iam:org:project:{projectid}:rolesurn:zitadel:iam:org:project:{projectid}:roles. The scope I mentioned has been described here

urn:zitadel:iam:org:project:{projectid}:rolesurn:zitadel:iam:org:project:{projectid}:roles

This adds the project to the token’s aud (audience) claim, ensuring Zitadel includes roles for that specific project.
lmk if this helps

Rajat Singh•3/4/25, 9:25 AM

Hi @linwalth I will check this with my team

Rajat Singh•3/4/25, 9:28 AM

may I know what do you mean by newer service account here?. When was the old one was created and when did you create this "new" service account

Rajat Singh•3/6/25, 9:55 AM

hi @Porphyrion it could be that service account behaviour might have changed over the span of two years, but with Access Token Type Bearer, there should have been no problem, were you still running into this issue or were you able to resolve it with the new service account that you created?.

Rajat Singh•3/6/25, 10:46 AM

Nice!
Perfect!

JJeff @Rajat Singh like @Porphyrion said the missing claims are now included in the ID...

Rajat Singh•3/17/25, 7:19 AM

hi @Jeff I'd suggest you to open a new question on the channel
questions-help-bugs(🏁 Start here - READ ME!) Forum post template & resources for me to look at, also , please mention the curl request that you used to make the request tht generated you ID token, this should not happen based on what you described but a better detailed description of the probem will help me to understand

thanks