Custom
Custom clients are the OIDC baseline provider: when the scope includes openid, the token response includes an id_token, and every step follows the standard flow described in OAuth Flow. Use custom with your own provider label to impersonate any provider the predefined types don’t cover — the label is the branding shown above the client name on the consent screen (see Clients & Identities).
Custom claims
Section titled “Custom claims”Custom clients are the only provider type that supports the identity claims map. Create and update requests that set claims on a google, github, apple, or facebook client are rejected with a 400 — mirroring reality, where you cannot inject arbitrary claims into a Google- or Apple-issued token.
On a custom client, the claims (e.g. { "roles": "admin", "tenant": "acme" }) are merged into every ID token and userinfo response for that identity, so you can test role- or tenant-based authorization in your app. Standard claims cannot be overridden — claim names that collide with the standard set (iss, sub, aud, exp, iat, nbf, jti, email, email_verified, name, preferred_username, picture, nonce, at_hash) are rejected with a 400 at create/update time. See Clients & Identities.
Token response
Section titled “Token response”The token response returns token_type: "Bearer" and includes expires_in (3600). The code is exchanged with a form-encoded POST to the token endpoint.
Fetching the user profile
Section titled “Fetching the user profile”Custom clients serve the standard /oauth/userinfo endpoint — call it with the access token as a Bearer token. The identity’s custom claims appear alongside the standard profile fields.
PKCE (S256) is optional for custom clients.