Hi, I enabled "Exclude permissions claim" on our Access Key JWT template and saved it. The preview correctly shows no permissions field, but newly generated tokens still include permissions in the tenants claim. What could be causing this?

Template Configuration Issue The "Exclude permissions claim" setting affects the Authorization Claims Configuration, but there are a few potential causes for this behavior. Troubleshooting Steps 1. Verify the template is set as the project's default Access Key JWT template Navigate to Project Settings > JWT Templates and confirm your modified template is selected as the default for Access Key tokens . 2. Check the Authorization Claims Configuration setting The "Exclude permissions claim" option works in conjunction with the Authorization Claims Configuration. If you have "Default Descope JWT" selected, permissions will still appear in tenant objects. Try switching to "No Descope Claims" to completely exclude authorization claims . 3. Generate a fresh token Clear any cached tokens and generate a new Access Key token to ensure you're testing with the updated template configuration. • Note: The preview shows the expected output, but actual tokens may still use cached configurations until refreshed • Note: JWT templates for Access Keys have the same Authorization Claims Configuration options as User JWT Templates JWT Templates | Descope Documentation

It might be a bug. I enable this with the 'Default Descope JWT' -> and the permissions stayed. but when I switched to 'Current tenant, no tenant reference' with enabling "Exclude permissions claim"-> the permissions was gone. switched back to 'Default Descope JWT' -> the permissions came back again.

Confirmed Bug with Default Descope JWT You've identified a bug in the JWT template configuration. The "Exclude permissions claim" setting should work consistently across all Authorization Claims Configuration options, but it's not functioning properly with "Default Descope JWT". Current Workaround Use "Current Tenant, No Tenant Reference" with "Exclude permissions claim" enabled. This configuration: • Removes the

tenants

claim structure • Places tenant-specific roles in the root level (if needed) • Successfully excludes permissions when the setting is enabled Expected vs Actual Behavior • Expected: "Exclude permissions claim" should remove permissions from both root-level and tenant objects regardless of the Authorization Claims Configuration • Actual: The setting only works with "Current Tenant, No Tenant Reference" but is ignored with "Default Descope JWT" This appears to be a template processing bug where the "Default Descope JWT" configuration doesn't properly respect the exclude permissions setting . I'd recommend reporting this to Descope support as it's inconsistent behavior that should be fixed. For now, the "Current Tenant, No Tenant Reference" option provides the functionality you need. JWT Templates | Descope Documentation

Could you share a screenshot or a video of the bug We'll investigate an raise a bug if needed For enabling newly generated tokens to have the updated format you need to select the template in Project settings -> Session Management

yap I did that, i'll send a video one sec

@Omer Vishnia I have investigated the issue and the "Exclude permissions claim" is behaving as expected I can't see any issue there. Could please give some brief on how you are testing this right now ?

i wrote what I did in the first comment of the thread, anything else that you need to debug this?

Yes, I have debugged the issue and its working fine. So, just a quick question from where you are pulling out the JWT generated by the access Key ? Are you using this API - https://api.descope.com/v1/auth/accesskey/exchange

sorry for the delay, we are using the Go SDK, and using the 'ExchangeAccessKey' method of the DescopeClient struct.

Hey @Omer Vishnia After investigating, I can confirm this is a bug with how "Exclude permissions claim" interacts with the Default Descope JWT configuration. The "Exclude permissions claim" toggle currently only strips permissions from the root level of the JWT. With Default Descope JWT, permissions are nested inside the

tenants.{tenantId}.permissions

object and the exclude toggle doesn't reach in there. With Current Tenant, No Tenant Reference, claims are flattened to the root, which is why the toggle works correctly there. For now you can use this as a workaround - Use "Current Tenant, No Tenant Reference" + "Exclude permissions claim" enabled as your JWT template configuration. This will correctly exclude permissions from the token. Just note that this changes the JWT structure slightly — tenant-specific roles will appear at the root level (alongside a

dct

claim identifying the tenant) rather than inside a nested

tenants

object. As long as your backend can accommodate that, you're good to go.

That's sound good enough for me, thanks for the quick response 🙏

Hi @Omer Vishnia Just wanted to update you on the issue that you raised earlier - "Exclude permissions claim" was not working with the Default Descope JWT. Has been fixed now!!!

thankss!