# Need 'scope' claim in JWT

**URL:** https://discuss.pomerium.com/t/need-scope-claim-in-jwt/510
**Category:** Support
**Created:** [June 2, 2026, 1:30pm UTC](https://discuss.pomerium.com/t/need-scope-claim-in-jwt/510 "2026-06-02T13:30:34Z")
**Posts on this page:** 2
**Page:** 1

<div class="post-metadata">

### Author: ![dwatrous](https://yyz1.discourse-cdn.com/flex031/user_avatar/discuss.pomerium.com/dwatrous/32/189_2.png) [@dwatrous](https://discuss.pomerium.com/u/dwatrous)
#### Post date: [June 2, 2026, 1:30pm UTC](https://discuss.pomerium.com/t/need-scope-claim-in-jwt/510/1 "2026-06-02T13:30:34Z")

</div>

## What happened?

I’m using the pomerium JWT as a bearer token and configured snowflake to validate the JWT against the JWKS endpoint. Unfortunately snowflake requires a `scope` claim, and I can’t see a way to include that in the pomerium JWT.

## What did you expect to happen?

I expected to be able to add a custom claim to the pomerium JWT

## How’d it happen?

Can’t find any docs, forum posts or materials to support a custom clain

## What’s your environment like?

- Pomerium version (retrieve with `pomerium --version`): **v0.32.5**
- Server Operating System/Architecture/Cloud: GKE

## What’s your config.yaml?

```auto
    apiVersion: networking.k8s.io/v1                                                                                                                     
    kind: Ingress                                                                                                                                        
    metadata:                                                                                                                                            
      name: backstage                                                                                                                                    
      namespace: backstage                                                                                                                               
      annotations:                                                                                                                                       
        ingress.pomerium.io/policy: |                                                                                                                    
          allow:                                                                                                                                         
            and:                                                                                                                                         
              - domain:                                                                                                                                  
                  is: domain.com                                                                                                                        
        ingress.pomerium.io/pass_identity_headers: "true"                                                                                                
        ingress.pomerium.io/allow_websockets: "true"                                                                                                     
    ...                                                                                                                                                  
    spec:                                                                                                                                                
      ingressClassName: pomerium                                                                                                                         
      rules:                                                                                                                                             
        - host: portal.idp.domain.com                                                                                                                

```

## What did you see in the logs?

NA

## Additional context

NA

---

<div class="post-metadata">

### Author: ![kjenkins](https://avatars.discourse-cdn.com/v4/letter/k/54ee81/32.png) [@kjenkins](https://discuss.pomerium.com/u/kjenkins)
#### Post date: [June 3, 2026, 10:26pm UTC](https://discuss.pomerium.com/t/need-scope-claim-in-jwt/510/2 "2026-06-03T22:26:49Z")

</div>

Hi @dwatrous,

I’m unfamiliar with Snowflake — is there any public Snowflake documentation that would help me understand the requirement for a ‘scope’ claim?

I believe Pomerium currently has only limited support for customizing the Pomerium JWT. Specifically, any claims included in the [JWT Claim Headers](https://www.pomerium.com/docs/reference/jwt-claim-headers) option will additionally be copied from the IdP user info into the Pomerium JWT. So, if you’re able to configure your IdP to populate a ‘scope’ claim with the value you need, that might be an option. As for setting a completely custom claim directly in Pomerium, I believe this is not currently supported.

Thanks,  
Ken