To create a token hook in Ory, you can use the Ory CLI with the following keys:

bash ory patch oauth2-config {project.id} \    --add '/oauth2/token_hook="<https://my-example.app/token-hook>"' \    --format yaml

This command enables the generic token hook. The

{project.id}

should be replaced with your project's ID and

"<https://my-example.app/token-hook>"

should be replaced with your token hook endpoint. The token hook endpoint must accept the following payload format:

json {    "session": {    "id_token": {    "id_token_claims": {    "jti": "",    "iss": "<http://localhost:4444/>",    "sub": "subject",    "aud": ["app-client"],    "nonce": "",    "at_hash": "",    "acr": "1",    "amr": null,    "c_hash": "",    "ext": {}    },    "headers": {    "extra": {}    },    "username": "",    "subject": "foo"    },    "extra": {},    "client_id": "app-client",    "consent_challenge": "",    "exclude_not_before_claim": false,    "allowed_top_level_claims": []    },    "request": {    "client_id": "app-client",    "granted_scopes": ["offline", "openid", "hydra.*"],    "granted_audience": [],    "grant_types": ["authorization_code"],    "payload": {}    }   }

The webhook supports API key authentication. You can configure whether the API key is sent as a cookie or in a header, and the cookie/header name:

bash ory patch oauth2-config {project.id} \    --add '/oauth2/token_hook/url="<https://my-example.app/token-hook>"' \    --add '/oauth2/token_hook/auth/type="api_key"' \    --add '/oauth2/token_hook/auth/config/in="header"' `# or cookie` \    --add '/oauth2/token_hook/auth/config/name="X-API-Key"' \    --add '/oauth2/token_hook/auth/config/value="MY API KEY"' \    --format yaml

In this command, replace

{project.id}

with your project's ID,

"<https://my-example.app/token-hook>"

with your token hook endpoint, and

"MY API KEY"

with your API key. For more information, you can refer to the [Ory documentation](https://www.ory.sh/docs/hydra/guides/claims-at-refresh) and [Ory API reference](https://www.ory.sh/docs/reference/api).