diff --git a/docs/auth.rst b/docs/auth.rst index 867339cbc..94e449db5 100644 --- a/docs/auth.rst +++ b/docs/auth.rst @@ -93,9 +93,18 @@ Alternately database roles can represent groups instead of (or in addition to) i SQL code can access claims through GUC variables set by PostgREST per request. For instance to get the email claim, call this function: +For PostgreSQL server version >= 14 + .. code:: sql current_setting('request.jwt.claims', true)::json->>'email'; + + +For PostgreSQL server version < 14 + +.. code:: sql + + current_setting('request.jwt.claim.email', true); This allows JWT generation services to include extra information and your database code to react to it. For instance the RLS example could be modified to use this current_setting rather than current_user. The second 'true' argument tells current_setting to return NULL if the setting is missing from the current configuration.