Overview

Flask-JWT-Extended 4.4, released on April 1, 2022, adds support for additional claims in JWT tokens.

Main Features

Additional claims

Additional claims allow including custom data in JWT tokens, such as user roles and permissions.

python 
from flask import Flask
from flask_jwt_extended import (
    JWTManager, create_access_token, get_jwt
)

app = Flask(__name__)
app.config['JWT_SECRET_KEY'] = 'secret'
jwt = JWTManager(app)

# Token with additional claims
token = create_access_token(
    identity='alice',
    additional_claims={'role': 'admin', 'dept': 'IT'},
)

Claims verification

Claims can be verified in protected routes to implement role-based access control.

python 
from flask_jwt_extended import jwt_required, get_jwt

@app.route('/admin')
@jwt_required()
def admin_page():
    claims = get_jwt()
    if claims.get('role') != 'admin':
        return {'error': 'Access denied'}, 403
    return {'message': 'Welcome admin'}

Sources