How to fix auth/reserved-claims: Custom claims use reserved OIDC claim names in Firebase

const admin = require('firebase-admin');

admin.auth().setCustomUserClaims(uid, {
  role: 'admin',
  aud: 'my-app'  // ❌ 'aud' is a reserved OIDC claim
})
.catch(error => console.log(error.message)); // auth/reserved-claims

const admin = require('firebase-admin');

admin.auth().setCustomUserClaims(uid, {
  role: 'admin',
  // ✅ 'aud' removed - audience is handled by Firebase
})
.then(() => console.log('Custom claims set'))
.catch(error => console.log(error));

const admin = require('firebase-admin');

// Instead of 'iat' (issued at), use 'assigned_at'
// Instead of 'exp' (expires), use 'token_expires_at'

admin.auth().setCustomUserClaims(uid, {
  role: 'admin',
  permissions: ['read', 'write', 'delete'],
  assigned_at: new Date().toISOString(),
  token_expires_at: new Date(Date.now() + 7 * 24 * 60 * 60 * 1000).toISOString(),
})
.then(() => console.log('Custom claims set'))
.catch(error => console.log(error));

const admin = require('firebase-admin');

const customClaims = {
  role: 'admin',
  permissions: ['read', 'write', 'delete'],
  department: 'engineering',
  level: 5,
};

// Check size (rough estimate - Firebase uses exact JSON serialization)
const size = JSON.stringify(customClaims).length;
console.log(`Claims size: ${size} bytes`); // Should be < 1000

if (size > 1000) {
  console.warn('Custom claims exceed 1000 bytes!');
} else {
  admin.auth().setCustomUserClaims(uid, customClaims)
    .then(() => console.log('Custom claims set successfully'))
    .catch(error => console.error('Error:', error));
}

// Client-side (Web SDK)
import { getAuth } from 'firebase/auth';

const auth = getAuth();
const currentUser = auth.currentUser;

if (currentUser) {
  // Force refresh to get updated claims in token
  currentUser.getIdToken(true)
    .then(idToken => {
      console.log('Token refreshed with new claims');
      // Use the new token for API calls
    })
    .catch(error => console.error('Failed to refresh token:', error));
}

// iOS
let user = Auth.auth().currentUser
user?.getIDTokenForcingRefresh(true) { idToken, error in
  if let error = error {
    print("Error refreshing token:", error)
    return
  }
  print("Token refreshed with new claims")
}

// Android
FirebaseAuth mAuth = FirebaseAuth.getInstance();
FirebaseUser user = mAuth.getCurrentUser();

user.getIdToken(true)
  .addOnCompleteListener(task -> {
    if (task.isSuccessful()) {
      String idToken = task.getResult().getToken();
      Log.d("Auth", "Token refreshed with new claims");
    } else {
      Log.e("Auth", "Error refreshing token", task.getException());
    }
  });