getAuth() function does not return organizationId, role, etc

[P-Essonam]

[nicknisi]

Thanks for reporting this! I investigated and was unable to reproduce — getAuth() does return organizationId, role, roles, permissions, and other org-scoped fields when they're present in the session.

These fields are populated from the JWT claims in your access token. They'll only have values when your session has an active organization context. Common reasons they'd be undefined:

• No organization selected — If you authenticate without specifying an organizationId, the JWT won't contain org-scoped claims. You need to either:
  • Pass organizationId when generating the auth URL: getSignInUrl({ data: { organizationId: 'org_...' } })
  • Call switchToOrganization('org_...') after login (available from useAuth())
• No roles/permissions configured — Even with an org selected, role and permissions will be empty unless you've configured roles in the WorkOS dashboard and assigned them to the user for that organization.

If you do have organizations configured and are still not seeing these fields, could you share:

1. How you're authenticating (are you passing an organizationId?)
2. The result of await getAuth() in your loader (with sensitive fields redacted)?

That would help narrow down the issue.

[P-Essonam]

[image: {FB2AC5EE-6A19-4DF5-B15B-3C2A911088A1}.png] Yes you're right, it returns the values. I tried to extract them directly and noticed they are not type safe, so I thought they don't exist at all. Thank you for your quick response and I think you should update the readme file to make it clear. Thank you again and have a great day!

…

On Fri, Apr 3, 2026 at 7:50 PM Nick Nisi ***@***.***> wrote: *nicknisi* left a comment (workos/authkit-tanstack-start#62) <#62 (comment)> Thanks for reporting this! I investigated and was unable to reproduce — getAuth() does return organizationId, role, roles, permissions, and other org-scoped fields when they're present in the session. These fields are populated from the JWT claims in your access token. They'll only have values when your session has an active organization context. Common reasons they'd be undefined: - *No organization selected* — If you authenticate without specifying an organizationId, the JWT won't contain org-scoped claims. You need to either: - Pass organizationId when generating the auth URL: getSignInUrl({ data: { organizationId: 'org_...' } }) - Call switchToOrganization('org_...') after login (available from useAuth()) - *No roles/permissions configured* — Even with an org selected, role and permissions will be empty unless you've configured roles in the WorkOS dashboard and assigned them to the user for that organization. If you do have organizations configured and are still not seeing these fields, could you share: 1. How you're authenticating (are you passing an organizationId?) 2. The result of await getAuth() in your loader (with sensitive fields redacted)? That would help narrow down the issue. capture_20260403_134636.png (view on web) <https://github.com/user-attachments/assets/b8bc51f1-614f-488b-b64d-fff08fd86493> — Reply to this email directly, view it on GitHub <#62?email_source=notifications&email_token=BDV45LA75EMQOXAPR6SNDNL4UABWRA5CNFSNUABFM5UWIORPF5TWS5BNNB2WEL2JONZXKZKDN5WW2ZLOOQXTIMJYGQ3TGNZQHEZKM4TFMFZW63VGMF2XI2DPOKSWK5TFNZ2KYZTPN52GK4S7MNWGSY3L#issuecomment-4184737092>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/BDV45LGP37FCWSYJR533E5L4UABWRAVCNFSM6AAAAACXL5NYMKVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHM2DCOBUG4ZTOMBZGI> . You are receiving this because you authored the thread.Message ID: ***@***.***>