# Lambdas

An overview of FusionAuth's lambdas, which are pluggable JavaScript code that run at various points in the user lifecycle.

> For the index of this section of the site, see [llms.txt](https://4002.18-224-161-104.sslip.io/docs/llms.txt)

In FusionAuth, a lambda is a JavaScript function that can augment or modify behavior during authentication or authorization. For example, the following lambda adds additional claims to a JWT:

```javascript
function populate(jwt, user, registration) {
  jwt.favoriteColor = user.data.favoriteColor;
  jwt.applicationBackgroundColor = registration.data.backgroundColor;
}
```

FusionAuth uses lambdas to react to events as well as to customize tokens and messages such as JWTs or SAML responses. You can also invoke your own lambdas to further customize behavior.

Lambdas do not have full access to JavaScript modules and libraries. They also cannot import, require or load other libraries. This page explains the objects and methods that FusionAuth provides access to.

This brief video provides an overview of lambdas:

[Play](https://youtube.com/watch?v=aKIWILh3qxM)

## Console

The `console` object creates entries in the Event Log during a lambda invocation. Unlike the browser `console` object, lambda `console` methods only accept one argument.

The `console` object provides the following log methods:

*   `info()` - Create an event log of type Information
*   `log()` - alias to the `info` method
*   `error()` - Create an event log of type Error
*   `debug()` - Create an event log of type Debug *only when the Lambda has debugging enabled*
    
    Caution
    
    Debug messages only appear in the Event Log when you have enabled **Debug** in your lambda configuration.
    

Messages accumulate during lambda invocation, creating a maximum of one event log of each type. For instance, multiple requests to `console.info` in the lambda function body results in a single event log of type Information that combines all of the request contents.

To see object data in the Event Log, stringify objects with `JSON.stringify(<object>)`:

```javascript
function populate(jwt, user, registration) {
  //...
  console.log(user); // doesn't log any data other than the fact a user is an object. Probably not what you want.
  console.log(JSON.stringify(user)); // outputs all the properties of the user object.
  console.log(JSON.stringify(user, null, ' ')); // pretty prints the user object.
  //...
}
```

## HTTP Connect

> **PLAN:** This feature requires [at least an Essentials plan](https://4002.18-224-161-104.sslip.io/docs/get-started/core-concepts/plans-features.md#essentials-features).

Lambda HTTP Connect makes HTTP requests from within a lambda.

For instance, the following lambda adds additional claims to a JWT based on an HTTP request:

```javascript
function populate(jwt, user, registration) {
  var response = fetch("https://api.example.com/api/status?" + user.id, {
    method: "GET",
    headers: {
      "Content-Type": "application/json"
    }
  });

  if (response.status === 200) {
    // assuming successful response looks like:
    // {"status":"statusValue"}
    var jsonResponse = JSON.parse(response.body);
    jwt.status = jsonResponse.status;
  } else {
    jwt.status = "basic";
  }
}
```

For more information, see the [Lambda HTTP Connect documentation](https://4002.18-224-161-104.sslip.io/docs/extend/code/lambdas/lambda-remote-api-calls.md).

## Secrets

Available since `1.64.0`

Lambda secrets help you securely store secret values used in lambdas, like API keys and application passwords.

1.  In the Admin UI, visit Settings -> Key Master .
2.  From the dropdown in the upper right, select Import secret .
3.  Specify a unique **secret name**, which you will use to access your secret from a lambda.
4.  Specify your **secret value**.

To access secrets, use the `context` parameter. Pass a secret **name** to `context.services.secrets.get('<key>')` to retrieve the corresponding secret **value** as a string:

```javascript
function populate(jwt, user, registration, context) {
  var apiKey = context.services.secrets.get('<secret-name>');

  var response = fetch("https://api.example.org/api/status?" + user.id, {
    method: "GET",
    headers: {
      "content-type": "application/x-www-form-urlencoded"
      "authorization": "Basic " + apiKey
    }
  });

  if (response.status === 200) {
    var jsonResponse = JSON.parse(response.body);
    console.log('response: ' + jsonResponse);
    jwt.status = jsonResponse.status;
  } else {
    console.warn('failed request: ' + response.status);
    jwt.status = "basic";
  }
}
```

## Exceptions

Throwing an exception in a lambda has the following effect:

*   writes an event log entry
*   exits the lambda code path

The impact on the user experience depends on the type of lambda. For example, for a JWT populate lambda, the JWT will not be modified. For a reconcile lambda, the user will not be created or linked.

Don't use exceptions for flow control; reserve them for *exceptional* situations.

To view exception details, enable debugging on the lambda via the Enable debug logging toggle in the administrative user interface or the API.

## Managing Lambdas

Use the [FusionAuth APIs](https://4002.18-224-161-104.sslip.io/docs/apis/lambdas.md), [client libraries](https://4002.18-224-161-104.sslip.io/docs/sdks.md) or [the CLI tool](https://4002.18-224-161-104.sslip.io/docs/operate/cli.md) to manage lambdas.

Always [test your lambdas](https://4002.18-224-161-104.sslip.io/docs/extend/code/lambdas/testing.md) and use version control to track changes to lambdas. They are part of your authentication and authorization logic.

## Engine

### GraalJS

GraalJS is built on top of the Java virtual machine. For security reasons, FusionAuth restricts access to various GraalJS features within lambdas.

The GraalJS Engine [supports ECMAScript 2021](https://www.graalvm.org/22.0/reference-manual/js/JavaScriptCompatibility/).

For more information, see the [GraalJS engine documentation](https://www.graalvm.org/latest/reference-manual/js/).

This engine has been available since FusionAuth version `1.35.0`.

## Lambda Types

Lambdas are typed according to their intended purpose. Different lambda types have different signatures.

FusionAuth currently supports the following lambdas; for examples and details, see the linked documentation pages:

*   [Apple Reconcile](https://4002.18-224-161-104.sslip.io/docs/extend/code/lambdas/reconcile/apple-reconcile.md)
*   [CIMD Client Registration](https://4002.18-224-161-104.sslip.io/docs/extend/code/lambdas/cimd-client-registration.md)
*   [Client Credentials JWT Populate](https://4002.18-224-161-104.sslip.io/docs/extend/code/lambdas/client-credentials-jwt-populate.md)
*   [Epic Games Reconcile](https://4002.18-224-161-104.sslip.io/docs/extend/code/lambdas/reconcile/epic-games-reconcile.md)
*   [External JWT Reconcile](https://4002.18-224-161-104.sslip.io/docs/extend/code/lambdas/reconcile/external-jwt-reconcile.md)
*   [Facebook Reconcile](https://4002.18-224-161-104.sslip.io/docs/extend/code/lambdas/reconcile/facebook-reconcile.md)
*   [Google Reconcile](https://4002.18-224-161-104.sslip.io/docs/extend/code/lambdas/reconcile/google-reconcile.md)
*   [HYPR Reconcile](https://4002.18-224-161-104.sslip.io/docs/extend/code/lambdas/reconcile/hypr-reconcile.md)
*   [JWT Populate](https://4002.18-224-161-104.sslip.io/docs/extend/code/lambdas/jwt-populate.md)
*   [LDAP Connector Reconcile](https://4002.18-224-161-104.sslip.io/docs/extend/code/lambdas/reconcile/ldap-connector-reconcile.md)
*   [LinkedIn Reconcile](https://4002.18-224-161-104.sslip.io/docs/extend/code/lambdas/reconcile/linkedin-reconcile.md)
*   [Login Validation](https://4002.18-224-161-104.sslip.io/docs/extend/code/lambdas/login-validation.md)
*   [MFA Requirement](https://4002.18-224-161-104.sslip.io/docs/extend/code/lambdas/mfa-requirement.md)
*   [Nintendo Reconcile](https://4002.18-224-161-104.sslip.io/docs/extend/code/lambdas/reconcile/nintendo-reconcile.md)
*   [OpenID Connect Reconcile](https://4002.18-224-161-104.sslip.io/docs/extend/code/lambdas/reconcile/openid-connect-response-reconcile.md)
*   [SAML v2 Populate](https://4002.18-224-161-104.sslip.io/docs/extend/code/lambdas/samlv2-response-populate.md)
*   [SAML v2 Reconcile](https://4002.18-224-161-104.sslip.io/docs/extend/code/lambdas/reconcile/samlv2-response-reconcile.md)
*   [SCIM Group Req. Converter](https://4002.18-224-161-104.sslip.io/docs/extend/code/lambdas/scim-group-request-converter.md)
*   [SCIM Group Resp. Convtr.](https://4002.18-224-161-104.sslip.io/docs/extend/code/lambdas/scim-group-response-converter.md)
*   [SCIM User Req. Converter](https://4002.18-224-161-104.sslip.io/docs/extend/code/lambdas/scim-user-request-converter.md)
*   [SCIM User Resp. Converter](https://4002.18-224-161-104.sslip.io/docs/extend/code/lambdas/scim-user-response-converter.md)
*   [Self-Service Registration](https://4002.18-224-161-104.sslip.io/docs/extend/code/lambdas/self-service-registration.md)
*   [Sony PSN Reconcile](https://4002.18-224-161-104.sslip.io/docs/extend/code/lambdas/reconcile/sony-playstation-network-reconcile.md)
*   [Steam Reconcile](https://4002.18-224-161-104.sslip.io/docs/extend/code/lambdas/reconcile/steam-reconcile.md)
*   [Twitch Reconcile](https://4002.18-224-161-104.sslip.io/docs/extend/code/lambdas/reconcile/twitch-reconcile.md)
*   [Twitter Reconcile](https://4002.18-224-161-104.sslip.io/docs/extend/code/lambdas/reconcile/twitter-reconcile.md)
*   [UserInfo Populate](https://4002.18-224-161-104.sslip.io/docs/extend/code/lambdas/userinfo-populate.md)
*   [Xbox Reconcile](https://4002.18-224-161-104.sslip.io/docs/extend/code/lambdas/reconcile/xbox-reconcile.md)

Related

[Extend JWT Populate Lambda An overview of the JWT populate lambda. custom claimsfusionauth lambdajavascript](https://4002.18-224-161-104.sslip.io/docs/extend/code/lambdas/jwt-populate.md)

[APIs Create a Lambda API API documentation for the FusionAuth Create a Lambda API. custom codereconcile lambdajwt populate](https://4002.18-224-161-104.sslip.io/docs/apis/lambdas/create-a-lambda.md)

[APIs Delete a Lambda API API documentation for the FusionAuth Delete a Lambda API. custom codereconcile lambdajwt populate](https://4002.18-224-161-104.sslip.io/docs/apis/lambdas/delete-a-lambda.md)

[APIs Lambda API Learn about the APIs for creating, retrieving, updating and deleting lambdas. custom codereconcile lambdajwt populate](https://4002.18-224-161-104.sslip.io/docs/apis/lambdas.md)
---

## Other pages in Code

> For the full index of this section, see [Extend](https://4002.18-224-161-104.sslip.io/docs/llms-extend.txt).

- [CIMD Client Registration Lambda](https://4002.18-224-161-104.sslip.io/docs/extend/code/lambdas/cimd-client-registration.md): An overview of the CIMD client registration lambda.
- [Client Credentials JWT Populate Lambda](https://4002.18-224-161-104.sslip.io/docs/extend/code/lambdas/client-credentials-jwt-populate.md): An overview of the Client Credentials JWT Populate lambda.
- [JWT Populate Lambda](https://4002.18-224-161-104.sslip.io/docs/extend/code/lambdas/jwt-populate.md): An overview of the JWT populate lambda.
- [Call an API from a Lambda](https://4002.18-224-161-104.sslip.io/docs/extend/code/lambdas/lambda-remote-api-calls.md): An overview of how to make API calls from Lambdas.
- [Login Validation Lambda](https://4002.18-224-161-104.sslip.io/docs/extend/code/lambdas/login-validation.md): An overview of the login validation lambda.
- [MFA Requirement Lambda](https://4002.18-224-161-104.sslip.io/docs/extend/code/lambdas/mfa-requirement.md): An overview of the MFA requirement lambda.
- [Apple Reconcile Lambda](https://4002.18-224-161-104.sslip.io/docs/extend/code/lambdas/reconcile/apple-reconcile.md): An overview of the Apple Reconcile lambda.
- [Epic Games Reconcile Lambda](https://4002.18-224-161-104.sslip.io/docs/extend/code/lambdas/reconcile/epic-games-reconcile.md): An overview of the Epic Games Reconcile lambda.
- [External JWT Reconcile Lambda](https://4002.18-224-161-104.sslip.io/docs/extend/code/lambdas/reconcile/external-jwt-reconcile.md): An overview of the External JWT Reconcile lambda.
- [Facebook Reconcile Lambda](https://4002.18-224-161-104.sslip.io/docs/extend/code/lambdas/reconcile/facebook-reconcile.md): An overview of the Facebook Reconcile lambda.
- [Google Reconcile Lambda](https://4002.18-224-161-104.sslip.io/docs/extend/code/lambdas/reconcile/google-reconcile.md): An overview of the Google Reconcile lambda.
- [HYPR Reconcile Lambda](https://4002.18-224-161-104.sslip.io/docs/extend/code/lambdas/reconcile/hypr-reconcile.md): An overview of the HYPR Reconcile lambda.
- [LDAP Connector Reconcile Lambda](https://4002.18-224-161-104.sslip.io/docs/extend/code/lambdas/reconcile/ldap-connector-reconcile.md): An overview of the LDAP Connector Reconcile lambda.
- [LinkedIn Reconcile Lambda](https://4002.18-224-161-104.sslip.io/docs/extend/code/lambdas/reconcile/linkedin-reconcile.md): An overview of the LinkedIn Reconcile lambda.
- [Nintendo Reconcile Lambda](https://4002.18-224-161-104.sslip.io/docs/extend/code/lambdas/reconcile/nintendo-reconcile.md): An overview of the Nintendo Reconcile lambda.
- [OpenID Connect Reconcile Lambda](https://4002.18-224-161-104.sslip.io/docs/extend/code/lambdas/reconcile/openid-connect-response-reconcile.md): An overview of the OpenID Connect Response Reconcile lambda.
- [SAML v2 Reconcile Lambda](https://4002.18-224-161-104.sslip.io/docs/extend/code/lambdas/reconcile/samlv2-response-reconcile.md): An overview of the SAML v2 Response Reconcile lambda.
- [Sony PlayStation Network Reconcile Lambda](https://4002.18-224-161-104.sslip.io/docs/extend/code/lambdas/reconcile/sony-playstation-network-reconcile.md): An overview of the Sony PlayStation Network Reconcile lambda.
- [Steam Reconcile Lambda](https://4002.18-224-161-104.sslip.io/docs/extend/code/lambdas/reconcile/steam-reconcile.md): An overview of the Steam Reconcile lambda.
- [Twitch Reconcile Lambda](https://4002.18-224-161-104.sslip.io/docs/extend/code/lambdas/reconcile/twitch-reconcile.md): An overview of the Twitch Reconcile lambda.
- [Twitter Reconcile Lambda](https://4002.18-224-161-104.sslip.io/docs/extend/code/lambdas/reconcile/twitter-reconcile.md): An overview of the Twitter Reconcile lambda.
- [Xbox Reconcile Lambda](https://4002.18-224-161-104.sslip.io/docs/extend/code/lambdas/reconcile/xbox-reconcile.md): An overview of the Xbox Reconcile lambda.
- [SAML v2 Populate Lambda](https://4002.18-224-161-104.sslip.io/docs/extend/code/lambdas/samlv2-response-populate.md): An overview of the SAML v2 populate lambda.
- [SCIM Group Request Converter Lambda](https://4002.18-224-161-104.sslip.io/docs/extend/code/lambdas/scim-group-request-converter.md): An overview of the SCIM Group Request Converter lambda.
- [SCIM Group Response Converter Lambda](https://4002.18-224-161-104.sslip.io/docs/extend/code/lambdas/scim-group-response-converter.md): An overview of the SCIM Group Response Converter lambda.
- [SCIM User Request Converter Lambda](https://4002.18-224-161-104.sslip.io/docs/extend/code/lambdas/scim-user-request-converter.md): An overview of the SCIM User Request Converter lambda.
- [SCIM User Response Converter Lambda](https://4002.18-224-161-104.sslip.io/docs/extend/code/lambdas/scim-user-response-converter.md): An overview of the SCIM User Response Converter lambda.
- [Self-Service Registration Validation Lambda](https://4002.18-224-161-104.sslip.io/docs/extend/code/lambdas/self-service-registration.md): An overview of the Self-Service Registration Validation lambda.
- [Test Lambdas](https://4002.18-224-161-104.sslip.io/docs/extend/code/lambdas/testing.md): A guide on how to create and test lambdas with FusionAuth.
- [UserInfo Populate Lambda](https://4002.18-224-161-104.sslip.io/docs/extend/code/lambdas/userinfo-populate.md): An overview of the UserInfo populate lambda.
- [Custom Password Hashing](https://4002.18-224-161-104.sslip.io/docs/extend/code/password-hashes/custom-password-hashing.md): Learn how to write a FusionAuth plugin to implement a custom password hashing algorithm (also referred to a password encryptors).
- [Plugins](https://4002.18-224-161-104.sslip.io/docs/extend/code/password-hashes.md): Extend the functionality of FusionAuth with plugins.
- [Writing a Plugin](https://4002.18-224-161-104.sslip.io/docs/extend/code/password-hashes/writing-a-plugin.md): Learn how to write a FusionAuth plugin.