aam_jwt_claims_filter no longer works as expected

Hi AAM team,

First of all, thank you for a great plugin. I’ve been successfully using AAM up through version 6.9.51 in a project that requires JWT authentication and extended token payloads.

Specifically, I’m using the documented filter aam_jwt_claims_filter to include additional custom key/value pairs in the JWT token issued by AAM. This has worked perfectly until version 7.0.

Here’s a simplified version of my working code (still in use with AAM 6.9.51):

function cci_aam_extend_jwt_claims($claims)
{
    if (!isset($claims['userId'])) {
        return $claims;
    }

    $family_id = cci_get_user_family_id($claims['userId']);

    if ($family_id) {
        return array_merge($claims, [
            'house'           => cci_get_apartment_number($family_id) ?? '',
            'apartment_id'    => cci_get_apartment_id($family_id) ?? '',
            'family_id'       => $family_id,
            'customer_number' => cci_family_customer_number($family_id) ?? '',
        ]);
    }

    return $claims;
}

add_filter('aam_jwt_claims_filter', 'cci_aam_extend_jwt_claims');

When using AAM version 6.9.51, all of these claims (house, apartment_id, family_id, customer_number) are properly included in the generated JWT.

However, after upgrading to AAM 7.0 or later, the filter is still called, and my custom claims are correctly added to the $claims array — but they no longer appear in the final JWT token payload. Only the default claims such as user_id, iat, exp, and iss remain.

I’ve reviewed the plugin code and noticed that in newer versions, the token payload is filtered through a filterClaims() method (possibly inside JWTService), which appears to whitelist only specific keys. This internal filtering seems to override or discard custom claims added via the aam_jwt_claims_filter — even though your documentation still states that custom claims will be included.

Can you please clarify:

1. Is this change in behavior intentional?
2. Is there an officially supported way to include custom claims again in AAM 7+?
3. If so, is aam.jwt.claims.whitelist still supported (and if yes, how should it be used)?

I’d prefer not to fork the plugin or create my own JWT issuing logic if it can be avoided.

Thanks again for your work — I’m hoping for a clarification or a roadmap item that might help plugin developers like myself continue to use AAM’s JWT support with custom claims.

Best regards,
Torben