diff --git a/lib/types/UserClaims.ts b/lib/types/UserClaims.ts
index a87b4ad4a..8d2d1852b 100644
--- a/lib/types/UserClaims.ts
+++ b/lib/types/UserClaims.ts
@@ -18,7 +18,7 @@
  */
 
  /* eslint-disable camelcase */
-export interface UserClaims {
+export type UserClaims<T = {}> = T & {
   auth_time?: number;
   aud?: string;
   email?: string;
@@ -37,5 +37,5 @@ export interface UserClaims {
   updated_at?: number;
   ver?: number;
   zoneinfo?: string;
-  [propName: string]: any;  // For custom claims that may be configured by the org admin
+  at_hash?: string;
 }
\ No newline at end of file
diff --git a/test/apps/app/src/tokens.ts b/test/apps/app/src/tokens.ts
index 96d0db47c..72b74a020 100644
--- a/test/apps/app/src/tokens.ts
+++ b/test/apps/app/src/tokens.ts
@@ -26,7 +26,7 @@ function tokensHTML(tokens: Tokens): string {
     </thead>
     <tbody>
     ${
-      Object.keys(claims).map((key) => {
+      Object.keys(claims).map((key: keyof UserClaims) => {
         return `<tr><td>${key}</td><td>${claims[key]}</td></tr>`;
       }).join('\n')
     }
diff --git a/test/types/auth.test-d.ts b/test/types/auth.test-d.ts
index 14196e0f2..885adc368 100644
--- a/test/types/auth.test-d.ts
+++ b/test/types/auth.test-d.ts
@@ -105,6 +105,10 @@ const authorizeOptions2: TokenParams = {
   // User
   expectType<boolean>(await authClient.isAuthenticated());
   expectType<UserClaims>(await authClient.getUser());
+  const user = { sub: 'sub', groups: ['fake group'] };
+  expectAssignable<UserClaims<{
+    groups: string[];
+  }>>(user);
 
   // Redirect
   expectType<boolean>(authClient.isLoginRedirect());