Hmmm. That seems like it should work, or be clearly documented that on the first user creation, nothing added by a webhook is going to be available in the user object.

Can you please file a bug here: https://github.com/fusionauth/fusionauth-issues/issues with the replication steps you have outlined? You can also link to this forum post.

Other things you can try:

• using the non transactional webhook to do the update
• preloading your users by bulk loading from auth0, as outlined here: https://fusionauth.io/docs/v1/tech/migration-guide/auth0/

1. on a user.create event in webhook I create user record in custom DB (I know here I can't use FA's API to update user because transactions)
2. on a user.registration event we already have saved user in FA's DB and in custom DB, so I use FA's API in webhook to put userId in FA's user.data object
3. I use populate access token lamda to get userId from user.data object and put it to JWT access token.

But it looks like 3rd step happends earlier then 2nd because
in browser I put email/password and my app get token without userId. But if I logout and then login to application then I have userId in token.
So I think we create JWT access token early than create user and populate user.data on user.registration event.

I supposed that user.registration event happens before JWT populate lambda. And I supposed that user.registration event is transactional and the JWT populate lambda wait when user.registration event will be finished.

Lambda to populate JWT:

function populate(jwt, user, registration) {
  if (!user.data || !user.data.userId) {
    return;
  }

  var namespace = 'https://mydomain.com/';
  var customUser = {
    id: user.data.userId
  };
  
  jwt[namespace + 'userId'] = customUser.id;
}

Webhook for 'user.registration.create' event:

private async populateFusionAuthUser(event: FusionAuthEvent) {
    let user = undefined;
    if (event.user.data && event.user.data.userId) {
        logger.info('FusionAuth user already populated');
        return;
    }
    if (event.user.email && event.user.verified) {
        user = await this.authService.getUser(event.user.email);
    }
    if (user) {
        const patchBody = {
            user: {
                email: event.user.email,
                data: {
                    userId: user.id
                }
            },
        }
        await this.fusionAuthService.updateUser(event.user.id, patchBody);
        logger.info('FusionAuth user populated');
    }
}

So, to repeat back the problem, you are augmenting user.data in a user.registration.create webhook and the data is stored on the user after successful login, but not available in the populate JWT lambda to be put in the generated JWT? Is that correct?

There are issues with modifying data in transactional webhooks. More on that here: https://fusionauth.io/docs/v1/tech/events-webhooks/writing-a-webhook/#calling-fusionauth-apis-in-webhooks

Does this user exist already or are they being newly created? Can you provide the webhook code for examination?