Skip to main content

Documentation Index

Fetch the complete documentation index at: https://auth0-feat-authentication-api-migration.mintlify.app/llms.txt

Use this file to discover all available pages before exploring further.

GET /userinfo Given the Auth0 Access Token obtained during login, this endpoint returns a user’s profile. This endpoint will work only if openid was granted as a scope for the Access Token. The user profile information included in the response depends on the scopes requested. For example, a scope of just openid may return less information than a scope of openid profile email.

​
Remarks

  • The sample auth0.js script uses the library version 8. If you are using auth0.js version 7, please see this reference guide.
  • The auth0.js parseHash method requires that your tokens are signed with RS256, rather than HS256.
  • To return user_metadata or other custom information from this endpoint, add a custom claim to the ID token with an Action. For more information refer to User profile claims and scope.
  • This endpoint will return three HTTP Response Headers that provide relevant data on its rate limits:
    • X-RateLimit-Limit: Number of requests allowed per minute.
    • X-RateLimit-Remaining: Number of requests available. Each new request reduces this number by 1. For each minute that passes, requests are added back, so this number increases by 1 each time.
    • X-RateLimit-Reset: Remaining time until the rate limit (X-RateLimit-Limit) resets. The value is in UTC epoch seconds.
  • The Email claim returns a snapshot of the email at the time of login.
  • Standard claims (other than email) return the latest value (unless the value comes from an external IdP).
  • Custom claims always return the latest value of the claim.
  • To access the most up-to-date values for the email or custom claims, you must get new tokens. You can log in using silent authentication (where the prompt parameter for your call to the authorize endpoint equals none).
  • To access the most up-to-date values for standard claims that were changed using an external IdP (for example, the user changed their email address in Facebook), you must get new tokens. Log in again using the external IdP, but not with silent authentication.

​
Learn More

​
Parameters

​
access_token
string
required
​
DPoP
string
A DPoP proof for the request. This is optional and only required if your application uses Demonstrating Proof-of-Possession.

​
Response

StatusDescription
200User profile retrieved successfully.
401Unauthorized, invalid or missing access token.