0Pricing
OAuth2 & OpenID Connect Deep Dive · Lesson

The UserInfo Endpoint

Learn how the OpenID Connect UserInfo endpoint lets clients fetch additional verified claims about the authenticated user using an access token.

The UserInfo Endpoint is a free OAuth2 & OpenID Connect Deep Dive lesson on CoddyKit — lesson 4 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the OAuth2 & OpenID Connect Deep Dive learning path, one of 4 lessons in the course, and your progress syncs across the web and the CoddyKit app.

Beyond the ID Token

The ID token proves who the user is, but to keep it small it may carry only a few claims. The UserInfo endpoint is an OAuth2-protected resource that returns additional claims about the currently authenticated user.

It Is a Protected Resource

UserInfo is not part of the token endpoint — it is a normal protected API. You call it with the access token obtained during the OIDC flow, presented as a Bearer token.

Discovering the Endpoint

Its URL is published in the provider's discovery document under userinfo_endpoint.

GET /.well-known/openid-configuration

{
  "userinfo_endpoint": "https://op.example.com/userinfo"
}

Making the Request

Send a GET (or POST) with the access token in the Authorization header.

GET /userinfo HTTP/1.1
Host: op.example.com
Authorization: Bearer eyJhbGciOiJSUzI1NiIs...

The Response

The response is a JSON object of claims. It must include the sub claim, which must equal the sub in the ID token to prevent token substitution.

{
  "sub": "248289761001",
  "name": "Jane Doe",
  "email": "jane@example.com",
  "email_verified": true,
  "picture": "https://example.com/jane.jpg"
}

Scopes Control Claims

Which claims are returned depends on the scopes granted during authorization:

  • profile — name, picture, locale, etc.
  • email — email, email_verified.
  • address — postal address.
  • phone — phone_number, phone_number_verified.

Verifying the sub

Always confirm the sub from UserInfo matches the sub in the validated ID token. Otherwise an attacker could swap an access token issued for a different user.

if (userInfo.sub !== idTokenClaims.sub) {
  throw new Error('sub mismatch - possible token substitution');
}

Signed and Encrypted Responses

By default UserInfo returns plain JSON. Providers can also return a signed JWT (set via userinfo_signed_response_alg) so the client can verify integrity, and even an encrypted JWT for confidentiality.

ID Token vs UserInfo

When to use which?

  • Put stable, identity-critical claims in the ID token (sub, auth_time).
  • Fetch large or changeable profile data from UserInfo as needed.

This keeps the ID token compact while still giving rich profile access.

Caching Considerations

UserInfo data can change (a user updates their name). Avoid caching it indefinitely; refresh it on login or when you need current values, balancing freshness against extra network calls.

Error Handling

If the access token is expired or invalid, UserInfo returns a 401 with a WWW-Authenticate: Bearer error="invalid_token" header. Handle this by refreshing the token or re-authenticating.

Quick Check

Check your understanding of the UserInfo endpoint.

Recap

The UserInfo endpoint returns additional user claims using the access token.

  • It is a protected resource, discovered via userinfo_endpoint.
  • Returned claims depend on granted scopes.
  • Always verify its sub matches the ID token's sub.
  • Responses can be plain JSON or signed/encrypted JWTs.

Frequently asked questions

Is the “The UserInfo Endpoint” lesson free?

Yes — the full text of “The UserInfo Endpoint” is free to read here on the web, and the OAuth2 & OpenID Connect Deep Dive course includes 4 lessons in total. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the OAuth2 & OpenID Connect Deep Dive course, upgrade to CoddyKit PRO.

What will I learn in “The UserInfo Endpoint”?

Learn how the OpenID Connect UserInfo endpoint lets clients fetch additional verified claims about the authenticated user using an access token. You practise OAuth2 & OpenID Connect Deep Dive with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.

Do I need any experience to start OAuth2 & OpenID Connect Deep Dive?

No prior experience is required. OAuth2 & OpenID Connect Deep Dive on CoddyKit is structured for beginners through advanced learners; this is — lesson 4 of 4, so you can start here or from the beginning and move at your own pace.

How long does the “The UserInfo Endpoint” lesson take?

Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.

Can I write and run code in this OAuth2 & OpenID Connect Deep Dive lesson?

Yes. Every OAuth2 & OpenID Connect Deep Dive lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.

All lessons in this course

  1. OIDC: Identity Layer on OAuth2
  2. ID Tokens & Claims
  3. OIDC Flows Overview
  4. The UserInfo Endpoint
← Back to OAuth2 & OpenID Connect Deep Dive