v1auth context
User info
GET /v1/auth/userinfo — the OIDC UserInfo endpoint, and the only endpoint third-party clients need.
GET /v1/auth/userinfo is the standard OIDC UserInfo endpoint. It is the one endpoint a third-party client needs in this context: everything else here serves the first-party account UI.
Request
Authorization: Bearer <access_token>The token must be a resource token issued by the oauth context, with audience auth and at least one of openid / profile / email in its scope.
curl 'https://id.example.com/v1/auth/userinfo' \
-H "Authorization: Bearer $ACCESS_TOKEN"Response
{
"sub": "usr_...",
"name": "Alice",
"preferred_username": "alice",
"email": "alice@example.com",
"email_verified": true,
"locale": "zh-Hans",
"updated_at": 1763111100
}| Field | Notes |
|---|---|
sub | Stable subject identifier; never use a username or email as a key |
name | Display name |
preferred_username | Username; omitted when the account has none |
email / email_verified | Primary email and its verification state |
locale | Language preference |
updated_at | Last profile update, in seconds |
Which fields appear depends on the scope: profile for the identity fields, email for the address.
Why it is separate from /account/me
| Endpoint | Audience | Data |
|---|---|---|
/v1/auth/userinfo | auth | The identity fields a client may read |
/v1/account/me | account | Extended profile: gender, birthdate, bio, metadata |
Third-party clients never get an account-audience token, so the separation is enforced by the token itself rather than by a runtime "is this first party" check. A check can be forgotten; an audience cannot.
Rules
| Rule | Notes |
|---|---|
| No session token | A session token has no client_id and is not accepted here |
sub must be stable | Users may change their username; sub must not change with it |
| Do not cache the token | It expires; caching a user snapshot means serving stale identity data |
Related
- How clients get the token: Authorization code flow
- Extended profile: Account profile
- Scope and audience rules: Scopes and audiences