# 401 Unauthorized /userinfo endpoint

**URL:** <https://community.auth0.com/t/401-unauthorized-userinfo-endpoint/189145>\
**Category:** Get Help\
**Tags:** user-profile, user-management\
**Created:** [July 14, 2025, 9:31am UTC](https://community.auth0.com/t/401-unauthorized-userinfo-endpoint/189145 "2025-07-14T09:31:54Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![regis.chevillot](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/regis.chevillot/32/75703_2.png) [@regis.chevillot](https://community.auth0.com/u/regis.chevillot)\
**Post date:** [July 14, 2025, 9:31am UTC](https://community.auth0.com/t/401-unauthorized-userinfo-endpoint/189145/1 "2025-07-14T09:31:54Z")

</div>

Hello,

I’m trying to retreive the user info via the userinfo endpoint but i have a 401 response  
Currently i have the following setup  
On the frontend part i’m using the auth0 spa js library.  
The backend side is a node js server with express.

On the frontend i have the following code:

```auto
//initialization
const auth0 = await createAuth0Client({
    domain: import.meta.env.VITE_AUTH0_DOMAIN,
    clientId: import.meta.env.VITE_AUTH0_CLIENT_ID,
    authorizationParams: {
        redirect_uri: import.meta.env.VITE_AUTH0_CALLBACK_URL,
        scope: 'openid profile email',
    }
});

```

then on a button click i call this:  
`auth0.loginWithRedirect();`

After the redirect when landing on my callback page i do that:

```auto
await auth0.handleRedirectCallback();
const token = await auth0.getTokenSilently();

```

Then i send the access token into the headers to my server API like that:

```auto
axios({
  url,
  method,
  data: data.params,
  headers: {
    Authorization: `Bearer ${token}`
  }
});

```

On the backend i have a middleware function that retrieve the token + send it to the userinfo endpoint:

```auto
const axios = require('axios');
const authenticateToken = async (req, res, next) => {
  const token = req.headers.authorization.split(' ')[1];

  let config = {
    method: 'get',
    maxBodyLength: Infinity,
    url: `https://${process.env.AUTH0_DOMAIN}/userinfo`,
    headers: { 
      'Accept': 'application/json', 
      'access_token': token
    }
  };
  
  axios.request(config)
  .then((response) => {
    console.log("RESPONSE AUTH TOKEN", JSON.stringify(response.data));
  })
  .catch((error) => {
    console.log("ERROR AUTH TOKEN", error);
  });
}

```

---

<div class="post-metadata">

**Author:** ![nik.baleca](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/nik.baleca/32/68749_2.png) [@nik.baleca](https://community.auth0.com/u/nik.baleca)\
**Post date:** [July 17, 2025, 5:04pm UTC](https://community.auth0.com/t/401-unauthorized-userinfo-endpoint/189145/3 "2025-07-17T17:04:54Z")

</div>

Hi @regis.chevillot

Welcome to the Auth0 Community!

I believe the issue may reside in the fact that when you initialize the Auth0 Client, you are not using an audience inside the authorization parameters which result in an invalid/opaque token.

The 401 error response indicates that the token may either be invalid/expired/opaque per our Authentication API [documentation](https://auth0.com/docs/api/authentication/user-profile/get-user-info).

Let me know if you have any other questions!

Kind Regards,  
Nik

---

<div class="post-metadata">

**Author:** ![regis.chevillot](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/regis.chevillot/32/75703_2.png) [@regis.chevillot](https://community.auth0.com/u/regis.chevillot)\
**Post date:** [July 17, 2025, 6:44pm UTC](https://community.auth0.com/t/401-unauthorized-userinfo-endpoint/189145/4 "2025-07-17T18:44:19Z")

</div>

Hi Nik,  
Thanks for answering.  
i’m a bit confused with your response. Isn’t the purpose of the endpoint /userinfo to return the user info of a given opaque token?  
Indeed i did not mention any audience parameter because i do want to get an opaque token and use the endpoint /userinfo to get the user info

Régis

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/auth0/original/3X/b/5/b560f266932fcce5d57f09a6595bd50518cae3f3.jpeg) [@system](https://community.auth0.com/u/system)\
**Post date:** [July 31, 2025, 6:44pm UTC](https://community.auth0.com/t/401-unauthorized-userinfo-endpoint/189145/5 "2025-07-31T18:44:23Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.