# accessToken doesn't include any identity info (user\_id)

**URL:** <https://community.auth0.com/t/accesstoken-doesnt-include-any-identity-info-user-id/90652>\
**Category:** Get Help\
**Tags:** jwt, identity, auth0\
**Created:** [September 15, 2022, 5:36am UTC](https://community.auth0.com/t/accesstoken-doesnt-include-any-identity-info-user-id/90652 "2022-09-15T05:36:17Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Fawwaz-2009](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/fawwaz-2009/32/39953_2.png) [@Fawwaz-2009](https://community.auth0.com/u/Fawwaz-2009)\
**Post date:** [September 15, 2022, 5:36am UTC](https://community.auth0.com/t/accesstoken-doesnt-include-any-identity-info-user-id/90652/1 "2022-09-15T05:36:17Z")

</div>

hey all 👋 ,

I setup both an application and an API with auth0. Plus everything seems to be working as expected and jwtCheck is working. the issue is that they payload for the jwt has nothing about user identity. If I’m building a simple todo app, I need way to make sure that authorized users can only CRUD thier own recourses.

My question is how to add user info like `user_id` to the accessToken?

![image](https://global.discourse-cdn.com/auth0/original/3X/1/6/160680f3a018479b544e1acd2a4f006bf203e051.png)

---

<div class="post-metadata">

**Author:** ![SaqibHussain](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/saqibhussain/32/42924_2.png) [@SaqibHussain](https://community.auth0.com/u/SaqibHussain)\
**Post date:** [September 15, 2022, 6:31am UTC](https://community.auth0.com/t/accesstoken-doesnt-include-any-identity-info-user-id/90652/2 "2022-09-15T06:31:33Z")

</div>

Hi @Fawwaz-2009

Welcome to the Auth0 Community, it’s great to have you here.

The sub claim of an Access Token obtained on login should contain the user\_id. If you need more user information you can use the access token to call the [userinfo](https://auth0.com/docs/api/authentication#user-profile) endpoint, more information here [https://auth0.com/docs/secure/tokens/access-tokens#sample-access-token](https://auth0.com/docs/secure/tokens/access-tokens#sample-access-token)

Warm regards.

---

<div class="post-metadata">

**Author:** ![Fawwaz-2009](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/fawwaz-2009/32/39953_2.png) [@Fawwaz-2009](https://community.auth0.com/u/Fawwaz-2009)\
**Post date:** [September 15, 2022, 7:10am UTC](https://community.auth0.com/t/accesstoken-doesnt-include-any-identity-info-user-id/90652/3 "2022-09-15T07:10:17Z")

</div>

Hey @SaqibHussain thanks so much for the quick reply much appreciated 🙂 .

maybe I should’ve clarified by access token I meant the access token returned by the `oauth/token`.

I’m using the `access_token` from the endpoint to call an external API protected by Auth0. unfortunately the payload for that token has no info about the user, WDYT?

![image](https://global.discourse-cdn.com/auth0/original/3X/a/b/ab2518f82df20478091e24d89b8300acae6ed4f7.png)  
 ![image](https://global.discourse-cdn.com/auth0/original/3X/6/a/6abbcc780e2bf9a42edf0ddde0d65ce3c4963565.png)  
 ![image](https://global.discourse-cdn.com/auth0/original/3X/1/6/160680f3a018479b544e1acd2a4f006bf203e051.png)

---

<div class="post-metadata">

**Author:** ![SaqibHussain](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/saqibhussain/32/42924_2.png) [@SaqibHussain](https://community.auth0.com/u/SaqibHussain)\
**Post date:** [September 16, 2022, 6:33am UTC](https://community.auth0.com/t/accesstoken-doesnt-include-any-identity-info-user-id/90652/4 "2022-09-16T06:33:59Z")

</div>

Hi @Fawwaz-2009

This should work without issue, please try the [Authorization Code Flow](https://auth0.com/docs/api/authentication#authorization-code-flow44) as an example:

```auto
https://YOUR-DOMAIN/authorize?&response_type=code&client_id=YOUR-CLIENT-ID&redirect_uri=http://jwt.io&scope=read:users&audience=https://testapi.com

```

Take the code returned from the browser and pass it into the curl below

```auto
curl --request POST \
  --url 'https://YOUR-DOMAIN/oauth/token' \
  --header 'content-type: application/x-www-form-urlencoded' \
  --data 'grant_type=authorization_code&client_id=YOUR-CLIENT-ID&client_secret=YOUR-CLIENT-SECRET&code=CODE-RETURNED&redirect_uri=http://jwt.io'

```

This will deliver

```auto
{
  "iss": "https://YOUR-DOMAIN/",
  "sub": "auth0|61e99362072c07006a9e4d47",
  "aud": "https://testapi.com",
  "iat": 1663309296,
  "exp": 1663395696,
  "azp": "gdKJLq8Zcs6ODhXP3NVGtfI1cTTOmzTE",
  "scope": "read:users"
}

```

The sub claim will contain the user\_id.

I hope this helps.

Warm regards.

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/auth0/original/3X/b/5/b560f266932fcce5d57f09a6595bd50518cae3f3.jpeg) [@system](https://community.auth0.com/u/system)\
**Post date:** [November 14, 2024, 12:55am UTC](https://community.auth0.com/t/accesstoken-doesnt-include-any-identity-info-user-id/90652/5 "2024-11-14T00:55:25Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.