You mention 1 earlier but now I understand what you mean, yes my app takes the user_id from the sub field (idTokenPayload) and queries to my DB.
I’m not doing 2, but that’s something that could work for my app. right now it checks for the user_id but it doesn’t retrieve any of the data on my database, it only retrieves the data on auth0 database that I used to sign up.
So I can add all of my additional data to my token by adding additional claims to my token using a rule that queries my db?