# Auth0 storing a local copy of user information

**URL:** <https://community.auth0.com/t/auth0-storing-a-local-copy-of-user-information/69316>\
**Category:** Get Help\
**Tags:** login, auth0\
**Created:** [September 8, 2021, 4:48pm UTC](https://community.auth0.com/t/auth0-storing-a-local-copy-of-user-information/69316 "2021-09-08T16:48:10Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![woopgfx](https://upload.wikimedia.org/wikipedia/commons/thumb/7/7c/User_font_awesome.svg/768px-User_font_awesome.svg.png) [@woopgfx](https://community.auth0.com/u/woopgfx)\
**Post date:** [September 8, 2021, 4:48pm UTC](https://community.auth0.com/t/auth0-storing-a-local-copy-of-user-information/69316/1 "2021-09-08T16:48:10Z")

</div>

I am using Auth0 for my application. I want to keep a local copy of the user information. More specifically, I just want to grab the email so I have an easy way to contact users in the future if need be.

I’m a little bit confused with the flow of things. So the user goes through the whole OAuth song-and-dance using auth0 and they’re given an opaque [access token](https://auth0.com/docs/security/tokens/access-tokens). I’m then sending up that access token to my server `POST /users` `bearer access-token` . I’m then calling the [User Profile GET](https://auth0.com/docs/api/authentication#user-profile) API with that access token. I then subsequently store that information.

The flow of that seemed somewhat logical to me, until I think about subsequent calls to one of my APIs. Let’s say I have another endpoint `POST /users/{userId}/notes` , how would I go about validating that the call is from the given user?

---

<div class="post-metadata">

**Author:** ![marcus.baker](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/marcus.baker/32/8586_2.png) [@marcus.baker](https://community.auth0.com/u/marcus.baker)\
**Post date:** [September 8, 2021, 5:47pm UTC](https://community.auth0.com/t/auth0-storing-a-local-copy-of-user-information/69316/2 "2021-09-08T17:47:31Z")

</div>

Hi!

For requests to your /users/{userid}/notes endpoint you could do the same process and call the /userinfo endpoint to verify the user making the request is the correct user.

You could also look at adding non-personal information of some kind to the access token as a custom claim, like an email address for example to identify the user. You could potentially remove the need to call /userinfo in this case.

We have information on custom claims here: [Create Custom Claims](https://auth0.com/docs/security/tokens/json-web-tokens/create-namespaced-custom-claims)

Hope this helps!

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/auth0/original/3X/b/5/b560f266932fcce5d57f09a6595bd50518cae3f3.jpeg) [@system](https://community.auth0.com/u/system)\
**Post date:** [September 23, 2021, 5:47pm UTC](https://community.auth0.com/t/auth0-storing-a-local-copy-of-user-information/69316/3 "2021-09-23T17:47:32Z")

</div>

This topic was automatically closed 15 days after the last reply. New replies are no longer allowed.