# When call /userinfo API returns Unauthorized

**URL:** <https://community.auth0.com/t/when-call-userinfo-api-returns-unauthorized/99765>\
**Category:** Get Help\
**Tags:** new-universal-login-experience, login-experience\
**Created:** [February 6, 2023, 2:11am UTC](https://community.auth0.com/t/when-call-userinfo-api-returns-unauthorized/99765 "2023-02-06T02:11:29Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![bill\_huang](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/bill_huang/32/42913_2.png) [@bill\_huang](https://community.auth0.com/u/bill_huang)\
**Post date:** [February 6, 2023, 2:11am UTC](https://community.auth0.com/t/when-call-userinfo-api-returns-unauthorized/99765/1 "2023-02-06T02:11:29Z")

</div>

Dear my friends,Unauthorized returns by auth0 when I use the /userinfo API. I don’t know how to deal with the problem. Have you ever encountered a similar problem? Thanks.

First I get the access\_token for the customer using the following API:  
curl --request POST   
–url ‘https://YOUR\_DOMAIN/oauth/token’   
–header ‘content-type: application/x-www-form-urlencoded’   
–data ‘grant\_type=password&username=USERNAME&password=PASSWORD&audience=API\_IDENTIFIER&scope=SCOPE&client\_id=YOUR\_CLIENT\_ID&client\_secret=YOUR\_CLIENT\_SECRET’

Next I tried querying a customer’s profile with access\_token, but auth0 returned Unauthorized.  
curl --request GET   
–url ‘https://YOUR\_DOMAIN/userinfo’   
–header ‘Authorization: Bearer {ACCESS\_TOKEN}’   
–header ‘Content-Type: application/json’

---

<div class="post-metadata">

**Author:** ![james.merrigan](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/james.merrigan/32/44373_2.png) [@james.merrigan](https://community.auth0.com/u/james.merrigan)\
**Post date:** [February 7, 2023, 7:25am UTC](https://community.auth0.com/t/when-call-userinfo-api-returns-unauthorized/99765/3 "2023-02-07T07:25:39Z")

</div>

Hi @bill_huang

The `/userinfo` endpoint will only work if `openid` was granted as a scope for the Access Token you are attaching to the request. You can find documentation on this via the following link:

- [Authentication API Explorer](https://auth0.com/docs/api/authentication?shell#user-profile)

Based on the error you are receiving, it is possible this scope is not being set on the Access Token. Could you confirm that you are including this in your scope parameters when requesting the token?

---

<div class="post-metadata">

**Author:** ![bill\_huang](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/bill_huang/32/42913_2.png) [@bill\_huang](https://community.auth0.com/u/bill_huang)\
**Post date:** [February 9, 2023, 1:50am UTC](https://community.auth0.com/t/when-call-userinfo-api-returns-unauthorized/99765/4 "2023-02-09T01:50:03Z")

</div>

Hi @james.merrigan, Thank you very much.  
The information you provided was very helpful to me,For a more detailed auth0 help document, please refer to: [Call Your API Using Resource Owner Password Flow](https://auth0.com/docs/get-started/authentication-and-authorization-flow/call-your-api-using-resource-owner-password-flow) Hope to help friends who encounter this problem, thanks again.

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/auth0/original/3X/b/5/b560f266932fcce5d57f09a6595bd50518cae3f3.jpeg) [@system](https://community.auth0.com/u/system)\
**Post date:** [February 23, 2023, 1:50am UTC](https://community.auth0.com/t/when-call-userinfo-api-returns-unauthorized/99765/5 "2023-02-23T01:50:04Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.