Hi @bill_huang
The /userinfo endpoint will only work if openid was granted as a scope for the Access Token you are attaching to the request. You can find documentation on this via the following link:
Based on the error you are receiving, it is possible this scope is not being set on the Access Token. Could you confirm that you are including this in your scope parameters when requesting the token?