Code in

Userinfo

Who the person is as of now: the claims their consent allows, read fresh from their account.

GET or POST https://accounts.aton-network.org/oauth/userinfo

When to use it

When you need current details (a plan, a verified age, linked wallets) rather than what the ID token said when they signed in.

Authentication

Authorization: Bearer <access token>. ID tokens are refused.

Parameters

Name	In	Type	Required	Limits	What it is
`Authorization`	header	string	yes	Bearer <access token>	An access token issued to your client, under 15 minutes old.

Request

# Who the person is as of now, with an access token issued to your client.
curl https://accounts.aton-network.org/oauth/userinfo \
  -H "Authorization: Bearer $ACCESS_TOKEN"

Response

http

HTTP 200
content-type: application/json
cache-control: no-store

{
  "sub": "9a6d4c1e-1f0b-4a51-8a8e-3b2f6c0d7e11",
  "name": "Ada Lovelace",
  "email": "ada@example.com",
  "email_verified": true,
  "age": { "verified": true, "adult": true, "sixteen_or_over": true }
}

Errors

HTTP	error	Cause	Fix
401	`invalid_token`	Not an access token (ID tokens are refused), expired (15 minutes), the account is suspended, access was withdrawn, or the app is suspended.	Refresh the access token, or sign the person in again. Never send an ID token to userinfo.
429	`rate_limited`	Over your quota for this bucket, this minute or this day.	Wait the Retry-After seconds. Requests over the limit still count, so a retry loop keeps you over it.

Good to know

Only the claims of scopes the person agreed to come back. A claim you did not ask for is never there.
A call that reads a sensitive scope (age, membership, wallet, licences, creator) also counts against the smaller userinfo:sensitive bucket.

Security

Key your records on sub, never on email: people change their email.

Try it

Call it with a test token in the sandbox.

Ask Atlas

AI assistant

Ask anything about Sign in with Atheron, the API or the portal. You get an answer from our docs, with links to the pages it used.