The UserInfo endpoint is a standardized OpenID Connect endpoint that lets an application securely retrieve additional profile claims directly from the authorization server. It complements the ID token when the application needs more identity information than the token contains. section 13.3.2 section 13.3
When the ID token is not enough
After a user signs in, an application may need the user’s name, email address, or profile picture. Instead of relying only on the claims included in the ID token, it can securely fetch this additional or dynamic profile data through the UserInfo endpoint. section 13.3.2 section 13.5
The endpoint matters because it:
- Provides a standardized way to retrieve user details from the authorization server. section 13.3.2
- Complements the ID token with profile information that may be dynamic, extensive, or absent from the token. section 13.3.2
- Supports OIDC’s identity layer alongside authentication mechanisms and ID tokens. section 13.3
The practical distinction is simple: OAuth 2.0 answers what an application can access, while OpenID Connect also establishes who the user is. The UserInfo endpoint supplies further profile data after that identity is established. section 13.5 section 13.6
