> ## Documentation Index
> Fetch the complete documentation index at: https://docs.member.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Oauth Userinfo

> OIDC UserInfo Endpoint (RFC 6749 §3.1 / OIDC §5.3).

Accepts a Bearer access_token with aud="mio-oauth". Returns identity claims
gated by the granted scope:
  - always: sub, hub_id
  - "email" scope: email, email_verified
  - "profile" scope: name, picture (when available)

SECURITY:
- Only accepts aud=mio-oauth tokens (contact, mio-api, and refresh tokens
  all have wrong audiences and are rejected with 401).
- Revoked (blacklisted jti) tokens return 401.
- Errors follow RFC 6750 §3.1: 401 + WWW-Authenticate: Bearer header.

This is an OIDC standard endpoint — NOT JSON:API.



## OpenAPI

````yaml /openapi/mio-openapi.json get /oauth/userinfo
openapi: 3.1.0
info:
  description: >-
    Production API reference for Membership.io. Use the authored guides for
    workflows and the generated endpoint pages for exact parameters and schemas.
  title: Membership.io API
  version: 0.1.0
servers:
  - description: Production
    url: https://api.member.dev
security:
  - bearerAuth: []
paths:
  /oauth/userinfo:
    get:
      tags:
        - oauth
      summary: Oauth Userinfo
      description: >-
        OIDC UserInfo Endpoint (RFC 6749 §3.1 / OIDC §5.3).


        Accepts a Bearer access_token with aud="mio-oauth". Returns identity
        claims

        gated by the granted scope:
          - always: sub, hub_id
          - "email" scope: email, email_verified
          - "profile" scope: name, picture (when available)

        SECURITY:

        - Only accepts aud=mio-oauth tokens (contact, mio-api, and refresh
        tokens
          all have wrong audiences and are rejected with 401).
        - Revoked (blacklisted jti) tokens return 401.

        - Errors follow RFC 6750 §3.1: 401 + WWW-Authenticate: Bearer header.


        This is an OIDC standard endpoint — NOT JSON:API.
      operationId: oauth.get_oauth_get_oauth_userinfo
      responses:
        '200':
          content:
            application/vnd.api+json:
              schema:
                $ref: '#/components/schemas/UserInfoResponse'
          description: Successful Response
components:
  schemas:
    UserInfoResponse:
      description: >-
        OIDC UserInfo response (§5.3).


        sub and hub_id are always present. email/email_verified are included
        only

        when the "email" scope was granted. name/picture only when "profile"
        granted.
      properties:
        email:
          anyOf:
            - type: string
            - type: 'null'
          title: Email
        email_verified:
          anyOf:
            - type: boolean
            - type: 'null'
          title: Email Verified
        hub_id:
          title: Hub Id
          type: string
        name:
          anyOf:
            - type: string
            - type: 'null'
          title: Name
        picture:
          anyOf:
            - type: string
            - type: 'null'
          title: Picture
        sub:
          title: Sub
          type: string
      required:
        - sub
        - hub_id
      title: UserInfoResponse
      type: object
  securitySchemes:
    bearerAuth:
      bearerFormat: JWT or mio_sk API key
      description: >-
        Send platform JWTs, contact JWTs, or team API keys as `Authorization:
        Bearer <token>`.
      scheme: bearer
      type: http

````