If your app calls Auth0’s /userinfo endpoint on every request, first check whether that request path really needs fresh profile data. For basic profile information in a client, use the relevant claims from a validated ID token. If the app needs data specifically from /userinfo, cache the response according to how fresh that data must be. The exact code change depends on your SDK, authentication flow, and runtime.
How to confirm where the repeated calls come from
Inspect the browser’s network trace or your server logs and look for repeated requests to /userinfo. Trace each call back to the code path that makes it: a request handler, middleware, client-side route, or SDK helper may be retrieving the profile repeatedly. Then check whether that path needs fresh endpoint data or is fetching profile information already available after authentication.
As an Amazon Associate I earn from qualifying purchases.
Auth0 documents that its Auth0.js userInfo method makes a request to /userinfo. If your application uses that library, inspect calls to this method as well as any wrapper around it. Other SDKs may behave differently, so confirm the package and version actually installed before changing the implementation. Auth0.js documentation
Use the right token for the job
An ID token carries user information for the client application after authentication. An access token is used to call /userinfo or a protected API. These tokens are not interchangeable: do not send an ID token as a bearer token to a custom API. Validate tokens before using or storing their contents. Auth0 ID Tokens · Authorization Code Flow
#1 Best Overall
Access tokens are audience-specific. Use a token intended for the endpoint you are calling. Auth0 documents a /userinfo audience and a separate audience for a custom API; a particular custom-API configuration can allow a token to target both. Check the audience configured for your application rather than assuming a token for one API can be used with another. Auth0 access-token guidance
Choose a fix that matches the data you need
For basic profile information in a client
Read the relevant claims from the validated ID token instead of making a profile-endpoint request on every application request. Auth0 describes ID tokens as a way to provide user profile information to a client and cache that information. This is appropriate when the client needs the claims available in the authentication context, rather than a fresh endpoint response for each operation. Auth0 ID Tokens
Rank #2
- Used Book in Good Condition
When the application still needs /userinfo
Cache the profile data the application needs and set a freshness policy that fits the product. Auth0 Support recommends using and caching an ID token to reduce calls, and also identifies caching the /userinfo response as an option. Decide how long cached values remain acceptable and what event or user action should refresh them; the right interval depends on the data and how quickly changes need to appear. Auth0 Support: 429 rate-limit errors
Free tools Windows power users keep installed
One-click scans. No signup required.
The available documentation does not identify the application’s SDK, flow, or runtime, so it cannot establish a single code edit for every project. Make the change at the call site you found, using the token and cache APIs for your actual SDK and version.
Check scopes, responses, and rate limits
- Empty JSON response: verify that the access token was granted the
openidscope. The returned profile fields depend on requested scopes;openid profile emailcan return more information thanopenidalone. Auth0 Get User Info · Auth0 Support troubleshooting - 401 response: check that the request includes a valid user-issued access token. A missing or invalid token can cause this response. Auth0 Support troubleshooting
- 429 response: the request has exceeded a rate limit. Respect the response headers
X-RateLimit-Limit,X-RateLimit-Remaining, andX-RateLimit-Resetwhen deciding whether and when to retry. Limits can depend on the service and tenant; consult current Auth0 guidance instead of relying on a universal request quota. Auth0 Get User Info · Auth0 Support rate-limit guidance - Unexpected SDK-generated calls: inspect the installed SDK version and its configuration. Auth0 Support describes a historical case involving Auth0.js v9 and Lock v11 with HS256-signed ID tokens; it is a version- and configuration-specific troubleshooting path, not a general explanation for current applications. Auth0 Support: invalid-token troubleshooting
Account for profile changes
ID-token claims represent information for the authentication context; they are not a guarantee of a live profile lookup on every request. Auth0 notes that email in an ID token is a snapshot at login, and obtaining updated values may require new tokens. Choose a refresh strategy that matches how quickly your application needs profile changes to appear. Auth0 Get User Info
Quick Recap
Best Value
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
