UserInfo endpoint (OIDC Core §5.3)

POST /oauth/userinfo

Returns claims about the user who authorized the grant behind the bearer token. Bearer-authenticated by the same `verifyMcpAccessToken` function `POST /mcp` uses, so a revoked grant, a deactivated user and an expired token are all refused exactly as they are there. Never cached: this is the one response in this router that can carry a person's address. `sub` is always present — the stable `usr_…` primary key, never reassigned and never pairwise. `email` and `email_verified` are returned together, and only when the grant holds the `email` scope; a client that asked only for `openid` gets a subject and no contact detail. The two never appear separately, since an `email` without the flag beside it would invite a relying party to assume verification.

Response Body

emailstring · email

Present only when the grant holds the email scope.

email_verifiedboolean

Present only alongside email. Derived from how the account authenticates (a consumed email code, a signed SSO assertion over a DNS-verified org domain, an identity provider that publishes and enforces its own verification signal) — never a self-reported flag.

substring

Stable, opaque subject identifier (usr_…). Same value for every client — subject_types_supported: ["public"].

curl -X POST 'https://api.elaichi.ai/oauth/userinfo' \
  -H 'Authorization: Bearer $ELAICHI_API_TOKEN' \
  -H 'Content-Type: application/json'

const response = await fetch('https://api.elaichi.ai/oauth/userinfo', {
  method: 'POST',
  headers: {
    'Authorization': 'Bearer ' + process.env.ELAICHI_API_TOKEN,
    'Content-Type': 'application/json',
  },
});

const data = await response.json();
console.log(data);

import os
import requests

url = "https://api.elaichi.ai/oauth/userinfo"
headers = {
    "Authorization": f"Bearer {os.environ['ELAICHI_API_TOKEN']}",
    "Content-Type": "application/json",
}

response = requests.post(url, headers=headers)
print(response.json())