Me endpoint
Returns the identity of the user an access token belongs to, filtered by whatever scopes were actually granted. Called from the connecting app's backend.
GET /oauth/userinfo
proxy_auth_token: <access_token>
The access token is sent as a plain proxy_auth_token header, not Authorization, not Bearer-prefixed.
curl https://your-domain.example/api/oauth/userinfo \
-H "proxy_auth_token: <access_token>"
{...}{ "id": 481, "sub": 481, "name": "Jane Doe", "mobile": "9876543210", "profile_picture_url": "https://.../avatar.png", "email": "[email protected]", "granted_scopes": ["profile", "email", "tickets:read"] }
Field presence depends entirely on what was granted:
Field | Present when |
|---|---|
| always; a stable identifier for the user (both fields are the same value) |
|
|
|
|
| always; every scope the token actually carries, including custom ones |
If no scopes were granted at all, the response is just {"id": ..., "sub": ..., "granted_scopes": []}, still a normal 200, not an error. This is also how your own backend should check whether a token has a custom scope (e.g. tickets:read) before serving whatever that scope is meant to gate: call this endpoint yourself with the token you were handed, and check granted_scopes. 36Blocks doesn't enforce custom scopes for you; only your own backend knows what they mean.