---
title: "Signed-in user (OpenID Connect UserInfo)"
method: POST
path: "/oauth/userinfo"
tags: ["OAuth"]
---

# Signed-in user (OpenID Connect UserInfo)

`POST /oauth/userinfo`

## Request

- Base URL: `https://api.groundmail.dev`
- URL: `https://api.groundmail.dev/oauth/userinfo`
- Auth: HTTP bearer

Who the access token's user is. Send an OAuth access token (`gm_oat_…`) that was granted the `openid` and/or `email` scope; API keys and tokens without an identity scope are refused. `sub` is the stable user id. `email` and `email_verified` are returned with the `email` scope. Sign-in requires a verified email address, so `email_verified` is `true` for every account. The identity scopes grant no other access: a token with only `openid` and `email` is refused by every other endpoint.

## Response `200`

Claims for the signed-in user

- OAuthUserInfo
  - `sub` string, required: Stable user id
  - `email` string, email: With the `email` scope
  - `email_verified` boolean: With the `email` scope

## Other responses

- `401`: Missing, invalid or expired access token (`WWW-Authenticate: Bearer`)
- `403`: The token has neither the `openid` nor the `email` scope (`insufficient_scope`)

---

[API](https://skmtc.dev/groundmail/apis/groundmail-api.md) · [All operations](https://skmtc.dev/groundmail/apis/groundmail-api/llms.txt) · [OpenAPI document](https://skmtc.dev/groundmail/apis/groundmail-api/revisions/479821c9fecf?raw)