fetchUserInfo

When true, requests the OpenID Provider UserInfo endpoint after token exchange and uses that response for OidcToken.Id.userInfo.

• The request sends the OAuth access token as a Bearer credential.

• Signed JWT UserInfo is verified.

• Encrypted UserInfo JWTs are rejected.

• The UserInfo sub claim must match the ID token subject; a mismatch or request failure fails the callback.

Also applied when a refresh response includes a new ID token.

Defaults to false. Then, and when metadata has no userinfo_endpoint or the access token is blank, OidcToken.Id.userInfo is taken from ID token claims instead.

Report a problem