I 've setup a SSO for an Single page page app it work fine but the oauth2.0 userinfo endpoint doesn't seems to work The oidc client i use is OIDC-client-ts and it does this request under the hood :

js
fetch("<http://localhost:4000/userinfo>", {
  "headers": {
    "accept": "application/json, application/jwt",
    "accept-language": "fr-FR,fr;q=0.9,en-US;q=0.8,en;q=0.7",
    "authorization": "Bearer ory_at_AbC123.xYz789", // this is the token i get from the token endpoint
    "sec-ch-ua": "\"Not_A Brand\";v=\"99\", \"Google Chrome\";v=\"109\", \"Chromium\";v=\"109\"",
    "sec-ch-ua-mobile": "?0",
    "sec-ch-ua-platform": "\"Windows\"",
    "sec-fetch-dest": "empty",
    "sec-fetch-mode": "cors",
    "sec-fetch-site": "same-site"
  },
  "referrer": "<http://localhost:3000/>",
  "referrerPolicy": "strict-origin-when-cross-origin",
  "body": null,
  "method": "GET",
  "mode": "cors",
  "credentials": "include"
});

and i get this response: HTTP/1.1 401 Unauthorized Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: http://localhost:3000 Access-Control-Expose-Headers: Set-Cookie, Cache-Control, Expires, Last-Modified, Pragma, Content-Length, Content-Language, Content-Type Alt-Svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400 Cache-Control: private, no-cache, no-store, must-revalidate Cf-Cache-Status: DYNAMIC Cf-Ray: 78e864eb6c03d6b2-CDG Content-Type: application/json Date: Tue, 24 Jan 2023 112257 GMT Server: cloudflare Set-Cookie: __cflb=0pg1PgkZtX3ARcYPXvJZm51VR4Nt1Fp96U3smBAj; Path=/; HttpOnly; SameSite=Lax Strict-Transport-Security: max-age=0; Vary: Origin Vary: Origin Www-Authenticate: Bearer error="request_unauthorized",error_description="The request could not be authorized. Check that you provided valid credentials in the right format." Content-Length: 155 {"error":"request_unauthorized","error_description":"The request could not be authorized. Check that you provided valid credentials in the right format."} Did i miss something in my request for this to append ?

Hi @future-doctor-89396 I believe you need to send the oauth2 token in the request headers to the

/userinfo

endpoint. https://www.ory.sh/docs/reference/api#tag/oidc/operation/getOidcUserInfo

"authorization": "Bearer ory_at_AbC123.xYz789", // this is the token i get from the token endpoint this ?