I'm trying to follow **OpenID Connect** [best practices](https://auth0.com/docs/api-auth/why-use-access-tokens-to-secure-apis). For the simple scenario of calling API from application the *OpenID Connect* suggest to pass the Access Token (which is not included user identity), and if the API in some points need the user identity it should call `/userinfo` endpoint of *OpenID Connect* provider.

So the question is: Is it the best way to get the user identity in API? 

Assume I have an end point named `CreateOrderForCurrentUser()` so each time any user call this api I need to call the `/userinfo` endpoint, it seems too much cost for calling an api.

1. Why I don't pass the Identity token to the API?
2. Or Why I don't put some identity claims in Access token?
3. Should I use [HOK](https://nordicapis.com/api-security-oauth-openid-connect-depth/) Token instead of Access token?

Any idea please.

It seems here is kind of same as my question: [Clarification on id\_token vs access\_token](https://stackoverflow.com/questions/46681889/clarification-on-id-token-vs-access-token) 

And he respond in comments: <https://community.auth0.com/t/clarification-on-token-usage/8447#post_2>

Which as my understanding means: put some identity claims in Access token (Custom Claims) and rely on that in the API.

But still it doesn't make sense. The OIDC insist to not use Access token as Identity and now we are going to add identity claims inside Access Token. Could any one clarify that?