title: Auth0 right way to call userinfo
body: <p>I have created an API with RS256 signing algorithm and <a href="http://localhost:3000/api/v1" rel="nofollow noreferrer">http://localhost:3000/api/v1</a> as the Identifier (audience) and I added openid, phone, profile as the scopes to the created API</p>
  
  <p>Then created an application to invoke the above API, with RS256 signing and turned off OIDC Conformant since I'm using a customized login page.</p>
  
  <p>I was able to invoke the following authorize request successfully : </p>
  
  <pre><code>https://hostname.auth0.com/authorize?client_id=CLIENT_ID&amp;redirect_uri=http://localhost:4200/dashboard&amp;response_type=code&amp;scope=openid%20profile&amp;state=state&amp;nonce=nonce&amp;audience=https://hostname.auth0.com/userinfo
  </code></pre>
  
  <p>After getting the code I was able to execute the token call and received the access_token</p>
  
  <pre><code>curl --request POST \ --url https://hostname.auth0.com/oauth/token \ --header 'content-type: application/json' \ --data '{"client_id":"CLIENT_ID","client_secret":"CLIENT_SECRET","audience":"localhost:3000/api/v1","grant_type":"client_credentials","code": "CODE"}'
  </code></pre>
  
  <p>But after decoding the JWT token I couldn't see the userinfo endpoint in audience field</p>
  
  <p>So I'm getting unauthorized error in executing the following userinfo call, but I was able to call my other API (secured resources) using the given access token without any issue.</p>
  
  <pre><code> curl --request GET \
   --url 'https://hostname.auth0.com/userinfo' \
   --header 'authorization: Bearer {ACCESS_TOKEN}' \
   --header 'content-type: application/json'
  </code></pre>
  
  <p>Unauthorized</p>
  
  <p>-Then I tried to invoke the token endpoint using userinfo url as the audience value:</p>
  
  <pre><code> curl --request POST \
   --url https://hostname.auth0.com/oauth/token \
   --header 'content-type: application/json' \
   --data '{"client_id":"CLIENT_ID","client_secret":"CLIENT_SECRET","audience":"https://hostname.auth0.com/userinfo","grant_type":"client_credentials","code": "CODE"}'
  </code></pre>
  
  <p>Then I'm getting the following error:</p>
  
  <pre><code> {"error":"access_denied","error_description":"Client is not authorized to access \"https://hostname.auth0.com/userinfo\". You might probably want to create a \"client-grant\" associated to this API. See: https://auth0.com/docs/api/v2#!/Client_Grants/post_client_grants"}
  </code></pre>
  
  <p>When I tried to add userinfo url as an additional Identifier (audience) when creating an API, I'm getting an error saying 'provided identifier is reserved'</p>
  
  <p>Please let me know what I'm doing wrong here. Looking forward to your reply.</p>
  
  <p>Thanks.</p>