This call is used to authenticate Social Login users. You must use https to make this call.

During the authentication process, the auth_info call is used to retrieve the profile information of the user. Using the apiKey of the application, and the one time token provided by Social Login, it returns the requested data from the Identity Provider.

Examples of auth_info responses by provider are available in the auth_info Overview topic.

Accepted Content-types

  • application/x-www-form-urlencoded
  • multipart/form-data

Portable Contacts Format

The Portable Contacts Format is industry standard. You can find the details at:

accessCredentials Fields

The list below shows the fields returned by accessCredentials, listed by Provider.

  • Amazon — accessToken, uid, expires, refreshToken, scopes
  • Disqus — accessToken, uuid, expires, refreshToken, type
  • Facebook — accessToken, expires, uid, type
  • Flickr, MySpace, Yahoo! — oauthToken, oauthSessionHandle, oauthTokenSecret, type
  • Google — oauthToken, oauthTokenSecret, scopes, type
  • Google+ — accessToken, uid, expires, scopes, type
  • Instagram — accessToken, uid, scopes, type
  • LinkedIn, Orkut, Twitter — oauthToken, oauthTokenSecret, type
  • Mixi — accessToken, refreshToken, expires, scopes
  • MYDIGIPASS.COM — accessToken, uid, type
  • PayPal — uid
  • QQ — accessToken, uid, scopes, type
  • Ren Ren — type, oauthToken, uid, expires
  • Sound Cloud, Sina Weibo — type, oauthToken, uid
  • tumblr — oauthToken, oauthTokenSecret, uid, type
  • VK — accessToken, uuid, expires, scopes, types
  • Microsoft Account — eact, type
  • Xing — oauthToken, oauthTokenSecret, uid, type

Provider Fields

The list below shows the fields returned by provider, listed by Provider.

  • Facebook — albums, games, groups, videos
  • Foursquare — type, pings, relationship
  • LinkedIn — associations, patents, numRecommenders, industry, following, courses, certifications, publications, positions, jobBookmarks, honors, groupMemberships, mFeedRssUrl, skills, proposalComments, recommendations, volunteer
  • Mixi — occupation, bloodType, favoriteThings
  • Paypal — verifiedAccount
  • SalesForce — local, userType, active

This endpoint includes the following settings:

  • POST



This endpoint supports Basic authentication. To create an authentication string, combine your API client ID, a colon (:), and your client secret into a single value. For example, if your client ID is abcdefg and your client secret is hijklmnop, that value would look like this:


Next, take the string and base64 encode it.

For example, on a Mac, you can base encode the string using this command:

echo -n "abcdefg:hijklmnop" | base64

If you’re running Microsoft Windows, you can encode the string by using a Windows PowerShell command similar to this:


The resulting value (e.g., YWJjZGVmZzpoaWprbG1ub3A=) should be used in your authentication header.

If you are making API calls using Postman, select Basic Auth as your identification type, then use the client ID as the username and the client secret as the password.

Make sure that your API client has the all the permissions (for example, the right to read user profile information) needed to complete the API call.

Base URL

The base URL for this endpoint is your application domain followed by /api/v2; for example:


You can find your application domain in the Social Login (Engage Dashboard) on the Settings page:

Example Request

curl -X POST \
    --data-urlencode apiKey=1234567891234567891234567891234567891234\
    --data-urlencode token=a1b2c3d4e5f6g7h8i9j0\
    --data-urlencode extended=false\
    --data-urlencode tokenUrl=https://example.com/token_url \

Example Response

  "profile": {
    "name": {
      "givenName": "Sam",
      "familyName": "Knot",
      "formatted": "Sam Knot"
    "verifiedEmail": "sam@example.com",
    "googleUserId": "123456789123456789123",
    "displayName": "sam",
    "preferredUsername": "sam",
    "url": "https://www.google.com/profiles/123456789123456789123",
    "providerName": "Google",
    "identifier": "https://www.google.com/profiles/123456789123456789123",
    "email": "sam@example.com"
  "accessCredentials": {
    "scopes": "Blogger,Google Buzz,Google Contacts,YouTube,Picasa Web Albums,Google Calendar,Google Docs",
    "oauthToken": "1/1234567891234567891234567891234567891234567",
    "type": "OAuth",
    "oauthTokenSecret": "123456789123456789123456"
  "merged_poco": {
    "urls": [
        "type": "other",
        "value": "https://www.google.com/profiles/123456789123456789123"
    "preferredUsername": "Sam",
    "name": {
      "formatted": "Sam Knot",
      "familyName": "Knot",
      "givenName": "Sam"
    "languagesSpoken": [
    "emails": [
        "type": "other",
        "value": "sam@example.com"
  "stat": "ok"

Running Code Samples Using Postman

The Janrain REST API code samples are written using Curl, but they can easily be run from within Postman. To use one of our code samples in Postman:

  1. Click the Copy to Clipboard button located directly beneath the code sample
  2. In Postman, click Import to display the Import dialog box.
  3. In the Import dialog box, click Paste Raw Text, and then paste in the copied code. The Import dialog box should look similar to this:

  4. Click Import, and the Curl command will be converted to a format that can be run from within Postman. All you need to do now is configure the command to work with your Janrain implementation.

Query Parameters

Parameter Type Required Description
apiKey string Yes Social Login API key. This key can be found on the Janrain Dashboard.
extended string When true, returns the extended Simple Registration and HCard data in addition to the normalized Portable Contacts format. The default value is false.
token string Yes Social Login auth_info token.
tokenUrl string Validates the specified token URL value against the URL that was originally sent. See the 'Token URL mismatch' response example below for more details.


200 OK

Response Fields






A dictionary of fields forming the user's profile. This data may have been obtained through SREG, HCard, but is represented in the standard Portable Contacts schema.



If the user logged in with a provider that allows account access after authentication, this will be present and contain the user's authorization credentials. The fields returned differ by provider and are referenced in the "accessCredentials Fields" section at the top of this page.



Merged Portable Contacts data will be present here if the extended request argument was true and extended profile data were available.



The user's friends' identifiers will be present here if the extended request argument was true and friends data is available.



Supported by Twitter, Sound Cloud, and Sina Weibo only. The people whom the user is following will be present here if the extended request argument was true.



Supported by Twitter, Sound Cloud, and Sina Weibo only. The people who follow the user will be present here if the extended request argument was true.



Supported by Twitter, Sound Cloud, and Sina Weibo only. People who are both following and followers will be present here if the extended request argument was true.