get auth0 user metadata as part of user information - php

Question

I don't find how to get the user_metadata from the Auth0 Authentication api:
$auth0Api = new Authentication($domain, $clientId, $clientSecret);
$tokenInfo = $auth0Api->login([
'username' => $username,
'password' => $password,
'realm' => 'Username-Password-Authentication',
]);
$accessToken = $tokenInfo["access_token"];
$info = $auth0Api->userinfo($accessToken);
The final $info array only contains the main user information, no meta_data at all. I tried creating a rule from the Auth0 side to add stuff to the user itself (doing user.customtag = 'helloworld' for example) and the customization does not show either.
User info retrieved:
{
"sub":"auth0|XXXX",
"name":"XXXX#XXXX.com",
"nickname":"XXXX",
"picture":"XXXX.png",
"updated_at":"2017-03-31T08:50:59.819Z",
"email":"XXXX#XXXX.com",
"email_verified":true
}
The "Raw Json" tab of that user shows something much more complete:
{
"email": "XXXX#XXXX.com",
"email_verified": true,
"user_id": "auth0|XXXX",
"picture": "XXXX.png",
"nickname": "XXXX",
"identities": [
{
"user_id": "XXXX",
"provider": "auth0",
"connection": "Username-Password-Authentication",
"isSocial": false
}
],
"updated_at": "2017-03-31T08:50:59.819Z",
"created_at": "2017-03-23T16:03:47.075Z",
"name": "XXXX",
"user_metadata": {
"languageCode": "EN"
},
"last_ip": "XXXX",
"last_login": "XXXX",
"logins_count": XXXX,
"blocked_for": [],
"guardian_enrollments": []
}
How is it supposed to work?
Environment:
composer: "auth0/auth0-php": "~5.0"
php 7.1
Auth0 Free account

Answer 1

Try starting up your application locally, then update the following URL with your own settings and paste it into a web browser:
https://YOUR_TENANT.auth0.com/authorize?client_id=YOUR_CLIENT_ID&response_type=code&scope=openid profile&redirect_uri=YOUR_REDIRECT_URI&nonce=12345
This should at least ensure you are making a request with right scopes etc. You should also ensure you have a User Profile with some "metadata" assigned if you are expecting to read that data post authentication of course ;)