docs: handle userinfo invalid_token outcomes in callback example

Update SDK example callback and integration guidance to treat UserInfoException as an authorization-state outcome (e.g. subject disabled/inactive scope) and return a clear 403 path.
2026-02-26 11:51:29 +00:00
parent 7bb919a0a0
commit 78a18ccfab
2 changed files with 6 additions and 0 deletions
@@ -134,6 +134,8 @@ try {
 }
 ```

+`UserInfoException` with `invalid_token` can occur when provider-side subject scope is no longer active (for example user/project disabled) between token issuance and userinfo retrieval.
+
 ## Operational guidance

 - Keep provider URLs in environment variables, not hard-coded.