Change User Pictures
Auth0 normalizes common profile properties in the User Profile, this includes the name
, picture
field and more. The picture field is populated by either the social provider profile picture or the Gravatar image associated with the user's email address. See our blog: Update of the user's details section for more information.
By default, all database users will have a placeholder image with their initials. When you authenticate the user, this picture field is referred to as user.picture
.

The user.picture
attribute is not directly editable when provided by identity providers other than Auth0 (such as Google, Facebook, Twitter).
To edit this attribute, you must configure your connection sync with Auth0 so that user attributes will be updated from the identity provider only on user profile creation. Root attributes will then be available to be edited individually or by bulk import using the Management API.
Alternatively, you can use the metadata to store the picture attribute for users, but this is not recommended for scalability. For example, if your app provides a way to upload profile pictures, once the picture is uploaded, you can set the URL to the picture in the user.user_metadata.picture
:
curl --request PATCH \
--url 'https://YOUR_DOMAIN/api/v2/users/USER_ID' \
--header 'authorization: Bearer ABCD' \
--header 'content-type: application/json' \
--data '{"user_metadata": {"picture": "https://example.com/some-image.png"}}'
var client = new RestClient("https://YOUR_DOMAIN/api/v2/users/USER_ID");
var request = new RestRequest(Method.PATCH);
request.AddHeader("authorization", "Bearer ABCD");
request.AddHeader("content-type", "application/json");
request.AddParameter("application/json", "{\"user_metadata\": {\"picture\": \"https://example.com/some-image.png\"}}", ParameterType.RequestBody);
IRestResponse response = client.Execute(request);
package main
import (
"fmt"
"strings"
"net/http"
"io/ioutil"
)
func main() {
url := "https://YOUR_DOMAIN/api/v2/users/USER_ID"
payload := strings.NewReader("{\"user_metadata\": {\"picture\": \"https://example.com/some-image.png\"}}")
req, _ := http.NewRequest("PATCH", url, payload)
req.Header.Add("authorization", "Bearer ABCD")
req.Header.Add("content-type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := ioutil.ReadAll(res.Body)
fmt.Println(res)
fmt.Println(string(body))
}
HttpResponse<String> response = Unirest.patch("https://YOUR_DOMAIN/api/v2/users/USER_ID")
.header("authorization", "Bearer ABCD")
.header("content-type", "application/json")
.body("{\"user_metadata\": {\"picture\": \"https://example.com/some-image.png\"}}")
.asString();
var axios = require("axios").default;
var options = {
method: 'PATCH',
url: 'https://YOUR_DOMAIN/api/v2/users/USER_ID',
headers: {authorization: 'Bearer ABCD', 'content-type': 'application/json'},
data: {user_metadata: {picture: 'https://example.com/some-image.png'}}
};
axios.request(options).then(function (response) {
console.log(response.data);
}).catch(function (error) {
console.error(error);
});
#import <Foundation/Foundation.h>
NSDictionary *headers = @{ @"authorization": @"Bearer ABCD",
@"content-type": @"application/json" };
NSDictionary *parameters = @{ @"user_metadata": @{ @"picture": @"https://example.com/some-image.png" } };
NSData *postData = [NSJSONSerialization dataWithJSONObject:parameters options:0 error:nil];
NSMutableURLRequest *request = [NSMutableURLRequest requestWithURL:[NSURL URLWithString:@"https://YOUR_DOMAIN/api/v2/users/USER_ID"]
cachePolicy:NSURLRequestUseProtocolCachePolicy
timeoutInterval:10.0];
[request setHTTPMethod:@"PATCH"];
[request setAllHTTPHeaderFields:headers];
[request setHTTPBody:postData];
NSURLSession *session = [NSURLSession sharedSession];
NSURLSessionDataTask *dataTask = [session dataTaskWithRequest:request
completionHandler:^(NSData *data, NSURLResponse *response, NSError *error) {
if (error) {
NSLog(@"%@", error);
} else {
NSHTTPURLResponse *httpResponse = (NSHTTPURLResponse *) response;
NSLog(@"%@", httpResponse);
}
}];
[dataTask resume];
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://YOUR_DOMAIN/api/v2/users/USER_ID",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "PATCH",
CURLOPT_POSTFIELDS => "{\"user_metadata\": {\"picture\": \"https://example.com/some-image.png\"}}",
CURLOPT_HTTPHEADER => [
"authorization: Bearer ABCD",
"content-type: application/json"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}
import http.client
conn = http.client.HTTPSConnection("")
payload = "{\"user_metadata\": {\"picture\": \"https://example.com/some-image.png\"}}"
headers = {
'authorization': "Bearer ABCD",
'content-type': "application/json"
}
conn.request("PATCH", "/YOUR_DOMAIN/api/v2/users/USER_ID", payload, headers)
res = conn.getresponse()
data = res.read()
print(data.decode("utf-8"))
require 'uri'
require 'net/http'
require 'openssl'
url = URI("https://YOUR_DOMAIN/api/v2/users/USER_ID")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
http.verify_mode = OpenSSL::SSL::VERIFY_NONE
request = Net::HTTP::Patch.new(url)
request["authorization"] = 'Bearer ABCD'
request["content-type"] = 'application/json'
request.body = "{\"user_metadata\": {\"picture\": \"https://example.com/some-image.png\"}}"
response = http.request(request)
puts response.read_body
import Foundation
let headers = [
"authorization": "Bearer ABCD",
"content-type": "application/json"
]
let parameters = ["user_metadata": ["picture": "https://example.com/some-image.png"]] as [String : Any]
let postData = JSONSerialization.data(withJSONObject: parameters, options: [])
let request = NSMutableURLRequest(url: NSURL(string: "https://YOUR_DOMAIN/api/v2/users/USER_ID")! as URL,
cachePolicy: .useProtocolCachePolicy,
timeoutInterval: 10.0)
request.httpMethod = "PATCH"
request.allHTTPHeaderFields = headers
request.httpBody = postData as Data
let session = URLSession.shared
let dataTask = session.dataTask(with: request as URLRequest, completionHandler: { (data, response, error) -> Void in
if (error != nil) {
print(error)
} else {
let httpResponse = response as? HTTPURLResponse
print(httpResponse)
}
})
dataTask.resume()
To ensure that the picture from the user_metadata
is returned in the ID token, create a rule to check whether the user.user_metadata.picture
attribute is present, and if so replace the user.picture
attribute with that value. This ensures that the picture from the user_metadata
is returned in the picture
claim of the ID token.
Here is an example of the code you can use in your rule:
function (user, context, callback) {
if (user.user_metadata.picture)
user.picture = user.user_metadata.picture;
callback(null, user, context);
}
Change default picture for all users
To change the default picture of all users who do not have a profile picture set, you can use a rule to do this. For example:
function (user, context, callback) {
if (user.picture.indexOf('cdn.auth0.com') > -1) {
const url = require('url');
const u = url.parse(user.picture, true);
u.query.d = 'URL_TO_YOUR_DEFAULT_PICTURE_HERE';
delete u.search;
user.picture = url.format(u);
}
callback(null, user, context);
}