diff --git a/internal/client/delivery/http/client_http_test.go b/internal/client/delivery/http/client_http_test.go
index bff37ac..cf2fdf8 100644
--- a/internal/client/delivery/http/client_http_test.go
+++ b/internal/client/delivery/http/client_http_test.go
@@ -11,6 +11,8 @@ import (
 
 	delivery "source.toby3d.me/website/indieauth/internal/client/delivery/http"
 	"source.toby3d.me/website/indieauth/internal/domain"
+	"source.toby3d.me/website/indieauth/internal/profile"
+	profilerepo "source.toby3d.me/website/indieauth/internal/profile/repository/memory"
 	"source.toby3d.me/website/indieauth/internal/session"
 	sessionrepo "source.toby3d.me/website/indieauth/internal/session/repository/memory"
 	"source.toby3d.me/website/indieauth/internal/testing/httptest"
@@ -20,6 +22,7 @@ import (
 )
 
 type Dependencies struct {
+	profiles     profile.Repository
 	client       *domain.Client
 	config       *domain.Config
 	matcher      language.Matcher
@@ -65,13 +68,19 @@ func TestRead(t *testing.T) {
 func NewDependencies(tb testing.TB) Dependencies {
 	tb.Helper()
 
+	store := new(sync.Map)
 	client := domain.TestClient(tb)
 	config := domain.TestConfig(tb)
 	matcher := language.NewMatcher(message.DefaultCatalog.Languages())
-	store := new(sync.Map)
 	sessions := sessionrepo.NewMemorySessionRepository(store, config)
 	tokens := tokenrepo.NewMemoryTokenRepository(store)
-	tokenService := tokenucase.NewTokenUseCase(tokens, sessions, config)
+	profiles := profilerepo.NewMemoryProfileRepository(store)
+	tokenService := tokenucase.NewTokenUseCase(tokenucase.Config{
+		Config:   config,
+		Profiles: profiles,
+		Sessions: sessions,
+		Tokens:   tokens,
+	})
 
 	return Dependencies{
 		client:       client,
@@ -79,6 +88,7 @@ func NewDependencies(tb testing.TB) Dependencies {
 		matcher:      matcher,
 		sessions:     sessions,
 		store:        store,
+		profiles:     profiles,
 		tokens:       tokens,
 		tokenService: tokenService,
 	}
diff --git a/internal/domain/profile.go b/internal/domain/profile.go
index e008d14..3375357 100644
--- a/internal/domain/profile.go
+++ b/internal/domain/profile.go
@@ -33,6 +33,10 @@ func TestProfile(tb testing.TB) *Profile {
 	}
 }
 
+func (p Profile) HasName() bool {
+	return len(p.Name) > 0
+}
+
 // GetName safe returns first name, if any.
 func (p Profile) GetName() string {
 	if len(p.Name) == 0 {
@@ -42,6 +46,10 @@ func (p Profile) GetName() string {
 	return p.Name[0]
 }
 
+func (p Profile) HasURL() bool {
+	return len(p.URL) > 0
+}
+
 // GetURL safe returns first URL, if any.
 func (p Profile) GetURL() *URL {
 	if len(p.URL) == 0 {
@@ -51,6 +59,10 @@ func (p Profile) GetURL() *URL {
 	return p.URL[0]
 }
 
+func (p Profile) HasPhoto() bool {
+	return len(p.Photo) > 0
+}
+
 // GetPhoto safe returns first photo, if any.
 func (p Profile) GetPhoto() *URL {
 	if len(p.Photo) == 0 {
@@ -60,6 +72,10 @@ func (p Profile) GetPhoto() *URL {
 	return p.Photo[0]
 }
 
+func (p Profile) HasEmail() bool {
+	return len(p.Email) > 0
+}
+
 // GetEmail safe returns first email, if any.
 func (p Profile) GetEmail() *Email {
 	if len(p.Email) == 0 {
diff --git a/internal/domain/token.go b/internal/domain/token.go
index ca4111d..c18935b 100644
--- a/internal/domain/token.go
+++ b/internal/domain/token.go
@@ -19,7 +19,6 @@ type (
 		Expiry       time.Time
 		ClientID     *ClientID
 		Me           *Me
-		Profile      *Profile
 		Scope        Scopes
 		AccessToken  string
 		RefreshToken string
@@ -29,7 +28,6 @@ type (
 	NewTokenOptions struct {
 		Expiration  time.Duration
 		Issuer      *ClientID
-		Profile     *Profile
 		Subject     *Me
 		Scope       Scopes
 		Secret      []byte
@@ -48,7 +46,6 @@ var DefaultNewTokenOptions = NewTokenOptions{
 	Secret:      nil,
 	Algorithm:   "HS256",
 	NonceLength: 32,
-	Profile:     nil,
 }
 
 // NewToken create a new token by provided options.
@@ -83,23 +80,6 @@ func NewToken(opts NewTokenOptions) (*Token, error) {
 		}
 	}
 
-	if opts.Profile != nil {
-		for key, val := range map[string]interface{}{
-			"name":  opts.Profile.GetName(),
-			"url":   opts.Profile.GetURL(),
-			"photo": opts.Profile.GetPhoto(),
-			"email": opts.Profile.GetEmail(),
-		} {
-			if val == nil {
-				continue
-			}
-
-			if err = tkn.Set(key, val); err != nil {
-				return nil, fmt.Errorf("failed to set JWT token claim: %w", err)
-			}
-		}
-	}
-
 	if opts.Issuer != nil {
 		if err = tkn.Set(jwt.IssuerKey, opts.Issuer.String()); err != nil {
 			return nil, fmt.Errorf("failed to set JWT token field: %w", err)
@@ -123,7 +103,6 @@ func NewToken(opts NewTokenOptions) (*Token, error) {
 		CreatedAt:    now,
 		Expiry:       now.Add(opts.Expiration),
 		Me:           opts.Subject,
-		Profile:      opts.Profile,
 		RefreshToken: "", // TODO(toby3d)
 		Scope:        opts.Scope,
 	}, nil
@@ -147,6 +126,8 @@ func TestToken(tb testing.TB) *Token {
 		ScopeCreate,
 		ScopeDelete,
 		ScopeUpdate,
+		ScopeProfile,
+		ScopeEmail,
 	}
 
 	for key, val := range map[string]interface{}{
@@ -176,7 +157,6 @@ func TestToken(tb testing.TB) *Token {
 		ClientID:     cid,
 		Me:           me,
 		Scope:        scope,
-		Profile:      TestProfile(tb),
 		AccessToken:  string(accessToken),
 		RefreshToken: "", // TODO(toby3d)
 	}
diff --git a/internal/token/delivery/http/token_http.go b/internal/token/delivery/http/token_http.go
index c4d8f42..fdf347f 100644
--- a/internal/token/delivery/http/token_http.go
+++ b/internal/token/delivery/http/token_http.go
@@ -175,7 +175,7 @@ func (h *RequestHandler) handleIntrospect(ctx *http.RequestCtx) {
 		return
 	}
 
-	tkn, err := h.tokens.Verify(ctx, req.Token)
+	tkn, _, err := h.tokens.Verify(ctx, req.Token)
 	if err != nil || tkn == nil {
 		// WARN(toby3d): If the token is not valid, the endpoint still
 		// MUST return a 200 Response.
diff --git a/internal/token/delivery/http/token_http_test.go b/internal/token/delivery/http/token_http_test.go
index 5ba7eb5..5d9c51f 100644
--- a/internal/token/delivery/http/token_http_test.go
+++ b/internal/token/delivery/http/token_http_test.go
@@ -12,6 +12,8 @@ import (
 
 	"source.toby3d.me/website/indieauth/internal/common"
 	"source.toby3d.me/website/indieauth/internal/domain"
+	"source.toby3d.me/website/indieauth/internal/profile"
+	profilerepo "source.toby3d.me/website/indieauth/internal/profile/repository/memory"
 	"source.toby3d.me/website/indieauth/internal/session"
 	sessionrepo "source.toby3d.me/website/indieauth/internal/session/repository/memory"
 	"source.toby3d.me/website/indieauth/internal/testing/httptest"
@@ -27,6 +29,7 @@ import (
 type Dependencies struct {
 	client        *http.Client
 	config        *domain.Config
+	profiles      profile.Repository
 	sessions      session.Repository
 	store         *sync.Map
 	tickets       ticket.Repository
@@ -135,19 +138,26 @@ func TestRevocation(t *testing.T) {
 func NewDependencies(tb testing.TB) Dependencies {
 	tb.Helper()
 
+	store := new(sync.Map)
 	client := new(http.Client)
 	config := domain.TestConfig(tb)
-	store := new(sync.Map)
 	token := domain.TestToken(tb)
+	profiles := profilerepo.NewMemoryProfileRepository(store)
 	sessions := sessionrepo.NewMemorySessionRepository(store, config)
 	tickets := ticketrepo.NewMemoryTicketRepository(store, config)
 	tokens := tokenrepo.NewMemoryTokenRepository(store)
 	ticketService := ticketucase.NewTicketUseCase(tickets, client, config)
-	tokenService := tokenucase.NewTokenUseCase(tokens, sessions, config)
+	tokenService := tokenucase.NewTokenUseCase(tokenucase.Config{
+		Config:   config,
+		Profiles: profiles,
+		Sessions: sessions,
+		Tokens:   tokens,
+	})
 
 	return Dependencies{
 		client:        client,
 		config:        config,
+		profiles:      profiles,
 		sessions:      sessions,
 		store:         store,
 		tickets:       tickets,
diff --git a/internal/token/usecase.go b/internal/token/usecase.go
index 2b43eb4..fd2ae24 100644
--- a/internal/token/usecase.go
+++ b/internal/token/usecase.go
@@ -18,7 +18,7 @@ type (
 		Exchange(ctx context.Context, opts ExchangeOptions) (*domain.Token, *domain.Profile, error)
 
 		// Verify checks the AccessToken and returns the associated information.
-		Verify(ctx context.Context, accessToken string) (*domain.Token, error)
+		Verify(ctx context.Context, accessToken string) (*domain.Token, *domain.Profile, error)
 
 		// Revoke revokes the AccessToken and blocks its further use.
 		Revoke(ctx context.Context, accessToken string) error
diff --git a/internal/token/usecase/token_ucase.go b/internal/token/usecase/token_ucase.go
index d7d1519..8a02baf 100644
--- a/internal/token/usecase/token_ucase.go
+++ b/internal/token/usecase/token_ucase.go
@@ -9,32 +9,41 @@ import (
 	"github.com/lestrrat-go/jwx/jwt"
 
 	"source.toby3d.me/website/indieauth/internal/domain"
+	"source.toby3d.me/website/indieauth/internal/profile"
 	"source.toby3d.me/website/indieauth/internal/session"
 	"source.toby3d.me/website/indieauth/internal/token"
 )
 
-type tokenUseCase struct {
-	sessions session.Repository
-	tokens   token.Repository
-	config   *domain.Config
-}
+type (
+	Config struct {
+		Config   *domain.Config
+		Profiles profile.Repository
+		Sessions session.Repository
+		Tokens   token.Repository
+	}
 
-func NewTokenUseCase(tokens token.Repository, sessions session.Repository, config *domain.Config) token.UseCase {
-	jwt.RegisterCustomField("email", new(domain.Email))
-	jwt.RegisterCustomField("photo", new(domain.URL))
+	tokenUseCase struct {
+		config   *domain.Config
+		profiles profile.Repository
+		sessions session.Repository
+		tokens   token.Repository
+	}
+)
+
+func NewTokenUseCase(config Config) token.UseCase {
 	jwt.RegisterCustomField("scope", make(domain.Scopes, 0))
-	jwt.RegisterCustomField("url", new(domain.URL))
 
 	return &tokenUseCase{
-		config:   config,
-		sessions: sessions,
-		tokens:   tokens,
+		config:   config.Config,
+		profiles: config.Profiles,
+		sessions: config.Sessions,
+		tokens:   config.Tokens,
 	}
 }
 
-func (useCase *tokenUseCase) Exchange(ctx context.Context, opts token.ExchangeOptions) (*domain.Token, *domain.Profile,
+func (uc *tokenUseCase) Exchange(ctx context.Context, opts token.ExchangeOptions) (*domain.Token, *domain.Profile,
 	error) {
-	session, err := useCase.sessions.GetAndDelete(ctx, opts.Code)
+	session, err := uc.sessions.GetAndDelete(ctx, opts.Code)
 	if err != nil {
 		return nil, nil, fmt.Errorf("cannot get session from store: %w", err)
 	}
@@ -66,14 +75,13 @@ func (useCase *tokenUseCase) Exchange(ctx context.Context, opts token.ExchangeOp
 	}
 
 	tkn, err := domain.NewToken(domain.NewTokenOptions{
-		Expiration:  useCase.config.JWT.Expiry,
+		Expiration:  uc.config.JWT.Expiry,
 		Issuer:      session.ClientID,
 		Subject:     session.Me,
 		Scope:       session.Scope,
-		Secret:      []byte(useCase.config.JWT.Secret),
-		Profile:     session.Profile,
-		Algorithm:   useCase.config.JWT.Algorithm,
-		NonceLength: useCase.config.JWT.NonceLength,
+		Secret:      []byte(uc.config.JWT.Secret),
+		Algorithm:   uc.config.JWT.Algorithm,
+		NonceLength: uc.config.JWT.NonceLength,
 	})
 	if err != nil {
 		return nil, nil, fmt.Errorf("cannot generate a new access token: %w", err)
@@ -82,24 +90,24 @@ func (useCase *tokenUseCase) Exchange(ctx context.Context, opts token.ExchangeOp
 	return tkn, session.Profile, nil
 }
 
-func (useCase *tokenUseCase) Verify(ctx context.Context, accessToken string) (*domain.Token, error) {
-	find, err := useCase.tokens.Get(ctx, accessToken)
+func (uc *tokenUseCase) Verify(ctx context.Context, accessToken string) (*domain.Token, *domain.Profile, error) {
+	find, err := uc.tokens.Get(ctx, accessToken)
 	if err != nil && !errors.Is(err, token.ErrNotExist) {
-		return nil, fmt.Errorf("cannot check token in store: %w", err)
+		return nil, nil, fmt.Errorf("cannot check token in store: %w", err)
 	}
 
 	if find != nil {
-		return nil, token.ErrRevoke
+		return nil, nil, token.ErrRevoke
 	}
 
-	tkn, err := jwt.ParseString(accessToken, jwt.WithVerify(jwa.SignatureAlgorithm(useCase.config.JWT.Algorithm),
-		[]byte(useCase.config.JWT.Secret)))
+	tkn, err := jwt.ParseString(accessToken, jwt.WithVerify(jwa.SignatureAlgorithm(uc.config.JWT.Algorithm),
+		[]byte(uc.config.JWT.Secret)))
 	if err != nil {
-		return nil, fmt.Errorf("cannot parse JWT token: %w", err)
+		return nil, nil, fmt.Errorf("cannot parse JWT token: %w", err)
 	}
 
 	if err = jwt.Validate(tkn); err != nil {
-		return nil, fmt.Errorf("cannot validate JWT token: %w", err)
+		return nil, nil, fmt.Errorf("cannot validate JWT token: %w", err)
 	}
 
 	result := &domain.Token{
@@ -107,7 +115,6 @@ func (useCase *tokenUseCase) Verify(ctx context.Context, accessToken string) (*d
 		Expiry:       tkn.Expiration(),
 		ClientID:     nil,
 		Me:           nil,
-		Profile:      nil,
 		Scope:        nil,
 		AccessToken:  accessToken,
 		RefreshToken: "", // TODO(toby3d)
@@ -120,49 +127,28 @@ func (useCase *tokenUseCase) Verify(ctx context.Context, accessToken string) (*d
 	}
 
 	if !result.Scope.Has(domain.ScopeProfile) {
-		return result, nil
+		return result, nil, nil
 	}
 
-	result.Profile = domain.NewProfile()
-
-	if name, ok := tkn.Get("name"); ok {
-		if n, ok := name.(string); ok {
-			result.Profile.Name = append(result.Profile.Name, n)
-		}
+	profile, err := uc.profiles.Get(ctx, result.Me)
+	if err != nil {
+		return result, nil, nil
 	}
 
-	if url, ok := tkn.Get("url"); ok {
-		if u, ok := url.(*domain.URL); ok {
-			result.Profile.URL = append(result.Profile.URL, u)
-		}
+	if !result.Scope.Has(domain.ScopeEmail) && len(profile.Email) > 0 {
+		profile.Email = nil
 	}
 
-	if photo, ok := tkn.Get("photo"); ok {
-		if p, ok := photo.(*domain.URL); ok {
-			result.Profile.Photo = append(result.Profile.Photo, p)
-		}
-	}
-
-	if !result.Scope.Has(domain.ScopeEmail) {
-		return result, nil
-	}
-
-	if email, ok := tkn.Get("email"); ok {
-		if e, ok := email.(*domain.Email); ok {
-			result.Profile.Email = append(result.Profile.Email, e)
-		}
-	}
-
-	return result, nil
+	return result, profile, nil
 }
 
-func (useCase *tokenUseCase) Revoke(ctx context.Context, accessToken string) error {
-	tkn, err := useCase.Verify(ctx, accessToken)
+func (uc *tokenUseCase) Revoke(ctx context.Context, accessToken string) error {
+	tkn, _, err := uc.Verify(ctx, accessToken)
 	if err != nil {
 		return fmt.Errorf("cannot verify token: %w", err)
 	}
 
-	if err = useCase.tokens.Create(ctx, tkn); err != nil {
+	if err = uc.tokens.Create(ctx, tkn); err != nil {
 		return fmt.Errorf("cannot save token in database: %w", err)
 	}
 
diff --git a/internal/token/usecase/token_ucase_test.go b/internal/token/usecase/token_ucase_test.go
index 512110d..7c802f6 100644
--- a/internal/token/usecase/token_ucase_test.go
+++ b/internal/token/usecase/token_ucase_test.go
@@ -3,35 +3,86 @@ package usecase_test
 import (
 	"context"
 	"errors"
+	"path"
 	"sync"
 	"testing"
 
 	"github.com/stretchr/testify/assert"
 
 	"source.toby3d.me/website/indieauth/internal/domain"
+	"source.toby3d.me/website/indieauth/internal/profile"
+	profilerepo "source.toby3d.me/website/indieauth/internal/profile/repository/memory"
+	"source.toby3d.me/website/indieauth/internal/session"
+	sessionrepo "source.toby3d.me/website/indieauth/internal/session/repository/memory"
 	"source.toby3d.me/website/indieauth/internal/token"
-	repository "source.toby3d.me/website/indieauth/internal/token/repository/memory"
+	tokenrepo "source.toby3d.me/website/indieauth/internal/token/repository/memory"
 	usecase "source.toby3d.me/website/indieauth/internal/token/usecase"
 )
 
-/* TODO(toby3d)
+type Dependencies struct {
+	config   *domain.Config
+	profile  *domain.Profile
+	profiles profile.Repository
+	session  *domain.Session
+	sessions session.Repository
+	store    *sync.Map
+	token    *domain.Token
+	tokens   token.Repository
+}
+
 func TestExchange(t *testing.T) {
 	t.Parallel()
+
+	deps := NewDependencies(t)
+	deps.store.Store(path.Join(profilerepo.DefaultPathPrefix, deps.session.Me.String()), deps.profile)
+
+	if err := deps.sessions.Create(context.TODO(), deps.session); err != nil {
+		t.Fatal(err)
+	}
+
+	opts := token.ExchangeOptions{
+		ClientID:     deps.session.ClientID,
+		Code:         deps.session.Code,
+		CodeVerifier: deps.session.CodeChallenge,
+		RedirectURI:  deps.session.RedirectURI,
+	}
+
+	tkn, userInfo, err := usecase.NewTokenUseCase(usecase.Config{
+		Config:   deps.config,
+		Profiles: deps.profiles,
+		Sessions: deps.sessions,
+		Tokens:   deps.tokens,
+	}).Exchange(context.TODO(), opts)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	if tkn == nil {
+		t.Errorf("Exchange(ctx, %v) = nil, want not nil", opts)
+	}
+
+	if userInfo == nil {
+		t.Errorf("Exchange(ctx, %v) = nil, want not nil", opts)
+	}
 }
-*/
 
 func TestVerify(t *testing.T) {
 	t.Parallel()
 
-	repo := repository.NewMemoryTokenRepository(new(sync.Map))
-	ucase := usecase.NewTokenUseCase(repo, nil, domain.TestConfig(t))
+	deps := NewDependencies(t)
+	ucase := usecase.NewTokenUseCase(usecase.Config{
+		Config:   domain.TestConfig(t),
+		Profiles: deps.profiles,
+		Sessions: deps.sessions,
+		Tokens:   deps.tokens,
+	})
 
 	t.Run("valid", func(t *testing.T) {
 		t.Parallel()
 
 		accessToken := domain.TestToken(t)
 
-		result, err := ucase.Verify(context.TODO(), accessToken.AccessToken)
+		result, _, err := ucase.Verify(context.TODO(), accessToken.AccessToken)
 		if err != nil {
 			t.Fatal(err)
 		}
@@ -46,11 +97,11 @@ func TestVerify(t *testing.T) {
 		t.Parallel()
 
 		accessToken := domain.TestToken(t)
-		if err := repo.Create(context.TODO(), accessToken); err != nil {
+		if err := deps.tokens.Create(context.TODO(), accessToken); err != nil {
 			t.Fatal(err)
 		}
 
-		result, err := ucase.Verify(context.TODO(), accessToken.AccessToken)
+		result, _, err := ucase.Verify(context.TODO(), accessToken.AccessToken)
 		if !errors.Is(err, token.ErrRevoke) {
 			t.Errorf("Verify(%s) = %v, want %v", accessToken.AccessToken, err, token.ErrRevoke)
 		}
@@ -64,21 +115,41 @@ func TestVerify(t *testing.T) {
 func TestRevoke(t *testing.T) {
 	t.Parallel()
 
-	config := domain.TestConfig(t)
-	accessToken := domain.TestToken(t)
-	repo := repository.NewMemoryTokenRepository(new(sync.Map))
+	deps := NewDependencies(t)
 
-	if err := usecase.NewTokenUseCase(repo, nil, config).
-		Revoke(context.TODO(), accessToken.AccessToken); err != nil {
+	if err := usecase.NewTokenUseCase(usecase.Config{
+		Config:   deps.config,
+		Profiles: deps.profiles,
+		Sessions: deps.sessions,
+		Tokens:   deps.tokens,
+	}).Revoke(context.TODO(), deps.token.AccessToken); err != nil {
 		t.Fatal(err)
 	}
 
-	result, err := repo.Get(context.TODO(), accessToken.AccessToken)
+	result, err := deps.tokens.Get(context.TODO(), deps.token.AccessToken)
 	if err != nil {
 		t.Error(err)
 	}
 
-	if result.AccessToken != accessToken.AccessToken {
-		t.Errorf("Get(%s) = %s, want %s", accessToken.AccessToken, result.AccessToken, accessToken.AccessToken)
+	if result.AccessToken != deps.token.AccessToken {
+		t.Errorf("Get(%s) = %s, want %s", deps.token.AccessToken, result.AccessToken, deps.token.AccessToken)
+	}
+}
+
+func NewDependencies(tb testing.TB) Dependencies {
+	tb.Helper()
+
+	store := new(sync.Map)
+	config := domain.TestConfig(tb)
+
+	return Dependencies{
+		config:   config,
+		profile:  domain.TestProfile(tb),
+		profiles: profilerepo.NewMemoryProfileRepository(store),
+		session:  domain.TestSession(tb),
+		sessions: sessionrepo.NewMemorySessionRepository(store, config),
+		store:    store,
+		token:    domain.TestToken(tb),
+		tokens:   tokenrepo.NewMemoryTokenRepository(store),
 	}
 }
diff --git a/internal/user/delivery/http/user_http.go b/internal/user/delivery/http/user_http.go
index c8eeca2..0205707 100644
--- a/internal/user/delivery/http/user_http.go
+++ b/internal/user/delivery/http/user_http.go
@@ -65,8 +65,8 @@ func (h *RequestHandler) handleUserInformation(ctx *http.RequestCtx) {
 
 	encoder := json.NewEncoder(ctx)
 
-	tkn, err := h.tokens.Verify(ctx, strings.TrimPrefix(string(ctx.Request.Header.Peek(http.HeaderAuthorization)),
-		"Bearer "))
+	tkn, userInfo, err := h.tokens.Verify(ctx, strings.TrimPrefix(string(ctx.Request.Header.Peek(
+		http.HeaderAuthorization)), "Bearer "))
 	if err != nil || tkn == nil {
 		// WARN(toby3d): If the token is not valid, the endpoint still
 		// MUST return a 200 Response.
@@ -88,24 +88,26 @@ func (h *RequestHandler) handleUserInformation(ctx *http.RequestCtx) {
 	}
 
 	resp := new(UserInformationResponse)
-	if tkn.Profile == nil {
+	if userInfo == nil {
 		_ = encoder.Encode(resp)
 
 		return
 	}
 
-	resp.Name = tkn.Profile.GetName()
-
-	if url := tkn.Profile.GetURL(); url != nil {
-		resp.URL = url.String()
+	if userInfo.HasName() {
+		resp.Name = userInfo.GetName()
 	}
 
-	if photo := tkn.Profile.GetPhoto(); photo != nil {
-		resp.Photo = photo.String()
+	if userInfo.HasURL() {
+		resp.URL = userInfo.GetURL().String()
 	}
 
-	if email := tkn.Profile.GetEmail(); email != nil && tkn.Scope.Has(domain.ScopeEmail) {
-		resp.Email = email.String()
+	if userInfo.HasPhoto() {
+		resp.Photo = userInfo.GetPhoto().String()
+	}
+
+	if tkn.Scope.Has(domain.ScopeEmail) && userInfo.HasEmail() {
+		resp.Email = userInfo.GetEmail().String()
 	}
 
 	_ = encoder.Encode(resp)
diff --git a/internal/user/delivery/http/user_http_test.go b/internal/user/delivery/http/user_http_test.go
new file mode 100644
index 0000000..0b12093
--- /dev/null
+++ b/internal/user/delivery/http/user_http_test.go
@@ -0,0 +1,94 @@
+package http_test
+
+import (
+	"path"
+	"sync"
+	"testing"
+
+	"github.com/goccy/go-json"
+	http "github.com/valyala/fasthttp"
+
+	"github.com/fasthttp/router"
+
+	"source.toby3d.me/website/indieauth/internal/domain"
+	"source.toby3d.me/website/indieauth/internal/profile"
+	profilerepo "source.toby3d.me/website/indieauth/internal/profile/repository/memory"
+	"source.toby3d.me/website/indieauth/internal/session"
+	sessionrepo "source.toby3d.me/website/indieauth/internal/session/repository/memory"
+	"source.toby3d.me/website/indieauth/internal/testing/httptest"
+	"source.toby3d.me/website/indieauth/internal/token"
+	tokenrepo "source.toby3d.me/website/indieauth/internal/token/repository/memory"
+	tokenucase "source.toby3d.me/website/indieauth/internal/token/usecase"
+	delivery "source.toby3d.me/website/indieauth/internal/user/delivery/http"
+)
+
+type Dependencies struct {
+	config       *domain.Config
+	profile      *domain.Profile
+	profiles     profile.Repository
+	sessions     session.Repository
+	store        *sync.Map
+	token        *domain.Token
+	tokens       token.Repository
+	tokenService token.UseCase
+}
+
+func TestUserInfo(t *testing.T) {
+	t.Parallel()
+
+	deps := NewDependencies(t)
+	deps.store.Store(path.Join(profilerepo.DefaultPathPrefix, deps.token.Me.String()), deps.profile)
+
+	r := router.New()
+	delivery.NewRequestHandler(deps.tokenService, deps.config).Register(r)
+
+	client, _, cleanup := httptest.New(t, r.Handler)
+	t.Cleanup(cleanup)
+
+	req := httptest.NewRequest(http.MethodGet, "https://example.com/userinfo", nil)
+	defer http.ReleaseRequest(req)
+	deps.token.SetAuthHeader(req)
+
+	resp := http.AcquireResponse()
+	defer http.ReleaseResponse(resp)
+
+	if err := client.Do(req, resp); err != nil {
+		t.Fatal(err)
+	}
+
+	result := new(delivery.UserInformationResponse)
+	if err := json.Unmarshal(resp.Body(), result); err != nil {
+		t.Fatal(err)
+	}
+
+	if result.Name != deps.profile.GetName() ||
+		result.Photo != deps.profile.GetPhoto().String() {
+		t.Errorf("GET /userinfo = %+v, want %+v", result, &delivery.UserInformationResponse{
+			Name:  deps.profile.GetName(),
+			URL:   deps.profile.GetURL().String(),
+			Photo: deps.profile.GetPhoto().String(),
+			Email: deps.profile.GetEmail().String(),
+		})
+	}
+}
+
+func NewDependencies(tb testing.TB) Dependencies {
+	tb.Helper()
+
+	store := new(sync.Map)
+	config := domain.TestConfig(tb)
+
+	return Dependencies{
+		profile: domain.TestProfile(tb),
+		token:   domain.TestToken(tb),
+		config:  config,
+		store:   store,
+		tokens:  tokenrepo.NewMemoryTokenRepository(store),
+		tokenService: tokenucase.NewTokenUseCase(tokenucase.Config{
+			Config:   config,
+			Profiles: profilerepo.NewMemoryProfileRepository(store),
+			Sessions: sessionrepo.NewMemorySessionRepository(store, config),
+			Tokens:   tokenrepo.NewMemoryTokenRepository(store),
+		}),
+	}
+}
diff --git a/main.go b/main.go
index 47526f7..c3d6ac2 100644
--- a/main.go
+++ b/main.go
@@ -277,7 +277,12 @@ func NewApp(opts NewAppOptions) *App {
 		matcher:  language.NewMatcher(message.DefaultCatalog.Languages()),
 		sessions: sessionucase.NewSessionUseCase(opts.Sessions),
 		tickets:  ticketucase.NewTicketUseCase(opts.Tickets, opts.Client, config),
-		tokens:   tokenucase.NewTokenUseCase(opts.Tokens, opts.Sessions, config),
+		tokens: tokenucase.NewTokenUseCase(tokenucase.Config{
+			Config:   config,
+			Profiles: opts.Profiles,
+			Sessions: opts.Sessions,
+			Tokens:   opts.Tokens,
+		}),
 	}
 }