Pre-1.0 · one maintainer · Stripe and cards only · no SDKs (client libraries) yet · no production users yet. Docs describe v0.9.1 (29 Oct 2026) · What’s new →

Resolve the current credential to its tenant context

GET

/v1/whoami

const url = 'http://localhost:8080/v1/whoami';
const options = {method: 'GET', headers: {Authorization: 'Bearer <token>'}};

try {
  const response = await fetch(url, options);
  const data = await response.json();
  console.log(data);
} catch (error) {
  console.error(error);
}

curl --request GET \
  --url http://localhost:8080/v1/whoami \
  --header 'Authorization: Bearer <token>'

Returns the resolved auth context for whichever credential the request carries — hardcount_session cookie (dashboard) or Authorization: Bearer (SDK / curl). Cookie path returns user_id + email; Bearer path returns key_id + key_type. All callers get tenant_id, livemode, can_email_setup_links, can_send_invites and smtp_configured.

Authorizations

BearerAuth

Responses

200

Resolved auth context

application/json

object

tenant_id

required

string

livemode

required

boolean

can_email_setup_links

required

Whether this server can email a customer a link to add a payment method. False when email sending (SMTP) or PAYMENT_UPDATE_URL is not set up; resending a setup link then fails.

boolean

can_send_invites

required

Whether this server can invite a teammate. False when email sending (SMTP) or DASHBOARD_BASE_URL is not set up; inviting then fails with 409.

boolean

smtp_configured

required

Whether this server has SMTP set up (SMTP_HOST). False means no email of any kind is sent. Settings → Email (GET /v1/settings/email) has the details.

boolean

user_id

string

email

string

key_id

string

key_type

string

Allowed values: platform secret

Example

{
  "key_type": "platform"
}

401

Missing, revoked, or expired credential

application/json

object

error

object

type

One of invalid_request_error, authentication_error, rate_limit_error or api_error. Every error the API answers has this shape, including an unknown path (404, code route_not_found) and a method the path does not take (405, code method_not_allowed, with an Allow header). The few exceptions are listed in docs/api-surface.md.

string

code

string

message

string

request_id

string

param

The request field the error is about. Sent only when the error names one. A request body may hold only the fields its operation lists, spelled and cased as listed: any other field, or one the server sets (such as id), is refused with 422 and param naming it. An operation with no request body lists no fields: send no body, {} or null. The Stripe and Postmark webhooks and the LiteLLM callback take their sender’s body as it comes.

string

Example

{
  "error": {
    "type": "invalid_request_error"
  }
}