Get the current user

The signed-in user's profile, as an OIDC UserInfo response.

GET /users/me

The OIDC userinfo endpoint: the profile of the user the token belongs to. POST /users/me answers the same, as OIDC requires.

Authorization

Authorization: Bearer <access token>: a user token minted by the org whose host you call. A client_credentials token is refused with 401.

Response

200.

{
  "sub": "usr_…",
  "email": "ada@acme.com",
  "given_name": "Ada",
  "family_name": "Lovelace",
  "name": "Ada Lovelace",
  "picture": "https://…",
  "provider": "google",
  "labels": [
    { "id": "…", "name": "Admins", "color": "…", "icon": "…", "level": "…" }
  ]
}

Field	Type	Description
`sub`	string	The user’s id, `usr_…`. Matches the token’s `sub`.
`email`	string
`given_name`, `family_name`	string
`name`	string	The display name.
`picture`	URL
`provider`	string	How the account signs in (`google`, …).
`labels`	object[]	The directory groups the user carries in the token’s tenant. Always empty for a console token, because labels belong to tenants.

Errors

Status	`error`	When
`401`	`unauthorized`	No token, or an invalid, expired or ended one. See Authentication.
`404`	`user_not_found`	The account was deleted after the token was minted.

Example

curl https://acme.loginwith.dev/users/me \
  -H "Authorization: Bearer eyJ…"