# Authentication

export const whoamiCurl = `curl https://api.afterlib.com/v1/whoami \\
  -H "Authorization: Bearer al_live_replace_me"`;

export const whoamiJs = `const response = await fetch('https://api.afterlib.com/v1/whoami', {
  headers: {Authorization: 'Bearer al_live_replace_me'},
});

const identity = await response.json();`;

export const whoamiTs = `type WhoamiRequest = Record<string, never>;

const request: WhoamiRequest = {};

const response = await fetch('https://api.afterlib.com/v1/whoami', {
  headers: {Authorization: 'Bearer al_live_replace_me'},
});

const identity = await response.json();`;

export const whoamiPhp = `$response = file_get_contents('https://api.afterlib.com/v1/whoami', false, stream_context_create([
  'http' => [
    'header' => 'Authorization: Bearer al_live_replace_me',
  ],
]));

$identity = json_decode($response, true);`;

export const whoamiPython = `import json
import urllib.request

request = urllib.request.Request(
    'https://api.afterlib.com/v1/whoami',
    headers={'Authorization': 'Bearer al_live_replace_me'},
)

with urllib.request.urlopen(request) as response:
    identity = json.loads(response.read().decode('utf-8'))`;

Send your API key as a Bearer token:

<ApiExampleTabs curl={whoamiCurl} javascript={whoamiJs} typescript={whoamiTs} php={whoamiPhp} python={whoamiPython} />

The response includes the connected account id, billing account id, current plan state, display name, and primary email address.

```json
{
	"authenticated": true,
	"authSource": "api_key",
	"user": {
		"userId": "00000000-0000-7001-8001-aa0000000001",
		"billingUserId": "00000000-0000-7001-8001-aa0000000001",
		"name": "Ada Lovelace",
		"emailAddress": "ada@example.com",
		"planId": "pro",
		"isTeamMember": false,
		"subscriptionStatus": "active"
	},
	"apiKey": {
		"id": "019e6387-e2e9-7478-9d6d-170158c523b0",
		"name": "Claude Desktop",
		"keyPrefix": "al_live_abc12345"
	},
	"oauthClientId": null
}
```

`user.name` and `user.emailAddress` are nullable. They are returned from the connected AfterLib identity when available.

## Key format

Live keys begin with `al_live_`. Treat them like passwords.

Do not send keys in query strings. Query strings are commonly logged by proxies, browsers, and support tools.

## Access

Keys created in the Developer Portal use the standard AfterLib API access set.

## Revocation

Revoke keys from the Developer Portal. Revoked keys stop working immediately.