Authentication

Send your API key as a Bearer token:

curl

curl https://api.afterlib.com/v1/whoami \
  -H "Authorization: Bearer al_live_replace_me"

JavaScript

const response = await fetch('https://api.afterlib.com/v1/whoami', {
  headers: {Authorization: 'Bearer al_live_replace_me'},
});

const identity = await response.json();

TypeScript

type WhoamiRequest = Record<string, never>;

const request: WhoamiRequest = {};

const response = await fetch('https://api.afterlib.com/v1/whoami', {
  headers: {Authorization: 'Bearer al_live_replace_me'},
});

const identity = await response.json();

PHP

$response = file_get_contents('https://api.afterlib.com/v1/whoami', false, stream_context_create([
  'http' => [
    'header' => 'Authorization: Bearer al_live_replace_me',
  ],
]));

$identity = json_decode($response, true);

Python

import json
import urllib.request

request = urllib.request.Request(
    'https://api.afterlib.com/v1/whoami',
    headers={'Authorization': 'Bearer al_live_replace_me'},
)

with urllib.request.urlopen(request) as response:
    identity = json.loads(response.read().decode('utf-8'))

The response includes the connected account id, billing account id, current plan state, display name, and primary email address.

{
  "authenticated": true,
  "authSource": "api_key",
  "user": {
    "userId": "00000000-0000-7001-8001-aa0000000001",
    "billingUserId": "00000000-0000-7001-8001-aa0000000001",
    "name": "Ada Lovelace",
    "emailAddress": "ada@example.com",
    "planId": "pro",
    "isTeamMember": false,
    "subscriptionStatus": "active"
  },
  "apiKey": {
    "id": "019e6387-e2e9-7478-9d6d-170158c523b0",
    "name": "Claude Desktop",
    "keyPrefix": "al_live_abc12345"
  },
  "oauthClientId": null
}

user.name and user.emailAddress are nullable. They are returned from the connected AfterLib identity when available.

Key format

Live keys begin with al_live_. Treat them like passwords.

Do not send keys in query strings. Query strings are commonly logged by proxies, browsers, and support tools.

Access

Keys created in the Developer Portal use the standard AfterLib API access set.

Revocation

Revoke keys from the Developer Portal. Revoked keys stop working immediately.