# Your identity and credential (/api/identity/get-whoami)

`GET /api/whoami`

Who you are and which credential you presented (sling whoami). credential.type discriminates a session — a browser cookie or a device-flow bearer token — from an api-key caller, which also carries its key id and scopes.

Base URL: `https://runners.starsling.dev`

## Authentication

Requires a bearer token (`Authorization: Bearer`).

## Responses

| Status | Description |
| --- | --- |
| `200` | Who you are and which credential you presented. `credential.type` discriminates a session from an api-key caller. |
| `401` | No credential was sent, or the one sent is expired or revoked. Sign in with `sling login`. |
| `500` | The request was valid; the control plane or a dependency it calls failed. |

### `200` body

- `identity` — object, required
  - `userId` — string, required. e.g. `u_abc123`
  - `name` — string, required. e.g. `Ada Lovelace`
  - `email` — string, required. e.g. `ada@example.com`
  - `githubLogin` — string | null, required. e.g. `ada`
- `credential` — object, required
  - **Variant 1** — object
    - `type` — string, required. `session`
    - `expiresAt` — string | null, required
  - **Variant 2** — object
    - `type` — string, required. `apiKey`
    - `expiresAt` — string | null, required
    - `keyId` — string, required
    - `scopes` — object

### Example

```json
{
  "identity": {
    "userId": "u_abc123",
    "name": "Ada Lovelace",
    "email": "ada@example.com",
    "githubLogin": "ada"
  },
  "credential": {
    "type": "session",
    "expiresAt": "2026-08-19T09:41:00.000Z"
  }
}
```