Introspect the calling API key: user identity, owning app, scope, USDC balance and remaining spend allowance — one call.

GET /api/v1/apps/me

Introspect the calling API key: user identity, owning app, scope, USDC balance and remaining spend allowance — one call.

cURL

curl --request GET \
  --url https://api.example.com/api/v1/apps/me \
  --header 'x-api-key: <x-api-key>'

200

{
  "email": "<string>",
  "balance": 123,
  "spendLimit": 123,
  "appId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
  "appName": "<string>",
  "name": "<string>",
  "scope": []
}

Headers

x-api-key · string · required

Response

200

application/json

Successful Response

Everything an API-key client needs to know about itself in one call.

Returned by GET /apps/me. Avoids the older multi-step dance of GET /user + GET /apps/{id} + GET /balance for callers (e.g. the CLI) that only have an X-Api-Key and want to introspect.

email · string · required

balance · number · required

spendLimit · number · required

appId · string<uuid> · required

appName · string · required

name · string | null

scope · enum<string>[]

Allowed values for ApiAppAccess.scope.

Each entry is the lowercased form of a FastAPI route tag — scope enforcement (_enforce_api_app_scope in app/dependencies.py) intersects the api-key's scopes with the calling route's tags case-insensitively. Stored that way so admins editing an app's access.scope see a stable, predictable set of values.

Adding a new router tag? Add it here too so issued keys can target it.

Available options: apps, apps-transfer, balance, transfer requests, banks, cards, transactions, exports, merchant, contracts, invoices, documents, user, team, chat, devices, referrals, public, mcp, xero, admin, admin sso, kybagent, b2b, incorporate, 2fa, auth, activity, tee, tee-local, utils, webhook