Authentication API Live

Endpoints for verifying the current token, fetching the bound agent, and revoking sessions. For login, signup, and password reset see Auth (signup, login, logout).

Who am I

Returns the agent record bound to the current bearer token, including role, channel scope, and the current tokenVersion. Use this for client-side hydration after page load.

Response shape

{
  "agent": {
    "id": "uuid",
    "email": "[email protected]",
    "name": "Alex Lee",
    "role": "admin",
    "channels": ["chat", "ticket", "call"],
    "workspaceId": "uuid",
    "tokenVersion": 7
  }
}

Code samples

curl 'https://app.message.com/api/v1/auth/me' \
  -H 'Authorization: Bearer YOUR_WORKSPACE_JWT'

const res = await fetch('https://app.message.com/api/v1/auth/me', {
  headers: { Authorization: 'Bearer ' + token }
});
const { agent } = await res.json();

import requests
r = requests.get(
    "https://app.message.com/api/v1/auth/me",
    headers={"Authorization": f"Bearer {token}"},
)
agent = r.json()["agent"]

require "net/http"
require "json"
uri = URI("https://app.message.com/api/v1/auth/me")
res = Net::HTTP.start(uri.host, uri.port, use_ssl: true) do |http|
  req = Net::HTTP::Get.new(uri)
  req["Authorization"] = "Bearer #{token}"
  http.request(req)
end
agent = JSON.parse(res.body)["agent"]

<?php
$ctx = stream_context_create([
  "http" => ["method" => "GET", "header" => "Authorization: Bearer $token"]
]);
$body = file_get_contents("https://app.message.com/api/v1/auth/me", false, $ctx);
$agent = json_decode($body, true)["agent"];

Workspace bound to current agent

Returns the full workspace record for the token-bound agent. Used by the dashboard to render the workspace switcher, brand settings, and the channel matrix. See Workspaces API for the shape.

Verify a token

Returns { "valid": true } on a fresh, non-revoked token. Returns 401 otherwise. Cheap (no DB read on success); use it from middleware that needs a thumbs-up without pulling the full agent record.

Refresh a token

Exchanges a still-valid token for a fresh one with a reset 7-day clock. Useful when the agent has been actively using the dashboard and you want to extend the session without forcing a password prompt.

Logout everywhere

Bumps the agent's tokenVersion. Every live token signed against the old counter is invalidated the next time it hits an authenticated route. Returns 204 No Content on success.

API keys (planned)

Planned Endpoints for issuing, listing, and revoking workspace-scoped API keys are committed for Q2 2026. The planned routes are:

• GET/api/v1/api-keysAuth: Bearer
• POST/api/v1/api-keysAuth: Bearer
• DELETE/api/v1/api-keys/:idAuth: Bearer

Errors

Common pitfalls

• Caching /auth/me too aggressively. Role and channel scope change at the speed of the workspace owner editing the team page. Cache for tens of seconds, not minutes.
• Treating logout as device-local. It is global; design your dashboard to handle "logged out elsewhere" gracefully.
• Embedding the JWT in static HTML. Never. JWTs are agent credentials. The widget bundle uses a separate anonymous identifier.