> ## Documentation Index
> Fetch the complete documentation index at: https://docs.axon402.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Auth Context

> Introspect the org, wallet, and scopes resolved from the current credential

Returns the auth context resolved from the current `Authorization` header. Used by `@axon402/cli` at `auth login` to show the operator which org an API key belongs to, and which signing mode the org runs in.

## Authentication

Accepted credentials:

* A database-backed tenant API key (`axon_sk_*`)
* A platform JWT (Supabase user access token) when `AXON_PLATFORM_AUTH_ENABLED=true`

```http theme={null}
GET /v1/me
Authorization: Bearer <api-key-or-jwt>
```

No request body.

> [!NOTE]
>
> The static operator key (`AXON_DECISION_API_KEY`) authenticates successfully, but `GET /v1/me` still returns `404 NOT_FOUND` because that key is not bound to an organization.

## Response

```json theme={null}
{
  "auth_mode": "api_key",
  "surface": "runtime",
  "organization": {
    "id": "uuid",
    "name": "Example Corp",
    "signing_mode": "full"
  },
  "wallet": {
    "id": "uuid",
    "role": "agent_pocket"
  },
  "scopes": ["read", "write"]
}
```

### Fields

| Field | Type | Description |
| :- | :- | :- |
| `auth_mode` | `"api_key" \| "platform"` | How the caller authenticated |
| `surface` | `"runtime" \| "operator"` | Capability surface resolved from the credential |
| `organization.id` | `string` | UUID of the org the caller is acting on |
| `organization.name` | `string` | Display name of the org |
| `organization.signing_mode` | `"full" \| "browser"` | Resolved from the org vault wallet mode |
| `wallet` | `object \| null` | The bound wallet for wallet-scoped keys, otherwise `null` |
| `wallet.id` | `string` | Wallet UUID |
| `wallet.role` | `"agent_pocket" \| "vault"` | The wallet's role in the org |
| `scopes` | `string[]` | API-key scopes. Platform sessions return `[]`. |

## Signing mode resolution

`organization.signing_mode` is derived from the organization's **vault wallet** `wallet_mode`:

* `wallet_mode = 'full'` on the vault → `signing_mode = "full"` (server holds the vault private key, can allocate from vault to pockets)
* `wallet_mode = 'browser'` on the vault → `signing_mode = "browser"` (user's browser holds the key, vault allocation is unavailable, all funding goes via external deposit)

Clients can use this field to decide whether to show "Allocate from Vault" as an option in a UI, or to short-circuit a `POST /v1/wallets/:id/fund` call that would otherwise fail with `VAULT_ALLOCATION_UNAVAILABLE`.

## Multi-org platform sessions

If the caller is using a Supabase JWT (`auth_mode: "platform"`) and the user has memberships in more than one organization, **v1 returns the first organization in the membership map**. Disambiguation via a `?organization_id=` query parameter is tracked as a follow-up.

For deterministic multi-org operator tooling, use API keys instead — each API key is bound to exactly one organization at mint time. Check `surface` if you need to decide whether a credential should be routed to the runtime surface or the operator/manage surface.

## Errors

* **`401` `UNAUTHENTICATED` / `INVALID_API_KEY`**: missing or invalid bearer token
* **`404 NOT_FOUND`**: no organization is associated with the auth context, or the resolved organization no longer exists

## Example: `axon-op auth login` flow

```text theme={null}
$ axon-op auth login --api-key axon_sk_abc…
→ GET /v1/me
← 200 { auth_mode: "api_key", organization: { id: "…", name: "Example", signing_mode: "full" }, … }

✓ Signed in as Example (full signing mode).
  Scopes: read, write
  Credential stored in ~/.axon/operator.json (chmod 0600)
```

## See also

* [`@axon402/cli`](https://docs.axon402.com/docs/cli/installation#step-2-the-operator-cli) — the primary caller
* [POST /v1/api-keys](https://docs.axon402.com/docs/api-reference/organizations/create-api-key.md) — mint a credential this endpoint can introspect
* [Authentication](https://docs.axon402.com/docs/operations/authentication.md) — overall auth model for the Decision API


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.