Read Who Is Signed In

A page on a registered aidenkt.com origin can ask who is signed in, with the visitor’s cookie:

const r = await fetch("https://accounts.aidenkt.com/api/whoami", { credentials: "include" });
const me = r.ok ? await r.json() : null; // 401: nobody is signed in

{
  "signedIn": true, "id": "9f2c…", "kind": "user", "displayName": "Aiden", "handle": "aiden",
  "avatarUrl": "https://accounts.aidenkt.com/media/…", "bannerUrl": "https://accounts.aidenkt.com/media/…",
  "isOwner": false, "permissions": ["brand.materials", "role.friend"], "badges": ["friend"],
  "apps": [{ "id": "…", "name": "Notes", "href": "https://notes.aidenkt.com/", "iconUrl": null, "builtin": null, "color": "kt-green", "accent": "#15DD7D" }]
}

Signed out, the answer is 401 {"signedIn": false}. GET /v1/me is the same endpoint.

The Fields

Field
id	The person’s KT Accounts ID. The same value is sub in OpenID Connect
kind	user or agent
displayName	"" when unset
handle	Can be null
avatarUrl, bannerUrl	Images served by KT Accounts
isOwner	true for Aiden
permissions	Named permissions, including the role.<badge> ones. See Roles and Permissions
badges	Badge keys in display order: aiden, sysadmin, partner, friend, developer, agent, test
apps	The person’s Your Apps tiles in order, already filtered by each app’s audience. Left out when the apps cannot be read

It never includes an email address, a session, a token, an IP address or sign-in providers.

displayName and handle are typed by the person, and <, > and & are allowed in a display name. Escape them before putting them into HTML (textContent and JSX do it for you).

What It Is For

What a page shows or hides with this is presentation only. A site’s own server does not receive the KT Accounts session cookie: it is sent only to accounts.aidenkt.com. For anything that matters on a server, use OpenID Connect and keep your own session.

Rate limit: 120 requests a minute per IP address.