Identity

The identity behind this credential: what it is, the organization it is scoped to, and the scopes it currently holds.

user is present for an OAuth token and absent for an API key, which has an organization but no person behind it. credential.kind says which you are holding, so a client can branch without guessing from a missing field.

scopes is what the credential may do now, so a client can check before it calls.

{
  rc: string;
  user: {
    id: string;
    fullname?: string;
    email?: string;
  };
  org: {
    id: string;
  };
  scopes: string[];
}

{
  rc: string;
}

{
  rc: string;
}