> ## Documentation Index
> Fetch the complete documentation index at: https://docs.bota.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Credential identity

> Resolve the current project developer key and its granted scopes

> [!NOTE]
>
> This authored guide describes the packaged CLI/MCP compatibility source preview.
> It does not extend this site's published OpenAPI projection. Additional REST
> schema publication and matching-backend availability remain separate.
>
> The public [CLI `0.2.0-beta.0` cohort](https://docs.bota.dev/cli) includes `bota auth status`.
> This endpoint and hosted `get_project_identity` still require a compatible
> deployed backend. Client package delivery, endpoint/tool qualification and
> docs-site promotion have separate release checks.

`GET /v1/auth/identity` returns the authenticated project credential's context.
Secret and restricted project keys can call it without a business-resource
scope. A restricted key with only `devices:read`, only `integrations:read`, or
an empty scope list can check its own identity without reading end users.

Device, upload, reset-completion and end-user credentials cannot use this
developer operation. Ordinary authentication, expiry/revocation, organization
quarantine and rate limits still apply. The successful response is not cached
(`Cache-Control: no-store`).

| Field | Meaning |
| - | - |
| `project_id`, `organization_id` | Verified project and organization identifiers |
| `key_id` | Database credential identifier; never the reusable key or a key hint |
| `key_type` | `secret` or `restricted` |
| `is_test_mode` | Stored credential flag; does not certify isolated test data or billing |
| `scope_mode` | `project_secret` for existing broad project-key admission, or `restricted` |
| `scopes` | `null` for a secret key; the stored grant strings for a restricted key, including `[]` when none are granted |

These are current credential facts. A listed scope does not bypass operation
ownership, feature, policy or billing checks. The response does not identify a
human Platform account or claim OAuth delegation, an expiry time, or access to
another project.

Use [CLI status](https://docs.bota.dev/cli.md#check-status) for terminal output. Hosted MCP exposes the
same fields through `get_project_identity`; `bota mcp --mode hosted` discovers
that tool from a compatible backend. The default legacy local mode retains
its existing tool set.

An HTTP 401 means authentication failed. HTTP 403 means this credential tier
is not permitted, 423 means organization access is quarantined, and 429 means
the check is rate limited. A missing endpoint on an older backend, service
failure or malformed response does not establish that the key was revoked.
The CLI reports failure without falling back to an unrelated resource read.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.