---
title: "Auth Me"
method: GET
path: "/api/auth/me"
tags: ["auth", "billing"]
---

# Auth Me

`GET /api/auth/me`

## Request

- Base URL: `https://www.oxfordledge.com` (the document declares no server; this is the origin it was published from)
- URL: `https://www.oxfordledge.com/api/auth/me`
- Auth: none declared

Return current authenticated user info, tier, and CSRF token.

Mirrors the existing _handle_auth_me logic exactly:
- Checks trial status via billing module
- Returns tier (free / plus_trial / plus / pro / etc.)
- Extracts CSRF token from cookie for JS to use in X-CSRF-Token header

Also issues an anon CSRF token to unauthenticated callers — SSR
pages (e.g. /learn/<course>/<module>/) need this so the quiz-submit
flow can satisfy `validate_csrf` before sign-in. Symmetric to
`/api/auth/challenge`.

## Response `200`

Successful Response

- AuthMeResponse: Response shape for GET /api/auth/me (anon + authenticated branches).
  - `authenticated` boolean, required: True iff the request carried a valid session.
  - `csrf_token` string, required: CSRF token for the X-CSRF-Token header. Set on both anonymous and authenticated branches; anonymous callers also receive a fresh `ol_csrf` cookie scoped 1h.
  - `user` AuthMeUser
    - `id` unknown
    - `email` string, nullable
    - `displayName` string, nullable
    - `provider` string, nullable
    - `is_admin` boolean, nullable
    - `oauth_age_pending` boolean, nullable
  - `tier` string, nullable
  - `effective_tier` string, nullable
  - `consumer_tier` string, nullable
  - `agent_plan` string, nullable
  - `trial_active` boolean, nullable
  - `trial_days_remaining` integer, nullable
  - `terms_reacceptance_required` boolean, nullable
  - `terms_version_user` string, nullable
  - `terms_version_current` string, nullable
  - `consent_status` string, nullable: Parental consent for a 13-17 account: null when none is needed, else 'confirmed', 'pending' (a live approval link is with the parent) or 'needed' (no approval and no live link; the client offers to send the request again).

---

[API](https://skmtc.dev/oxfordledge/apis/oxford-ledge-api.md) · [All operations](https://skmtc.dev/oxfordledge/apis/oxford-ledge-api/llms.txt) · [OpenAPI document](https://skmtc.dev/oxfordledge/apis/oxford-ledge-api/revisions/e832a1260f0b?raw)