---
title: "Inspect the current management credential"
method: GET
path: "/credits/auth/credential"
tags: ["Authentication"]
---

# Inspect the current management credential

`GET /credits/auth/credential`

## Request

- Base URL: `https://api.paywithlocus.com/api`
- URL: `https://api.paywithlocus.com/api/credits/auth/credential`
- Auth: one of:
  - HTTP bearer
  - HTTP bearer

Returns only the authenticated credential kind, tenant, role, effective scopes, and current step-up state. Owner and admin dashboard sessions are step-up eligible; developer, billing, viewer, and secret-key principals are not. It never returns raw keys, hashes, JWT claims, or secrets. Call this before attempting a scoped management operation.

## Response `200`

Effective authorization context

- object
  - `success` unknown, required
  - `credential` object, required
    - `auth` 'secret_key' | 'cognito', required
    - `tenantId` string, uuid, required
    - `role` 'owner' | 'admin' | 'developer' | 'billing' | 'viewer', required: Owner and admin are workspace-administrator roles. Exactly one member holds owner; it moves only through the transfer-ownership operation, never through role updates or invitations.
    - `credentialId` string, nullable, required
    - `scopes` CreditsTenantScope[], required
    - `stepUpEligible` boolean, required
    - `stepUpFresh` boolean, required

## Other responses

- `401`: Missing, invalid, expired, or revoked management credential

---

[API](https://skmtc.dev/paywithlocus/apis/locus-pro-api.md) - [All operations](https://skmtc.dev/paywithlocus/apis/locus-pro-api/llms.txt) - [OpenAPI document](https://skmtc.dev/paywithlocus/apis/locus-pro-api/revisions/aab8fa5d6cef?raw)