---
title: "Fill in a name and photo from a Google ID token"
method: POST
path: "/api/account/identity"
tags: ["Account"]
---

# Fill in a name and photo from a Google ID token

`POST /api/account/identity`

Posts the raw Google ID token minted by the sign-in button. The server verifies the signature with Google, checks the audience is Result's own client and that the token's email matches the session, then fills in the profile's display name and avatar ONLY where they are still empty — a name typed in Settings is never overwritten by a later sign-in. Returns the resulting values whether or not anything was written.

## Request body

- object
  - `idToken` string, required — The `credential` from Google Identity Services, unmodified. It is verified server-side; never decode it client-side.

## Response `200`

The profile's name and photo after the call.

- object
  - `data` Identity, required
    - `displayName` string, nullable, required — The person's name, or null if still unknown.
    - `avatarUrl` string, uri, nullable, required — A photo URL on Google's own image host, or null. Never an arbitrary origin.

## Other responses

- `400` — The request body did not match the schema for this operation.
- `401` — No session token, or a token that is expired or invalid.
- `403` — The token is valid but does not authorize this operation.
- `500` — Something failed on our side. The response body says so and nothing more; the detail is in our logs.

---

[API](https://skmtc.dev/result/apis/result-api.md) · [All operations](https://skmtc.dev/result/apis/result-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/result/result-api/revisions/103d45168871/schema)