Auth API

building

List the accounts in a project, newest first, with a cursor and a last-seen time.

Get users

GET/v1/auth/users

Secret key only. This endpoint answers no CORS at all — listing other people's accounts is exactly what must not be reachable from a browser, so there is no preflight response for it. A secret key pasted into a frontend bundle still cannot make this call.

Request

1curl "$BASE/v1/auth/users?limit=50" -H "authorization: Bearer $SK"

Parameter	Notes
`limit`	How many to return; defaults to a sensible page
`before`	The `nextCursor` from the previous page

Response

1{2  "users": [3    {4      "id": "NrzmwycxFVpxrD8RSZqieT4iqpW24W9M",5      "email": "ada@example.com",6      "name": "Ada Lovelace",7      "emailVerified": false,8      "createdAt": "2026-08-17T14:22:39.655Z",9      "lastSeenAt": "2026-08-17T14:25:41.491Z"10    }11  ],12  "nextCursor": null13}

nextCursor is null on the last page. Pass it as ?before= to continue.

lastSeenAt

The last time a session of theirs was used, or null if they have never signed in.

It is there so you can decide what counts as dormant — we do not bill on it, and we do not act on it. Nothing here deactivates an account for being quiet.

What this costs you

Auth is charged per user account stored, so this list is also the answer to "what am I paying for". An account you delete stops costing you at the next nightly count.

Errors

Status	Code	Means
`401`	—	Missing key, or a publishable key
`403`	—	The key is not scoped for `auth:read`
`503`	—	The project's auth database is still being created