<!-- section: Auth API · status: building · source: docs/auth-api/12-get-users.md -->

> List the accounts in a project, newest first, with a cursor and a last-seen time.


# Get users

## GET /v1/auth/users

**Secret key only.** This endpoint answers no CORS at all — listing other
people's accounts is exactly what must not be reachable from a browser, so there
is no preflight response for it. A secret key pasted into a frontend bundle still
cannot make this call.

```bash Request
curl "$BASE/v1/auth/users?limit=50" -H "authorization: Bearer $SK"
```

| Parameter | Notes |
|---|---|
| `limit` | How many to return; defaults to a sensible page |
| `before` | The `nextCursor` from the previous page |

```json Response
{
  "users": [
    {
      "id": "NrzmwycxFVpxrD8RSZqieT4iqpW24W9M",
      "email": "ada@example.com",
      "name": "Ada Lovelace",
      "emailVerified": false,
      "createdAt": "2026-08-17T14:22:39.655Z",
      "lastSeenAt": "2026-08-17T14:25:41.491Z"
    }
  ],
  "nextCursor": null
}
```

`nextCursor` is `null` on the last page. Pass it as `?before=` to continue.

## lastSeenAt

The last time a session of theirs was used, or `null` if they have never signed
in.

It is there so **you** can decide what counts as dormant — we do not bill on it,
and we do not act on it. Nothing here deactivates an account for being quiet.

## What this costs you

Auth is charged per user account stored, so this list is also the answer to "what
am I paying for". An account you [delete](/docs/auth-api/delete-users) stops
costing you at the next nightly count.

## Errors

| Status | Code | Means |
|---|---|---|
| `401` | — | Missing key, or a publishable key |
| `403` | — | The key is not scoped for `auth:read` |
| `503` | — | The project's auth database is still being created |