---
title: "Proxy: day + month call counters for an org (Next.js dashboard)"
method: GET
path: "/internal/account/usage"
tags: ["internal"]
---

# Proxy: day + month call counters for an org (Next.js dashboard)

`GET /internal/account/usage`

Validates the end-user's Supabase token via auth.get_user (catches revocation; no new dep or secret). Derives the org server-side from the verified user id — never trusts a caller-supplied org_id (closes the IDOR). Still gated by X-Internal-Secret as defense-in-depth (only the Vercel proxy reaches this).

## Headers

- `X-User-Token` string, nullable
- `x-internal-secret` string, nullable

## Response `200`

Successful Response

- UsagePublic
  - `calls_today` integer, required
  - `calls_this_month` integer, required
  - `active_streams` integer, nullable
  - `max_streams` integer, nullable

## Other responses

- `422` — Validation Error

---

[API](https://skmtc.net/goldprice/apis/gold-api.md) · [All operations](https://skmtc.net/goldprice/apis/gold-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/goldprice/gold-api/revisions/5e6518098e6e/schema)