---
title: "Get authentication context"
method: GET
path: "/auth/context"
tags: ["Authentication"]
---

# Get authentication context

`GET /auth/context`

Returns the authenticated principal, organization, credential scope, and effective request scope. The response is derived from the verified request context and does not expose credential secrets.

## Response `200`

Authentication context for the current request

- AuthContext — The identity and authorization context resolved for the current request.
  - `authentication` AuthContextAuthentication, required
    - `credential_id` string, nullable, required — The API key ID when authenticated with an API key; null for session credentials.
    - `method` 'api_key' | 'jwt', required — The credential format used to authenticate the request.
    - `source` 'api_key' | 'oauth' | 'dashboard', required — The source classification resolved by authentication middleware.
  - `authorization` AuthContextAuthorization, required — The credential's maximum scope and the effective scope selected for this request. Future permission data can be added without changing scope semantics.
    - `credential_scope` AuthContextScope, required — A scope within the authenticated organization. A null project_id represents organization-wide scope.
      - `project_id` string, nullable, required — The Kernel project ID, or null when the scope is organization-wide.
    - `effective_scope` AuthContextScope, required — A scope within the authenticated organization. A null project_id represents organization-wide scope.
      - `project_id` string, nullable, required — The Kernel project ID, or null when the scope is organization-wide.
  - `organization` AuthContextOrganization, required
    - `id` string, required — The authenticated Kernel organization ID.
  - `principal` AuthContextPrincipal, required
    - `id` string, required — The API key ID for API-key principals or user ID for user principals.
    - `type` 'api_key' | 'user', required — The kind of principal authenticated for the request.

## Other responses

- `401` — Unauthorized – missing or invalid authorization token
- `500` — Internal Server Error

---

[API](https://skmtc.net/onkernel/apis/kernel-api.md) · [All operations](https://skmtc.net/onkernel/apis/kernel-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/onkernel/kernel-api/revisions/858365328f92/schema)