Account API
How a brand's own app lets a signed-in person manage their own account.
The account API lets a signed-in person see and change their own account at one brand: their profile and metadata, their sessions and sign-ins, their passkeys, and the deletion of their account. It lives at /me on the brand's issuer, such as https://acme.auth.synq.build/me, and only the brand's own apps may call it.
Authentication
Send Authorization: Bearer <access token>, with an access token from the brand's issuer for the account API: ask for it with resource=<issuer>/me when the person signs in. Each route needs one of the account API's scopes, and the routes that add or remove a way to sign in also want a recent sign-in: their reference says so, and the answer is fresh_sign_in_required when it is too old.
Errors
Errors are problem documents (RFC 9457) with a stable code, the same as the management API's: see every error code.
webhook.updated Webhook
Sent to each subscription that wants it, with `webhook-id`, `webhook-timestamp` and `webhook-signature` (Standard Webhooks). Answer 2xx within 10 seconds; anything else is tried again, 6 times in all.
Revoke an API key DELETE
At once: its API's next check of it answers `active: false`. Needs `me:write`. Recorded as `user.api_key_revoked`.