/api/developer/me
Takes the same pair as every other call, and answers with the account they resolve to.
This is how the console's Verify button works: a 200 means the backend accepted both halves together, a 401 means it did not. The verdict is the status code — there is nothing to compare client-side.
It did not always work that way. This call used to accept the bearer token alone and answer with the matching apiToken, which made it a credential oracle: anyone holding a leaked bearer token could ask for the other half and complete the pair, defeating the point of requiring both. It now requires both and returns neither.
The exact envelope is owned by the backend, so the console reads type and name leniently — a nested caller object works just as well as the flat shape documented here.
https://dashboard.a2bsample.com/api/developer/meAuthorizationandX-Api-Tokenas headers./api/developer/mehttps://dashboard.a2bsample.com/api/developer/meSend a request to see the response.
Example request
Request
Headers3
AuthorizationstringrequiredThe secret half of the credential pair. Bearer clt_… for a client caller, Bearer vnd_… for a vendor caller — the four-character prefix says which table to resolve it in, so the row it matches is the caller. DeveloperApiAuthFilter resolves it before any handler runs.
X-Api-TokenstringrequiredThe identity half — this caller's own 40-hex apiToken, issued alongside the bearer token and handed over with it. Compared in constant time against the bearer token's own row by DeveloperApiAuthFilter, before any handler runs, so a bearer token lifted on its own is not enough to call anything here. There is no endpoint that will tell you this value — an integrator who has lost it asks for the pair to be regenerated.
AcceptstringoptionalResponse media type.
Responses
The account this credential pair resolves to.
successboolean- Whether the call succeeded.
typestring- Which side of the marketplace this token calls from. Decided by the token prefix, not by anything the caller sends.
idstring<uuid>- The caller's own id. Never accepted as a parameter anywhere — every handler takes it from the token.
namestring- Company name, for display.