Returns authenticated key metadata

GET 
/auth/me

Returns the authenticated identity of a request made with HTTP Basic Auth. Smoke test endpoint — for quickly verifying that the integration works.

RETURNED FIELDS (there is NO api_secret_hash or similar sensitive field):

• api_key_id: Internal numeric ID
• reseller_id: WHMCS tblclients.id (the reseller's client id)
• name: Key label
• permissions: Scope list (["orders:create", "*"])
• client_ip: IP of the client making this request (resolved via X-Forwarded-For trusted proxy resolver)
• last_used_at: Last time this key was used (RFC 3339)
• expires_at: Key expiry date (NULL = never)
• rate_limit_rpm: Legacy single-number override; affects only the default bucket (NULL = 60)
• rate_limits: EFFECTIVE per-minute limits per bucket ({"default":60,"services_read":150,"services_status":300,"services_changes":120})
• auto_apply_credit: POST /orders automatic balance charge toggle (true = default; if false the order returns pending_payment + notice=auto_apply_credit_disabled and the reseller pays the invoice manually). Changed via admin CLI: php bin/api-key-update.php <id> --auto-apply-credit=0|1

Responses

200

Authenticated, identity returned

Response Headers

X-RateLimit-Limit

The per-minute limit defined for this key

X-RateLimit-Remaining

Number of requests remaining in the current window

X-RateLimit-Reset

Unix epoch of the start of the next window (UTC seconds)

401

Authentication failed — missing header, invalid API key/secret, revoked or expired key.

Response Headers

WWW-Authenticate

RFC 7235 header — signals the Basic Auth requirement to the client

403

IP whitelist violation — the incoming IP is not in the key's allow list

429

Per-minute limit exceeded

Response Headers

Retry-After

Seconds to wait before retrying after a 429 (RFC 7231 §7.1.3)

X-RateLimit-Limit

The per-minute limit defined for this key

X-RateLimit-Remaining
X-RateLimit-Reset

Unix epoch of the start of the next window (UTC seconds)