Identity and authority
Session status and live organiser and platform authority checks.
The API owns Better Auth sessions. A session proves identity only; organiser and platform access is re-read from live records on every protected operation. Removing a role therefore takes effect without waiting for a token to expire.
| Operation | Access | Result |
|---|---|---|
GET /api/me | Session | The authenticated user. |
GET /api/identity/status | Public; session optional | Authentication, onboarding, and configured Google sign-in availability. |
GET /api/identity/membership | Organiser session | The selected live organisation membership and all eligible memberships. Optional organizationId must itself be authorised. |
GET /api/identity/platform-admin | Platform session | The independently provisioned platform administrator. |
GET /api/viewer | Public; session optional | First-party navigation state, organiser affordances, and unread count. |
Missing sessions return 401; authenticated callers outside the required live
scope return 403. Crew scanner access is not organiser-console access, and an
organiser administrator is not a platform administrator.
Better Auth's sign-in, callback, and session-management routes are SDK internals, not public consumer operations. See Internal endpoints.
Invited team passwords
POST /api/crew/password sets a password after the invited email has been verified and the team invitation accepted. Existing passwords require currentPassword; the new password and confirmation must match and contain 12–128 characters. A recent authenticated session and live organisation membership are required. The response is { "ok": true }. Visitors continue to use email OTP or enabled Google sign-in; public password sign-up is disabled.