Readable identity debugging with Authdog CLI /whoami

Identity debugging usually starts with one question: who does the server actually think I am? Authdog CLI answers that from the authenticated API itself, rather than leaning only on whatever a locally decoded token claims.

Type /whoami or /me inside authdog-cli and you'll get your answer.

It asks the userinfo endpoint directly

The command calls authenticated GET /v1/userinfo with your current access token, which gives the CLI a server-provided view of your identity and session, not just a guess based on local state.

The response comes in two forms:

• Pretty groups fields into readable sections and tables.
• Raw shows indented JSON if you want the exact shape.

Tab and Shift-Tab switch between them, and both keyboard and mouse-wheel scrolling keep larger responses usable inside the fullscreen interface.

Token fields, made readable

When identity data contains JWT-shaped values, shared formatting helpers decode the payload for display. Timestamps turn into readable dates, expired ones get flagged, and noisy session identifiers can be suppressed from the formatted view so you're not wading through noise.

One thing worth being explicit about: decoded doesn't mean verified. The local JWT helper reads payload claims for display purposes only. It doesn't check the signature. Trust decisions still live entirely with Authdog's APIs and whatever token verification you've correctly configured in your application.

Raw output stays in context, on purpose

The Raw view is genuinely useful for comparing the exact API response against the formatted one, but for now the beta keeps both inside its terminal UI. It doesn't emit stable JSON to stdout for pipelines like jq yet.

That's a deliberate choice, not a gap we forgot to fill. It avoids locking in a fragile automation contract while the data shape and command model are still evolving underneath it.

When something looks off, check the surrounding state

If an identity looks unexpected, pair /whoami with /status. Status shows the credential path along with the active organization, tenant, project, and environment selections, plus token lengths and limited previews rather than full credentials.

For a quick current-user check, the workflow is short:

1. /login to establish a session.
2. /whoami to inspect the server-provided identity.
3. Switch between Pretty and Raw views as needed.
4. /status to confirm the resource scope.
5. /logout when the local session should go away.

None of this is meant to replace protocol-level tooling. It's meant to make the identity check you run most often fast and easy to read.