Skip to main content
GET
Whether this account has a password and whether it is SSO-managed

Authorizations

Authorization
string
header
required

JWT Bearer token authentication. Include your access token in the Authorization header as: Bearer YOUR_ACCESS_TOKEN

Example:

Response

Credential state resolved

What the account-settings password form is allowed to render (FLO-2735 G-2).

Both fields are read live from auth.users on every call rather than folded into GET /profile/me. Two reasons: the profile response is fetched on every page load and this is needed on exactly one screen, and has_password changes the moment a first password is set — a value cached alongside the profile would keep showing "Set a password" to someone who just set one.

has_password
boolean
required

Whether the Supabase Auth record already has a password. Mirrors the user.HasPassword() guard GoTrue applies before enforcing Require Current Password, so the form asks for a current password exactly when GoTrue would demand one. False for a magic-link-only or freshly invited account, which sets its first password with no current password to give.

is_sso_managed
boolean
required

Whether the Supabase Auth record is SSO-managed (auth.users.is_sso_user). GoTrue refuses email/phone/password updates for these outright with user_sso_managed, so the form is not rendered at all rather than offered and then rejected. Defaults false so an unknown state still shows a form whose failure is at least explained.