curl --request GET \
--url https://api.mnemom.ai/v1/auth/session \
--cookie mnemom_session={
"user": {
"id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"email": "jsmith@example.com",
"app_metadata": {},
"user_metadata": {}
}
}Minimal whoami endpoint. Returns { user } when the mnemom_session cookie is valid; returns 401 otherwise. Preferred over GET /auth/me for cookie-only browser sessions — /auth/me is bearer-only and preserves its legacy response shape unchanged.
curl --request GET \
--url https://api.mnemom.ai/v1/auth/session \
--cookie mnemom_session={
"user": {
"id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"email": "jsmith@example.com",
"app_metadata": {},
"user_metadata": {}
}
}HttpOnly, Secure, SameSite=Lax cookie issued by /v1/auth/sign-in (or the SSO / email-callback flows). The value is an AES-256-GCM-encrypted blob of {access_token, refresh_token, issued_at, auth_method}. Browser clients include this automatically with credentials: "include".
Authenticated session.
Supabase user shape. Fields beyond id and email are passthrough.
Show child attributes