---
title: Identity
description: Identity protocol schemas
---

{/* ⚠️  AUTO-GENERATED — DO NOT EDIT. Run build-docs.ts to regenerate. Hand-written docs go in content/docs/guides/. */}

Identity & User Model Specification

Defines the standard user, account, and session data models for ObjectStack.

These schemas represent "who is logged in" and their associated data.

This is separate from authentication configuration (auth.zod.ts) which

defines "how to login".

<Callout type="info">
**Source:** `packages/spec/src/identity/identity.zod.ts`
</Callout>

## TypeScript Usage

```typescript
import { Account, ApiKey, Session, User, VerificationToken } from '@objectstack/spec/identity';
import type { Account, ApiKey, Session, User, VerificationToken } from '@objectstack/spec/identity';

// Validate data
const result = Account.parse(data);
```

---

## Account

### Properties

| Property | Type | Required | Description |
| :--- | :--- | :--- | :--- |
| **id** | `string` | ✅ | Unique account identifier |
| **userId** | `string` | ✅ | Associated user ID |
| **type** | `Enum<'oauth' \| 'oidc' \| 'email' \| 'credentials' \| 'saml' \| 'ldap'>` | ✅ | Account type |
| **provider** | `string` | ✅ | Provider name |
| **providerAccountId** | `string` | ✅ | Provider account ID |
| **refreshToken** | `string` | optional | OAuth refresh token |
| **accessToken** | `string` | optional | OAuth access token |
| **expiresAt** | `number` | optional | Token expiry timestamp (Unix) |
| **tokenType** | `string` | optional | OAuth token type |
| **scope** | `string` | optional | OAuth scope |
| **idToken** | `string` | optional | OAuth ID token |
| **sessionState** | `string` | optional | Session state |
| **createdAt** | `string` | ✅ | Account creation timestamp |
| **updatedAt** | `string` | ✅ | Last update timestamp |


---

## ApiKey

### Properties

| Property | Type | Required | Description |
| :--- | :--- | :--- | :--- |
| **id** | `string` | ✅ | API key identifier |
| **name** | `string` | ✅ | API key display name |
| **start** | `string` | optional | Key prefix for identification |
| **prefix** | `string` | optional | Custom key prefix |
| **userId** | `string` | ✅ | Owner user ID |
| **organizationId** | `string` | optional | Scoped organization ID |
| **expiresAt** | `string` | optional | Expiration timestamp |
| **createdAt** | `string` | ✅ | Creation timestamp |
| **updatedAt** | `string` | ✅ | Last update timestamp |
| **lastUsedAt** | `string` | optional | Last used timestamp |
| **lastRefetchAt** | `string` | optional | Last refetch timestamp |
| **enabled** | `boolean` | ✅ | Whether the key is active |
| **rateLimitEnabled** | `boolean` | optional | Whether rate limiting is enabled |
| **rateLimitTimeWindow** | `integer` | optional | Rate limit window (ms) |
| **rateLimitMax** | `integer` | optional | Max requests per window |
| **remaining** | `integer` | optional | Remaining requests |
| **permissions** | `Record<string, boolean>` | optional | Granular permission flags |
| **scopes** | `string[]` | optional | High-level access scopes |
| **metadata** | `Record<string, any>` | optional | Custom metadata |


---

## Session

### Properties

| Property | Type | Required | Description |
| :--- | :--- | :--- | :--- |
| **id** | `string` | ✅ | Unique session identifier |
| **sessionToken** | `string` | ✅ | Session token |
| **userId** | `string` | ✅ | Associated user ID |
| **activeOrganizationId** | `string` | optional | Active organization ID for context switching |
| **expires** | `string` | ✅ | Session expiry timestamp |
| **createdAt** | `string` | ✅ | Session creation timestamp |
| **updatedAt** | `string` | ✅ | Last update timestamp |
| **ipAddress** | `string` | optional | IP address |
| **userAgent** | `string` | optional | User agent string |
| **fingerprint** | `string` | optional | Device fingerprint |


---

## User

### Properties

| Property | Type | Required | Description |
| :--- | :--- | :--- | :--- |
| **id** | `string` | ✅ | Unique user identifier |
| **email** | `string` | ✅ | User email address |
| **emailVerified** | `boolean` | ✅ | Whether email is verified |
| **name** | `string` | optional | User display name |
| **image** | `string` | optional | Profile image URL |
| **createdAt** | `string` | ✅ | Account creation timestamp |
| **updatedAt** | `string` | ✅ | Last update timestamp |


---

## VerificationToken

### Properties

| Property | Type | Required | Description |
| :--- | :--- | :--- | :--- |
| **identifier** | `string` | ✅ | Token identifier (email or phone) |
| **token** | `string` | ✅ | Verification token |
| **expires** | `string` | ✅ | Token expiry timestamp |
| **createdAt** | `string` | ✅ | Token creation timestamp |


---

