apivault whoami
The apivault whoami command shows which identity the CLI is using — your account or a service token — so you can check before running anything that changes keys.
Usage
apivault whoami
Prints the signed-in user and when this device's token expires. With fewer than 14 days left, the expiry line is highlighted as a reminder to run apivault login again.
Service tokens
When APIVAULT_TOKEN is set, whoami prints the token's name, project, scopes and environment pin instead of an email address. Because that variable wins over a stored device token, this is the quickest way to find out which credential a shell or pipeline picked up. See checking which credential you picked up.
JSON output
With --json, a signed-in user is returned with the expiry as tokenExpiresAt (null for tokens issued before expiry existed), which is the field to check from a scheduled job. When nobody is signed in it returns {"authenticated": false}.
apivault --json whoami | jq -r ".tokenExpiresAt"
Global options
apivault whoami also accepts the global options, including --json.