# client.identity.me

> client.identity.me — the identity.me operations.

`client.identity.me` — the `identity.me` operations.

On `AsyncKindgi` every method is the same, awaited.

## `client.identity.me.second_factor()`

```python signature
second_factor(*, timeout: float | None = None) -> SecondFactorStatus
```

My second factor. `GET /v1/identity/me/second-factor`

Whether you have a second factor set up (an authenticator app), since when, how many recovery codes are left, and whether your workspace requires one. From a session only: `400 auth-not-session-token` with an API key. Mounted when the deployment keeps second factors (from 0.1.9).

## `client.identity.me.start_second_factor()`

```python signature
start_second_factor(
    body: SecondFactorProof | Mapping[str, Any] | None = None,
    /,
    *,
    idempotency_key: str | None = None,
    timeout: float | None = None,
    **fields: Any,
) -> SecondFactorKey
```

Start setting up a second factor. `POST /v1/identity/me/second-factor`

A new key for an authenticator app, shown this once: nothing changes until a code from it is confirmed (`POST /v1/identity/me/second-factor/confirm`), within the hour. With one set up already, a code from it (or a recovery code) is needed, and the new key replaces it at the confirm. From a session only. Mounted when the deployment keeps second factors (from 0.1.9).

## `client.identity.me.confirm_second_factor()`

```python signature
confirm_second_factor(
    body: SecondFactorConfirmBody | Mapping[str, Any] | None = None,
    /,
    *,
    idempotency_key: str | None = None,
    timeout: float | None = None,
    **fields: Any,
) -> SecondFactorRecoveryCodes
```

Confirm a new second factor. `POST /v1/identity/me/second-factor/confirm`

A code from the new key sets it up, and answers the 10 recovery codes, this once. Your sessions stay as they are; your next sign-in asks for a code. From a session only. Mounted when the deployment keeps second factors (from 0.1.9).

## `client.identity.me.new_recovery_codes()`

```python signature
new_recovery_codes(
    body: SecondFactorProof | Mapping[str, Any] | None = None,
    /,
    *,
    idempotency_key: str | None = None,
    timeout: float | None = None,
    **fields: Any,
) -> SecondFactorRecoveryCodes
```

New recovery codes. `POST /v1/identity/me/second-factor/recovery-codes`

10 new recovery codes, shown this once; the old ones stop working. Takes a code from your app, or a recovery code. From a session only. Mounted when the deployment keeps second factors (from 0.1.9).

## `client.identity.me.remove_second_factor()`

```python signature
remove_second_factor(
    body: SecondFactorProof | Mapping[str, Any] | None = None,
    /,
    *,
    idempotency_key: str | None = None,
    timeout: float | None = None,
    **fields: Any,
) -> SecondFactorRemoved
```

Take my second factor off. `POST /v1/identity/me/second-factor/remove`

Off, with a code from your app or a recovery code: the key is deleted and the recovery codes stop working. Refused while your workspace requires one (`403 second-factor-required`): replace it instead, or ask a tenant admin. From a session only. Mounted when the deployment keeps second factors (from 0.1.9).

## `client.identity.me.permissions()`

```python signature
permissions(*, timeout: float | None = None) -> MyPermissions
```

What I may do. `GET /v1/identity/me/permissions`

What the caller may do, so a client can hide what it can't: tenant admin, its reviewer role and the roles it decides, its API key's limits and capabilities, the projects it may read with its role in each and every way it holds it (directly, a team, an org it administers, tenant admin), its orgs and teams, and what each project role allows (from the runtime's authorization model). The key's limits are applied: a `member` key is never tenant admin, and a key limited to a project sees that project alone. Only what the caller may see. The server still checks every call. `501 permissions-unsupported` on a runtime without an authorization store: read whoami's `tenantAdmin` and `reviewerRole` instead.