# `GET /auth/me`

Protected. Requires a valid session cookie (`credentials: 'include'`).

Current user

Returns the authenticated user from the session cookie and the Google client ID.
`user.picture` is the stored profile image as a base64 string when present.
Unauthenticated calls still receive `googleClientId` and `schemaVersion` with 401.


## Response `200`

Authenticated

```json
{
  "user": {
    "id": 1,
    "email": "user@example.com",
    "selectedCompanyId": 1,
    "picture": "…"
  },
  "googleClientId": "…",
  "schemaVersion": 1,
  "vhost": true,
  "vhostSettings": "…"
}
```

## Errors

| Status | Description |
|--------|-------------|
| 401 | Unauthorized — still includes `googleClientId` and `schemaVersion` for the frontend |

---

_Generated from `@openapi` JSDoc. Do not edit by hand — run `npm run docs:api`._