> ## Documentation Index
> Fetch the complete documentation index at: https://docs.baseten.co/llms.txt
> Use this file to discover all available pages before exploring further.

# truss whoami

> Show user information.

```sh theme={"system"}
truss whoami [OPTIONS]
```

Shows the currently authenticated user information and exits. Use this command to verify your authentication status.

### Options

<ParamField body="--remote" type="TEXT">
  Name of the remote in `.trussrc` to check.
</ParamField>

<ParamField body="--show-oidc">
  Display your [OIDC configuration](/organization/oidc) for workload identity, including org ID, team IDs, issuer, audience, and the subject claim format used for cloud provider trust policies.
</ParamField>

<ParamField body="--show-aws-assume-role">
  Display the [AWS AssumeRole](/organization/aws-assume-role) trust-policy inputs for your organization: the Baseten role ARN to allow and the external ID to require via `sts:ExternalId`.
</ParamField>

<ParamField body="--log" type="humanfriendly | W | WARNING | I | INFO | D | DEBUG" default="humanfriendly">
  Logging verbosity. `humanfriendly` (default) is pretty-printed; `INFO`, `DEBUG`, `WARNING` produce structured logs.
</ParamField>

<ParamField body="--non-interactive">
  Disable interactive prompts. Use in CI/automated contexts where stdin isn't a TTY.
</ParamField>

**Examples:**

Check the current authenticated user:

```sh theme={"system"}
truss whoami
```

You should see:

```text theme={"system"}
my-workspace\user@example.com
```

View your OIDC configuration for setting up cloud provider trust policies:

```sh theme={"system"}
truss whoami --show-oidc
```

This displays your OIDC configuration for workload identity:

| Field | Description | Example |
| - | - | - |
| Org ID | Your organization identifier | `abcd1234` |
| Teams | Team IDs within your organization | `wxyz5678 (my-team)` |
| Issuer | The Baseten OIDC issuer URL | `https://oidc.baseten.co` |
| Audience | The expected audience claim | `oidc.baseten.co` |
| Workload Type Options | Available workload types for subject claims | `model_container`, `model_build` |
| Subject Claim Format | Pattern used in cloud provider trust policies to scope access | `v=1:org=<org_id>:team=<team_id>:model=<model_id>:deployment=<deployment_id>:environment=<environment>:type=<workload_type>` |

Use the org and team IDs from this output when configuring trust policies in [AWS](/organization/oidc#aws) or [GCP](/organization/oidc#gcp).

After Baseten enables [AWS AssumeRole](/organization/aws-assume-role) for your
organization, view your trust-policy inputs:

```sh theme={"system"}
truss whoami --show-aws-assume-role
```

You should see:

```text theme={"system"}
my-workspace\user@example.com

Baseten Role ARN: arn:aws:iam::123456789012:role/baseten-customer-access
AWS External ID: baseten-2fdd8a01c4c34e6bb92a2b96fca29b70
```

Allow the Baseten role ARN in your IAM role's trust policy and require the
external ID through its `sts:ExternalId` condition when granting Baseten access
to your ECR images or S3 weights. For setup instructions, see [AWS AssumeRole
authentication](/organization/aws-assume-role).