Resources for developers building with and expanding the Netlify platformhttps://www.netlify.com/https://www.netlify.com/changelog/2026-10-07-context-user-in-functions/https://www.netlify.com/changelog/2026-10-07-context-user-in-functions/On private projects and sites protected with Netlify team login, your Netlify Functions and Edge Functions can now see who is making the request. The signed-in Netlify user is available as context.user, with their user ID, email address, and when their access expires. This function returns the signed-in user's ID, email address, and access expiry as JSON at /whoami, and responds with a 401 when context.user isn't set: // netlify/functions/whoami.ts import type { Config, Context } from &#39;@netlify/functions&#39; export default async (req: Request, context: Context) =&gt; { if (!context.user) { return new Response(&#39;Unauthorized&#39;, { status: 401 }) } return Response.json({ id: context.user.id, email: context.user.email, expiresAt: context.user.expiresAt.toISOString(), }) } export const config: Config = { path: &#39;/whoami&#39; } Previously, protecting a site meant Netlify checked who could visit, but your code couldn't tell who they were. Knowing who's on the other end meant adding a second login of your own on top. Now Netlify verifies the visitor at the edge and passes their identity to your code. Because context.user comes from Netlify and not from the request, a visitor can't impersonate someone else by sending their own headers. With context.user, you can build on the login your team already uses. Examples like: <ul> <li>Internal dashboards and admin tools that show each person their own data</li> <li>Audit logs that record who made a change or triggered an action</li> <li>Approval and review workflows that know who approved what</li> <li>Per-person settings, permissions, or feature access inside an internal app</li> </ul> Learn more in the Netlify documentation: <ul> <li>context.user in Netlify Functions </li> <li>context.user in Edge Functions </li> <li>Private projects </li> <li>Team login protection </li> </ul> Wed, 07 Oct 2026 00:00:00 GMT