diff --git a/crates/workspace-server/src/server.rs b/crates/workspace-server/src/server.rs
index c67f08f1..cd3990da 100644
--- a/crates/workspace-server/src/server.rs
+++ b/crates/workspace-server/src/server.rs
@@ -2669,7 +2669,7 @@ async fn post_passkey_registration_options(
 async fn post_passkey_registration_complete(
     State(api): State<WorkspaceApi>,
     Json(request): Json<PasskeyRegistrationCompleteRequest>,
-) -> ApiResult<Json<AuthUserResponse>> {
+) -> ApiResult<Response> {
     let challenge = api
         .store
         .consume_auth_challenge_by_id(
@@ -2732,9 +2732,7 @@ async fn post_passkey_registration_complete(
             created_at: crate::auth::now_rfc3339(),
             last_used_at: None,
         })?;
-    Ok(Json(AuthUserResponse {
-        user: user_response(user),
-    }))
+    issue_browser_session_response(&api, user)
 }
 
 async fn post_passkey_login_options(
@@ -2869,6 +2867,10 @@ async fn post_passkey_login_complete(
             created_at: stored.created_at,
             last_used_at: Some(crate::auth::now_rfc3339()),
         })?;
+    issue_browser_session_response(&api, user)
+}
+
+fn issue_browser_session_response(api: &WorkspaceApi, user: UserRecord) -> ApiResult<Response> {
     let session_token = mint_secret("yoi_sess");
     api.store.create_browser_session(&BrowserSessionRecord {
         session_id: new_id("session"),
@@ -2893,7 +2895,7 @@ async fn post_passkey_login_complete(
     );
     Ok((
         headers,
-        Json(PasskeyLoginCompleteResponse {
+        Json(AuthUserResponse {
             user: user_response(user),
         }),
     )
diff --git a/web/workspace/src/lib/workspace/auth/model.ts b/web/workspace/src/lib/workspace/auth/model.ts
index 129641a1..56899616 100644
--- a/web/workspace/src/lib/workspace/auth/model.ts
+++ b/web/workspace/src/lib/workspace/auth/model.ts
@@ -5,9 +5,8 @@ export type AuthenticatedUser = {
   display_name: string;
 };
 
-export type RequestActor = {
-  user: AuthenticatedUser;
-  auth_kind: string;
+export type RequestActor = AuthenticatedUser & {
+  auth_method: "browser_session" | "api_token" | string;
 };
 
 export type WhoamiResponse = {
diff --git a/web/workspace/src/routes/account/+page.svelte b/web/workspace/src/routes/account/+page.svelte
index 4af3cf5e..d8330cfa 100644
--- a/web/workspace/src/routes/account/+page.svelte
+++ b/web/workspace/src/routes/account/+page.svelte
@@ -22,9 +22,9 @@
     try {
       const whoami = await loadWhoami();
       actor = whoami.actor;
-      if (actor?.user.handle) {
-        handle = actor.user.handle;
-        displayName = actor.user.display_name;
+      if (actor?.handle) {
+        handle = actor.handle;
+        displayName = actor.display_name;
       }
     } catch (err) {
       error = err instanceof Error ? err.message : String(err);
@@ -104,23 +104,23 @@
         <dl class="account-details">
           <div>
             <dt>Handle</dt>
-            <dd>{actor.user.handle}</dd>
+            <dd>{actor.handle}</dd>
           </div>
           <div>
             <dt>Display name</dt>
-            <dd>{actor.user.display_name}</dd>
+            <dd>{actor.display_name}</dd>
           </div>
           <div>
             <dt>User ID</dt>
-            <dd><code>{actor.user.user_id}</code></dd>
+            <dd><code>{actor.user_id}</code></dd>
           </div>
           <div>
             <dt>Account ID</dt>
-            <dd><code>{actor.user.account_id}</code></dd>
+            <dd><code>{actor.account_id}</code></dd>
           </div>
           <div>
             <dt>Auth kind</dt>
-            <dd>{actor.auth_kind}</dd>
+            <dd>{actor.auth_method}</dd>
           </div>
         </dl>
         <div class="settings-action-row">
diff --git a/web/workspace/src/routes/login/device/+page.svelte b/web/workspace/src/routes/login/device/+page.svelte
index d03a72d1..e5bfe0af 100644
--- a/web/workspace/src/routes/login/device/+page.svelte
+++ b/web/workspace/src/routes/login/device/+page.svelte
@@ -22,7 +22,7 @@
     try {
       const whoami = await loadWhoami();
       actor = whoami.actor;
-      if (actor?.user.handle) handle = actor.user.handle;
+      if (actor?.handle) handle = actor.handle;
     } catch (err) {
       error = err instanceof Error ? err.message : String(err);
     } finally {
@@ -85,7 +85,7 @@
     {#if loading}
       <p class="muted">Loading session…</p>
     {:else if actor}
-      <p>Logged in as <strong>{actor.user.display_name}</strong> <span class="muted">@{actor.user.handle}</span>.</p>
+      <p>Logged in as <strong>{actor.display_name}</strong> <span class="muted">@{actor.handle}</span>.</p>
     {:else}
       <p class="muted">You need to log in with a passkey before approving a device login.</p>
       <form class="settings-form" onsubmit={(event) => { event.preventDefault(); void login(); }}>