diff --git a/README.md b/README.md
index f6dd87b..bb22f4b 100644
--- a/README.md
+++ b/README.md
@@ -93,6 +93,29 @@ Credentials are cached on the server (see [File fallback](#file-fallback)), and
 source-coop --version
 ```
 
+### Checking login status
+
+`auth status` shows whether you're logged in and as whom, and when the cached tokens and a role's credentials expire. It works from the cache: nothing is refreshed and nothing is sent over the network. The account is the one `auth login` looked up (through the API at `--api-url`) when you logged in; for a login from before it did, `auth status` says so until you log in again. On a terminal, labels are dim and the login's state is green or red.
+
+```bash
+source-coop auth status
+```
+
+```
+Environment    production (https://data.source.coop)
+Login          logged in
+Account        Anthony Lukach (alukach)
+Profile        https://source.coop/alukach
+Refresh token  renewed 2026-10-13T14:00:00Z (3 hours ago); expires 2026-11-12 (in 29 days)
+ID token       expires 2026-10-13T18:00:00Z
+Access token   for https://source.coop, expires 2026-10-13T18:00:00Z
+Credentials    _default: expire 2026-10-13T18:30:00Z
+```
+
+**How long until you must log in again** is set by the refresh token, which `creds` and API commands use to renew everything else, so the expiries of the ID token, access token and credentials don't force a login. source.coop's login (Ory) issues opaque refresh tokens, and its token response doesn't say how long they last: that's an Ory project setting, and each renewal starts the clock again. So `auth status` shows when the refresh token was last renewed, and when it expires if left unused: an estimate, to the day, assuming a 30-day lifetime (Ory's default). Set `SOURCE_REFRESH_TOKEN_LIFETIME` (e.g. `720h`, `14d`) if the server uses another; it only changes this estimate, since a login can't ask for a lifetime. Where a provider does give an expiry, that's shown instead. A login from before renewals were recorded shows just `yes` until its next renewal or `auth login`. The profile link is on the site the login was for (`https://staging.source.coop` for a staging login).
+
+The keyring can't list its entries, so `auth status` reports on one environment and role. Pass `--proxy-url` and `--role-arn` (or set `SOURCE_PROXY_URL` and `SOURCE_ROLE_ARN`) to check others.
+
 ### Setting credentials on the environment
 
 After logging in, you can export cached credentials as environment variables:
@@ -161,6 +184,7 @@ endpoint_url = https://data.staging.source.coop
 | `--duration` | | | Session duration, e.g. `3600`, `90s`, `5m`, `12h`, `1d` (bare number = seconds) |
 | `--scope` | | `openid offline_access` | OAuth2 scopes (`offline_access` enables automatic refresh in `creds`) |
 | `--audience` | `SOURCE_API_AUDIENCE` | `https://source.coop` | Audience of the access token for the source.coop API; empty to request none |
+| `--api-url` | `SOURCE_API_URL` | `https://source.coop` | source.coop site whose API names the account you logged in as, for `auth status` |
 | `--port` | | `0` (random) | Local callback port |
 | `--no-cache` | | | Skip caching credentials (just print to stdout) |
 
diff --git a/src/main.rs b/src/main.rs
index 7d355fe..7c3919c 100644
--- a/src/main.rs
+++ b/src/main.rs
@@ -20,6 +20,7 @@ mod defaults {
     pub const PROXY_URL: &str = "https://data.staging.source.coop";
     pub const ROLE_ARN: &str = "_default";
     pub const API_URL: &str = "https://staging.source.coop";
+    pub const REFRESH_TOKEN_LIFETIME: &str = "30d";
 }
 
 #[cfg(not(feature = "staging"))]
@@ -29,6 +30,10 @@ mod defaults {
     pub const PROXY_URL: &str = "https://data.source.coop";
     pub const ROLE_ARN: &str = "_default";
     pub const API_URL: &str = "https://source.coop";
+    /// Ory's default `oauth2.ttl.refresh_token`: its refresh tokens carry no
+    /// expiry and the token response gives none, so `auth status` counts from
+    /// the last renewal. Overridden by `SOURCE_REFRESH_TOKEN_LIFETIME`.
+    pub const REFRESH_TOKEN_LIFETIME: &str = "30d";
 }
 
 /// Parse a duration into seconds. Accepts a bare number (seconds) or a value
@@ -64,7 +69,7 @@ struct Cli {
 
 #[derive(Subcommand)]
 enum Commands {
-    /// Log in, and print tokens for the source.coop API
+    /// Log in, see whether you are, and print tokens for the source.coop API
     #[command(subcommand)]
     Auth(AuthCommand),
     /// Output cached credentials as credential_process JSON, shell env vars,
@@ -114,11 +119,25 @@ enum AuthCommand {
     /// Log in through the browser, keeping the session and a role's S3
     /// credentials for `creds` and the API
     Login(LoginArgs),
+    /// Show the cached login session and a role's credentials, without
+    /// refreshing either or going to the network
+    Status(StatusArgs),
     /// Print an access token for the source.coop API, refreshing it if expired
     /// (e.g. `curl -H "Authorization: Bearer $(source-coop auth token)" ...`)
     Token(TokenArgs),
 }
 
+#[derive(Parser)]
+struct StatusArgs {
+    /// S3 proxy URL: selects the environment to report on
+    #[arg(long, env = "SOURCE_PROXY_URL", default_value = defaults::PROXY_URL)]
+    proxy_url: String,
+
+    /// Role ARN whose cached credentials to report on
+    #[arg(long, env = "SOURCE_ROLE_ARN", default_value = defaults::ROLE_ARN)]
+    role_arn: String,
+}
+
 #[derive(Parser)]
 struct TokenArgs {
     /// S3 proxy URL of the environment whose login session to use
@@ -162,6 +181,11 @@ struct LoginArgs {
     #[arg(long, env = "SOURCE_API_AUDIENCE", default_value = defaults::API_URL)]
     audience: String,
 
+    /// source.coop site URL whose API names the account you logged in as,
+    /// shown by `auth status`
+    #[arg(long, env = "SOURCE_API_URL", default_value = defaults::API_URL)]
+    api_url: String,
+
     /// Local callback port (0 for random available port)
     #[arg(long, default_value = "0")]
     port: u16,
@@ -228,6 +252,11 @@ async fn main() {
                 fail(e);
             }
         }
+        Commands::Auth(AuthCommand::Status(args)) => {
+            if let Err(e) = run_status(args) {
+                fail(e);
+            }
+        }
         Commands::Auth(AuthCommand::Token(args)) => {
             if let Err(e) = run_auth_token(args, verbose).await {
                 fail(e);
@@ -263,6 +292,239 @@ async fn main() {
     }
 }
 
+/// The account `access_token` acts as, from the API's `/whoami`, to keep
+/// with the session. None without a token; a failed lookup is noted, not an
+/// error, since the login itself worked.
+async fn whoami(
+    api_url: &str,
+    access_token: Option<String>,
+    verbose: bool,
+) -> Option<session::Account> {
+    let client = api::Client::new(api_url, Some(access_token?), verbose).ok()?;
+    match client
+        .get::<serde_json::Value>(client.url(&["whoami"]))
+        .await
+    {
+        Ok(me) => session::Account::from_whoami(&me),
+        Err(e) => {
+            eprintln!("Couldn't look up your account ({e}); `auth status` won't name it.");
+            None
+        }
+    }
+}
+
+fn run_status(args: StatusArgs) -> Result<(), String> {
+    let env = cache::env(&args.proxy_url)?;
+    let session = cache::read_session(env.as_deref())?;
+    let entry = cache::read_credentials(env.as_deref(), &args.role_arn)?;
+    let lifetime = refresh_lifetime()?;
+    print!(
+        "{}",
+        status_report(
+            &args.proxy_url,
+            env.as_deref(),
+            &args.role_arn,
+            session.as_ref(),
+            entry.as_ref().map(|e| &e.creds),
+            chrono::Utc::now().timestamp(),
+            Some((lifetime.0, lifetime.1.as_str())),
+            style::wanted(std::io::IsTerminal::is_terminal(&std::io::stdout())),
+        )
+    );
+    Ok(())
+}
+
+/// How long a refresh token lasts unused, in seconds, with how it was given
+/// (`30d`): `SOURCE_REFRESH_TOKEN_LIFETIME`, else this build's default. The
+/// provider doesn't say, so this is what `auth status` estimates from. It's
+/// only for display: OAuth2 has no way to ask for a refresh token's lifetime,
+/// so nothing sent at login depends on it; Ory's project config decides.
+fn refresh_lifetime() -> Result<(i64, String), String> {
+    let text = std::env::var("SOURCE_REFRESH_TOKEN_LIFETIME")
+        .ok()
+        .filter(|v| !v.trim().is_empty())
+        .unwrap_or_else(|| defaults::REFRESH_TOKEN_LIFETIME.to_string());
+    let secs = parse_duration(&text).map_err(|e| format!("SOURCE_REFRESH_TOKEN_LIFETIME: {e}"))?;
+    Ok((secs as i64, text.trim().to_string()))
+}
+
+/// The site a session's account lives on: the API audience it was issued
+/// for (`https://source.coop`, or a staging or preview site), else this
+/// build's.
+fn site(s: &session::Session) -> &str {
+    s.audience
+        .as_deref()
+        .filter(|a| !a.is_empty())
+        .unwrap_or(defaults::API_URL)
+        .trim_end_matches('/')
+}
+
+/// `at` relative to `now`, in the largest whole unit: "3 hours ago", or
+/// "in 29 days" while still ahead.
+fn relative(at: i64, now: i64) -> String {
+    let Some((at_t, now_t)) =
+        chrono::DateTime::from_timestamp(at, 0).zip(chrono::DateTime::from_timestamp(now, 0))
+    else {
+        return String::new();
+    };
+    if at <= now {
+        return product::ago(at_t, now_t);
+    }
+    match product::ago(now_t, at_t).as_str() {
+        "just now" => "in under a minute".into(),
+        ahead => format!("in {}", ahead.trim_end_matches(" ago")),
+    }
+}
+
+/// A Unix timestamp as RFC 3339, the API's date format.
+fn rfc3339(t: i64) -> Option<String> {
+    chrono::DateTime::from_timestamp(t, 0)
+        .map(|t| t.to_rfc3339_opts(chrono::SecondsFormat::Secs, true))
+}
+
+/// `<expires> <time>` for a Unix timestamp, or `expired <time>` (yellow)
+/// once it's past, as of `now`.
+fn expiry(exp: Option<i64>, now: i64, expires: &str, color: bool) -> String {
+    match exp.and_then(|t| chrono::DateTime::from_timestamp(t, 0)) {
+        None => "expiry unknown".into(),
+        Some(t) => {
+            let when = t.to_rfc3339_opts(chrono::SecondsFormat::Secs, true);
+            if t.timestamp() > now {
+                format!("{expires} {when}")
+            } else {
+                style::paint(color, "33", &format!("expired {when}"))
+            }
+        }
+    }
+}
+
+/// The `auth status` report for one environment and role, as of `now`: a
+/// `Label  value` row each, labels dim and the login's state green (logged
+/// in) or red (expired, not logged in) when `color`. `refresh_lifetime`, the
+/// assumed lifetime and how it was given, estimates when an unused login lapses.
+// Every input is a separate fact the report shows; a struct would only rename them.
+#[allow(clippy::too_many_arguments)]
+fn status_report(
+    proxy_url: &str,
+    env: Option<&str>,
+    role_arn: &str,
+    session: Option<&session::Session>,
+    creds: Option<&sts::Credentials>,
+    now: i64,
+    refresh_lifetime: Option<(i64, &str)>,
+    color: bool,
+) -> String {
+    let mut rows = vec![(
+        "Environment",
+        format!("{} ({proxy_url})", env.unwrap_or("production")),
+    )];
+    match session {
+        None => rows.push(("Login", style::paint(color, "31", "not logged in"))),
+        Some(s) => {
+            let id_exp = session::jwt_exp(&s.id_token);
+            // Without a refresh token, the session ends when its ID token does.
+            let state = match (&s.refresh_token, id_exp) {
+                (None, Some(exp)) if exp <= now => style::paint(color, "31", "expired"),
+                _ => style::paint(color, "32", "logged in"),
+            };
+            rows.push(("Login", state));
+            rows.push((
+                "Account",
+                match &s.account {
+                    Some(a) => match &a.name {
+                        Some(name) => format!("{name} ({})", style::id(color, &a.account_id)),
+                        None => a.account_id.clone(),
+                    },
+                    None => style::paint(color, "2", "unknown until your next `auth login`"),
+                },
+            ));
+            if let Some(a) = &s.account {
+                rows.push((
+                    "Profile",
+                    style::paint(color, "4", &format!("{}/{}", site(s), a.account_id)),
+                ));
+            }
+            // `renewed <time> (<ago>); expires <when> (<in>)`. Ory's refresh
+            // tokens are opaque and its token response gives no lifetime, so
+            // the expiry is the provider's where it said, and otherwise the
+            // last renewal plus the configured lifetime (to the day, as it's
+            // an estimate; the README says so).
+            let refresh = match (&s.refresh_token, s.refresh_token_issued_at) {
+                (None, _) => "none: log in again when the ID token expires".into(),
+                (Some(_), None) => "yes".into(),
+                (Some(_), Some(issued)) => format!(
+                    "renewed {} ({})",
+                    rfc3339(issued).unwrap_or_default(),
+                    relative(issued, now)
+                ),
+            };
+            let expires = match (s.refresh_token_expires_at, s.refresh_token_issued_at) {
+                (Some(exp), _) => Some((exp, rfc3339(exp).unwrap_or_default())),
+                (None, Some(issued)) => refresh_lifetime.map(|(secs, _)| {
+                    let at = issued + secs;
+                    let day = chrono::DateTime::from_timestamp(at, 0)
+                        .map(|d| d.format("%Y-%m-%d").to_string())
+                        .unwrap_or_default();
+                    (at, day)
+                }),
+                _ => None,
+            };
+            let refresh = match expires.filter(|_| s.refresh_token.is_some()) {
+                Some((at, when)) if at > now => {
+                    format!("{refresh}; expires {when} ({})", relative(at, now))
+                }
+                Some((at, when)) => format!(
+                    "{refresh}; {}",
+                    style::paint(
+                        color,
+                        "33",
+                        &format!("expired {when} ({})", relative(at, now))
+                    )
+                ),
+                None => refresh,
+            };
+            rows.push(("Refresh token", refresh));
+            rows.push(("ID token", expiry(id_exp, now, "expires", color)));
+            rows.push((
+                "Access token",
+                match &s.access_token {
+                    None => "none".into(),
+                    Some(_) => format!(
+                        "{}{}",
+                        s.audience
+                            .as_deref()
+                            .map(|a| format!("for {a}, "))
+                            .unwrap_or_default(),
+                        expiry(s.access_token_expires_at, now, "expires", color)
+                    ),
+                },
+            ));
+        }
+    }
+    rows.push((
+        "Credentials",
+        match creds {
+            None => format!("{role_arn}: none cached"),
+            Some(c) => {
+                let exp = chrono::DateTime::parse_from_rfc3339(&c.expiration).ok();
+                format!(
+                    "{role_arn}: {}",
+                    expiry(exp.map(|t| t.timestamp()), now, "expire", color)
+                )
+            }
+        },
+    ));
+    let width = rows.iter().map(|(label, _)| label.len()).max().unwrap_or(0);
+    rows.iter()
+        .map(|(label, value)| {
+            format!(
+                "{}  {value}\n",
+                style::paint(color, "2", &format!("{label:<width$}"))
+            )
+        })
+        .collect()
+}
+
 async fn run_auth_token(args: TokenArgs, verbose: bool) -> Result<(), String> {
     let env = cache::env(&args.proxy_url)?;
     let token = session::token(env.as_deref(), session::Want::Access, verbose)
@@ -327,7 +589,7 @@ async fn run_login(args: LoginArgs, verbose: bool) -> Result<(), String> {
             "No access token issued; commands that call the source.coop API will run signed out."
         );
     }
-    let session = session::Session::new(
+    let mut session = session::Session::new(
         tokens,
         args.proxy_url.clone(),
         args.client_id,
@@ -335,6 +597,7 @@ async fn run_login(args: LoginArgs, verbose: bool) -> Result<(), String> {
         audience.map(String::from),
         chrono::Utc::now().timestamp(),
     );
+    session.account = whoami(&args.api_url, session.access_token.clone(), verbose).await;
     {
         let _lock = cache::lock_session(env.as_deref())?;
         cache::write_session(env.as_deref(), &session)?;
@@ -538,6 +801,278 @@ mod tests {
         assert!(problems.is_empty(), "{problems:#?}");
     }
 
+    fn creds(expiration: &str) -> sts::Credentials {
+        sts::Credentials {
+            access_key_id: "KEY".into(),
+            secret_access_key: "SECRET".into(),
+            session_token: "SESSION".into(),
+            expiration: expiration.into(),
+        }
+    }
+
+    /// An unsigned JWT that expires at `exp`; only its claims are ever read.
+    fn jwt(exp: i64) -> String {
+        use base64::Engine;
+        let claims = base64::engine::general_purpose::URL_SAFE_NO_PAD
+            .encode(serde_json::json!({ "exp": exp }).to_string());
+        format!("e30.{claims}.sig")
+    }
+
+    fn live_session(now: i64, account: Option<session::Account>) -> session::Session {
+        session::Session {
+            proxy_url: Some("https://data.source.coop".into()),
+            client_id: "cid".into(),
+            token_endpoint: "https://auth.test/oauth2/token".into(),
+            audience: Some("https://source.coop".into()),
+            refresh_token: Some("rt".into()),
+            id_token: jwt(now + 3600),
+            access_token: Some("at".into()),
+            access_token_expires_at: Some(now - 60),
+            account,
+            refresh_token_issued_at: Some(now - 3 * 3600),
+            refresh_token_expires_at: None,
+        }
+    }
+
+    #[test]
+    fn status_names_who_is_logged_in() {
+        // 2026-10-13T17:00:00Z
+        let now = 1_791_910_800;
+        let me = session::Account {
+            account_id: "alukach".into(),
+            name: Some("Anthony Lukach".into()),
+        };
+        let report = status_report(
+            "https://data.source.coop",
+            None,
+            "_default",
+            Some(&live_session(now, Some(me))),
+            Some(&creds("2026-10-13T18:30:00Z")),
+            now,
+            None,
+            false,
+        );
+        assert_eq!(
+            report,
+            "Environment    production (https://data.source.coop)\n\
+             Login          logged in\n\
+             Account        Anthony Lukach (alukach)\n\
+             Profile        https://source.coop/alukach\n\
+             Refresh token  renewed 2026-10-13T14:00:00Z (3 hours ago)\n\
+             ID token       expires 2026-10-13T18:00:00Z\n\
+             Access token   for https://source.coop, expired 2026-10-13T16:59:00Z\n\
+             Credentials    _default: expire 2026-10-13T18:30:00Z\n"
+        );
+    }
+
+    #[test]
+    fn status_shows_the_refresh_tokens_expiry_where_the_provider_gave_one() {
+        let now = 1_791_910_800;
+        let mut s = live_session(now, None);
+        s.refresh_token_expires_at = Some(now + 30 * 86_400);
+        let report = status_report(
+            "https://data.source.coop",
+            None,
+            "_default",
+            Some(&s),
+            None,
+            now,
+            None,
+            false,
+        );
+        assert!(
+            report.contains(
+                "Refresh token  renewed 2026-10-13T14:00:00Z (3 hours ago); expires 2026-11-12T17:00:00Z (in 1 month)\n"
+            ),
+            "{report}"
+        );
+        // No Profile row without a known account.
+        assert!(!report.contains("Profile"), "{report}");
+    }
+
+    #[test]
+    fn status_estimates_when_an_unused_login_expires() {
+        let now = 1_791_910_800; // 2026-10-13T17:00:00Z, renewed 3 hours before
+        let row = |s: &session::Session, lifetime| {
+            let report = status_report(
+                "https://data.source.coop",
+                None,
+                "_default",
+                Some(s),
+                None,
+                now,
+                Some(lifetime),
+                false,
+            );
+            report
+                .lines()
+                .find(|l| l.starts_with("Refresh token"))
+                .unwrap()
+                .to_string()
+        };
+        let s = live_session(now, None);
+        assert_eq!(
+            row(&s, (30 * 86_400, "30d")),
+            "Refresh token  renewed 2026-10-13T14:00:00Z (3 hours ago); \
+             expires 2026-11-12 (in 29 days)"
+        );
+        // Renewed longer ago than the lifetime: expired.
+        assert_eq!(
+            row(&s, (3600, "1h")),
+            "Refresh token  renewed 2026-10-13T14:00:00Z (3 hours ago); \
+             expired 2026-10-13 (2 hours ago)"
+        );
+        // An expiry the provider gave is exact, to the second, and beats the
+        // estimate.
+        let mut exact = live_session(now, None);
+        exact.refresh_token_expires_at = Some(now + 86_400);
+        assert!(row(&exact, (30 * 86_400, "30d"))
+            .ends_with("; expires 2026-10-14T17:00:00Z (in 1 day)"));
+        // Without a renewal time there's nothing to count from.
+        let mut unknown = live_session(now, None);
+        unknown.refresh_token_issued_at = None;
+        assert_eq!(row(&unknown, (30 * 86_400, "30d")), "Refresh token  yes");
+    }
+
+    #[test]
+    fn relative_times_read_ahead_and_behind() {
+        let now = 1_791_910_800;
+        assert_eq!(relative(now + 29 * 86_400 + 5, now), "in 29 days");
+        assert_eq!(relative(now + 30, now), "in under a minute");
+        assert_eq!(relative(now - 3 * 3600, now), "3 hours ago");
+        assert_eq!(relative(now, now), "just now");
+    }
+
+    #[test]
+    fn a_bad_refresh_lifetime_override_says_which_variable() {
+        let err = parse_duration("forever").unwrap_err();
+        assert!(err.contains("invalid duration"), "{err}");
+        // refresh_lifetime() names SOURCE_REFRESH_TOKEN_LIFETIME around that;
+        // the default must always parse.
+        assert_eq!(
+            parse_duration(defaults::REFRESH_TOKEN_LIFETIME),
+            Ok(30 * 86_400)
+        );
+    }
+
+    #[test]
+    fn status_says_when_the_account_is_unknown_or_nobody_is_logged_in() {
+        let now = 1_791_910_800;
+        let unknown = status_report(
+            "https://data.source.coop",
+            None,
+            "_default",
+            Some(&live_session(now, None)),
+            None,
+            now,
+            None,
+            false,
+        );
+        assert!(
+            unknown.contains("Account        unknown until your next `auth login`\n"),
+            "{unknown}"
+        );
+        assert!(
+            unknown.ends_with("Credentials    _default: none cached\n"),
+            "{unknown}"
+        );
+
+        let nobody = status_report(
+            "https://data.staging.source.coop",
+            Some("data.staging.source.coop"),
+            "_default",
+            None,
+            None,
+            0,
+            None,
+            false,
+        );
+        assert_eq!(
+            nobody,
+            "Environment  data.staging.source.coop (https://data.staging.source.coop)\n\
+             Login        not logged in\n\
+             Credentials  _default: none cached\n"
+        );
+    }
+
+    #[test]
+    fn status_colours_labels_and_the_login_state() {
+        let now = 1_791_910_800;
+        let me = session::Account {
+            account_id: "alukach".into(),
+            name: Some("A".into()),
+        };
+        let report = status_report(
+            "https://data.source.coop",
+            None,
+            "_default",
+            Some(&live_session(now, Some(me))),
+            None,
+            now,
+            None,
+            true,
+        );
+        assert!(
+            report.contains("\x1b[2mLogin        \x1b[0m  \x1b[32mlogged in\x1b[0m"),
+            "{report:?}"
+        );
+        // The ID in gray, and a past expiry in yellow.
+        assert!(report.contains("A (\x1b[90malukach\x1b[0m)"), "{report:?}");
+        assert!(
+            report.contains("\x1b[33mexpired 2026-10-13T16:59:00Z\x1b[0m"),
+            "{report:?}"
+        );
+        let nobody = status_report(
+            "https://data.source.coop",
+            None,
+            "_default",
+            None,
+            None,
+            now,
+            None,
+            true,
+        );
+        assert!(
+            nobody.contains("\x1b[31mnot logged in\x1b[0m"),
+            "{nobody:?}"
+        );
+    }
+
+    #[test]
+    fn the_account_comes_from_whoami() {
+        let me =
+            serde_json::json!({"account": {"account_id": "alukach", "name": "Anthony Lukach"}});
+        assert_eq!(
+            session::Account::from_whoami(&me),
+            Some(session::Account {
+                account_id: "alukach".into(),
+                name: Some("Anthony Lukach".into())
+            })
+        );
+        // Signed in without an account yet.
+        assert_eq!(
+            session::Account::from_whoami(&serde_json::json!({"account": null})),
+            None
+        );
+    }
+
+    #[tokio::test]
+    async fn login_looks_up_the_account_only_with_an_access_token() {
+        let server = MockServer::start().await;
+        Mock::given(method("GET"))
+            .and(path("/api/v1/whoami"))
+            .respond_with(ResponseTemplate::new(200).set_body_json(
+                serde_json::json!({"account": {"account_id": "alukach", "name": "Anthony Lukach"}}),
+            ))
+            .expect(1)
+            .mount(&server)
+            .await;
+        let found = whoami(&server.uri(), Some("at".into()), false).await;
+        assert_eq!(found.map(|a| a.account_id), Some("alukach".to_string()));
+        // No token, no request (the mock expects exactly one).
+        assert_eq!(whoami(&server.uri(), None, false).await, None);
+    }
+
     /// `login` moved under `auth`; the old name still works, unlisted.
     #[test]
     fn login_still_works_by_its_old_name() {
diff --git a/src/oidc.rs b/src/oidc.rs
index bf525bc..41c3d6b 100644
--- a/src/oidc.rs
+++ b/src/oidc.rs
@@ -71,6 +71,10 @@ pub struct Tokens {
     pub refresh_token: Option<String>,
     pub access_token: Option<String>,
     pub expires_in: Option<i64>,
+    /// The refresh token's lifetime in seconds, from the providers that say
+    /// (`refresh_token_expires_in`, or `refresh_expires_in`). Ory doesn't:
+    /// its refresh tokens are opaque and their lifespan is server config.
+    pub refresh_expires_in: Option<i64>,
 }
 
 /// Run the browser-based OAuth2 Authorization Code flow with PKCE.
@@ -313,6 +317,9 @@ async fn token_request(
         refresh_token: body["refresh_token"].as_str().map(String::from),
         access_token: body["access_token"].as_str().map(String::from),
         expires_in: body["expires_in"].as_i64(),
+        refresh_expires_in: body["refresh_token_expires_in"]
+            .as_i64()
+            .or_else(|| body["refresh_expires_in"].as_i64()),
     })
 }
 
diff --git a/src/product.rs b/src/product.rs
index 788aa9c..b41df03 100644
--- a/src/product.rs
+++ b/src/product.rs
@@ -1412,7 +1412,10 @@ fn product_lines(p: &Value, site: &str, color: bool) -> Vec<String> {
 
 /// How long ago `then` was, at `now`, in the largest whole unit: "just now",
 /// "5 minutes ago", "3 days ago", "2 years ago".
-fn ago(then: chrono::DateTime<chrono::Utc>, now: chrono::DateTime<chrono::Utc>) -> String {
+pub(crate) fn ago(
+    then: chrono::DateTime<chrono::Utc>,
+    now: chrono::DateTime<chrono::Utc>,
+) -> String {
     let secs = (now - then).num_seconds();
     if secs < 0 {
         return "in the future".into();
diff --git a/src/session.rs b/src/session.rs
index 6a32dcb..c79380e 100644
--- a/src/session.rs
+++ b/src/session.rs
@@ -35,6 +35,42 @@ pub struct Session {
     /// When the access token expires, in Unix seconds.
     #[serde(default)]
     pub access_token_expires_at: Option<i64>,
+    /// Who logged in, as the API's `/whoami` said at login, for `auth status`
+    /// to show without going to the network. Absent when it couldn't be asked
+    /// (no access token) and in sessions written before it was kept.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub account: Option<Account>,
+    /// When the refresh token was issued or last rotated, in Unix seconds:
+    /// how long ago the login was renewed. Absent in sessions written before
+    /// it was kept.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub refresh_token_issued_at: Option<i64>,
+    /// When the refresh token expires, in Unix seconds, if the provider said.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub refresh_token_expires_at: Option<i64>,
+}
+
+/// The source.coop account a session acts as.
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq)]
+pub struct Account {
+    pub account_id: String,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub name: Option<String>,
+}
+
+impl Account {
+    /// The account in a `/whoami` response, if it names one.
+    pub fn from_whoami(me: &serde_json::Value) -> Option<Account> {
+        let account = me.get("account")?;
+        Some(Account {
+            account_id: account.get("account_id")?.as_str()?.to_string(),
+            name: account
+                .get("name")
+                .and_then(serde_json::Value::as_str)
+                .filter(|n| !n.is_empty())
+                .map(String::from),
+        })
+    }
 }
 
 /// Which token a caller needs from the session.
@@ -64,6 +100,9 @@ impl Session {
             id_token: String::new(),
             access_token: None,
             access_token_expires_at: None,
+            account: None,
+            refresh_token_issued_at: None,
+            refresh_token_expires_at: None,
         };
         session.apply(tokens, now);
         session
@@ -74,6 +113,8 @@ impl Session {
         self.id_token = tokens.id_token;
         if let Some(rotated) = tokens.refresh_token {
             self.refresh_token = Some(rotated);
+            self.refresh_token_issued_at = Some(now);
+            self.refresh_token_expires_at = tokens.refresh_expires_in.map(|s| now + s);
         }
         self.access_token_expires_at = tokens
             .expires_in
@@ -110,7 +151,7 @@ impl Session {
 
 /// The `exp` claim of a JWT, read without verifying it: only to know when to
 /// refresh, never to trust the token.
-fn jwt_exp(token: &str) -> Option<i64> {
+pub(crate) fn jwt_exp(token: &str) -> Option<i64> {
     let payload = URL_SAFE_NO_PAD.decode(token.split('.').nth(1)?).ok()?;
     serde_json::from_slice::<serde_json::Value>(&payload)
         .ok()?
@@ -199,6 +240,7 @@ mod tests {
             refresh_token: Some("rt-1".into()),
             access_token: access.map(String::from),
             expires_in,
+            refresh_expires_in: None,
         }
     }
 
@@ -224,6 +266,33 @@ mod tests {
             .await;
     }
 
+    #[test]
+    fn a_refresh_tokens_issue_time_follows_rotation_and_its_expiry_needs_saying() {
+        let mut s = Session::new(
+            tokens(NOW + 3600, None, None),
+            "https://data.source.coop".into(),
+            "cid".into(),
+            "https://auth.test/oauth2/token".into(),
+            None,
+            NOW,
+        );
+        assert_eq!(s.refresh_token_issued_at, Some(NOW));
+        // Ory says nothing of a refresh token's lifetime.
+        assert_eq!(s.refresh_token_expires_at, None);
+
+        // A refresh that doesn't rotate it leaves the time as it was...
+        let mut kept = tokens(NOW + 7200, None, None);
+        kept.refresh_token = None;
+        s.apply(kept, NOW + 100);
+        assert_eq!(s.refresh_token_issued_at, Some(NOW));
+        // ...and one that does, from a provider that gives a lifetime, moves both.
+        let mut rotated = tokens(NOW + 7200, None, None);
+        rotated.refresh_expires_in = Some(86_400);
+        s.apply(rotated, NOW + 200);
+        assert_eq!(s.refresh_token_issued_at, Some(NOW + 200));
+        assert_eq!(s.refresh_token_expires_at, Some(NOW + 200 + 86_400));
+    }
+
     #[test]
     fn reads_jwt_expiry() {
         assert_eq!(jwt_exp(&jwt(42)), Some(42));