diff --git a/cloud/api/BUILD.bazel b/cloud/api/BUILD.bazel
new file mode 100644
index 0000000..363713f
--- /dev/null
+++ b/cloud/api/BUILD.bazel
@@ -0,0 +1,24 @@
+load("@rules_proto//proto:defs.bzl", "proto_library")
+load("@io_bazel_rules_go//go:def.bzl", "go_library")
+load("@io_bazel_rules_go//proto:def.bzl", "go_proto_library")
+
+proto_library(
+    name = "api_proto",
+    srcs = ["iam.proto"],
+    visibility = ["//visibility:public"],
+)
+
+go_proto_library(
+    name = "api_go_proto",
+    compilers = ["@io_bazel_rules_go//proto:go_grpc"],
+    importpath = "source.monogon.dev/cloud/api",
+    proto = ":api_proto",
+    visibility = ["//visibility:public"],
+)
+
+go_library(
+    name = "api",
+    embed = [":api_go_proto"],
+    importpath = "source.monogon.dev/cloud/api",
+    visibility = ["//visibility:public"],
+)
diff --git a/cloud/api/gomod-generated-placeholder.go b/cloud/api/gomod-generated-placeholder.go
new file mode 100644
index 0000000..778f64e
--- /dev/null
+++ b/cloud/api/gomod-generated-placeholder.go
@@ -0,0 +1 @@
+package api
diff --git a/cloud/api/iam.proto b/cloud/api/iam.proto
new file mode 100644
index 0000000..2bfc4ed
--- /dev/null
+++ b/cloud/api/iam.proto
@@ -0,0 +1,18 @@
+syntax = "proto3";
+package cloud.api;
+option go_package = "source.monogon.dev/cloud/api";
+
+service IAM {
+  rpc WhoAmI(WhoAmIRequest) returns (WhoAmIResponse);
+}
+
+message WhoAmIRequest {
+}
+
+message WhoAmIResponse {
+  // Opaque identifier (eg. UUID) of the acting account. Immutable.
+  string account_id = 1;
+  // Primary email address of the acting account. Can change, must not be used
+  // as a foreign key in other systems.
+  string email = 2;
+}
\ No newline at end of file