Skip to main content
This endpoint returns the metadata for every API key associated with your account. Because it exposes key names, scopes, and usage timestamps, it requires an active browser session rather than an API key — this prevents a compromised key from being used to enumerate or inspect other keys on the account. Raw key values are never returned; you will only see prefixes such as pb_live_abc123 to help you identify which key is which.

​
Endpoint

Authentication: SessionAuth — browser session cookie (not an API key)

​
Response

The response is an array of ApiKey objects.
​
string (UUID)
The unique identifier for the API key. Use this value as the keyId path parameter when calling the Reveal Key or Revoke Key endpoints.
​
string
The human-readable label you assigned when the key was created.
​
string
The first few characters of the raw key, e.g. pb_live_abc123. Use this to identify a key in logs or dashboards without exposing the full secret.
​
array of strings
The permission scopes granted to this key, e.g. ["prompts:read", "prompts:write"].
​
string (ISO 8601) | null
The timestamp of the most recent authenticated request made with this key. null if the key has never been used.
​
string (ISO 8601) | null
The timestamp at which the key was revoked, or null if it is still active.
​
string (ISO 8601) | null
The timestamp at which the key will automatically expire, or null if it does not expire.
​
string (ISO 8601)
The timestamp at which the key was created.

​
Example Response

This endpoint is browser-session only. It cannot be called with an API key in the Authorization header. If you send a Bearer token, the request will be rejected with 401 Unauthorized. Use this endpoint from your account dashboard or from a server-side context where a valid session cookie is present.