---
title: "Get a list of API credentials"
method: GET
path: "/merchants/{merchantId}/apiCredentials"
tags: ["API credentials - merchant level"]
---

# Get a list of API credentials

`GET /merchants/{merchantId}/apiCredentials`

Returns the list of [API credentials](https://docs.adyen.com/development-resources/api-credentials) for the merchant account. The list is grouped into pages as defined by the query parameters.

To make this request, your API credential must have the following [roles](https://docs.adyen.com/development-resources/api-credentials#api-permissions):
* Management API—API credentials read and write

## Path parameters

- `merchantId` string, required

## Query parameters

- `pageNumber` integer
- `pageSize` integer

## Response `200`

OK - the request has succeeded.

- ListMerchantApiCredentialsResponse
  - `_links` PaginationLinks
    - `first` LinksElement, required
      - `href` string
    - `last` LinksElement, required
      - `href` string
    - `next` LinksElement
      - `href` string
    - `prev` LinksElement
      - `href` string
    - `self` LinksElement, required
      - `href` string
  - `data` ApiCredential[] — The list of API credentials.
    - `_links` ApiCredentialLinks
      - `allowedOrigins` LinksElement
        - `href` string
      - `company` LinksElement
        - `href` string
      - `generateApiKey` LinksElement
        - `href` string
      - `generateClientKey` LinksElement
        - `href` string
      - `merchant` LinksElement
        - `href` string
      - `self` LinksElement, required
        - `href` string
    - `active` boolean, required — Indicates if the API credential is enabled. Must be set to **true** to use the credential in your integration.
    - `allowedIpAddresses` string[], required — List of IP addresses from which your client can make requests. If the list is empty, we allow requests from any IP. If the list is not empty and we get a request from an IP which is not on the list, you get a security error.
    - `allowedOrigins` AllowedOrigin[] — List containing the [allowed origins](https://docs.adyen.com/development-resources/client-side-authentication#allowed-origins) linked to the API credential.
      - `_links` Links
        - `self` LinksElement, required
          - `href` string
      - `domain` string, required — Domain of the allowed origin.
      - `id` string — Unique identifier of the allowed origin.
    - `clientKey` string, required — Public key used for [client-side authentication](https://docs.adyen.com/development-resources/client-side-authentication). The client key is required for Drop-in and Components integrations.
    - `description` string — Description of the API credential.
    - `id` string, required — Unique identifier of the API credential.
    - `roles` string[], required — List of [roles](https://docs.adyen.com/development-resources/api-credentials#roles-1) for the API credential.
    - `subjectDN` string — The subject DN of the certificate issued by Adyen.
    - `username` string, required — The name of the [API credential](https://docs.adyen.com/development-resources/api-credentials), for example **ws@Company.TestCompany**.
  - `itemsTotal` integer, required — Total number of items.
  - `pagesTotal` integer, required — Total number of pages.

## Other responses

- `204` — No Content - the request has been successfully processed, but there is no additional content.
- `400` — Bad Request - a problem reading or understanding the request.
- `401` — Unauthorized - authentication required.
- `403` — Forbidden - insufficient permissions to process the request.
- `422` — Unprocessable Entity - a request validation error.
- `500` — Internal Server Error - the server could not process the request.

---

[API](https://skmtc.net/adyen/apis/management-api.md) · [All operations](https://skmtc.net/adyen/apis/management-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/adyen/management-api/revisions/1089ade06e17/schema)