---
title: "GET /me/api-key"
method: GET
path: "/me/api-key"
tags: ["Introspection"]
---

# GET /me/api-key

`GET /me/api-key`

Returns the current API key's authorization context — its bound user,
granted scopes, and any resource-scope narrowing. Useful for AI clients
(MCP) to hide tools that the key cannot use, instead of failing at the
first request.

## Response `200`

API key introspection

- ApiKeyIntrospection — Introspection endpoints for "what is the current API key allowed to do". Used by clients (notably the MCP server) to self-filter the tools they expose.
  - `userId` string, required — The user this key authenticates as.
  - `accountId` string, required — The account this key belongs to.
  - `scopes` string[], required — Granted granular scope strings (already normalized).
  - `resourceScope` object, required — Optional resource-scope narrowing. When a dimension is null/missing the key has access to every instance the bound user can see; when present it is the exclusive allowlist of ids on that dimension.
    - `feedback_portals` string[], nullable
    - `portfolios` string[], nullable
    - `workspaces` string[], nullable
  - `mcpAccess` boolean, required

## Other responses

- `401` — No valid API key

---

[API](https://skmtc.net/craft/apis/craft-io-public-api.md) · [All operations](https://skmtc.net/craft/apis/craft-io-public-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/craft/craft-io-public-api/versions/2d001661c781/schema)