---
title: "Batch Verify API Keys"
method: POST
path: "/v2alpha1/admin/apiKeys:batchVerify"
tags: ["ApiKeys"]
---

# Batch Verify API Keys

`POST /v2alpha1/admin/apiKeys:batchVerify`

Verifies up to 100 credentials in parallel in a single request. Each
credential is verified independently; partial failures are returned.
Admin access only.

Cache Control (HTTP Headers):
  - Cache-Control: no-cache  - Bypasses cache read, forces fresh DB lookup
  - Cache-Control: no-store  - Bypasses cache read AND write (never cached)
  - Pragma: no-cache         - Same as Cache-Control: no-cache (HTTP/1.0)

The cache directive applies to every credential in the batch.

```http
POST /v2alpha1/admin/apiKeys:batchVerify
{
  "requests": [
    {"credential": "sk_live_abc123..."},
    {"credential": "eyJhbGciOiJFZERTQSI..."}
  ]
}
```

## Headers

- `Cache-Control` string
- `Pragma` string

## Request body

- BatchVerifyApiKeysRequest
  - `requests` VerifyApiKeyRequest[]
    - `credential` string

## Response `200`

A successful response.

- BatchVerifyApiKeysResponse
  - `results` VerifyApiKeyResponse[]
    - `actor_id` string
    - `error_code` 'VERIFICATION_ERROR_UNSPECIFIED' | 'VERIFICATION_ERROR_INVALID_FORMAT' | 'VERIFICATION_ERROR_EXPIRED' | 'VERIFICATION_ERROR_REVOKED' | 'VERIFICATION_ERROR_NOT_FOUND' | 'VERIFICATION_ERROR_SIGNATURE_INVALID' | 'VERIFICATION_ERROR_INTERNAL' | 'VERIFICATION_ERROR_IP_NOT_ALLOWED' | 'VERIFICATION_ERROR_RATE_LIMITED' — - VERIFICATION_ERROR_UNSPECIFIED: No error (key is valid) - VERIFICATION_ERROR_INVALID_FORMAT: Credential format is invalid - VERIFICATION_ERROR_EXPIRED: Credential has expired - VERIFICATION_ERROR_REVOKED: Credential has been revoked - VERIFICATION_ERROR_NOT_FOUND: Credential not found in database - VERIFICATION_ERROR_SIGNATURE_INVALID: Cryptographic signature verification failed - VERIFICATION_ERROR_INTERNAL: Internal server error during verification - VERIFICATION_ERROR_IP_NOT_ALLOWED: Request IP is not in the key's allowed CIDR ranges - VERIFICATION_ERROR_RATE_LIMITED: Rate limit quota exhausted (commercial-only)
    - `error_message` string
    - `expire_time` string, date-time
    - `is_valid` boolean — is_valid reports whether verification succeeded. It is true only when the credential parses, the signature checks out, the key was found, all policy gates (expiry, revocation, IP allowlist, rate limit) pass, and the key's status is KEY_STATUS_ACTIVE. When false, error_code and error_message describe the reason. Use this field for authentication decisions; use status to inspect lifecycle state independently.
    - `issuer` string — The configured token issuer for this project. For derived tokens (JWT/macaroon), this matches the iss claim embedded in the verified token.
    - `key_id` string
    - `metadata` object — metadata mirrors the metadata stored on the verified key. AIP-148 metadata field.
    - `rate_limit_policy` RateLimitPolicy — RateLimitPolicy describes the rate limit policy for an API key. In OSS mode, this policy is informational and meant to be consumed by upstream gateways (Envoy, Cloudflare, etc.) for enforcement. In commercial mode, Talos enforces rate limits using in-memory or Redis backends, both using the GCRA (Generic Cell Rate Algorithm). Compliant with draft-ietf-httpapi-ratelimit-headers-10.
      - `quota` string, int64 — quota is the number of requests allowed per window.
      - `unit` string
      - `window` string — window is the time window for the quota. Common values: 60s (1 minute), 3600s (1 hour), 86400s (1 day).
    - `rate_limit_remaining` string, int64 — Approximate number of requests available before the rate limit is reached (commercial-only, only set when enforcement is active).
    - `rate_limit_reset_time` string, date-time — Time when the rate limiter returns to full capacity (all quota recovered).
    - `scopes` string[]
    - `status` 'KEY_STATUS_UNSPECIFIED' | 'KEY_STATUS_ACTIVE' | 'KEY_STATUS_REVOKED' | 'KEY_STATUS_EXPIRED' — KeyStatus represents the lifecycle state of an API key. - KEY_STATUS_UNSPECIFIED: Default zero value. Never returned by the server. Treated as ACTIVE for backward compatibility but should not be relied on. - KEY_STATUS_ACTIVE: The key is valid and can be used to authenticate. - KEY_STATUS_REVOKED: The key was revoked. Verification fails with VERIFICATION_ERROR_REVOKED. See revocation_reason for the cause. - KEY_STATUS_EXPIRED: The key passed its expire_time. Verification fails with VERIFICATION_ERROR_EXPIRED. The transition is computed at read time and not persisted.
    - `visibility` 'KEY_VISIBILITY_UNSPECIFIED' | 'KEY_VISIBILITY_SECRET' | 'KEY_VISIBILITY_PUBLIC' — KeyVisibility distinguishes public (client-safe) keys from secret (server-only) keys. Public keys use a different configurable prefix for visual distinction. Both types share the same scope/permission system — visibility is about exposure safety. - KEY_VISIBILITY_UNSPECIFIED: Treated as SECRET

## Other responses

- `default` — An unexpected error response.

---

[API](https://skmtc.net/ory/apis/ory-talos-api.md) · [All operations](https://skmtc.net/ory/apis/ory-talos-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/ory/ory-talos-api/versions/faeb5ce56780/schema)