---
title: "List API keys"
method: GET
path: "/api-keys"
tags: ["Account"]
---

# List API keys

`GET /api-keys`

Lists company-scoped API keys as non-secret metadata. The caller must have the `api_keys:manage` permission. Account-scoped keys select the company with the x-company-id header. Plain key values and stored hashes are never returned.

## Response `200`

API key metadata

- object
  - `success` boolean, required
  - `apiKeys` ApiKeyMetadata[], required
    - `id` string, required
    - `name` string, required
    - `prefix` string, required — Non-secret key prefix for identifying the credential.
    - `type` 'company', required
    - `scopes` string[], nullable, required — Explicit permission scopes, or null for full access.
    - `permissions` object, required — Effective permission receipt for the key.
    - `deviceName` string, nullable, required
    - `lastUsedAt` string, date-time, nullable, required
    - `createdAt` string, date-time, required
    - `updatedAt` string, date-time, required
    - `isCurrent` boolean, required — Whether this is the credential authenticating the request.

## Other responses

- `401` — Unauthorized
- `403` — Missing required API key management permission

---

[API](https://skmtc.net/sequenzy/apis/sequenzy-api.md) · [All operations](https://skmtc.net/sequenzy/apis/sequenzy-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/sequenzy/sequenzy-api/versions/af1cf9620482/schema)