---
title: "Check OAuth API key existence"
method: GET
path: "/oauth2/api-key/info"
tags: ["OAuth API Keys"]
---

# Check OAuth API key existence

`GET /oauth2/api-key/info`

The endpoint returns whether a partner-issued API key already exists for the authenticated user and OAuth2 client pair. Use the endpoint before redirecting the user to the OAuth API key flow — when a key already exists, skip the redirect and surface the appropriate message to the user.

**Required scope:** `apikeys.read`.

**Region availability:** The endpoint is available on the global server (`https://whitebit.com`) only.

## Response `200`

Successful response

- object
  - `data` object
    - `exists` boolean — A partner-issued API key exists for the authenticated user and OAuth2 client pair.
    - `isEnabled` boolean — The existing key is active. `false` when no key exists or when a key exists but is disabled (post-inactivity, awaiting user deletion from the dashboard).
    - `externalId` string, uuid, nullable — External UUID of the existing key. `null` when `exists` is `false`.
    - `permissions` object[] — Permission groups assigned to the key. Empty array when `exists` is `false`. For a disabled key (`isEnabled` is `false`), the array still reflects the permissions the user granted at creation time, so the partner can show the original scope. When the user granted zero permissions during the OAuth handshake, the array contains every offered group with every `urls[].enable` set to `false`.
      - `name` string — Locale-independent identifier of the permission group. Use the value for partner-side logic.
      - `title` string — Translated label of the permission group. The value depends on the authenticated user's locale — display only, never branch on the value.
      - `urls` object[] — Endpoint permissions inside the group. `enable` set to `true` means the user granted the action during the OAuth handshake; `enable` set to `false` means the action was offered but not granted.
        - `url` string — Endpoint path the permission controls.
        - `enable` boolean — The user granted the action during the OAuth handshake.

## Other responses

- `401` — Missing or invalid Bearer token, or token does not carry the `apikeys.read` scope.

---

[API](https://skmtc.net/whitebit/apis/whitebit-private-http-api-v4.md) · [All operations](https://skmtc.net/whitebit/apis/whitebit-private-http-api-v4/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/whitebit/whitebit-private-http-api-v4/revisions/76c9def9942f/schema)