List API keys

List active (non-revoked) API keys for the current space (scoped by X-Space-Id).

GET/api/api-keys

Authorization

better-auth.session_token<token>

Cookie session from Better Auth. Requires X-Org-Id header for org-scoped routes.

In: cookie

Header Parameters

X-Org-Id?string

Organization ID. Required for cookie auth. Not needed for API key auth (org resolved from key).

Formatuuid

X-Space-Id?string

Space ID. Required for space-scoped routes (agents, runs, schedules, and space-scoped module routes). Not needed for API key auth (space resolved from key).

curl -X GET "https://your-instance/api/api-keys"

{
  "object": "list",
  "hasMore": false,
  "data": [
    {
      "id": "cm8vwx234",
      "name": "Production CI",
      "keyPrefix": "apst_k3x9M2pq",
      "scopes": [
        "agents:run",
        "runs:read"
      ],
      "created_by": "user_abc",
      "created_by_name": "Jane Doe",
      "createdAt": "2026-01-10T08:00:00Z",
      "expiresAt": null,
      "lastUsedAt": "2026-01-12T10:00:00Z",
      "revokedAt": null
    }
  ]
}

{
  "type": "https://docs.appstrate.dev/errors/unauthorized",
  "title": "Unauthorized",
  "status": 401,
  "detail": "Invalid or missing session",
  "code": "unauthorized",
  "request_id": "req_abc123"
}

{
  "type": "https://docs.appstrate.dev/errors/forbidden",
  "title": "Forbidden",
  "status": 403,
  "detail": "Insufficient permissions",
  "code": "forbidden",
  "request_id": "req_abc123"
}