---
title: "List API keys"
method: GET
path: "/apikey/list"
tags: ["API Keys"]
---

# List API keys

`GET /apikey/list`

## Request

- Base URL: `https://apisign.io/api`
- URL: `https://apisign.io/api/apikey/list`
- Auth: API key in header `x-api-key`

List the organization's API keys, newest first. Raw keys are never returned.

## Response `200`

Keys

- object
  - `apiKeys` object[]
    - `id` string
    - `name` string
    - `start` string: First 8 characters of the key
    - `permission` 'read' | 'read_write': Applies to the MCP server only; REST endpoints do not check it
    - `enabled` boolean
    - `expiresAt` string, date-time, nullable
    - `createdAt` string, date-time
    - `lastRequest` string, date-time, nullable
    - `requestCount` integer

## Other responses

- `401`: Missing, invalid, expired or deleted API key. Body: `{ "error": "Unauthorized" }`
- `500`: Internal server error (also returned for a request body that is not valid JSON)

---

[API](https://skmtc.dev/apisign/apis/api-sign-api.md) · [All operations](https://skmtc.dev/apisign/apis/api-sign-api/llms.txt) · [OpenAPI document](https://skmtc.dev/apisign/apis/api-sign-api/revisions/fa21d8adbc69?raw)