---
title: "List API keys"
method: GET
path: "/api_keys"
tags: ["API keys"]
---

# List API keys

`GET /api_keys`

## Request

- Base URL: `https://arena-predictions.com/api/v1`
- URL: `https://arena-predictions.com/api/v1/api_keys`
- Auth: one of:
  - API key in cookie `sb-access-token`
  - HTTP bearer

Every key on the signed-in account, newest first, including revoked, expired and rotating ones, each with this month's requests, and the account's plan. status=active keeps the keys that still work (active and rotating). Not paginated: an account holds at most 10 active keys.

## Query parameters

- `status` 'all' | 'active'

## Response `200`

The account's keys.

- KeyListResponse
  - `keys` KeyView[], required
    - `id` string, uuid, required
    - `label` string, required
    - `tokenPrefix` string, required: First 16 characters of the token, for matching a row to a key. Never the token.
    - `scopes` string[], required
    - `status` 'active' | 'rotating' | 'revoked' | 'expired', required: rotating: replaced by a rotation and still inside its grace period (it works until expiresAt).
    - `createdAt` string, date-time, required
    - `lastUsedAt` string, date-time, nullable, required: Updated at most once an hour.
    - `expiresAt` string, date-time, nullable, required
    - `revokedAt` string, date-time, nullable, required
    - `createdVia` 'web' | 'cli', required: web: Settings. cli: arena keys.
    - `rotatedFrom` string, uuid, nullable, required: The key this one replaced by rotation.
    - `rotatedAt` string, date-time, nullable, required: When this key was rotated.
    - `requestsThisMonth` integer, required: Keyed requests counted against this key this month (UTC).
  - `count` integer, required
  - `usage` object, nullable, required: The account's plan and this month's requests, or null when they could not be read.
    - `tier` 'none' | 'basic' | 'builder' | 'desk' | 'enterprise'
    - `month` object
      - `limit` integer
      - `used` integer
      - `resetsAt` string, date-time, nullable
    - `minuteLimit` integer
    - `enforced` boolean

## Other responses

- `400`: invalid_request: status is not all or active.
- `401`: unauthorized (not signed in) or session_required (an API key was presented: a key never manages keys).
- `403`: guest_account: the session is anonymous. Sign in with Google or Apple.
- `500`: Could not load the keys.

---

[API](https://skmtc.dev/arena-predictions/apis/arena-api.md) · [All operations](https://skmtc.dev/arena-predictions/apis/arena-api/llms.txt) · [OpenAPI document](https://skmtc.dev/arena-predictions/apis/arena-api/revisions/9d89d166dae6?raw)