---
title: "List Credentials by Application"
method: GET
path: "/v3/portals/{portalId}/applications/{applicationId}/credentials"
tags: ["Applications"]
---

# List Credentials by Application

`GET /v3/portals/{portalId}/applications/{applicationId}/credentials`

## Request

- Base URL: `https://global.api.konghq.com`
- URL: `https://global.api.konghq.com/v3/portals/{portalId}/applications/{applicationId}/credentials`
- Auth: one of:
  - HTTP bearer
  - HTTP bearer
  - HTTP bearer
  - HTTP bearer

Lists all credentials for an application. This endpoint returns both API key credentials and DCR credentials, depending on the auth strategy the application uses: - For DCR applications: Credential information is retrieved from the identity provider using provider-specific APIs - For Key-Auth applications: Returns information about credentials Basic information about the credential is returned, but not the credential secret itself.

## Query parameters

- `page[size]` integer
- `page[number]` integer

## Response `200`

A paginated list of credentials for an application.

- ListCredentialsResponse
  - `meta` PaginatedMeta, required: returns the pagination information
    - `page` PageMeta, required: Contains pagination query parameters and the total number of objects returned.
      - `number` number, required
      - `size` number, required
      - `total` number, required
  - `data` CredentialListItem[], required
    - union
      - object: API key credential returned when listing credentials.
        - `type` 'api_key', required
        - `id` string, uuid, required: Contains a unique identifier used for this resource.
        - `display_name` string, required
        - `status` 'active' | 'expired' | 'revoked'
        - `expires_at` string, date-time, nullable
        - `created_at` string, date-time, required: An ISO-8601 timestamp representation of entity creation date.
      - object: Client secret credential returned when listing credentials.
        - `type` 'client_secret', required
        - `id` string, required: Credential identifier
        - `display_name` string, nullable: May not be available for all Client Credentials applications
        - `client_id` string, required: OAuth2 client identifier
        - `created_at` string, date-time, nullable, required: Creation timestamp, if available
        - `expires_at` string, date-time, nullable: Expiration timestamp, if applicable

## Other responses

- `400`: Bad Request
- `401`: Unauthorized
- `403`: Forbidden
- `404`: Not Found

## Changes

- **2026-10-15** `7aab863a6daa`: 1 breaking, 2 warning
  - added `#/components/schemas/InvalidParameterMinimumTime, #/components/schemas/InvalidParameterMaximumTime` to the `invalid_parameters/items/` response property `oneOf` list for the response status `400`
  - added the new `key_invalid` enum value to the `invalid_parameters/items/oneOf[#/components/schemas/InvalidParameterStandard]/rule` response property for the response status `400`
  - added the new `unique` enum value to the `invalid_parameters/items/oneOf[#/components/schemas/InvalidParameterStandard]/rule` response property for the response status `400`
- **2026-09-25** `68d43091b84d`: 3 warning
  - added the new `400.00` enum value to the `status` response property for the response status `400`
  - added the new `403.00` enum value to the `status` response property for the response status `403`
  - added the new `404.00` enum value to the `status` response property for the response status `404`
- **2026-09-18** `f324fb7610e4`: 3 breaking, 24 info
  - the response's body type changed from no type to `object` for status `400`
  - the response's body type changed from no type to `object` for status `403`
  - the response's body type changed from no type to `object` for status `404`
  - removed `#/components/schemas/BaseError, subschema #2` from the response body `allOf` list for the response status `400`
  - …23 more
- …earlier changes not shown

[Operation history](https://skmtc.dev/kong/apis/konnect-api-go-sdk/changes/v3/portals/:portalId/applications/:applicationId/credentials/get.md)

---

[API](https://skmtc.dev/kong/apis/konnect-api-go-sdk.md) · [All operations](https://skmtc.dev/kong/apis/konnect-api-go-sdk/llms.txt) · [OpenAPI document](https://skmtc.dev/kong/apis/konnect-api-go-sdk/revisions/7aab863a6daa?raw)