---
title: "List inbox API keys"
method: GET
path: "/v1/inboxes/{id}/api-keys"
tags: ["inboxes"]
---

# List inbox API keys

`GET /v1/inboxes/{id}/api-keys`

## Request

- Base URL: `https://api.openmail.sh`
- URL: `https://api.openmail.sh/v1/inboxes/{id}/api-keys`
- Auth: HTTP bearer

List the (non-revoked) API keys scoped to this inbox. Only non-secret fields are returned — the token itself is never retrievable after creation. An account-wide key, or a pod-scoped key for this inbox's pod, may list; an inbox-scoped key cannot.

## Path parameters

- `id` string, required

## Response `200`

List of API keys

- object: List of API keys
  - `data` ApiKey[]
    - `id` string: OpenMail API key ID
    - `name` string, nullable: Human-readable label for the key, if set.
    - `podId` string, nullable: ID of the pod this key is scoped to, or null for an account-wide key. A pod-scoped key can only access resources in this pod.
    - `inboxId` string, nullable: ID of the inbox this key is confined to, or null. When set, the key can only access this single inbox and its threads, messages, and drafts (its `podId` is the inbox's pod).
    - `tokenPrefix` string: Non-secret leading characters of the token, to help you identify it.
    - `last4` string: Last 4 characters of the token, shown alongside the prefix.
    - `createdAt` string, date-time
    - `lastUsedAt` string, date-time, nullable: When the key last authenticated a request, or null if never used.

## Other responses

- `403`: The authenticating key is inbox-scoped, or a pod-scoped key for a different pod, and cannot manage keys
- `404`: Inbox not found

---

[API](https://skmtc.dev/openmail/apis/openmail-api.md) · [All operations](https://skmtc.dev/openmail/apis/openmail-api/llms.txt) · [OpenAPI document](https://skmtc.dev/openmail/apis/openmail-api/revisions/b943eecca7e2?raw)