---
title: "List API-key metadata and immutable execution policies"
method: GET
path: "/credits/tenants/me/keys"
tags: ["Tenants"]
---

# List API-key metadata and immutable execution policies

`GET /credits/tenants/me/keys`

## Request

- Base URL: `https://api.paywithlocus.com/api`
- URL: `https://api.paywithlocus.com/api/credits/tenants/me/keys`
- Auth: one of:
  - HTTP bearer
  - HTTP bearer

Raw keys and hashes are never returned; every caller sees lifecycle metadata including createdBy (issuer subject). Dashboard (Cognito) sessions additionally receive createdByEmail (workspace member email when the issuer is still a member) and usage (current-UTC-month burn attribution: monthUsdc, monthCalls — null for keys with no attributed burns; attribution began 2026-08 with the burn initiator envelope). Secret-key callers never receive those two enrichment fields: member emails and spend rollups stay behind a human session, matching the /members boundary. Results are bounded to 100 records and sorted newest first. Follow nextCursor until null.

## Query parameters

- `limit` integer
- `cursor` string
- `usage` boolean

## Response `200`

{ success, keys: [...] } — lifecycle metadata only; raw keys and hashes are never returned

## Other responses

- `403`: INSUFFICIENT_SCOPE (needs credentials:manage; dashboard callers must be owner or admin).

---

[API](https://skmtc.dev/paywithlocus/apis/locus-pro-api.md) - [All operations](https://skmtc.dev/paywithlocus/apis/locus-pro-api/llms.txt) - [OpenAPI document](https://skmtc.dev/paywithlocus/apis/locus-pro-api/revisions/aab8fa5d6cef?raw)